Tim Peck

The AnyDesk TAG campaign uses cloned banking support sites and telephone-led social engineering to deploy AnyDesk and persistent ScreenConnect instances via malicious signed payloads and DLL side-loading.

Unauthorized AI relay services are reconfiguring legitimate OpenAI and Anthropic CLI tools to bypass regional restrictions, disabling sandboxes and routing data through third-party infrastructure.

A malicious loader disguised as a Capacitor configuration file executes remote JavaScript by decoding an environment variable and masking failures as authentication errors.

Glassworm threat actors compromised a contributor's GitHub account to replace official OVHcloud CLI release binaries with secret-stealing malware using a Solana-based dead drop for command and control.

Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.

DarkCore is a remote access trojan (RAT) that uses a dedicated browser to reuse stolen sessions and route traffic through victims' IP addresses to bypass MFA and security controls.

A China-linked operator utilized the AI-driven Cairn framework to conduct 66 intrusions against government and industry targets across Asia, leveraging LLM agents for automated exploitation.

CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.

WinLol is a multi-stage malware toolkit featuring a Rust dropper, an in-memory downloader, and a Go-based RAT that streams victim screens via WebRTC using DLL side-loading of legitimate OneDrive binaries.

Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.