Tim Peck

A vulnerability chain in Azure Arc for Windows allows low-privileged users to hijack service communications, escalate to SYSTEM and take over the machine's Azure cloud identity.

Exploitation of CVE-2026-3055 on Citrix NetScaler allows remote attackers to disclose sensitive memory, including administrative session IDs, via malformed WS-Federation requests.

The EvilTokens Phishing-as-a-Service platform is weaponizing Railway.com PaaS infrastructure to conduct large-scale OAuth token replay and device code phishing campaigns against Microsoft 365 environments.

North Korean threat actor NICKEL ALLEY is targeting tech professionals via fake job interviews to deliver PyLangGhost RAT and BeaverTail malware through social engineering and malicious GitHub repositories.

Multiple China-aligned threat actors, including Stately Taurus and clusters CL-STA-1048/1049, are targeting a Southeast Asian government using a diverse toolkit of USB-propagated malware, novel loaders, and remote access Trojans.

Threat actor TeamPCP compromised the 'telnyx' PyPI package to distribute credential-stealing malware using WAV steganography.

A South Asian financial institution was targeted by an emerging actor using BRUSHWORM, a modular backdoor with USB spreading capabilities, and BRUSHLOGGER, a side-loaded keylogger.

The threat actor TeamPCP compromised the popular litellm PyPI library to distribute a multi-stage credential harvester and Kubernetes lateral movement payload.

Threat actor TeamPCP compromised the Trivy vulnerability scanner and associated GitHub Actions to exfiltrate cloud and CI/CD credentials via poisoned tags and binaries.

A widespread initial access campaign using fraudulent human-verification prompts to trick victims into executing malicious commands via native system tools.