Ethan Andrews

An active phishing campaign targets hospitality organizations in Europe and Asia using photo-themed ZIP files to deliver a Node.js-based implant called TonRAT.

The Miasma worm campaign compromised 20 LeoPlatform npm packages and a Verana Blockchain Go module to deploy a Bun-based credential stealer targeting developer environments and CI/CD pipelines.

The MYRA Linux RAT, distributed via the npm package 'apintergrationpost', utilizes a native C rootkit and fileless execution for persistent system access.

Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.

A campaign involving hijacked npm and Go packages uses malicious VS Code tasks to trigger a multi-stage infection chain involving blockchain dead drops, a socket.io backdoor, and a Python infostealer.

A multi-stage steganographic loader campaign uses .NET-based binaries and bitmap objects to deploy payloads like Remcos RAT, Agent Tesla, and Red Line Stealer primarily targeting users in India.

An actor published 15 npm packages using 13 throwaway scopes to deliver a multi-stage Rust-compiled infostealer targeting developer and crypto credentials.

Researchers from AIR created a fake AI agent skill named brand-landingpage that bypassed multiple security scanners to reach 26,000 agents by hosting malicious instructions on an external domain.

Threat actors are weaponizing the OpenClaw AI agent ecosystem by publishing malicious skills on ClawHub that deliver infostealers and execute novel agentic financial fraud.

Attackers targeting financial executives use compromised small-business domains and fake HTML voicemail attachments to lure victims into calling a fraudulent Scotiabank support number.