Tim Peck

The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.

Adversaries use advanced sleep obfuscation techniques like Ekko and FOLIAGE to encrypt implants in-memory between callbacks, evading traditional YARA and memory attribute scanning.

Attackers can abuse Active Directory Certificate Services (ADCS) to obtain trusted TLS certificates and hijack DNS to perform MITM attacks against Microsoft Entra ID logins.

A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.

Armored Likho targets government and energy sectors in Russia, Brazil, and Kazakhstan using BusySnake Stealer, a Python-based infostealer distributed via AI-generated loaders and LNK files.

Adversaries target Microsoft Sentinel infrastructure to blind security teams by disabling analytic rules, shortening data retention, or altering diagnostic settings.

UAC-0226 is utilizing WinRAR path traversal (CVE-2025-8088) with NTFS Alternate Data Streams to deploy the GIFTEDCROOK stealer via a multi-stage PowerShell and reflective loading chain.

An isolated malware dropper, ascii-fetcher, utilizes a malicious npm dependency named @jaymara/jsononifier to execute XOR-encoded commands on Windows systems via VS Code.

Lazarus group deployed a cluster of malicious npm packages masquerading as Rollup polyfill tools to target developer workstations with a multi-stage remote access and data-stealing payload.

An authorized attacker can exploit CVE-2026-45504, a high-severity SSRF in Microsoft Exchange Server, to perform local file reads by manipulating EWS reference attachments and WOPI-related preview logic.