Intel Exchange

An unidentified operator deployed 28 malicious 'evil-twin' Open VSX extensions that exfiltrate developer environment data to i.apee.my.id using multiple network evasion techniques.

Outsider Enterprise utilizes the JWR phishing framework, a variant of The Outsider, to perform real-time credential and PII theft through SMS lures and encrypted WebSockets.

Kynx is a C++ infostealer developed with AI assistance that targets browser credentials, crypto wallets, gaming platforms, and AI coding assistants like Claude and Cursor.

Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.

China-based APT Jewelbug conducts simultaneous government espionage across the Middle East and Asia alongside industrial-scale cryptocurrency fraud using a unified C2 framework.

Adversaries may use GenAI coding agents like Claude Code as trusted parents to deploy reverse tunnels, steal credentials, and establish LaunchAgent persistence on macOS.

A sophisticated macOS ClickFix campaign is now using server-side browser-fingerprinting gates to deliver infostealers like AMOS and MacSync only to genuine macOS environments.

Adversaries compromised maintainer accounts and CI/CD pipelines to distribute trojanized PyPI and npm packages targeting quantum computing researchers and Alibaba developers.

Adversaries including Phorpiex and Mozi increasingly utilize direct-to-IP (D2IP) communications to bypass DNS-based security controls and reach hard-coded C2 infrastructure.

Researchers identified a lethal trifecta where a public AI triage agent was prompt-injected to trigger a privileged code-fixing agent, leading to RCE and credential theft in GitHub Actions.