ills3c Intel&Coffee

A critical 9.3 CVSS vulnerability in Signal's RingRTC library allows an attacker to saturate the call state machine event queue, keeping the microphone and camera active after a user hangs up.

The Ebury botnet hijacked over 300 Tor exit relays to perform Man-in-the-Middle (MitM) attacks on SSH traffic, capturing login credentials and installing further malware.

Chinese state-backed actors including Linen Typhoon and Violet Typhoon are exploiting CVE-2025-53770 in Microsoft SharePoint to achieve unauthenticated remote code execution and data theft.

Threat actors are concealing NetSupport Manager RAT payloads within structurally valid MP4 files using ISO-BMFF uuid boxes, delivered via PowerShell loaders from Cloudflare-fronted infrastructure.

Unauthenticated attackers can achieve remote code execution on Fortinet FortiSIEM by exploiting a gRPC path traversal vulnerability to write arbitrary files.

A Chinese-speaking threat actor utilizes the ARTEX framework combined with multiple AI models to automate global reconnaissance and data exfiltration targeting PII and financial records.

The threat actor UNG0002 is targeting academic institutions using macOS-style metadata folder structures to evade Windows security scanners and deliver Cobalt Strike via DLL sideloading.

ClickFix attackers use social engineering to trick users into pasting malicious commands into their OS, bypassing browser-based download protections to deliver infostealers and RATs.

Ransomware groups including Black Basta and Akira are exploiting CVE-2024-37085 to gain full administrative access to VMware ESXi hosts via Active Directory group manipulation.

CVE-2026-49950 allows unauthenticated remote code execution in Xorbits Xoscar via cloudpickle deserialization in the actor pool transport layer.