fortiguard.com, as data

# Fortiguard Labs### Inside a TrickBot Variant Using DNS Tunneling for C2FortiGuard Labs analyzes a TrickBot variant that uses DNS tunneling for C2 communication, modular execution, and employs persistence and...### The TTF Trap: A Global Campaign of a Low-Detection Lua LoaderFortiGuard Labs analyzes a global phishing campaign using obfuscated JScript, disguised .ttf files, and Lua loaders to deliver RATs and infostealers.### Analysis of Ongoing Ousaban Attacks Targeting the Iberian PeninsulaFortiGuard Labs analyzes a geofenced Ousaban campaign targeting Spain and Portugal with phishing PDFs, steganography, and evasive C2.### From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift BreachSee how Shai Hulud-linked CI/CD compromise exposed Jenkins credentials, enabled AWS escalation, and led to Redshift breach activity detected by...### Threat Actors Weaponize AI Hype to Deliver AsyncRATFortiGuard Labs analyzes a multi-stage malware campaign that uses fake AI-themed documents, hidden PowerShell scripts, AutoHotkey loaders, and...### Cybercriminals Are Targeting the FIFA World Cup 2026FortiGuard Labs research shows how cybercriminals are exploiting the demand for the FIFA World Cup 2026 through phishing, fake tickets, malware,...### Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMOFortiGuard Labs analyzes C0XMO, a new Gafgyt variant leveraging DD-WRT exploitation and multi-architecture propagation to expand IoT botnet...### Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive DataFortiGuard Labs analyzed a new phishing campaign that uses obfuscated JavaScript, PowerShell, process hollowing, and PureLogs to steal sensitive data### Misconfigured, Enrolled and Dormant: Anatomy of a P2Pinfect Kubernetes CompromiseFortiGuard Labs analyzed several P2PInfect compromises in GKE clusters, showing how exposed Redis instances can enable persistent botnet...## Threat Signals