Intel Exchange

The Iranopasmigirim campaign by an Iran-linked actor uses DLL sideloading to deploy ParsaStealer, a Rust-based infostealer targeting dissidents via lures mimicking the Rise Iran movement.

AvisLoader is a Windows loader using the Tox encrypted peer-to-peer messaging network for command-and-control to evade traditional domain-based takedowns.

A Ukrainian-themed phishing campaign utilizes a multi-stage VBScript dropper to download decoy documents and execute payloads from external file-hosting infrastructure.

Atomic macOS (AMOS) Stealer targets macOS users through social engineering campaigns masquerading as software toolkits, exfiltrating browser data, credentials, and cryptocurrency wallets.

A malicious LNK file disguised as an OIC invitation uses PowerShell to download an archive that installs PlugX via DLL side-loading through a Jarte-derived application.

Attackers are exploiting a maximum-severity zero-day vulnerability in Cisco Identity Services Engine (ISE) to bypass authentication and gain root-level access.

Kimsuky (APT-C-55) utilizes multi-stage PowerShell and C# malware delivered via disguised installers to target South Korean institutions for intelligence theft.

Researchers at pwn.ai discovered the Click2Shell attack chain, which leverages a WordPress core selector injection vulnerability to force theme installations and achieve remote code execution through theme-specific flaws.

Threat actors are chaining three JFrog Artifactory vulnerabilities to bypass authentication, escalate privileges to administrator, and deploy Rust-based backdoors.

Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.