Arnold Chan

Threat actors are abusing legitimate Microsoft Power BI domains to host phishing lures that deliver multiple rogue ScreenConnect instances for persistent remote access.

Threat actors are utilizing AI-assisted reverse engineering of Android and Flutter applications to discover and exploit vulnerabilities in backend APIs, bypassing front-end controls.

Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.

Threat actors are exploiting a remote code execution vulnerability in REDCap servers (CVE-2026-90817) to deploy XMRig miners using fileless techniques and steganography.

Star Blizzard (suspected Russian state-linked) is conducting spearphishing campaigns against Moldovan and Ukrainian civil society using password-protected VHDX files and WebDAV-based persistence.

Mir0Auth is a sophisticated phishing kit that abuses the Microsoft OAuth device authorization grant to harvest session tokens and bypass MFA.

China-aligned threat actor TA419 is conducting credential phishing campaigns against AI policy experts at US think tanks and universities using advanced AitM techniques.

Candiru and other mercenary spyware vendors use a technique called AdFection to deliver zero-click malware and conduct mass-deanonymization through the real-time bidding advertising ecosystem.

The Cling botnet exploits multiple IoT vulnerabilities to deploy a worm-like malware that repurposes legitimate STUN traffic and infrastructure for command-and-control communications.

The Wazza phishkit employs multi-stage routing, session validation, and anti-bot techniques to deliver Adobe-themed OAuth Device Code phishing lures targeting US, EU, and Australian organizations.