CRIL (Cyble Research and Intelligence Labs)

CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control. cyble.com/blog/glitch-sp… #GlitchSPY #RAT #CryptoClipping #Android #ThreatIntel

Cyble's latest analysis exposes 163 organizations compromised via abandoned DNS delegations in a Thai gambling SEO poisoning campaign. cyble.com/blog/borrowed-… #SEOPoisoning #DNSHijacking #DomainAbuse #ThreatIntel #AffiliateFraud

Cyble analyzes OverlayPhantom, an Android banking trojan targeting 180+ apps across 10 countries, stealing credentials via fake overlays and real-time screen streaming. cyble.com/blog/overlayph… #AndroidMalware #ThreatIntel #BankingTrojan #CredentialTheft

CRIL uncovers JOMANGY, a stealth PHP webshell by INJ3CTOR3 with 6 persistence layers and self-healing cron jobs built to survive host cleanup. cyble.com/blog/jomangy-i… #JOMANGY #FreePBX #TollFraud #INJ3CTOR3

Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable. github.com/beenuar/AiSOC

Cyble analyzes Operation HumanitarianBait, a stealthy espionage campaign using aid-themed lures to deploy a fileless Python infostealer. cyble.com/blog/operation… #Infostealer #SocialEngineering #Malware #Cyberespionage #ThreatIntel

CRIL uncovered 16,800+ spoofed domains by analyzing URL trust abuse, cloud infra clustering, and human‑centric deception instead of technical exploits. cyble.com/blog/operation… #DomainSpoofing #SocialEngineering #APT36 #ThreatIntel

CRIL analyzes a surge in an ongoing campaign to deliver MiningDropper — a modular Android malware framework - at scale. cyble.com/blog/miningdro… #CryptoMiner #Android #Malware #SocialEngineering #ThreatIntelligence

Cyble dissects a LinkedIn job‑lure campaign, exposing its multi‑stage PXA Stealer tactic that hijacks accounts and steals sensitive data. cyble.com/blog/professio… #Infostealer #malware #LinkedIn #PXAStealer #ThreatIntel

Cyble analyzes an AI-driven phishing campaign that abuses browser permissions to capture victims' images and exfiltrate the data to attacker-controlled Telegram bots. cyble.com/blog/ai-assist… #AI #CredentialTheft #Malware #Phishing #SocialEngineering #Bot

Cyble has identified a new Linux threat, ClipXDaemon, that targets cryptocurrency users by intercepting and manipulating copied wallet addresses. cyble.com/blog/clipxdaem… #Linux #Cryptocurrency #Cryototheft #ThreatIntel #Malware

Cyble uncovers SURXRAT’s evolution across versions, built on ArsinkRAT code, and now downloading large LLM modules, signaling an expansion of its operational capabilities. cyble.com/blog/surxrat-d… #RAT #Trojan #AI #MaaS #ThreatIntel

Cyble’s research reveals the exposure of ChatGPT API keys online, potentially enabling large‑scale abuse and hidden AI risk. cyble.com/blog/when-ai-s… #AI #ExposedCredential #Exploit #ChatGPT #ThreatIntel

Cyble analyzes expanding OTP/SMS bombing ecosystems using high‑speed APIs, SSL bypass, and cross‑platform automation. cyble.com/blog/sms-otp-b… #AuthenticationBypass #SMSBombing #OTPBombing #ThreatIntel #SSLBypass

Cyble uncovers ShadowHS, a stealthy fileless Linux framework running entirely in memory for covert, adaptive post‑exploitation control. cyble.com/blog/shadowhs-… #Hackshell #Linux #Cryptomining #CredentialHarvesting #ThreatIntel

Cyble analyzes deVixor, an advanced Android banking RAT with ransomware features actively targeting Iranian users. cyble.com/blog/devixor-a… #Android #RAT #deVixor #RAT #Ransomware #Iran

CRIL Uncovers a New Wave of Browser-Based e-Challan Phishing Powered by Shared Fraud Infrastructure. cyble.com/blog/rto-scam-… #Scam #Phishing #SocialEngineering #Fraud #ThreatIntel

CRIL has identified a commodity loader being leveraged by various threat actors in targeted email campaigns. cyble.com/blog/stealth-i… #TargetedEmailAttack #MalspamThreat #Steganography #socialengineering #ThreatIntel

CRIL has uncovered an active V3G4 campaign using a Mirai-derived botnet alongside a fileless, runtime-configured cryptominer. cyble.com/blog/v3g4-mira… #V3G4 #Botnet #Cryptominer #ThreatIntelligence