Loading story…
A cybercriminal inadvertently installed Huntress security software on their own device, granting researchers three months of unprecedented visibility into attacker workflows. Huntress analysts observed the use of automation, AI tools, phishing kits, and reconnaissance of various sectors, linking the activity to over 2,400 compromised identities. The incident has sparked debate in the cybersecurity community regarding the ethics of monitoring adversaries through EDR telemetry.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised a tech-sector organization's Linux host by exploiting `CVE-2025-55182` (**"React2Shell"**) in a vulnerable Next.js 15.4.6 and React 19.1.0 application, then used the access for overlapping malicious operations. Huntress linked the intrusion and later reinfection to multiple actor clusters: one ran a Monero miner disguised as `/var/tmp/systemd-logind` and mining to `62.60.246[.]210:443`, another deployed a multi-revenue botnet using XMRig, EarnFM, and Repocket, and a third harvested credentials and conducted broad data exfiltration. The attackers also established eight persistence mechanisms, attempted to disable the Huntress agent, and wiped logs to hinder investigation. The incident was complicated because the system's legitimate user, a developer, was actively using OpenAI Codex for software development and to troubleshoot suspicious behavior on the same host. Huntress found that some commands initially flagged as suspicious were actually AI-generated administrative actions, while the real compromise included theft of SSH keys, cloud credentials, API tokens, shell history, and system metadata. The case showed that AI-assisted remediation can reduce visible symptoms without removing root cause, and that human-led DFIR and continuous EDR telemetry were necessary to separate legitimate automation from attacker activity and uncover the full scope of the breach.
Jun 29, 2026
The hacking group **ShinyHunters** claimed to have breached the internal systems of *Resecurity*, a US-based cybersecurity firm, releasing screenshots purportedly showing access to sensitive dashboards, user management panels, API keys, employee data, and internal communications. ShinyHunters alleged they exfiltrated internal chats, client lists, threat intelligence data, and employee information, framing the attack as retaliation for Resecurity's alleged attempts to infiltrate threat actor groups by posing as buyers on dark web markets. The group also credited Devman Ransomware for assistance in the attack and published evidence to support their claims. However, *Resecurity* responded by stating that the data accessed by ShinyHunters was part of a sophisticated honeypot operation designed to monitor and log threat actor activity. According to Resecurity, the honeypot included simulated data and a planted honeytrap account, and there was no impact on actual customers or internal operations. Resecurity confirmed that all data referenced by ShinyHunters originated from the honeypot, and they had already logged the attackers' IP addresses. The incident highlights the ongoing cat-and-mouse dynamics between cybersecurity firms and threat actors, as well as the use of deception technologies in cyber defense.
Jun 29, 2026
Researchers linked multiple phishing-driven campaigns to **HawkEye** and related surveillance malware, describing a long-running credential-theft threat that targeted organizations across dozens of countries and industries. The malware was delivered through lures such as airline ticket confirmations and fake payment documents, often inside compressed archives or executable attachments, and was also tracked alongside the similar **Predator Pain** family. Victims included industrial, engineering, manufacturing, government, higher education, retail, telecommunications, and professional services organizations, with especially heavy targeting reported in the United States, Australia, Canada, parts of Asia, and the Middle East. The malware acted as a feature-rich spyware and keylogger, stealing browser, email, messaging, and FTP credentials, capturing keystrokes, screenshots, clipboard data, and system information, and in some cases injecting into legitimate `.NET` binaries such as `RegAsm.exe` and `vbc.exe`. Investigators said stolen data was exfiltrated through SMTP email, HTTP, PHP web panels, and FTP, including periodic submissions to attacker-controlled mailboxes; one variant checked external connectivity and included the victim’s public IP address in exfiltration messages. Kaspersky also tied Hawkeye-based tooling to **Operation Ghoul**, a financially motivated spear-phishing operation that hit more than 130 organizations and used both malware delivery and phishing pages to harvest accounts.
Aug 15, 2026