Arnold Chan

The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.

A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.

Tajin Group operates a sophisticated phishing and money laundering network targeting global financial institutions and Chinese citizens using Telegram-based guarantee marketplaces and anonymous virtual assets.

Casbaneiro banking trojan targets Latin American users via geofenced phishing and a multi-stage AutoIt infection chain to exfiltrate financial credentials.

A Russian threat actor named LeakySensey has compromised over 87,000 devices by brute-forcing legacy VPN protocols and modified Claude Code AI to automate the operation.

SilverFox threat actors have upgraded their malware delivery chain from open access and whitelisting to a sophisticated cloud-based blacklist mechanism to evade detection by security researchers.

Unauthenticated attackers are actively exploiting a maximum-severity path traversal vulnerability (CVE-2026-85706) in GitLab to read arbitrary files and sensitive configuration data.

Russian enterprises are facing sophisticated multi-stage attacks from NightEagle, Hacking Cat, and Toy Ghouls involving custom backdoors, wipers, and tunneling tools.

Oldphantomoftheopera and Phantom Softwares operate Phantom Stealer, a Malware-as-a-Service infostealer targeting Windows systems through multi-stage in-memory execution and obfuscated PowerShell to harvest credentials and cryptocurrency data.

ParaShells (CVE-2026-90894) allows a local non-admin macOS user to gain root access by exploiting a world-writable socket and argument injection in the Parallels Desktop background service.