Ethan Andrews

Researchers discovered a critical zero-click vulnerability in Opera GX's mod installation pipeline that allows malicious sites to perform universal CSS injection and steal sensitive data via XS-Leaks.

The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.

An unidentified threat actor launched an 81-million attempt password spray campaign against Microsoft 365 via Azure CLI, leveraging LSHIY LLC infrastructure.

Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.

A widespread campaign uses typosquatted software sites and SEO poisoning to distribute ScreenConnect, which then drops AsyncRAT onto target systems.

StrikeShark leverages custom SharkLoader malware via DLL sideloading and public-facing application exploits to deploy Cobalt Strike Beacons across diverse global sectors.

The Russia-aligned Gamaredon group significantly updated its arsenal in 2025, deploying six new PowerShell tools and leveraging legitimate cloud services and tunnels to target Ukrainian military and government institutions.

Akira ransomware actors utilized Bumblebee malware and AdaptixC2 via Bing SEO poisoning to gain initial access, move laterally, and exfiltrate over 75GB of data.

The North Korean-linked PolinRider campaign has expanded its supply chain targeting across npm, Packagist, Go modules, and Chrome extensions to deploy the DEV#POPPER and OmniStealer malware.

The StegoAd campaign utilized 119 malicious browser extensions to perform ad fraud and steal Google and WordPress credentials from 2.6 million users.