Intel Exchange

The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).

The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.

Warden Stealer is a Rust-based Malware-as-a-Service that targets AI coding agent tokens, browser data, and cryptocurrency wallets through process injection and anti-VM techniques.

The threat actor UAT-11985 is targeting Taiwan research organizations using AI-generated spear-phishing lures and QR codes to drive victims toward an Adversary-in-the-Middle (AitM) framework for harvesting Google account credentials and MFA codes.

Adversaries leverage ClickFix social engineering, ClearFake etherhiding, and SNEAKY2FA AiTM phishing to deliver malware and hijack sessions.

The P7 variant of DarkSword targets iOS 18.x devices using chained vulnerabilities to exfiltrate keychain data, cryptocurrency wallets, and Apple Notes via a sophisticated two-way C2 architecture.

Mustang Panda uses a diplomatic-themed OIC invitation LNK to deliver the PlugX RAT through multi-stage PowerShell execution and DLL side-loading.

Threat actors are leveraging malicious ChatGPT Custom GPTs to social engineer victims into executing PowerShell-based ClickFix attacks that deliver sophisticated Remote Access Trojans.

Adversaries are deploying modular Linux implants including BPFDoor, Rekoobe, and the new AVERAT RAT against telecom edge appliances, utilizing SMTP-disguised C2 and BPF packet filtering to evade detection.

Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.