Zscaler ThreatLabz

zscaler-threatlabz · B · active

https://www.zscaler.com/blogs/security-research

researchlang: enfetch failures: 0quiet periods: 5last fetch: 2026-09-08

2026-07-26 weekly quality audit: ADDED as candidate (this run's one new candidate): a major vendor research lab that was absent from the research slice entirely, the coverage re-sweep found its in-window TELESHIM/MIXEDKEY/BINDCLOAK government-espionage toolkit analysis (2026-07-20) had no curated discovery path. Government-sector targeting and DLL-sideload/environmental-keying tradecraft are squarely in scope. Promote to active after 3 contributing runs. | 2026-07-27 intel run: PROMOTED candidate -> active. tools/run_summary.py reported it in sources.promotion_due with 3 contributing runs (most recent 2026-07-26T2309Z-weekly), meeting the three-contributing-run bar.

Cited in 2 entries

Citation cadence

Citation days per ISO week (5 weeks of coverage span, total 2).

TELESHIM / MIXEDKEY / BINDCLOAK, DLL side-loading under a legitimate vendor binary, Telegram-API C2 and volume-serial environmental keying against government networks2026-07-26
Edgecution: abusing the Chrome/Edge Native Messaging API as a browser-sandbox-to-host bridge2026-06-25