LevelBlue SpiderLabs Blog

A Closer Look at the Novel and Stealthy KarstoRAT Malware

Chen Aviani — Tue, 21 Apr 2026 14:00:03 GMT

For almost three decades now, threat actors have used remote access trojans (RATs) to monitor user activity and steal sensitive information and credentials. The RAT’s surreptitious nature has cemented its spot in malicious actors’ malware arsenal, and over the years, it has evolved to include advanced functionalities, including remote code execution, browser decryption, C2 communication, and reconnaissance.

Go With the Flow: Abusing OAuth Device Code Flow

Jakub Wiewiorski — Mon, 20 Apr 2026 14:00:01 GMT

In early 2026, phishing attacks are still among the top contributors to the true positive detections in security operation centers (SOCs). Adversaries constantly come up with new ways of luring users into traps, concealing their actual intents and stacking anti-detection features. LevelBlue’s Global Threat Operations (GTO) team continuously tracks those behaviors and analyzes how the attacks evolve over months. One of the most recent investigations led to the identification of a previously unseen, niche attack vector that can lead to user account compromise.

RedSun and the Expanding Risk Window: Why Microsoft Defender Patching Can’t Wait

Fri, 17 Apr 2026 17:54:21 GMT

A newly disclosed zero-day vulnerability, dubbed RedSun, is raising fresh concerns for organizations relying on Microsoft Defender as a core layer of endpoint protection. Early indicators suggest similarities to the recently patched BlueHammer vulnerability (CVE-2026-33825), reinforcing a troubling trend: attackers are increasingly targeting the very tools designed to stop them.

Why Attackers Are Bypassing Phishing Emails and Targeting Identity Instead

Jamie Mamroe — Mon, 13 Apr 2026 14:00:00 GMT

One of the fastest growing initial access techniques we are seeing right now is Okta vishing: voice-based social engineering designed to compromise the identity provider rather than the inbox.

Trojanized CPUID HWMonitor Installer Delivers Fileless .NET Payload via Obfuscated IPv6 Scriptlet

Sean Shirley — Fri, 10 Apr 2026 16:49:56 GMT

Overview

Recent reporting has identified a trojanized version of the CPUID HWMonitor installer being used to deliver a multi-stage, fileless malware chain leveraging trusted Windows binaries. Upon execution, the installer initiates a sequence involving PowerShell, MSBuild, and regsvr32, ultimately leading to the execution of malicious scriptlet files such as Clippy.sct and a secondary launcher scriptlet. These scriptlets utilize ActiveX (WScript.Shell) to silently invoke:

Axios NPM Package Supply Chain Compromise Leads to RAT Deployment

Mahadev Joshi and Sho Kishimoto — Thu, 09 Apr 2026 20:16:36 GMT

KEY OBSERVATIONS

Malicious Package Versions Identified: Malicious versions of the Axios npm package (axios@1.14.1 and axios@0.30.4) were observed within a customer’s environment, indicating exposure to the supply chain compromise.
Suspicious Dependency Execution: The presence of an unauthorized dependency was identified, which executed a postinstall script during npm installation, triggering the initial stage of the infection.
Abnormal Process Execution Chain: Multiple systems exhibited suspicious parent-child process relationships where npm or node spawned command interpreters such as cmd.exe, powershell.exe, followed by execution of network utilities like curl or wget.
Post-exploitation activities detected by LevelBlue: LevelBlue’s Cybereason Defense Platform generated detections associated with post-install script execution, abnormal process (renamed PowerShell) spawning, and suspicious outbound network communication, indicating successful exploitation and potential remote access trojan (RAT) deployment on affected systems.

Err-Hiding and Seek: How ErrTraffic v3 Leverages EtherHiding in ClickFix Campaign

King Orande and Cris Tomboc — Thu, 09 Apr 2026 13:00:00 GMT

The LevelBlue SpiderLabs team examined the latest version of ErrTraffic, which emerged in early 2026. In a recently observed campaign, the team found that ErrTraffic primarily targets WordPress websites by deploying a PHP backdoor script in the must-use plugin (mu-plugin) that captures administrator credentials and ensures persistence on compromised sites. On the infected website, the backdoor injects malicious inline scripts that leverage both XOR and Base64 obfuscation to evade detection. ErrTraffic utilizes the Traffic Distribution System (TDS) to filter site visitors and redirect them to ClickFix lures.

Major Supply Chain Compromise in the Popular axios npm Package

Karl Sigler — Fri, 03 Apr 2026 12:28:57 GMT

On March 30, 2026, two malicious versions of the widely used axios HTTP client library were published to npm; axios@1.14.1 and axios@0.30.4. The malicious versions inject a new dependency, plain-crypto-js@4.2.1, which, in turn, downloads a Remote Access Toolkit (RAT).

Using RF Power Levels to Defeat MAC Address Randomization Enabling Passive Device Tracking

Tom Neaves — Tue, 31 Mar 2026 14:59:37 GMT

I came up with a theory (based on science) that it may be possible to passively track wireless devices even though they are making use of the defense that is MAC Address Randomization.

The Value of Microsoft Security Copilot: SCU Billing and Why Agent Design Matters

David Broggy — Fri, 27 Mar 2026 14:00:01 GMT

Most organizations start by using Microsoft Copilot the way it looks in demos: type a question, get an answer. That works for exploration. For repeatable operational work, it gets expensive quickly.