Tim Peck

Vidar Stealer utilizes memory forking and APC injections to extract and decrypt the Chromium v20_master_key, bypassing Application-Bound Encryption.

A Russian-speaking attacker is deploying the Meow AppleScript RAT via ClickFix social engineering lures to exfiltrate data and hijack cryptocurrency wallets on macOS.

A low-privileged user can coerce the Windows Store Install Service (SYSTEM) to perform NTLM authentication or execute arbitrary DLLs via UNC-located loose-file package registration.

The ROOTBOY actor is deploying Prinz Eugen, a technically deliberate Go-based ransomware that prioritizes fresh data and utilizes anti-forensics to evade detection.

CVE-2026-22778 allows remote attackers to execute arbitrary code on vLLM servers by chaining a heap address leak with a JPEG2000 decoder overflow in the video processing stack.

The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.

Dropping Elephant is using a China-themed decoy document to deliver a heavily reworked, in-memory RAT via DLL side-loading and Donut shellcode.

Attacker sergey2016 compromised the @mastra npm organization to inject the easy-day-js typosquat dependency, delivering an obfuscated postinstall dropper.

Threat actors can abuse Windows Quality of Service (QoS) policies via PowerShell or WMI to throttle EDR agent outbound bandwidth to near zero, effectively silencing cloud-based telemetry.

The GLASSWORM threat actor is deploying trojanized Open VSX extensions using TinyGo-compiled WebAssembly loaders that leverage Solana blockchain memos for C2 infrastructure resolution.