Intel Exchange

State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.

The StegoAd campaign utilized 119 malicious browser extensions to perform ad fraud and steal Google and WordPress credentials from 2.6 million users.

Rapid Brigantine and other cybercrime clusters are utilizing ClickFix social engineering to deploy modular loaders and backdoors including Potemkin, RMMProject, BabaDeda, and Lorem Ipsum.

Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.

DPRK-aligned actors are deploying macOS.Gaslight, a Rust-based implant that uses adversarial prompt injection to disrupt LLM-assisted malware analysis pipelines.

A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.

DPRK-aligned actors are deploying macOS.Gaslight, a Rust-based backdoor that utilizes prompt injection payloads to subvert LLM-assisted malware analysis pipelines.

The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.

The Pakistan-aligned APT36 is deploying a new variant of the SHEETCREEP RAT using Google Sheets for C2 communication, targeting Indian diplomatic interests.

Attackers are abusing Google Forms' editor invite feature to bypass email security and harvest sensitive information using name-matching social engineering pretexts.