Intel Exchange

JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.

The threat actor vpmdhaj published 14 malicious npm packages typosquatting OpenSearch and ElasticSearch libraries to harvest AWS, HashiCorp Vault, and GitHub Actions credentials.

Threat actors including Aeternum are exploiting CVE-2026-26980 in Ghost CMS to inject malicious JavaScript loaders that facilitate ClickFix social engineering attacks and malware delivery.

The threat actor UAC-0184 is targeting Ukrainian Defense Forces using gated HTA delivery methods and complex DLL sideloading chains that culminate in the repurposing of legitimate, signed network utilities.

Financially motivated actors are using SEO poisoning to impersonate AI tools like Gemini and Claude Code, delivering a fileless PowerShell infostealer to developer workstations.

The TAX#TRIDENT campaign utilizes fake Indian income tax assessment lures to deliver YTSCRat or unauthorized ManageEngine UEMS agents through various VBScript and ZIP-based infection paths.

Likely state-sponsored actor CL-STA-1132 is exploiting a zero-day buffer overflow (CVE-2026-0300) in PAN-OS Captive Portal to achieve root-level remote code execution.

The KongTuke threat actor is impersonating help-desk staff via external Microsoft Teams chats to deploy the multi-path ModeloRAT toolkit for persistent access.

Seedworm (MuddyWater) conducted a global espionage campaign in early 2026 using Node.js loaders and DLL sideloading to target manufacturing, government, and financial sectors.

The ClickFix campaign has evolved to deploy PySoxy, an open-source Python SOCKS5 proxy, for redundant encrypted C2 access and persistence following initial social engineering.