Tim Peck

The Phorpiex-linked Needle MaaS platform utilizes a modular Rust-based agent and browser spoofers to steal cryptocurrency seed phrases from over 1,900 victims.

An unknown threat actor is exploiting a critical cPanel authentication bypass (CVE-2026-41940) to target South-East Asian military and government entities for data exfiltration and persistent network access.

The InstallFix campaign utilizes Google Ads and fake Claude AI installation pages to deliver RedLine Stealer through a complex, multi-stage infection chain.

An unprivileged unprivileged user can gain root access on major Linux distributions by exploiting CVE-2026-31431, a deterministic 4-byte page cache write bug in the authencesn cryptographic template.

The HumanitarianBait campaign utilizes Russian-themed aid lures and GitHub-hosted Python implants to establish persistent surveillance and remote access on targeted systems.

The PhantomRaven actor is targeting DeFi, Cloud, and AI developers via 33 malicious NPM packages using a multi-stage Remote Dynamic Dependency chain to harvest credentials.

A Chinese-speaking threat actor compromised DAEMON Tools installers to deploy information collectors, minimalistic backdoors, and the complex QUIC RAT against targeted organizations.

An Iranian-nexus threat actor targeted 12 Omani government ministries using a custom C2 framework, ProxyShell exploits, and DotNetNuke vulnerabilities to exfiltrate judicial and citizen data.

MariaDB 11.4 and 11.8 series are vulnerable to a heap buffer overflow in the JSON_SCHEMA_VALID function, allowing authenticated users to escalate privileges and execute arbitrary OS commands.

An unknown threat actor is deploying the CloudZ RAT and a custom Pheno plugin to hijack Microsoft Phone Link bridges for the purpose of intercepting SMS-based one-time passwords (OTPs).