Intel Exchange

A malicious LNK file disguised as an OIC invitation uses PowerShell to download an archive that installs PlugX via DLL side-loading through a Jarte-derived application.

MovieReaper uses compromised torrent repositories and the Solana blockchain to deploy a multi-stage modular framework targeting diverse global sectors.

Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.

A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.

SilverFox threat actors have upgraded their malware delivery chain from open access and whitelisting to a sophisticated cloud-based blacklist mechanism to evade detection by security researchers.

Unidentified threat actors are exploiting multiple authentication bypass and remote code execution vulnerabilities in N-able N-central to compromise managed service providers and their downstream customers.

An unsigned GlobalProtect-themed MSI deploys a backdoor that utilizes Cloudflare Workers for configuration and Google Sheets for C2 communication, specifically targeting victims in Myanmar.

CRPx0 is a sophisticated cross-platform ransomware-as-a-service operation using ClickFix social engineering lures to deliver multi-stage Python-based payloads via clipboard hijacking.

StyleSmuggler is an unauthenticated zero-day RCE vulnerability in Magento and Adobe Commerce being exploited to deploy persistent Rust-based implants and backdoors.

Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.