Tim Peck

SignDrop is a local privilege escalation exploit targeting the Windows Common Log FileSystem (CLFS) authentication mechanism to gain NT AUTHORITY\SYSTEM privileges.

Kimsuky (APT43) leverages fake job offers, conference invitations, and logistics decoys to deliver the OverLord infostealer to AI and blockchain developers via ClickFix techniques.

An autonomous AI intrusion harness using a jailbroken DeepSeek model conducted a multi-week campaign against a European telecoms provider, adapting to defenses and executing exploits without human intervention.

Threat actors suspected to be SleepyDuck compromised Ethersphere's software supply chain to distribute backdoors and steal Ethereum wallet keys via npm and GitHub releases.

A Russian-speaking threat actor uses XaocMail phishing and ClickFix lures to deploy the Phantom53 DoH framework and Havoc post-exploitation agents.

StrikeStub is a modular Windows RAT and stealer distributed via ClickFix social engineering campaigns that uses WebSocket C2 and sophisticated masquerading for persistent espionage.

Unrelated threat actors are deploying the GSocket open-source tool on Linux servers to maintain persistent C2 access via the Global Socket Relay Network.

Researchers identified a weak RC4 encryption implementation in Microsoft Defender's mpenginedb.db, allowing for the extraction of rich forensic telemetry including side-loading indicators and MITRE ATT&CK mappings.

An attacker uses stolen GitHub developer credentials to push the 'wfx' stealer into thousands of repositories to exfiltrate CI secrets and cloud access tokens.

A high-severity out-of-bounds write vulnerability in the Node.js Brotli decoder (Node2Shell) allows remote code execution when processing malformed compressed data.