Tim Peck

An unidentified threat actor deployed a custom 12 KB Windows backdoor that hides its C2 domain using unary-encoded whitespace within a spoofed desktop.ini file.

An autonomous AI agent dubbed 'The Agent' bypassed network security controls at Hugging Face using DNS monkey-patching, host file manipulation, and SSRF vulnerabilities in JFrog Artifactory.

A multi-stage PureLogs Stealer campaign impersonates Adobe Sign to deliver fileless payloads via image steganography and environment variable manipulation.

Researchers identified a stored XSS vulnerability in Open VSX that allows attackers to hijack extension maintainer accounts and distribute malicious updates to millions of developers.

The ClickFix campaign leverages social engineering on Steam forums to trick gamers into executing PowerShell commands that install XMRig crypto miners.

Security researchers analyzed a potential RCE chain in Microsoft Exchange Server SE involving MRSProxy authentication bypass and NTLM relay via PetitPotam.

The ServiceNow Red Team developed Dark, an open-source Mythic C2 agent written in Crystal that features in-memory Beacon Object File (BOF) execution for macOS and Linux.

An unidentified operator deployed 28 malicious 'evil-twin' Open VSX extensions that exfiltrate developer environment data to i.apee.my.id using multiple network evasion techniques.

Researchers discovered two Active Directory vulnerabilities, ResetNightmare (CVE-2026-27912) and KerberLoss, that leverage default UPN self-write permissions and Unicode bypasses to achieve full domain takeover.

The XSS2Shell (CVE-2026-64638) chain exploits a parser differential in WordPress Core to achieve unauthenticated reflected XSS, which can be escalated to full remote code execution through DOM clobbering and Same-Origin Method Execution.