Arnold Chan

Threat actors are exploiting critical vulnerabilities in WooCommerce Wholesale Lead Capture and The Events Calendar plugins to deploy PHP web shells and achieve full site takeover.

The JeetBot browser extension exfiltrates Twitch OAuth tokens to Russian proxy infrastructure, affecting over 31,000 users.

A suspected Russian-speaking threat actor is using AI-powered agents to exploit a critical PaperCut NG/MF vulnerability chain (CVE-2026-81578 and CVE-2026-82078) to target the education sector globally.

The China-linked hacking group QTFY (associated with Nanjing Xinjiuwei Network Technology) utilizes the QScan and QTRouter distributed systems to exploit IoT devices and target critical infrastructure globally.

Suspected state-sponsored actors and cybercriminals, including Midnight Blizzard and ShinyHunters, are utilizing generative AI frameworks like PentAGI to automate the cyber kill chain, reconnaissance, and malware development against global targets.

DPRK-nexus actors are using fake Web3 job interviews to deliver signed ClickOnce applications that deploy NeedleStealer, an unclassified Rust stealer, and a Go-based hVNC RAT.

A stored XSS vulnerability in Telegram Desktop's HTML export pipeline allowed attackers to exfiltrate chat history and forge interface elements using malicious bot inline keyboard buttons.

An unidentified attacker compromised 3BB's network in Thailand, deploying MeshCentral for persistence and targeting subscriber RADIUS databases after attempting to exploit FortiGate SSL-VPN vulnerabilities.

Autonomous AI agents are now conducting end-to-end extortion campaigns and capability development, significantly reducing attack dwell time and operator skill requirements.

Threat actors known as PasteSwitch compromised the official HBO Max Reddit account to deploy ClickFix social engineering attacks, delivering macOS and Windows infostealers.