Huntress

Threat actors are actively abusing OpenAI's Custom GPTs feature within ChatGPT to distribute malware, disguising malicious links as legitimate product offerings. This tactic directs unsuspecting victims to compromised websites that utilize ClickFix lures to deliver malicious payloads.

Threat actors are actively exploiting trusted artificial intelligence platforms as a new attack surface, leveraging them to host malicious content, poison search engine results, and deceive users into installing malware.

Cybersecurity researchers have detailed a worm-like campaign that exploits ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. Huntress, a cybersecurity firm, reported that three distinct incidents have been observed, each employing different initial…

Huntress observed a 155x surge in password spraying attacks during the first half of 2026, indicating a significant escalation in this type of cyber threat. One notable campaign identified by Huntress generated over 81 million login attempts within a two-week…

Threat actors rarely cease their activities after achieving initial access to a system, instead focusing on establishing persistence, disabling defensive measures, and reconfiguring compromised environments. This post-breach behavior was analyzed by Huntress through a real-world intrusion, highlighting the critical need…

Cybersecurity researchers have identified a significant, ongoing, and automated password spray attack targeting Microsoft's Azure command-line interface (CLI). The attack, detailed by Huntress, has successfully compromised at least 78 Microsoft accounts.

Cybersecurity researchers have identified multiple ClickFix campaigns employing three new malware loaders: BabaDeda Loader, Lorem Ipsum Loader, and Potemkin. Morphisec, BlueVoyant, and Huntress independently reported on these findings. BabaDeda Loader, observed in April 2026, has been used to target organizations…