Goksel Atakan

PAYLOAD ransomware operators used Active Directory Group Policy Objects to disrupt domain-joined Windows workstations without encrypting files, as reported by Kaspersky.

Attackers give the open source ARTEX framework credentials and a goal. Its AI agents then run Active Directory enumeration, Kerberoasting, DCSync and cloud probing. Google tracks the activity as UNC7228, which overlaps Storm-0940.

Adversaries compromised the LiteLLM supply chain to distribute a credential stealer and remote code loader targeting cloud, AI, and developer secrets.

Unprivileged attackers use CVE-2026-46300 (Fragnesia) to corrupt the Linux page cache and gain root access, often chained with PHP remote code execution vulnerabilities.

SEO poisoning leads users to a lookalike WatchGuard site that harvests VPN credentials before delivering a genuine signed installer. Microsoft attributed a wider iteration of the campaign to Storm-2561.

The Shai-Hulud worm compromised the tensorlake npm package to steal developer credentials, AI tool configurations, and implement a self-destruct mechanism triggered by token revocation.

An unidentified attacker distributed a trojanized copy of the anthropic.claude-code editor extension that installs a persistent SSH reverse tunnel and backdoor. The analyzed sample targets macOS on Apple Silicon and the loader also contains Windows and Linux branches.

Threat actors are exploiting critical authentication bypass and RCE flaws in AhsayCBS backup servers to deploy JSP webshells and XMRig cryptominers.

Threat actors abuse Microsoft Teams external chat to pose as IT support, using email bombing and vishing to deploy remote access tools and malware.

Ransomware actors Spikey Scorpius and Tarnished Scorpius are exploiting an authentication bypass in PAN-OS GlobalProtect (CVE-2026-0257) to gain initial access, bypass MFA, and pivot to virtualization infrastructure.