Tim Peck

Multiple campaigns are using ghost accounts and compromised tokens to systematically enumerate and exfiltrate private data from GitHub organizations.

Russian-speaking threat actors are exploiting CVE-2026-35616 in FortiClient EMS to deploy EKZ Stealer and FortigateSniffer, facilitating credential harvesting and subsequent ransomware attacks by INC Ransom and Lynx.

The China-aligned threat actor UNK_MassTraction is exploiting Roundcube vulnerabilities to deploy IceCube and VShell backdoors against US and Canadian university physics departments.

The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.

Adversaries use advanced sleep obfuscation techniques like Ekko and FOLIAGE to encrypt implants in-memory between callbacks, evading traditional YARA and memory attribute scanning.

Attackers can abuse Active Directory Certificate Services (ADCS) to obtain trusted TLS certificates and hijack DNS to perform MITM attacks against Microsoft Entra ID logins.

A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.

Armored Likho targets government and energy sectors in Russia, Brazil, and Kazakhstan using BusySnake Stealer, a Python-based infostealer distributed via AI-generated loaders and LNK files.

Adversaries target Microsoft Sentinel infrastructure to blind security teams by disabling analytic rules, shortening data retention, or altering diagnostic settings.

UAC-0226 is utilizing WinRAR path traversal (CVE-2025-8088) with NTFS Alternate Data Streams to deploy the GIFTEDCROOK stealer via a multi-stage PowerShell and reflective loading chain.