Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Securonix threat researchers have been tracking a stealthy campaign targeting the hospitality sector using click-fix social engineering, fake captcha and fake blue screen of death to trick users into pasting malicious code. It leverages a trusted MSBuid.exe tool to bypass defenses and deploys a stealthy, Russian-linked DCRat payload for full remote access and the ability to drop secondary payloads.

Today’s adversaries are fast, distributed, and increasingly coordinated. Yet many SOCs remain reactively trapped in fragmented tools, endless alert queues, and growing pressure from executives to prove not just security, but resilience. It’s no longer enough to collect threat feeds or stand up a threat intel team. What’s needed is integrated intelligence—curated, contextualized, and operationalized—so your team can detect sooner, respond faster, and adapt continuously.

The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Labs in November 2025. The report also includes a synopsis of the threats, indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs), and related tags. Each threat has a comprehensive summary from Threat Labs and search queries from the Threat Research team.

The Securonix Threat Research team has analyzed a sophisticated web-based multi-stage malware campaign. The attack chain unfolds across three distinct stages: (1) an obfuscated JavaScript loader injected into a compromised website, (2) a stealthy HTA (HTML Application) that executes encrypted PowerShell stagers via mshta.exe, and (3) a final PowerShell payload that downloads, extracts, executes, and establishes persistence for a Windows-based remote access Trojan.

Every security team I meet is dealing with the same pressure: more cloud, more AI, more data, more noise, and less time. The cloud promised speed and flexibility, and it delivered. However, customers are asking for an easier path to understanding what’s actually happening across that environment. That gap, between what teams can see and what they need to see, is where threats hide.

Automation has become the foundation of modern cybersecurity operations. What was once a tool for efficiency is now critical. In parallel, artificial intelligence is no longer just a buzzword; it is reshaping how organizations detect, analyze, and respond to threats. The new Cybersecurity Automation and AI Adoption Report explores how global security leaders are approaching these technologies, what’s driving adoption, and where organizations still face challenges.

The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Labs in October 2025. The report also includes a synopsis of the threats, indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs), and related tags. Each threat has a comprehensive summary from Threat Labs and search queries from the Threat Research team.

Securonix Data Pipeline Manager Flex (DPM Flex) changes how SIEM data is managed with AI-enabled, value-based data consumption that lets you ingest, store, and analyze more data for the same cost. Expand visibility, strengthen compliance, and unlock more value from your existing investment.