Tim Peck

The SStar Agent is a Go-based cross-platform RAT delivered via a poisoned npm package (tw-style-utils) targeting Web3 developers with surveillance and exfiltration capabilities.

An attacker can steal broadly-scoped GitHub OAuth tokens by exploiting VSCode webview message handling to simulate keystrokes and install malicious extensions.

The suspected Chinese threat actor TA4922 is expanding globally, utilizing new loaders like RomulusLoader and SilentRunLoader alongside Atlas RAT to target organizations in Asia and Europe.

The BoldTealLayer campaign utilizes a sophisticated Lua-driven loader to execute fileless .NET payloads by bypassing AMSI and disabling ETW monitoring.

RemusStealer and the SessionGate framework are distributed through a complex ecosystem of impersonation websites and gated Traffic Distribution Systems (TDS) targeting technical users.

A heap buffer overflow in 7-Zip (CVE-2026-48095) allows remote code execution via a crafted NTFS image that triggers undefined behavior during decompression buffer allocation.

DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.

The Yuta/Solara campaign distributes a Python-based port of Glove Stealer targeting Roblox users and developers with advanced Chrome App-Bound Encryption bypasses.

IRGC-affiliated actor Nimbus Manticore deployed the new MiniFast backdoor using AppDomain hijacking and SEO poisoning to target both aviation and software sectors during geopolitical conflict.

The CL-CRI-1089 threat actor is conducting malvertising campaigns targeting macOS users to deploy FlutterShell, a Flutter-based backdoor that facilitates browser hijacking and arbitrary command execution.