Cybercrime & Underground Economy
Coverage of dark web markets, ransomware ecosystems, fraud operations, financial crime services, monetization tactics, and the evolving underground economy driving global cybercriminal activity.
-
Fake FFmpeg Update Infects Mac Users with Backdoor
A new backdoor campaign is targeting Mac users, tricking them into installing malicious software disguised as an FFmpeg update. This attack begins with fake job offers on LinkedIn, luring victims…
·
·
1–2 minutes -
Hackers Hijack Blender 3D Assets to Deploy StealC V2 Data-Stealing Malware
Cybersecurity experts reveal a new campaign leveraging Blender 3D assets to spread a dangerous info-stealing malware. This operation has been active for at least six months. Malicious .blend files are…
·
·
1–2 minutes -
Matrix Push C2 Uses Browser Notifications for Fileless, Cross-Platform Phishing Attacks
Bad actors are deploying Matrix Push C2, a new command-and-control platform for sophisticated phishing attacks. This framework uses web browser notifications to deliver malicious links across various operating systems, employing…
·
·
2–4 minutes -
Sanctions Hit Russia’s Bulletproof Hosting Provider
U.S., UK, and Australia sanction Russia-based Media Land for providing bulletproof hosting to ransomware groups like LockBit, BlackSuit, and Play, freezing assets and prohibiting transactions.
·
·
1–2 minutes -
ShadowRay 2.0: Ray AI Flaw Exploited for Cryptomining
ShadowRay 2.0 exploits a Ray AI flaw, creating a self-spreading GPU cryptomining botnet. Attackers use unpatched vulnerabilities, GitLab, and GitHub to spread malware and hijack computing power.
·
·
3–4 minutes -
RondoDox Exploits Unpatched XWiki Servers (CVE-2025-24893)
RondoDox is exploiting CVE-2025-24893 in XWiki to run miners, gain shells and add servers to DDoS botnets.
·
·
1–2 minutes -
Fake AI and WhatsApp apps on third‑party Android stores hide spyware, ad fraud
Appknox warns that fake ChatGPT, DALL·E and WhatsApp apps on third‑party Android stores range from harmless wrappers to spyware that intercepts OTPs.
·
·
1–2 minutes -
North Korean IT Worker Fraud Uncovered, $15M Seized
North Korean IT worker fraud scheme exposed, $15M seized.
·
·
2–4 minutes -
Phishing Campaign Targets Travel Websites
A Russian-speaking threat group launched a sophisticated phishing campaign, creating over 4,300 fake travel websites to steal payment information from hotel guests.
·
·
1–2 minutes -
What is Operation Endgame?
Operation Endgame is a major international law enforcement initiative aimed at disrupting and dismantling significant cybercrime infrastructure globally, targeting widespread malware families, botnets, and other illicit tools.
·
·
2–3 minutes
