ills3c Intel&Coffee

A developer named Hizbartech bypassed Google Play Store security by rebranding a legacy game into a counterfeit Chrome browser, amassing 100,000 downloads.

The EvilTokens phishing-as-a-service platform uses OAuth device-code flows to bypass MFA and maintain persistent access to Microsoft 365 environments.

OpenCode confirmed a security breach affecting 1.4% of its Console users, potentially exposing API keys for external AI providers like OpenAI and Anthropic.

A critical remote code execution vulnerability (CVE-2026-108097) in Drupal's Field UI module allows unauthenticated attackers to take over websites via specific contributed module interactions.

Warden Stealer is a Rust-based Malware-as-a-Service that targets AI coding agent tokens, browser data, and cryptocurrency wallets through process injection and anti-VM techniques.

French-speaking threat actors, potentially ShinyHunters or Nemesis, exploited AWS misconfigurations to steal and sell database, API, and Git credentials.

Luna Moth (Silent Ransom Group) uses voice-based callback phishing to trick victims into installing legitimate RMM tools for data extortion without using encryption.

Adversaries are targeting the OpenClaw agentic AI ecosystem through malicious skills and RCE vulnerabilities to deploy Atomic macOS Stealer (AMOS) and exfiltrate data.

The threat actor UAT-11985 is targeting Taiwan research organizations using AI-generated spear-phishing lures and QR codes to drive victims toward an Adversary-in-the-Middle (AitM) framework for harvesting Google account credentials and MFA codes.

An AI-assisted threat actor achieved full AWS environment compromise in 72 hours by chaining credential harvesting, CI/CD exploitation, and automated reconnaissance.