Arnold Chan

A confused deputy vulnerability in Google Cloud's Config Connector (KCC) allows Kubernetes users to escalate privileges to Organization Owner by submitting malicious IAMPolicyMember YAML files.

The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.

A local attacker can redirect Meta Muse dictation traffic by modifying an undocumented preference setting, enabling the capture of audio and abuse of the assistant's broad permissions.

Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.

ARToken is a Phishing-as-a-Service platform that abuses Microsoft's OAuth 2.0 device code flow to bypass MFA and achieve full Entra tenant takeover.

Threat actor Bratteam88 is distributing the Rust-based KRSID ransomware and Quasar RAT by compromising and updating fraudulent Home Trading System (HTS) applications.

The ClickFix campaign compromised a regional news outlet using malicious JavaScript to deliver social engineering prompts that lead to the execution of an encrypted .NET infostealer.

The Pakistan-nexus threat actor APT36 (Transparent Tribe) is conducting Operation RapidRust targeting government and defense sectors in India and Afghanistan using new Rust-based backdoors and USB propagation tools.

A flaw in major AI coding agents allows attackers to bypass SHA-pinning and execute zero-click remote code by swapping trusted plugins with malicious code via branch-name manipulation.

An unidentified ransomware-related threat actor is using SloppyRAT, a new multi-stage malware, to establish network footholds via ClickFix lures and blockchain-based C2 resolution.