Tim Peck

Nightmare Eclipse exploits a flaw in Windows Defender's Cloud Files remediation logic to achieve arbitrary file writes and SYSTEM execution via NTFS junctions and oplocks.

The Chinese threat actor VerdantBamboo is targeting unmonitored edge appliances such as firewalls and NAS devices to maintain persistence and bypass EDR security controls.

The Miasma threat actor compromised 56 npm packages to steal CI/CD secrets and deploy persistent backdoors using a novel binding.gyp execution trigger.

The SStar Agent is a Go-based cross-platform RAT delivered via a poisoned npm package (tw-style-utils) targeting Web3 developers with surveillance and exfiltration capabilities.

An attacker can steal broadly-scoped GitHub OAuth tokens by exploiting VSCode webview message handling to simulate keystrokes and install malicious extensions.

The suspected Chinese threat actor TA4922 is expanding globally, utilizing new loaders like RomulusLoader and SilentRunLoader alongside Atlas RAT to target organizations in Asia and Europe.

The BoldTealLayer campaign utilizes a sophisticated Lua-driven loader to execute fileless .NET payloads by bypassing AMSI and disabling ETW monitoring.

RemusStealer and the SessionGate framework are distributed through a complex ecosystem of impersonation websites and gated Traffic Distribution Systems (TDS) targeting technical users.

DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.

The Yuta/Solara campaign distributes a Python-based port of Glove Stealer targeting Roblox users and developers with advanced Chrome App-Bound Encryption bypasses.