Tim Peck

Threat actor I_H8_KDot uses Inland Revenue Authority of Singapore phishing lures to deliver Overlord RAT through malicious VHDX images and DLL sideloading.

The popular ModHeader browser extension was discovered containing a dormant but fully functional pipeline for collecting, encrypting, and exfiltrating user browsing history.

The OkoBot framework uses TookPS and an automated SSH bot to deliver sophisticated implants that target cryptocurrency seed phrases and browser extensions.

Adversaries can exploit Azure Container Registry permissions to push malicious images, modify ACR Tasks, and abuse Managed Identities for secret exfiltration and remote code execution.

ESET researchers discovered 11 Microsoft-signed UEFI shim bootloaders that allow attackers to bypass Secure Boot and deploy bootkits like BlackLotus and Bootkitty.

Adversaries utilize various AWS-native features including IAM users, cross-account roles, Lambda backdoors, and federated sessions to maintain long-term persistence in victim cloud environments.

Threat actors compromised an Artlist subdomain using stolen credentials to deploy a ClickFix campaign that uses blockchain-based EtherHiding for evasion and delivers a multi-stage RAT.

Salat Stealer, a Go-based information stealer, is distributed via gaming utilities like Xeno Executor to harvest credentials, crypto wallets, and perform live surveillance.

The DEBULL PhaaS framework leverages Microsoft device-code phishing and the GraphSpy post-exploitation tool to compromise Microsoft 365 tenants using Storm-2372-style tradecraft.

Russian FSB Center 16 and Static Tundra are actively exploiting the legacy Cisco Smart Install vulnerability (CVE-2018-0171) to extract device configurations and maintain persistence in critical infrastructure.