PolySwarm 🇺🇸

A threat intelligence & detection community helping security teams detect new & emerging malware.

Ticker: $NCT

Join our Discord:

[PolySwarm 🇺🇸 @PolySwarm]

#Rokarolla is a newly discovered Android banking #trojan targeting 217+ banking and #cryptocurrency apps through fake #TikTok, Chrome, and Google Play Protect sites. Learn how it steals credentials, evades detection, and enables fraud in our latest blog.

https://t.co/gdo71chhkF

[PolySwarm 🇺🇸 @PolySwarm]

#Rockcaroller targets 217+ banking & cryptocurrency apps with phishing overlays, SMS interception, clipboard hijacking, & more. Learn how it works & how to defend against it in our latest YouTube Short.

https://t.co/LmdxQpy3yL

#CyberSecurity #ThreatIntel #Android #BankingTrojan

[PolySwarm 🇺🇸 @PolySwarm]

Every malware sample tells a story.

PolySwarm’s marketplace lets independent researchers compete to surface the most accurate analysis.

Better incentives → better intelligence.

[PolySwarm 🇺🇸 @PolySwarm]

Billions of viewers. Millions of attendees. Thousands of connected systems.

The 2026 FIFA World Cup will be a massive target for cybercriminals, hacktivists, & nation-state actors.

Our latest analysis:
https://t.co/kKvSZCN4h9

#CyberSecurity #ThreatIntel #WorldCup #WorldCup2026

[PolySwarm 🇺🇸 @PolySwarm]

Security isn’t about louder alerts.

It’s about smarter detection.

PolySwarm incentivizes accuracy.

#CyberSecurity #ThreatIntelligence #SOC

[PolySwarm 🇺🇸 @PolySwarm]

Miasma is a software supply chain campaign targeting developers, GitHub repos, and CI/CD pipelines. By abusing trusted publishing workflows, attackers distributed malicious npm packages with valid attestations to steal credentials and secrets.

More: https://t.co/6twFKjcxiP

[PolySwarm 🇺🇸 @PolySwarm]

Recent activity attributed to #UNC3753 and other groups highlights a growing trend in which #ThreatActors increasingly prioritize data theft & extortion over traditional #ransomware deployment. @googlecloud recently reported on this activity.

https://t.co/DB3D1GRW9k

[PolySwarm 🇺🇸 @PolySwarm]

More engines = more perspectives.

More perspectives = fewer blind spots.

PolySwarm brings independent malware detections together in one place.

#CyberSecurity #ThreatIntelligence #Malware #ThreatHunting

[PolySwarm 🇺🇸 @PolySwarm]

Researchers identified #Weedhack, a #Minecraft-focused #MaaS operation spreading through fake mods, SEO poisoning, & YouTube. The platform enables credential theft, crypto theft, account hijacking, and remote access for as little as $5/month. Learn more: https://t.co/8wVHejCouo

[PolySwarm 🇺🇸 @PolySwarm]

Children's hospitals face unique threats. Stolen #pediatric records can fuel identity fraud for decades, while #ransomware attacks can directly impact patient care. Learn why pediatric #healthcare remains a high-value target & explore related samples: https://t.co/fQBtUxllVM

[PolySwarm 🇺🇸 @PolySwarm]

#IRGC-affiliated Nimbus Manticore is evolving its tradecraft with the MiniFast backdoor, AppDomain Hijacking, SEO poisoning, and stealthy persistence techniques targeting aviation, defense, telecom, and software sectors.

https://t.co/90bYIqUXvQ

#ThreatIntel #APT #CyberSecurity

[PolySwarm 🇺🇸 @PolySwarm]

#Lazarus-linked actors are targeting financial institutions and #cryptocurrency organizations with a stealthy #malware chain built around DPAPILoader and the memory-resident RemotePE RAT. PolySwarm analyzed related samples, infrastructure, and TTPs:

https://t.co/BfQllluJjK

[PolySwarm 🇺🇸 @PolySwarm]

@Vanished102 @Microsoft The potential applications are pretty compelling.

[PolySwarm 🇺🇸 @PolySwarm]

Kazuar #malware used by #Russia-linked Turla has evolved into a modular espionage framework built for stealth, resilience, and long-term intelligence collection. @Microsoft recently detailed the activity.

More in our blog + related PolySwarm samples:
https://t.co/rjEdweUxzZ

[PolySwarm 🇺🇸 @PolySwarm]

TeamPCP-linked supply chain attacks abused GitHub Actions, PyPI, Docker Hub, npm, and VS Code ecosystems to steal developer credentials and cloud secrets. New claims involving alleged Mistral AI repos may signal growing targeting of AI dev environments.

https://t.co/RDqWxbnh9O

[PolySwarm 🇺🇸 @PolySwarm]

SHADOW-EARTH-053 is exploiting legacy Microsoft Exchange infrastructure to target governments and critical infrastructure across Asia with ShadowPad malware and credential theft.

https://t.co/wlPpkmBOGx

#CyberSecurity #ThreatIntelligence #APT #ThreatHunting #PolySwarm

[PolySwarm 🇺🇸 @PolySwarm]

A large-scale supply chain compromise involving DAEMON Tools exposed users to malware delivered through digitally signed installers hosted on legitimate infrastructure.

https://t.co/PUl4DY4RTW

#CyberSecurity #ThreatIntelligence #Malware

[PolySwarm 🇺🇸 @PolySwarm]

@LJZ_actual Be extra cautious with emails, texts, or messages claiming to be from the school or Canvas over the next few weeks. Phishing and impersonation attempts usually increase after attacks like this.

If your kids reuse the same passwords, changing those passwords would be a good idea.

[PolySwarm 🇺🇸 @PolySwarm]

Great conversations going on this week at the #HealthISAC Spring Americas Summit.

One thing is clear: the gap between what organizations think they can see and what’s actually happening in their environments is becoming a major security risk.

#CyberSecurity #HealthcareSecurity