ills3c Intel&Coffee

Threat actor marchos1as uploaded typosquatted AUR packages impersonating yay and paru to execute malicious scripts delivering the CHAOS remote access trojan.

The Kali365 Phishing-as-a-Service platform exploits Microsoft's device code authentication flow to bypass MFA and capture persistent OAuth tokens for M365 environments.

The Cl0p extortion operation has pivoted from traditional encryption-based ransomware to large-scale data theft via the exploitation of internet-facing Managed File Transfer (MFT) and enterprise software.

A major ransomware attack on IDC Frontier's IDCF Cloud East Japan Region 1 disrupted 495 organizations, leading to significant service outages and the potential exposure of millions of records.

Attackers exploited an HTML injection vulnerability in xAI's email invite template to send malicious links from legitimate x.ai domains.

Threat actors are increasingly using AI-powered Phishing-as-a-Service (PhaaS) kits like the Jalisco toolkit to bypass MFA via device code phishing and OAuth token harvesting.

Remote attackers can trigger denial-of-service conditions on HTTP/3 servers by exploiting QPACK header compression vulnerabilities to cause massive memory amplification.

Silent Ransom Group (Luna Moth) is conducting high-value data extortion campaigns against US law firms using a combination of vishing and physical office intrusions to exfiltrate sensitive data.

Play (or Playcrypt) is a sophisticated ransomware group utilizing double extortion, custom information stealers like Grixba, and exploitation of vulnerabilities in FortiOS and Microsoft Exchange to target global organizations.

The ShinyHunters extortion group claims responsibility for ongoing voice phishing attacks targeting Okta, Microsoft, and Google SSO accounts to breach corporate SaaS platforms and steal data for extortion.