Intel Exchange

China-aligned threat actor TA419 is conducting credential phishing campaigns against U.S. AI policy experts using Adversary-in-the-Middle (AitM) techniques and a customized Frameless BitB kit.

Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.

The Poper Blocker browser extension by dingosolutions acts as spyware by using a custom remote interpreter to exfiltrate browsing history, AI chat logs, and screenshots.

China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.

RATHat is an advanced Android banking trojan that abuses wireless debugging for shell access and utilizes Gemini LLM models for automated UI interaction and victim financial scoring.

The MacSync family has evolved from AppleScript-based AMOS variants into a complex multi-stage binary infection chain targeting macOS users and developers to steal crypto and credentials.

Threat actors utilized fraudulent Google Ads and dynamic Vercel redirects to target Ledger hardware wallet users, aiming to steal secret recovery phrases through a sophisticated phishing chain.

Varonis Threat Labs identified TrustSink, a post-compromise technique where attackers with high privileges register rogue External Authentication Methods (EAM) in Microsoft Entra to capture plaintext passwords during legitimate MFA flows.

The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.

A local attacker can redirect Meta Muse dictation traffic by modifying an undocumented preference setting, enabling the capture of audio and abuse of the assistant's broad permissions.