Intel Exchange

CrashStealer is a native C++ macOS information stealer that impersonates Apple crash-reporting tools and uses notarized droppers to harvest credentials, keychain data, and crypto wallets.

A logistics-themed spear-phishing campaign deploys CrySome RAT via a multi-stage chain involving UAC bypass, AMSI patching, and the WinDefCtl utility to disable endpoint defenses.

Russian-speaking threat actors are exploiting CVE-2026-35616 in FortiClient EMS to deploy EKZ Stealer and FortigateSniffer, facilitating credential harvesting and subsequent ransomware attacks by INC Ransom and Lynx.

The Hyadina threat group is deploying the rebranded GodDamn ransomware, utilizing a Microsoft-signed PoisonX kernel driver to disable EDR and antivirus software.

QuimaRAT is a cross-platform Java-based Remote Access Trojan sold as a service, targeting Windows, Linux, and macOS environments through modular encrypted plugins.

The China-aligned threat actor UNK_MassTraction is exploiting Roundcube vulnerabilities to deploy IceCube and VShell backdoors against US and Canadian university physics departments.

A malicious actor compromised the @injectivelabs/sdk-ts npm package to exfiltrate cryptocurrency private keys and seed phrases through a deceptive telemetry module.

A financially motivated campaign by the X3D MINER group uses the Factory-v3 loader framework to deliver Vidar stealer and XMRig miner through malvertising and fake software cracks.

PamStealer is a macOS infostealer that validates captured credentials using the PAM API and uses a two-stage JXA/Rust delivery chain to evade detection.

A Vidar malware-as-a-service affiliate is targeting SMBs with a dual-payload infection of the Vidar infostealer and XMRig miner delivered via malicious software cracks.