kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

Vanilla Tempest

also tracked as vice society 1

1 story · 1 in the wild · June 21, 2026 – June 21, 2026

evidence: 1 observed

how they got in

  • phishing email 1 · Jun 21

malware and tools

  • bababeda 1 · Jun 21
  • clickfix 1 · Jun 21
  • cryptobandits 1 · Jun 21
  • lorem ipsum 1 · Jun 21
  • potemkin 1 · Jun 21

techniques

  • code execution 1 · Jun 21

attack phases seen

  • Execution 1 · Jun 21
  • Initial access 1 · Jun 21

what we reported, newest first, grouped by story

Jun 17 – June 21, 2026

  • ClickFix campaigns expanded with three new loaders — BabaDeda, Lorem Ipsum, and Potemkin — per Morphisec, BlueVoyant, and Huntress, with the Lorem Ipsum activity possibly tied to Vice Society (The Hacker News). Microsoft also detailed CryptoBandits, a USB-LNK worm spreading a Windows clipper that uses Windows Script Host, ActiveX, and a bundled Tor proxy for C2 (BleepingComputer). · Jun 21 · observed · via phishing email · as vice society · Threat Intelligence