Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave
Clicking one of these search results carries the user from the compromised website, through relay pages hosted on blogging platforms,...
Trend Micro Research : Research
13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan
Over roughly three months (February 26 – May 31, 2026), we confirmed 4,721 fake alert sites but only 11 distinct...
Inside the OpenAI – Hugging Face Incident: The AI Breach With No Human Attacker Behind It
Given enough leeway, an AI system can cause real damage entirely on its own, with no malicious intent and no...
Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass
In one of the cases we have investigated, a few hours after the user approved the request, the attacker signed...
Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet
Even though the actor managed to jailbreak the AI agent and bypass its safety controls for the operations mentioned above, the guardrail was still triggered on some occasions. In the instances...
TONResolver RAT Abuses TON Blockchain to Target Japan’s Hotel Industry
TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry | Trend Micro (US) Content has been added to your...
From Langflow to Monero: Inside CVE-2026-33017 Cryptominer
Stage 2: isp.sh - the dropper that prepares the ground isp.sh is a bash script served from 83142209214. Its job...
Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign
TrendAI™ Research monitoring found weekly campaigns since April 8, with each week introducing new pages, keyword, and geographic targeting. Wave...
Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open
We track the binary payload chain (CVE-2025-8088 to LNK to PowerShell to result.dll) under SHADOW-EARTH-066, our temporary designation for the...
Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet
Conclusion This case is a concrete demonstration that blockchain-based payload delivery has graduated from a proof-of-concept curiosity to an operational...
Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware
Based on technical artifacts and TTPs as well as code and infrastructure overlaps with BeaverTail and InvisibleFerret, TrendAI™ Research attributes...
One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign
StellarMonSetup.exe is in fact GoToResolve, a legitimate unattended remote-administration tool. Once installed, it gives the actor a persistent remote desktop...
Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft
The 21 shell reconnaissance commands include hostname, whoami, uname -a, ip addr, ip route, printenv, env | grep AWS_, kubectl...
Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America
The server-side controllers for these tools were both implemented as Python-based servers. The Python source code contained comprehensive comments, structured...
InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise
InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise | Trend Micro (US) Content has been added...
