Kaung Khant Ko

An unattributed threat cluster with similarities to SilverFox is targeting Cambodian organizations using a multi-stage infection chain that leverages BYOVD techniques and PNG-based shellcode to deploy SparkRAT.

ClickLock is a macOS information stealer and backdoor that uses social engineering and process-killing loops to coerce users into surrendering administrative credentials.

Lazarus group exploited a Windows AFD.sys zero-day (CVE-2026-68820) to deploy the FudModule rootkit against defense and aviation sectors via trojanized PDF software.

China-linked threat actor OP-512 is targeting Windows IIS servers with a custom ASPX/ASHX web shell framework and memory-only privilege escalation tools.

Lucid Stealer is a Node.js-based information stealer and RAT that uses Single Executable Application packaging to deliver modular payloads for credential theft and remote control.

A ransomware-related threat actor is deploying MLTBackdoor, a sophisticated malware using ClickFix lures and BOF loading capabilities for post-exploitation.

The financially motivated threat actor Woodgnat is deploying the stealthy Backdoor.Mistic via DLL side-loading to facilitate ransomware access for affiliates.

Myxa VPN operates 737 malicious Chrome extensions impersonating 66 privacy brands to redirect all user browser traffic through controlled SOCKS5 proxies.

Aeza Group infrastructure is being used to deploy Go-based Mach-O malware through ClickFix social engineering, targeting macOS users to steal credentials and drain cryptocurrency wallets.

Forest Blizzard (linked to Russian military intelligence) compromises SOHO routers to perform DNS hijacking and adversary-in-the-middle attacks targeting Microsoft 365 and government servers.