Intel Exchange

The MALFEX operator has conducted a two-year npm supply-chain campaign, deploying Overlord RAT and the movinlike stealer via multi-arm delivery packages, some of which remain active despite partial registry seizures.

An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.

China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.

The CSuite operation targets US and European organizations using sophisticated phishing lures to steal Microsoft 365 sessions and deploy legitimate RMM tools like ScreenConnect for persistent endpoint access.

Adversaries such as TeamPCP exploit Python package installation mechanisms including setup.py hooks, .pth files, and entry points to compromise developer environments and CI/CD pipelines.

A North Korean-linked operation targeted the npm registry using the GHAPPIER loader to establish persistence and remote access via compromised developer credentials.

Adversary Pursuit Group identified ChainScript, a Node.js RAT that utilizes Polygon smart contracts for resilient C2 infrastructure rotation and delivery via ClickFix lures.

The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.

Mini Shai-Hulud threat actors exploited re-enabled GitHub Actions repositories to resume credential harvesting via compromised mutable tags.

Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.