Tim Peck

WFX Phantom uses compromised GitHub tokens to inject a shell script named 'wfx' into CI workflows to steal secrets, cloud credentials, and establish cloud persistence.

An unidentified threat actor is using the 4EverAble2Shell exploit to achieve unauthenticated root RCE on N-able N-central servers, deploying XMRig miners even on recently patched systems.

Threat actors are utilizing ClickFix social engineering to trick victims into executing PowerShell commands that deliver various payloads including CrashHandler RAT and Stripe-based C2 implants.

Three malicious VS Code extensions use remote relays and keychain access to achieve code execution and credential theft on developer machines.

Unidentified threat actors are compromising GitHub repositories related to security testing and blockchain to deploy Trojan.Loader.3261 and AsyncRAT against developers.

Chinese-speaking actor leepsmarts executes the KeyHunter Operation, stealing 2,233 LLM API keys and orchestrating an academic fraud campaign targeting 20 universities.

An adversary (suspected China-nexus) utilized the Falcon browser-native C2 framework and Antino Rust implant to target government entities in the Middle East and Southeast Asia.

Adversaries can chain a path traversal vulnerability in Telerik RadImageEditor (CVE-2026-18672) with configuration-dependent file upload tampering (CVE-2026-19219) to achieve unauthenticated remote code execution.

A trojanized version of the Claude Code for VS Code extension (2.1.312 and 2.1.313) on the Cursor Marketplace drops persistent SSH backdoors and exfiltrates host reconnaissance data across macOS, Linux, and Windows.

A fake-download campaign uses trojanized Inno Setup installers to deliver various monetization payloads, including proxyware and distributed-computing agents, to compromised Windows devices.