Tim Peck

Adversaries can achieve SYSTEM privilege escalation by planting a malicious DLL at a non-existent ProgramData path referenced by a dangling COM registration and triggering it via custom COM marshaling.

The Phexia threat actor uses fake CAPTCHA 'ClickFix' lures to deploy a macOS backdoor that resolves its C2 hostname via a Polygon smart contract and drops multiple infostealers.

Atomic macOS Stealer (AMOS) is being delivered via a sophisticated ClickFix attack chain that uses a deceptive Xcode download site to trick users into executing malicious Terminal commands.

The Iranopasmigirim campaign by an Iran-linked actor uses DLL sideloading to deploy ParsaStealer, a Rust-based infostealer targeting dissidents via lures mimicking the Rise Iran movement.

An unidentified threat actor published malicious npm packages posing as Twilio security research tools to exfiltrate sensitive API credentials and system metadata.

A malicious Firefox extension named PDF Identity Verifier uses post-install payload fetching to steal Google session cookies and automate password resets for Portuguese- and Spanish-speaking users.

A Chinese-speaking operator nicknamed 'Miku' conducted a global campaign involving SQL injection, credential spraying, and LLM-assisted reconnaissance against government, military, and commercial targets in Pakistan, Vietnam, and Mexico.

Threat actors are actively exploiting CVE-2025-25249, a critical heap overflow in Fortinet's CAPWAP daemon, to deploy the PivotC2 remote access tool for network reconnaissance and lateral movement.

PIVOTPIPE is a newly discovered .NET malware that reimplements Cobalt Strike Beacon features with custom evasion techniques, including AMSI bypassing and indirect syscalls.

The Shai-Hulud worm payload has resurfaced on the npm registry via four new packages after 111 days of dormancy following the initial @AntV compromise.