Tim Peck

Threat actors compromised the Axios npm package to deliver a multi-platform Remote Access Trojan (RAT) via the malicious dependency 'plain-crypto-js'.

Threat actors including GOLD ENCOUNTER and campaigns STAC4713/STAC3725 are abusing QEMU virtualization to hide backdoors and deploy PayoutsKing and 3AM ransomware.

Storm-2755 uses AiTM techniques and SEO poisoning to hijack user sessions and divert payroll payments within Canadian organizations.

North Korean state actor Sapphire Sleet targets cryptocurrency and finance sectors using social engineering and multi-stage AppleScript-based infection chains on macOS.

The PowMix botnet targets Czech organizations using compliance-themed phishing lures and sophisticated PowerShell-based in-memory execution.

A coordinated campaign of 36 malicious npm packages disguised as Strapi CMS plugins targets Guardarian cryptocurrency infrastructure to execute Redis RCE, steal database secrets, and establish persistent C2.

A coordinated campaign involving 108 malicious Chrome extensions uses shared C2 infrastructure to exfiltrate Telegram sessions, steal Google account identity, and maintain backdoors for remote URL injection.

Threat actors are exploiting a zero-day vulnerability in Adobe Reader via malicious PDF files to execute privileged APIs and steal sensitive data, specifically targeting the Russian oil and gas sector.

Threat actors are increasingly abusing native Microsoft 365 mailbox rules to maintain persistence, suppress security alerts, and automate data exfiltration following account compromise.

JanelaRAT is an evolving variant of BX RAT targeting financial and cryptocurrency institutions in Latin America through DLL side-loading and sophisticated overlay attacks.