Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Securonix Threat Research team has identified an ongoing espionage campaign, tracked as SHEETCREEP, where threat actors deliver a C# remote access trojan through a diplomatic-themed ISO phishing lure.

Data loss is no longer a rare event—it is an inevitability. From ransomware attacks to accidental deletions, organizations must be prepared not just to prevent incidents, but to recover from them quickly and reliably. Modern threats increasingly target backup environments, making recovery readiness a critical component of any data protection strategy.

The 2026 FIFA World Cup is a once-in-a-generation opportunity, and threat actors have already begun capitalizing on it. The 2026 FIFA World Cup, set to kick off on June 11, has already broken records for the most host nations, the most matches, and the highest amount of prize money to date for winning teams. Arctic Wolf set out to proactively investigate the criminal ecosystem surrounding the tournament.

The US Federal Bureau of Investigation (FBI) has warned that a new phishing-as-a-service (PhaaS) platform called “Kali365” is targeting OAuth tokens to gain direct access to users’ Microsoft 365 accounts without stealing credentials or multifactor authentication codes. “Through the Kali365 platform subscription, cyber threat actors can capture ‘OAuth’ tokens and gain persistent access to targeted individuals/entities' Microsoft 365 environments,” the Bureau says.

A publication-safe corporate blog analysis of a Node.js SEA information stealer and remote-access trojan. Foresiet Threat Intel Team identified and statically analyzed a newly observed Lucid Stealer build promoted through Telegram-linked underground channels. The sample is not a generic packed executable: it is a Lucid-branded credential stealer, wallet stealer and remote-access toolkit packaged inside a legitimate Node.js Single Executable Application wrapper.