Key Findings from the Threatlabz 2026 VPN Risk Report

ThreatLabz identified a SmartApeSG-linked supply chain attack that targeted the Okendo Reviews widget impacting thousands of e-commerce sites.

ThreatLabz examines how termncolor and colorinal, malicious Python packages, expose supply chain risks via DLL sideloading, persistence, and covert C2 communication.

ThreatLabz details indirect prompt injection hidden in malicious webpages meant to mislead AI agents performing tasks.

China-nexus APT campaign leverages DLL sideloading, multi-stage infection chains, and low-level APIs to deploy Ghost RAT and PhantomNet backdoors against Tibetan targets.

ThreatLabz found a phishing campaign using fraudulent Google ads and fast-changing Vercel redirects to impersonate Ledger and steal users’ secret recovery phrases. The campaign sent victims through Google Cloud Storage and Google Sites, then used a fake device-verification flow to collect wallet credentials. #Ledger #GoogleAds #GoogleCloudStorage #Vercel #GoogleSites

A threat actor likely associated with ransomware is using Microsoft Teams vishing and Quick Assist to deliver new backdoors and proxy tools.

At a Glance Attribute Details Malware Family Vidar information stealer Threat Actor Unknown financially motivated cybercriminals Target Victims General internet users and corporate networks Delivery Vector Deceptive software cracks and malicious downloads Key Capabilities Custom virtual machine execution, stream cipher encryption, credential theft Source Zscaler ThreatLabz Executive Summary The Vidar information stealer obfuscation process now utilizes a lightweight virtual machine. Specifically, this recent upgrade replaces basic encryption with dynamic stream ciphers.

CoffeeLoader is a new malware loader that employs stealthy techniques including call stack spoofing, sleep obfuscation, and Windows fibers to evade detection.

At a Glance Malware Family: Indirect Prompt Injection (IPI) Threat Actor: Suspected GitHub user (Open-Agent-Utilities) Target: Autonomous AI agents and LLMs Delivery Vector: SEO poisoning and Typosquatting Key Capabilities: Content manipulation, unauthorized transactions Source: Zscaler ThreatLabz TL;DR Indeed, threat actors now use malicious websites to attack automated systems. Specifically, they hide instructions inside web code to exploit AI agent vulnerabilities…

Learn how HijackLoader has introduced call stack spoofing and new modules to improve its evasion and anti-analysis capabilities.

TransferLoader is a new malware family with sophisticated anti-analysis techniques that deploys embedded payloads that include a downloader, backdoor, and ransomware.

In Part 1 of this series, we explore Mustang Panda’s latest tools: ToneShell & StarProxy, which provide features including remote access and lateral movement.

The Russia-linked group COLDRIVER targeted dissidents and their supporters using a ClickFix technique, resulting in the deployment of BAITSWITCH and SIMPLEFIX.

Operation Endgame has targeted multiple threat groups including those behind DanaBot, which has been used in both criminal & nation-state attacks.

Zscaler ThreatLabz examines the employees targeted in a real-world ransomware attack, including the roles and business functions most common among the victims.

Zscaler ThreatLabz tracked Vidar’s string obfuscation as it evolved from XOR and ChaCha20 into a per-build virtual machine and custom stream cipher designed to frustrate static analysis. The report details how these changes affect deobfuscation, shows example VM opcodes and ARX/ChaCha-based cipher logic, and includes Zscaler detections for Vidar. #Vidar #Zscaler #ThreatLabz

A Fortune 50 company paid a record-breaking $75 million ransom payment to the Dark Angels ransomware gang, according to a report by Zscaler ThreatLabz.

A flaw in DanaBot's C2 server code caused a memory leak that we named "DanaBleed", exposing sensitive data and offering researchers a look into DanaBot’s operations.

Zscaler ThreatLabz discovered two new malware families, RevC2 & Venom Loader, deployed using Venom Spider MaaS Tools.

Zscaler ThreatLabz discovered two new malware families, RevC2 & Venom Loader, deployed using Venom Spider MaaS Tools.