Tim Peck

A heap buffer overflow in 7-Zip (CVE-2026-48095) allows remote code execution via a crafted NTFS image that triggers undefined behavior during decompression buffer allocation.

IRGC-affiliated actor Nimbus Manticore deployed the new MiniFast backdoor using AppDomain hijacking and SEO poisoning to target both aviation and software sectors during geopolitical conflict.

The CL-CRI-1089 threat actor is conducting malvertising campaigns targeting macOS users to deploy FlutterShell, a Flutter-based backdoor that facilitates browser hijacking and arbitrary command execution.

A new malware campaign dubbed Argamal targets players of adult games using trojanized installers to deliver a full-featured Remote Access Trojan (RAT).

The Iran-nexus group Screening Serpens is targeting technology, aerospace, and defense professionals in the US, Israel, and UAE using advanced AppDomainManager hijacking and new RAT variants.

TeamPCP and other actors are leveraging container escapes via host vulnerabilities (CVE-2024-21626) and misconfigured orchestration APIs to compromise Kubernetes secrets and host systems.

Unknown threat actors are exploiting CVE-2026-5426 in KnowledgeDeliver LMS using hardcoded machine keys to achieve RCE and deploy BLUEBEAM web shells and Cobalt Strike.

UNC5342 utilizes the EtherHiding technique on the BNB Smart Chain testnet to host immutable ClearFake payload routing instructions targeting Windows and macOS users.

The Kali365 Live PhaaS platform enables large-scale device code phishing and AitM session capture targeting Microsoft 365 environments across multiple sectors.

The Weedhack Malware-as-a-Service (MaaS) campaign targets Minecraft players with custom JAR files that deploy multi-stage infostealers and RATs using Ethereum-based C2 infrastructure.