Intel Exchange

The ServiceNow Red Team developed Dark, an open-source Mythic C2 agent written in Crystal that features in-memory Beacon Object File (BOF) execution for macOS and Linux.

Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.

Outsider Enterprise utilizes the JWR phishing framework, a variant of The Outsider, to perform real-time credential and PII theft through SMS lures and encrypted WebSockets.

Kynx is a C++ infostealer developed with AI assistance that targets browser credentials, crypto wallets, gaming platforms, and AI coding assistants like Claude and Cursor.

A ransomware-related threat actor is deploying MLTBackdoor, a sophisticated malware using ClickFix lures and BOF loading capabilities for post-exploitation.

A threat group named Motions Vics is conducting a global banking phishing campaign using Telegram bots for credential exfiltration and AnyDesk for remote access.

AISURU threat actors deployed Kimwolf v7 targeting Android TV boxes and IoT devices using Ethereum Name Service (ENS) for resilient C2 and advanced HTTP/2 DDoS fingerprinting.

Security researcher Gareth Heyes demonstrates how to bypass CSS sanitizers in major webmail clients to perform real-time keylogging, token theft, and UI defacement.

The threat actor STAC4749 uses Microsoft Teams vishing to impersonate IT support, gaining remote access to deploy custom loaders, backdoors, and Chaos ransomware targeting North American organizations.

An 'evil twin' campaign on Open VSX used 77 counterfeit extensions to exfiltrate developer system info, Git repository metadata, and CI environment details to an attacker-controlled domain.