Intel Exchange

DRAYN is a sophisticated multi-stage stealer and loader malware that utilizes 7-Zip SFX archives for deployment and maintains persistent C2 via WebSockets.

The Silver Fox threat actor targets Japanese and Chinese organizations using spear-phishing to deploy the modular 10FXRAT and the PoisonX kernel driver for security product bypass.

The SStar Agent is a Go-based cross-platform RAT delivered via a poisoned npm package (tw-style-utils) targeting Web3 developers with surveillance and exfiltration capabilities.

The Yuta/Solara campaign distributes a Python-based port of Glove Stealer targeting Roblox users and developers with advanced Chrome App-Bound Encryption bypasses.

A new malware campaign dubbed Argamal targets players of adult games using trojanized installers to deliver a full-featured Remote Access Trojan (RAT).

JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.

The threat actor vpmdhaj published 14 malicious npm packages typosquatting OpenSearch and ElasticSearch libraries to harvest AWS, HashiCorp Vault, and GitHub Actions credentials.

Threat actors including Aeternum are exploiting CVE-2026-26980 in Ghost CMS to inject malicious JavaScript loaders that facilitate ClickFix social engineering attacks and malware delivery.

The threat actor UAC-0184 is targeting Ukrainian Defense Forces using gated HTA delivery methods and complex DLL sideloading chains that culminate in the repurposing of legitimate, signed network utilities.

Financially motivated actors are using SEO poisoning to impersonate AI tools like Gemini and Claude Code, delivering a fileless PowerShell infostealer to developer workstations.