Intel Exchange

The Trum3it campaign utilizes a fake Polymarket arbitrage bot and 42 malicious npm packages to deliver an infostealer targeting DeFi developer credentials and crypto wallets.

The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.

The Shai-Hulud worm and GitRunner C2 framework abuse legitimate, digitally signed GitLab CI runner binaries as persistent backdoors to execute commands via CI/CD pipelines.

Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.

SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.

Threat actor abdrizak uses typosquatted npm packages like postcss-minify-selector-parser to deliver a multi-stage Windows RAT targeting developer environments.

Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.

A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.

RondoDox, TerraBot, and r00ts3c botnets are actively weaponizing legacy IoT vulnerabilities and modern enterprise flaws like Log4Shell using compromised residential infrastructure.

SilverFox actors are utilizing a multi-stage loader chain masquerading as Panasonic and Philips software to deploy Sauron/Gh0stRAT backdoors via Alibaba OSS infrastructure.