ills3c Intel&Coffee

Threat actor TeamPCP executed a massive supply chain campaign compromising GitHub Actions from Aqua Security and Checkmarx, VS Code extensions, and npm packages to deploy a multi-stage credential stealer and a self-propagating worm.

Adversaries, including activity sharing infrastructure history with APT29, are exploiting CVE-2026-42589 in Gotenberg to deploy the 'cache_base' Go-based reverse shell and a broader toolkit.

Threat actor UNK_SneakyStrike is using the TeamFiltration framework to conduct large-scale password-spraying attacks against Microsoft Entra ID accounts globally.

Threat actors associated with Vice Society are utilizing ClickFix social engineering to deploy Lorem Ipsum Loader and Python-based tunnels for network access.

Attackers are bypassing the Microsoft 365 RejectDirectSend control by using empty SMTP envelope senders to deliver unauthenticated internal-looking spearphishing emails.

Gryxa is a highly persistent, AI-developed toolkit used by financially motivated actors to steal credentials and maintain durable access via extensive recovery mechanisms.

PwnEscape (CVE-2026-99999) is a critical Linux kernel vulnerability in the IPv4 networking stack that enables guest-to-host virtual machine escapes and root code execution.

A critical pre-authentication vulnerability chain in WordPress Core allows attackers to escalate a reflected XSS into full RCE by abusing administrative application password flows.

Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.

AdFection is a technique used by spyware vendors like Candiru to deliver zero-click surveillance malware by exploiting real-time bidding in the digital advertising ecosystem.