ThreatBook Blog

Actionable research, threat intelligence trends, product updates, and thought leadership from ThreatBook.

Threat Research

15 min read

Analysis of the AI-Driven ARTEX Attacks on South Korean Financial Institutions

Picture of ThreatBook Research Team ThreatBook Research Team: 9 October 2026, 04:10 PM

Overview From September 27 to early October 2026, the internet-facing (peripheral) business systems of multiple South Korean financial institutions...

Threat Research
Read More

3 min read

Apple Libnotify/notifyd Stack Overflow (CVE-2026-64739) — Discovered by ThreatBook XGPT

Picture of ThreatBook Research Team ThreatBook Research Team: 28 July 2026, 05:07 PM

On July 27, 2026, Apple released security updates for iOS 26.6 and iPadOS 26.6, fixing vulnerabilities across several components — Accessibility,...

Threat Research
Read More
Fastjson remote code execution (RCE) vulnerability advisory from ThreatBook: Alibaba Fastjson Java library versions 1.2.83 and earlier are high risk and under active exploitation (XVE-2026-39684)

2 min read

Fastjson RCE (≤1.2.83): Active Exploitation Detected — Detection & Mitigation

Picture of ThreatBook Research Team ThreatBook Research Team: 22 July 2026, 12:07 PM

A remote code execution vulnerability in Fastjson affects every version up to and including 1.2.83. A remote attacker can run arbitrary code on a...

Threat Research
Read More

5 min read

APAC's Cyber Threat Landscape: Inside the 2026 Mid-Year Data

Picture of ThreatBook Research Team ThreatBook Research Team: 21 July 2026, 07:07 AM

ThreatBook Labs recorded 15,205 security incidents across Asia-Pacific between June 2025 and June 2026. Read one at a time, they look like an...

Threat Research
Read More
ThreatBook analysis of TA558 using steganography to hide malware in images and launch global cyberattacks.

5 min read

TA558 Uses Steganography to Launch Global Cyberattacks

Picture of ThreatBook Research Team ThreatBook Research Team: 6 April 2026, 12:04 AM

Overview TA558 (also known as "SteganoAmor") is a financially motivated cybercriminal organization that has been active since 2018. Its attacks are...

Threat Research
Read More
Lazarus Group poisons the Axios npm package: ThreatBook analysis of the JavaScript supply chain attack.

4 min read

Lazarus Group Poisons Axios: Inside the npm Supply Chain Attack

Picture of ThreatBook Research Team ThreatBook Research Team: 1 April 2026, 12:04 AM

Regarding yesterday's Axios npm supply chain poisoning incident, ThreatBook has conducted in-depth sample analysis and attack tracing. Drawing on...

Threat Research
Read More
Axios on npm backdoored with cross-platform rat

3 min read

OpenClaw Users at Risk: Axios on npm Backdoored with Cross-Platform RAT

Picture of ThreatBook Research Team ThreatBook Research Team: 31 March 2026, 02:03 PM

Axios — one of the most foundational dependencies in the JavaScript ecosystem, with over 3.6 billion annual downloads — was compromised on npm on...

Threat Research
Read More

3 min read

When Security Tools Get Compromised: The LiteLLM Supply Chain Poisoning Incident

Picture of ThreatBook Research Team ThreatBook Research Team: 25 March 2026, 03:03 PM

On March 24, 2026, ThreatBook Research Team detected a large-scale supply chain attack targeting LiteLLM — a core component widely used across the AI...

Threat Research
Read More
ThreatBook blog post banner: “Phishing with Google Ads and Fake AI Docs – A Criminal Campaign Targeting the AI Ecosystem,” a threat intelligence analysis of malvertising that uses fake AI tool documentation to lure users.

3 min read

Phishing With Google Ads and Fake AI Docs: A Criminal Campaign Targeting the AI Ecosystem

Picture of ThreatBook Research Team ThreatBook Research Team: 20 March 2026, 08:03 AM

ThreatBook Research and Response Team has identified and tracked an organized threat group conducting a large-scale malware distribution campaign...

Threat Research Security Operations
Read More
ThreatBook technical breakdown of the AI ecosystem threat campaign targeting AI tools and users.

3 min read

Inside the Attack: Complete Technical Breakdown of the AI Ecosystem Threat Campaign

Picture of ThreatBook Research Team ThreatBook Research Team: 20 March 2026, 08:03 AM

This is the full technical companion to our campaign overview published in Part 1. It documents the Windows and macOS malware chains in detail, and...

Threat Research
Read More
1 2 Next