Renata Cardoso

QuimaRAT is a cross-platform Java-based Remote Access Trojan sold as a service, targeting Windows, Linux, and macOS environments through modular encrypted plugins.

ARToken is an EvilTokens-linked Phishing-as-a-Service platform that uses Microsoft OAuth Device Code grants to capture Primary Refresh Tokens (PRTs) for persistent access and BEC operations.

INCRansom affiliates utilize reg.exe to dump SECURITY, SAM, and SYSTEM registry hives to extract LSA secrets and domain credentials from service accounts.

Unauthenticated attackers can bypass authentication on exposed Gitea instances to gain full administrative control by spoofing the X-WEBAUTH-USER HTTP header.

Adversaries leverage automated tools and weak server-side authorization to exploit Web APIs through BOLA, JWT tampering, and SSRF techniques.