Intel Exchange

BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.

The PhantomEnigma campaign leverages compromised Brazilian .gov.br infrastructure to deliver a modular Node.js backdoor aimed at banking credential theft.

TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.

Apex Foundation is distributing a macOS infostealer via npm packages and a fake MCP server, targeting Web3 founders with an AI-advisor lure.

Blind Eagle (APT-C-36) is utilizing a modernized JC-46 AsyncRAT build featuring WNF process injection and a Chrome App-Bound Encryption bypass to target Latin American financial interests.

TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.

DPRK-aligned threat actors are targeting developers with fake coding interviews that deliver OTTERCOOKIE malware via SVG-based steganography.

ShinyHunters compromised the @asyncapi NPM organization via a GitHub Actions CI/CD exploit to deliver the Miasma modular runtime using import-time execution.

A suspected North Korean cluster, linked to Sapphire Sleet, uses AppleScript to bypass macOS TCC protections and deploy the ptApp backdoor targeting cryptocurrency organizations.

LabubaRAT is a newly discovered Rust-based remote access tool that uses NVIDIA-themed metadata and multiple communication channels, including DNS tunneling, to maintain persistence and control over infected Windows hosts.