Looks legitimate. Runs legitimate. Carries a RAT. 🎭 Our team investigated a #SectopRAT variant concealed inside legitimate software and unpacked through a multi-stage loader before executing in memory. Once active, it gives attackers broad remote control, including screen capture, file and process management, command execution, and access to sensitive data from browsers, email clients, gaming platforms, and crypto wallets. 🔗 See how the payload stays hidden and what it can do: ow.ly/QvuS50ZR8Hz

WORKFLOW STATUS: APPROVED ✅ AUTHENTICATION: NOT REQUIRED 🚫 RESULT: OS COMMAND EXECUTION 🚨 That is the problem with CVE-2026-58138. #FortiGuardLabs is seeing active attack attempts against vulnerable Orkes Conductor deployments, where malicious workflow definitions can escape the intended scripting environment and execute commands on the underlying server. 🔗 Get the technical analysis: ow.ly/5SM150ZPb1l

For years, anonymity has worked in the cybercriminal's favor. What changes when it doesn't? @FortiGuardLabs Derek Manky and @CSIWorld's Hayley van Loon discuss how the Cybercrime Bounty program is designed to raise the cost of operating in the shadows by giving people a trusted, anonymous way to share what they know. The goal goes beyond disruption: accountability and deterrence. 🔗 See how Operation Silent Vector I is putting that model into action: ow.ly/njaL50ZO3yX

At @INTERPOL_HQ's 11th Americas Working Group on Cybercrime for Heads of Unit, Fortinet's Arturo E. Torres joined INTERPOL, the World Economic Forum (@wef) and Paraguayan authorities around a practical question: How do we turn threat intelligence into coordinated action across Latin America? 💬 This new blog shares how @FortiGuardLabs intelligence supports investigations and operations, and why disruption, not information sharing alone, is the real measure of public-private collaboration. 🔗 Read Arturo's perspective: ow.ly/gA5t50ZNT0L

Casbaneiro is getting harder to read on purpose. 🕵️‍♂️ #FortiGuardLabs uncovered a new campaign targeting Latin America that uses geofencing, staged loaders, selective activation, and separate servers for stolen data to make the #malware appear inactive or inaccessible during analysis. 🔗 Explore the attack chain: ow.ly/4pyo50ZMbSc

Someone else may be spending your AI budget. 💸🤖 #FortiGuardLabs analyzed an Amazon Bedrock LLMjacking incident where a leaked AWS IAM key was used to create a new identity, subscribe to foundation models, and generate inference charges on the victim’s account. Valid access. Real cost. 🔗 See how to spot LLMjacking: ow.ly/SFzZ50ZKIAl

🚨 New #FortiGuardLabs Outbreak Alert: WordPress Core Unauthenticated RCE The WP2Shell attack chain combines two critical vulnerabilities to enable remote code execution against vulnerable WordPress installations without authentication or user interaction. Read the latest and sign up for outbreak alerts today: ow.ly/gHWK50ZIUYl

As a founding partner of @FIRSTdotOrg, #Fortinet is helping expand training, cyber drills, regional engagement, and incident response readiness where it can make the greatest impact. This is capacity building, not just technology. It's investing in the people, skills, and relationships behind coordinated response. Great to see Derek Manky, our Chief Security Strategist and Global VP of Threat Intelligence at @FortiGuardLabs, featured in FIRST's video series on this work. 🔗 See what global collaboration looks like in practice: ow.ly/vrua50ZIRtM

From access brokers and botnets to ransomware affiliates and scam networks, @INTERPOL_HQ's African Cyberthreat Assessment Report 2026 shows a more specialized, automated, and borderless threat landscape. → AI is accelerating attacks. → Credentials remain a key target. → Cybercrime-as-a-Service lowers barriers. → Collaboration enables disruption. With contributions from @FortiGuardLabs, the report reinforces the need for coordinated intelligence sharing and public-private partnerships. 🔗 Read the analysis: ow.ly/swlO50ZIjGY

🚨 New #FortiGuardLabs Outbreak Alert: QuickFox Supply Chain Attack A trojanized Windows installer turned a trusted software path into a selective delivery mechanism for the FDMTP backdoor. Read more: ow.ly/6GYu50ZFpsc

🌎 In this week's "Improving Security Across Nations with @FIRSTdotOrg" video series, we spotlight Derek Manky, Chief Security Strategist and Global VP of Threat Intelligence at @Fortinet, and FIRST CORE Founding Partner. Watch here: go.first.org/3GtbN #cybersecurity

Mirai evolved. So did the risk. 🐧 Our researchers are tracking Evooo1Bot, a previously undocumented #Linux botnet that expands the familiar Mirai framework with a far more capable toolkit. → Exploit exposed devices → Steal credentials → Scan for SSH access → Turn compromised infrastructure into a proxy 🔗 Read the technical analysis: ow.ly/kgJc50ZzzAr

Detecting cybercrime is one thing. Identifying the people behind it is another. 🔍 At #BHUSA, Fortinet's Derek Manky spoke with @theCUBE about closing that accountability gap through the Cybercrime Bounty program with Crime Stoppers International. → Trusted, anonymous reporting → Human intelligence, not just technical indicators → Turning validated tips into actionable intelligence ⏯️ Watch the full interview: ow.ly/VNh350ZyB5N

The threat wasn’t hiding behind the download... It was inside it. 🦊 ⚠️ #FortiGuardLabs researchers uncovered a long-running supply chain attack in which a trojanized QuickFox Windows installer selectively profiled targets before deploying the FDMTP backdoor. 🔗 Read the coverage from The Hacker News: ow.ly/pLXo50ZyIRU

There’s a hidden passenger in this shortcut. 🦊⚠️ Our team uncovered a long-running supply chain attack that used a trojanized #QuickFox application to identify select Windows targets and deploy the FDMTP implant for persistent access. 🔗 See how the campaign operated: ow.ly/S15A50Zwl46 #FortiGuardLabs

TOMORROW: Black Hat 2026 is on! 🎰 Join #FortiGuardLabs in Las Vegas for a look at what threat intelligence is seeing next as AI-enabled adversaries raise the stakes for defenders. 🗓️ August 4-6, 2026 🔗 Get connected today: ow.ly/SaoE50ZvXiT #BHUSA

TrickBot is changing how it hides in plain sight. 🕵️‍♂️ 🌐 Our team examines a variant that replaces traditional HTTP-based command-and-control with DNS tunneling, embedding encrypted data inside malformed DNS traffic. See how it maintains persistence, evades analysis, and executes malicious modules in memory. 🔗 Read the analysis: ow.ly/I6N150ZtEgh

A .ttf file may not be a font at all. ⌨️ 🔍 A large-scale campaign is disguising low-detection Lua loaders as font files to deploy RATs and infostealers, including Agent Tesla, Remcos, XWorm, and Snake Keylogger. See how the infection chain works and how attackers are evolving it to evade detection. 🔗 Read the analysis: ow.ly/pr7Z50Zrxpq

The next wave of AI threats is already taking shape. Join #FortiGuardLabs at Black Hat 2026 for a look at what threat intelligence is seeing next, from AI-enabled adversaries to the rise of autonomous defense. 🎤 Speaker: Aamir Lakhani, Sr. Director, AI and Threat Research 🗓️ August 5, 2026 🕜 1:30 PM Get connected today: ow.ly/eZ9l50ZqcaN

This Trojan checks your location before opening the door. 🚪🏦 Our #FortiGuard researchers analyzed an ongoing Ousaban campaign targeting banking users in Spain and Portugal. 👉 One small detail defenders should not miss: the campaign uses daily-changing domains to reach C2 infrastructure. Read the latest threat analysis: ow.ly/GTSR50ZjU8i