Tim Peck

MiniRAT is a Go-based macOS remote access trojan delivered via the compromised velora-dex-sdk npm package, utilizing LaunchAgent persistence and AES-encrypted C2 configurations.

TeamPCP executed a supply chain attack on the elementary-data PyPI package using GitHub Actions injection to distribute a credential-stealing payload targeting data engineers.

NVIDIA's NemoClaw sandbox environment is vulnerable to data exfiltration and configuration poisoning via weaponized authorized tools and emoji-based evasion.

BlueNoroff is targeting Web3 and cryptocurrency executives using AI-generated deepfake meetings and ClickFix clipboard injection to deploy credential stealers.

Kernel-level anti-cheat systems utilize deep OS integration and rootkit-like behaviors to counter sophisticated threats including DMA hardware, BYOVD attacks, and hypervisor-based cheats.

Threat actor Dr. Tube uses the Bissa Scanner and AI tools like Claude Code to exploit React2Shell vulnerabilities at scale, targeting financial and crypto sectors for secret harvesting.

Exploits named BlueHammer and RedSun leverage a TOCTOU race condition (CVE-2026-33825) in Windows Defender to achieve SYSTEM-level privilege escalation via filesystem manipulation.

Lotus Wiper is a destructive malware campaign targeting the energy and utilities sector in Venezuela, using batch scripts and masqueraded binaries to wipe physical drives and delete system recovery mechanisms.

The Kyber ransomware group deploys specialized dual-platform payloads targeting VMware ESXi infrastructure and Windows file systems, utilizing hybrid encryption and extensive anti-recovery techniques.

The Gentlemen RaaS employs a multi-platform locker suite targeting Windows, Linux, and ESXi environments, utilizing SystemBC and Cobalt Strike for lateral movement and persistence.