Tim Peck

The threat actor Storm-2372 is utilizing AI-built phishing kits, TokenLover and YaksaLover, to automate large-scale BEC attacks and persistence via Windows Hello for Business key injection.

APT42 (suspected Iran-linked) is utilizing AI-assisted phishing and the SpearSpecter campaign to deliver an evolved modular TAMECAT backdoor targeting defense and nuclear energy sectors.

Evidence refutes the attribution of TAG-150 commodity Russian Malware-as-a-Service (MaaS) and ClixFlare infrastructure to the Iranian state actor MuddyWater.

The wp2shell exploit chain leverages vulnerabilities in WordPress Core's REST API and WP_Query to achieve unauthenticated remote code execution on default installations.

Threat actors are using multi-stage AutoIT scripts delivered via phishing to inject VIPKeylogger and MedusaHVNC into legitimate Windows processes like charmap.exe.

Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.

The FakeAgent campaign utilizes malicious Claude.ai artifacts and SEO poisoning to deliver SectopRAT through DLL sideloading and blockchain-based C2 infrastructure.

Attackers are abusing the OAuth 2.0 device authorization grant to trick users into authenticating malicious sessions on legitimate Microsoft sign-in pages, bypassing MFA.

Russian-affiliated threat actor CL-STA-1114 exploits a zero-click vulnerability in Zimbra Collaboration Suite to exfiltrate user credentials and email archives from global targets.

Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.