Tim Peck

The UNK_DeadDrop threat actor targets developers with fake recruitment and code review phishing campaigns to deploy cross-platform malware for cryptocurrency theft.

A new threat actor is deploying clones of the Shai-Hulud infostealer and the Phantom Bot DDoS malware via typosquatted npm packages targeting developers.

EvilTokens and other phishing frameworks are increasingly abusing the Microsoft Device Code Flow to bypass MFA and conduct Business Email Compromise (BEC) at scale.

Mustang Panda APT utilizes a multi-stage PlugX execution chain involving legitimate G DATA binaries and complex obfuscation to target systems via fake browser updates.

A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.

The Silver Fox threat actor targets Japanese and Chinese organizations using spear-phishing to deploy the modular 10FXRAT and the PoisonX kernel driver for security product bypass.

Windows Search URI handlers are vulnerable to an unpatched NTLM leakage primitive that allows remote attackers to capture Net-NTLMv2 hashes via a single link click.

Nightmare Eclipse exploits a flaw in Windows Defender's Cloud Files remediation logic to achieve arbitrary file writes and SYSTEM execution via NTFS junctions and oplocks.

The Miasma threat actor compromised 56 npm packages to steal CI/CD secrets and deploy persistent backdoors using a novel binding.gyp execution trigger.

The Chinese threat actor VerdantBamboo is targeting unmonitored edge appliances such as firewalls and NAS devices to maintain persistence and bypass EDR security controls.