Threat Feed

Reverse-chronological stream of leaks, malware campaigns, ransomware claims, CVE disclosures, and security news.

LeakHIGH25 Sept 2026Threxar Intel

2.3 million employee records including names, hashed passwords, and internal email addresses listed by threat actor "v0idcrack".

MalwareHIGH24 Sept 2026Threxar Intel

A newly documented loader malware dubbed "StealCraft" is actively targeting finance and HR departments via spoofed invoice lures.

RansomwareCRITICAL23 Sept 2026Threxar Intel

NocturnLock published 14GB of patient administrative records to their leak site after reporting no ransom payment was received.

CVECRITICAL22 Sept 2026Threxar Intel

A heap overflow vulnerability in the Nginx HTTP/2 stack allows an unauthenticated remote attacker to execute arbitrary code.

MalwareHIGH21 Sept 2026Threxar Intel

A previously undocumented mobile spyware framework is being deployed against civil society targets in three countries.

LeakHIGH20 Sept 2026Threxar Intel

Active production API keys for GlobalChain's freight management platform were committed to a public GitHub repository and exposed for 11 days.

NewsMEDIUM19 Sept 2026Threxar Intel

An updated phishing kit is circulating on criminal forums, claiming to target online banking portals across 12 regional financial institutions.

CVECRITICAL18 Sept 2026Threxar Intel

A Java deserialization vulnerability in Apache Struts 2.5.x and 6.0.x enables unauthenticated remote code execution via crafted OGNL expressions.

CVECRITICAL17 Sept 2026Threxar Intel

A public exploit PoC for FortiOS admin portal authentication bypass (CVE-2026-47883) was released on GitHub.

MalwareHIGH16 Sept 2026Threxar Intel

Telemetry correlation identified 38 active command-and-control nodes powering ShadowRAT info-stealer campaigns.