Intel Exchange

The Manic Android malware family targets financial and government services, utilizing unique Wi-Fi and Bluetooth mesh networks to exfiltrate data from offline devices.

PurpleDelta, a North Korean IT worker group, uses AI-generated personas and identity brokering to secure remote technical roles for revenue generation and potential supply-chain compromise.

The StopAndProtect operation abuses compromised WordPress sites to distribute a multi-component toolkit for file encryption, data theft, and lateral movement via social engineering.

Lazarus group exploited a Windows AFD.sys zero-day (CVE-2026-68820) to deploy the FudModule rootkit against defense and aviation sectors via trojanized PDF software.

OnyxC2 is a sophisticated Malware-as-a-Service info-stealer and remote access toolkit targeting over 200 applications including crypto wallets, browsers, and 2FA extensions.

Lucid Stealer is a Node.js-based information stealer and RAT that uses Single Executable Application packaging to deliver modular payloads for credential theft and remote control.

The financially motivated threat actor Woodgnat is deploying the stealthy Backdoor.Mistic via DLL side-loading to facilitate ransomware access for affiliates.

Abyssos is a new modular C++ RAT utilizing LLVM-based obfuscation and a custom TCP protocol to perform credential theft, remote access via VNC, and network reconnaissance.

The North Korean-linked threat actor Larva-26005 is targeting South Korean users by distributing the Xctdoor and XcLoader backdoors through spear phishing and installers disguised as legitimate security programs.

UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.