F S

State-sponsored and criminal actors are increasingly using AI as an engineering workforce to automate exploit development, surveillance, and multi-victim cyber campaigns.

The ShieldCrash exploit targets CVE-2026-69414 to achieve arbitrary file read as SYSTEM by bypassing incomplete patches for the ShieldBreak vulnerability in Windows Defender.

Kimsuky (APT43) is utilizing subdomains on the home[.]kg FreeDNS zone to mimic Visual Studio Code authentication services for stealing developer credentials.

Security researcher Chaotic Eclipse has released multiple proof-of-concept exploits, including FalconFlank and ShieldBreak, targeting CrowdStrike, Kaspersky, and Microsoft Defender to achieve SYSTEM privileges.

Researchers Alejandro Hernando and Borja Martinez demonstrated that Windows Plug-and-Play (PnP) can be weaponized to silently install vulnerable drivers from Windows Update, enabling SYSTEM code execution via physical or RDP vectors.

The EXFILSQUAD ransomware group has claimed a significant data breach of Microsoft involving 8 million records, though researchers treat the claim as unverified and potentially fraudulent.

Threat actors are actively exploiting critical deserialization vulnerabilities in on-premises Microsoft SharePoint Server to achieve remote code execution and maintain persistence via machine key theft.

A sophisticated supply chain attack compromised the AsyncAPI npm organization to distribute the Miasma multi-stage dropper, targeting developers for credential theft and lateral movement.

ClickLock Dev uses ClickFix social engineering and aggressive process-killing loops to steal credentials and crypto wallets from macOS users in Europe and North America.

The ModHeader browser extension (v7.0.17) exfiltrates user browsing history to a covert C2 domain using encrypted IndexedDB storage and randomized upload schedules.