Tim Peck

Threat actors are exploiting a zero-day vulnerability in Adobe Reader via malicious PDF files to execute privileged APIs and steal sensitive data, specifically targeting the Russian oil and gas sector.

Threat actors are increasingly abusing native Microsoft 365 mailbox rules to maintain persistence, suppress security alerts, and automate data exfiltration following account compromise.

JanelaRAT is an evolving variant of BX RAT targeting financial and cryptocurrency institutions in Latin America through DLL side-loading and sophisticated overlay attacks.

The BlueHammer exploit chains NTFS junctions, batch oplocks, and the Cloud Files API to force Windows Defender into leaking SAM hive hashes, granting attackers SYSTEM-level access.

Threat actor 0xFFF (aka alh1mik) has released notnullOSX, a modular Go-based macOS stealer and backdoor targeting high-value cryptocurrency users through ClickFix social engineering.

Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.

An attacker uses a multi-stage fileless infection chain involving obfuscated VBScript and in-memory .NET loaders to deploy ScreenConnect for persistent remote access.

TeamPCP executed a cascading supply chain campaign using the CanisterWorm and Cloud Stealer malware to harvest credentials from GitHub Actions and PyPI packages.

The Iranian threat actor MuddyWater (MOIS) is leveraging Russian-speaking TAG-150's CastleRAT and ChainShell malware platforms to target Israeli infrastructure and aerospace sectors.

ClipBanker malware utilizes a complex, multi-stage infection chain starting from trojanized software on GitHub to swap cryptocurrency wallet addresses via clipboard monitoring.