Intel Exchange

Threat actors are leveraging malicious ChatGPT Custom GPTs to social engineer victims into executing PowerShell-based ClickFix attacks that deliver sophisticated Remote Access Trojans.

Agent Tesla is a .NET-based spyware Trojan that steals credentials, keystrokes, and screenshots primarily through malicious email attachments.

IronChain is a destructive malware build packaged with PyInstaller that utilizes multiple kernel drivers for process termination and persistence while intentionally discarding encryption keys to prevent data recovery.

Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.

The STAC4924 campaign, linked to GOLD VICTOR (Vice Society), uses TerminalFix lures to deploy Lorem Ipsum Loader and custom Python tunneling implants via DLL sideloading.

Suspected Star Blizzard threat actors target Moldovan and Ukrainian civil society using the RedFlick technique, involving conversation-based phishing and VHDX-delivered malware.

2CLoader is a sophisticated new malware loader identified in August 2026 that uses indirect system calls and environment spoofing to deliver information stealers like Vidar and Remus.

DragonForce ransomware group is utilizing legitimate Microsoft Teams TURN servers and MQTT brokers for redundant, stealthy C2 communication.

The MALFEX operator has conducted a two-year npm supply-chain campaign, deploying Overlord RAT and the movinlike stealer via multi-arm delivery packages, some of which remain active despite partial registry seizures.

ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.