Tim Peck

The BlueHammer exploit chains NTFS junctions, batch oplocks, and the Cloud Files API to force Windows Defender into leaking SAM hive hashes, granting attackers SYSTEM-level access.

Threat actor 0xFFF (aka alh1mik) has released notnullOSX, a modular Go-based macOS stealer and backdoor targeting high-value cryptocurrency users through ClickFix social engineering.

Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.

An attacker uses a multi-stage fileless infection chain involving obfuscated VBScript and in-memory .NET loaders to deploy ScreenConnect for persistent remote access.

TeamPCP executed a cascading supply chain campaign using the CanisterWorm and Cloud Stealer malware to harvest credentials from GitHub Actions and PyPI packages.

The Iranian threat actor MuddyWater (MOIS) is leveraging Russian-speaking TAG-150's CastleRAT and ChainShell malware platforms to target Israeli infrastructure and aerospace sectors.

ClipBanker malware utilizes a complex, multi-stage infection chain starting from trojanized software on GitHub to swap cryptocurrency wallet addresses via clipboard monitoring.

The threat actor Storm-2372 is utilizing the EvilToken Phishing-as-a-Service (PhaaS) toolkit to execute automated, AI-enhanced device code phishing attacks against organizational accounts.

Canis C2 is a previously undocumented cross-platform surveillance framework targeting Japanese users with sophisticated mobile agents and OS-specific fingerprinting.

Threat actor TeamPCP compromised multiple @fairwords npm packages to deploy CanisterWorm, a self-propagating malware that steals cloud credentials, crypto wallets, and Chrome passwords.