Duo Tech

Attackers are exploiting CVE-2026-65400, a critical macOS Screen Sharing authentication bypass, to gain root access and deploy Monero miners on internet-exposed systems.

Adversa AI researchers identified a new attack technique, Cryptographic Context Injection, that bypasses AI guardrails by using code execution runtimes to decrypt malicious instructions stored in ciphertext.

China-aligned threat actor ITG27 (Mustang Panda) is targeting the Indian government and energy sector using updated Toneshell v10 and a new VNC-capable backdoor named Havencode.

The Mirage2FA Phishing-as-a-Service toolkit by LinX Coders utilizes Adversary-in-the-Middle (AiTM) techniques to bypass MFA and steal Microsoft 365 session cookies, primarily targeting US-based technology and manufacturing sectors.

Lazarus Group's Famous Chollima unit utilizes stolen identities and AI-assisted workflows to infiltrate Western finance and technology firms as remote IT workers.

AmnesiaStealer is a multi-stage Rust-based macOS infostealer that uses ClickFix lures and a remote streaming module to gain live, hidden control of Chromium browsers.

C2Looper is a new Rust-based backdoor likely linked to ransomware actors, utilizing GitHub for command-and-control and distributed via ClickFix campaigns.

Suspected Russian clusters UNC6293, UNC7005, and UNC5976 are abusing legitimate authentication flows like OAuth and app passwords to target individuals in government, defense, and academia.

ACRStealer campaign leverages a legitimate, Microsoft-signed Korean DLP driver (DCRCVDrv.sys) to perform kernel-context process termination for security software suppression.

PurpleDelta, a North Korean IT worker group, uses AI-generated personas and identity brokering to secure remote technical roles for revenue generation and potential supply-chain compromise.