Ethan Andrews

A new macOS ClickFix campaign uses social engineering to trick users into running Terminal commands that silently mount DMGs and execute the Atomic macOS Stealer (AMOS).

A critical heap out-of-bounds write vulnerability in FFmpeg's MagicYUV decoder (CVE-2026-8461) allows remote code execution via crafted media files targeting media servers and thumbnail generators.

An unrelated third-party ad operator has re-registered the expired MaxCDN domain netdna-ssl.com, creating a massive supply chain risk for thousands of sites still referencing its legacy infrastructure.

A threat actor known as Poisson utilized Havoc C2 and Tailscale VPN to establish persistent, secondary access into French automotive and individual targets for credential theft.

The ErrTraffic Malware-as-a-Service framework uses the ClickFix social engineering tactic and EtherHiding blockchain dead-drop resolvers to distribute infostealers and loaders through compromised WordPress sites and fake AI platforms.

UNC6508, a PRC-nexus threat actor, targets medical and military research institutions using INFINITERED malware to harvest credentials and exfiltrate data via manipulated compliance rules.

Midnight Blizzard leverages compromised Entra ID Agent Blueprints to pivot between tenants and escalate to Global Administrator using Temporary Access Passes.

The AutoJack exploit chain leverages a confused deputy browsing agent to bypass localhost trust boundaries and achieve RCE in Microsoft's AutoGen Studio.

Financially motivated actors like Vanilla Tempest are leveraging ClickFix social engineering to deliver modular loaders including BabaDeda, Lorem Ipsum, and Potemkin, ultimately deploying ransomware like Rhysida.

An invoice fraud campaign uses legitimate Upflow.io tokens and spoofed subdomains to bypass authentication and capture payments via fraudulent IBANs.