Intel Exchange

The TeamPCP campaign hijacked the @bitwarden/cli npm package to distribute a sophisticated stealer targeting developer credentials, cloud secrets, and AI configuration files.

The Mini Shai-Hulud malware targets SAP npm packages to steal developer and cloud credentials using an obfuscated Bun-based execution framework.

The Nightmare-Eclipse toolset, including BlueHammer and RedSun, was observed in a live intrusion following initial access via compromised FortiGate VPN credentials.

The Shai Hulud threat actor compromised SAP CAP framework packages by exploiting an AI coding assistant's GitHub integration to inject malicious code and steal npm OIDC tokens.

Deep#Door is a sophisticated Python-based Remote Access Trojan (RAT) that uses self-referential batch scripts for deployment and leverages the bore[.]pub tunneling service for stealthy C2 communications.

Silver Fox threat group utilizes tax-themed phishing to deploy a modified RustSL loader, ValleyRAT, and a new Python-based backdoor named ABCDoor against organizations in Russia and India.

APT28 (Fancy Bear) exploited a chain of vulnerabilities in Windows LNK files to achieve remote code execution and zero-click NTLM authentication coercion.

MiniRAT is a Go-based macOS remote access trojan delivered via the compromised velora-dex-sdk npm package, utilizing LaunchAgent persistence and AES-encrypted C2 configurations.

TeamPCP executed a supply chain attack on the elementary-data PyPI package using GitHub Actions injection to distribute a credential-stealing payload targeting data engineers.

NVIDIA's NemoClaw sandbox environment is vulnerable to data exfiltration and configuration poisoning via weaponized authorized tools and emoji-based evasion.