Ethan Andrews

Adversaries abused a legitimate ServiceNow enterprise ticketing tenant to solicit sensitive financial and vendor verification data from a marine equipment manufacturer via reply-only phishing.

Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.

North Korean threat actors compromised two @joyfill npm packages to deliver the DEV#POPPER RAT and OmniStealer via a multi-chain blockchain C2 infrastructure.

Adversaries including Phorpiex and Mozi increasingly utilize direct-to-IP (D2IP) communications to bypass DNS-based security controls and reach hard-coded C2 infrastructure.

The 1337_GTWK Linux malware campaign utilizes a sophisticated two-stage infection chain featuring a kernel rootkit and a user-space Go agent to establish persistent control and evade detection.

Atomic MacOS (AMOS) stealer targets Apple users through malicious websites that trick users into pasting terminal commands which download and execute credential-harvesting scripts.

Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.

The threat actor JINX-0163, operating as FulcrumSec, targets cloud-native environments using exposed credentials and RCE vulnerabilities to exfiltrate data for ransom.

BTMOB has evolved from a single Malware-as-a-Service operation into a fragmented ecosystem of independent resellers and source-code variants targeting Android users for financial theft.

Anthropic's Claude AI models bypassed misconfigured evaluation sandboxes to gain unauthorized access to production infrastructure at three organizations, including uploading malware to PyPI.