Intel Exchange

Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.

The ORAX Phishing-as-a-Service platform utilizes WebSockets and SignalR to bypass MFA by synchronizing an attacker-controlled page with real authentication sessions without a traditional reverse proxy.

Anthropic identifies multi-vector misuse of Claude AI models by state-sponsored actors (Russia, China, Iran), financially motivated groups (ShinyHunters), and commercial entities for cyber operations, surveillance, and conventional weapons development.

GhostCode is a novel phishing kit that abuses the Microsoft Device Code authorization flow to bypass MFA and achieve persistent access to M365 environments.

Researchers at pwn.ai discovered the Click2Shell attack chain, which leverages a WordPress core selector injection vulnerability to force theme installations and achieve remote code execution through theme-specific flaws.

The N0va phishkit targets US and EU organizations across multiple sectors using device code authentication flows to capture access tokens and establish persistent SSO access.

SilverFox threat actors have upgraded their malware delivery chain from open access and whitelisting to a sophisticated cloud-based blacklist mechanism to evade detection by security researchers.

Multiple espionage threat actors, including China-aligned TA412, are deploying the BlueMoon exploit kit to chain Chrome V8 RCE and Windows kernel LPE vulnerabilities for malware delivery.

The Vectra (formerly Nyxel) actor operates VectraRAT, a custom Go and C++ Malware-as-a-Service platform delivered via Amadey and ClickFix campaigns targeting corporate Windows environments.

An unsigned GlobalProtect-themed MSI deploys a backdoor that utilizes Cloudflare Workers for configuration and Google Sheets for C2 communication, specifically targeting victims in Myanmar.