Research, News, and Perspectives

Exploits & Vulnerabilities

Pwn2Own Berlin 2026: On the Ground With TrendAI™ ZDI's Biggest AI Showdown Yet

47 zero-days fell at Pwn2Own Berlin 2026 for US$1,298,250 in payouts. TrendAI™ was on the ground all three days — here's what we saw.

Latest News Jun 01, 2026

Save to Folio

Latest News Jun 01, 2026

Save to Folio

Compliance & Risks

Making Cyber Risk Measurable: Why Risk Assessment and Compliance Must Go Hand in Hand

Today, most organizations already have a broad range of modern security solutions in place, yet many still struggle with a lack of meaningful visibility. The challenge is no longer collecting more security data.

Expert Perspective May 27, 2026

Save to Folio

Expert Perspective May 27, 2026

Save to Folio

Cyber Crime

Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet

TrendAI™ Research analysed an intrusion where threat actors used the EtherHiding technique to route ClearFake payload delivery through smart contracts on the BNB Smart Chain testnet. The attack chain ended with two simultaneously deployed stealers, SectopRAT and ACRStealer alongside an on-chain execution tracker that confirmed each victim compromise in real time.

Latest News May 26, 2026

Save to Folio

Latest News May 26, 2026

Save to Folio

Malware

Analysing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware

Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections.

Research May 22, 2026

Save to Folio

Research May 22, 2026

Save to Folio

Cyber Crime

One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign

A solo Russian-speaking threat actor ran a 5-year Telegram channel and, starting September 2025, used AI to automate its content, credential theft, and a cryptocurrency fraud scheme targeting American audiences.

Research May 21, 2026

Save to Folio

Research May 21, 2026

Save to Folio

Cyber Threats

Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud

In this blog entry, researchers from the TrendAI™ MDR team discuss how they mapped the full end-to-end operation of SHADOW-WATER-063’s Banana RAT banking malware by analysing server-side artefacts and victim-side data.

Latest News May 19, 2026

Save to Folio

Latest News May 19, 2026

Save to Folio

Artificial Intelligence (AI)

Agentic Governance: Why It Matters Now

AI agents now act inside the trust boundary with real credentials, and agentic governance is what keeps them from quietly breaking things at machine speed.

May 18, 2026

Save to Folio

May 18, 2026

Save to Folio

Cyber Threats

Analysing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft

Our research examines the 22 April Checkmarx KICS and 24 April elementary-data incidents as part of a broader TeamPCP supply chain campaign. Across both cases, the actor abused trusted CI/CD and release workflows to steal credentials at scale.

Research May 13, 2026

Save to Folio

Research May 13, 2026

Save to Folio

Artificial Intelligence (AI)

Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America

TrendAI™ Research has identified two emerging threat campaigns—SHADOW-AETHER-040 and SHADOW-AETHER-064—that use agentic AI to drive intrusion operations against government and financial organisations in Latin America, marking these among the first cases we have observed of AI agents executing attacks from initial access to data exfiltration.

Research May 11, 2026

Save to Folio

Research May 11, 2026

Save to Folio

Cyber Threats

What Is the Instructure Canvas Breach? Impact, Risks, and What Institutions Should Do

The Instructure Canvas breach affects universities, K–12 school districts, and teaching hospitals globally. This blog entry intends to provide context and practical guidance.

May 10, 2026

Save to Folio

May 10, 2026

Save to Folio