Duo Tech

TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.

Threat actors are spoofing OAuth client IDs in Microsoft Entra to perform stealthy user enumeration and credential validation without generating successful sign-in logs.

Threat actors are increasingly using LLMs to generate bespoke, functional malware and automate complex Active Directory enumeration, data exfiltration, and extortion workflows.

Russian-speaking threat actor UAT-11795 is utilizing ClickFix lures and trojanized software to deploy novel Python-based Starland RAT and PowerShell-based WLDR agent for cryptocurrency theft.

The Kratos Phishing-as-a-Service (PhaaS) platform targets Microsoft 365 credentials in the US and Europe using sophisticated multi-generation phishing kits and anti-bot measures.

The MemGhost framework automates stealth memory injection into persistent AI agents like OpenClaw, enabling long-term compromise via a single adversarial email.

A threat actor compromised the jscrambler npm package, delivering cross-platform Rust-based infostealers through malicious preinstall hooks and self-executing functions targeting developers and CI/CD environments.

The threat actor Hyadina has rebranded Beast ransomware as GodDamn, utilizing the malicious PoisonX kernel driver to disable endpoint defenses via BYOVD attacks.

A logistics-themed spear-phishing campaign deploys CrySome RAT via a multi-stage chain involving UAC bypass, AMSI patching, and the WinDefCtl utility to disable endpoint defenses.

Detection opportunities and rules for TAG-182's MarkiRAT campaign, covering fake VPN/media-player lures, BITS job abuse, svehost.exe masquerading, and typosquatted C2 infrastructure impersonating maj…