Arnold Chan

The N0va phishkit targets US and EU organizations across multiple sectors using device code authentication flows to capture access tokens and establish persistent SSO access.

Researcher Asim Manizada released working exploits for four Linux kernel vulnerabilities (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) that enable local root access and potential remote crashes.

LausivLoader utilizes a multi-stage infection chain involving JavaScript, PowerShell, and .NET, leveraging environment variable inheritance for inter-process data handoff and steganography to deliver final payloads.

China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.

The TeamPCP threat group utilized backdoored TanStack npm packages to harvest credentials from a former CrowdSec employee, leading to the theft of 170 private GitHub repositories.

BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.

An adversary uses malicious Google Apps Scripts in Google Doc sidebars to deliver AMOS and NetSupport Manager malware targeting both macOS and Windows users.

Koktevrat is a multi-stage Android RAT distributed via a fake Polish government application named MandatGO that utilizes Accessibility Services and Firebase for full device control.

The NightEagle APT group (APT-Q-95) is targeting Russian businesses by deploying the GhostContainer backdoor on Microsoft Exchange servers and utilizing legitimate tunneling tools for lateral movement.

Researchers at Forever Security demonstrated 'BragJack', a technique using malicious browser extensions to hijack AI assistants in Chrome, Edge, Comet, Opera Neon, and Claude by manipulating trusted domains and network traffic.