Tim Peck

Threat actors are leveraging Windows Toast Notifications and Application User Model IDs to spoof trusted system alerts for credential theft and malicious URL redirection.

Microsoft Defender blocked a large-scale human-operated ransomware attack that attempted to weaponize Group Policy Objects (GPOs) for security tampering and automated payload distribution.

Attackers weaponized an unauthenticated RCE in Langflow within 20 hours of disclosure to exfiltrate credentials and deploy second-stage payloads.

The GhostClaw malware campaign has expanded its delivery from npm packages to malicious GitHub repositories and AI-assisted developer workflows to steal macOS credentials.

A sophisticated PureLog Stealer campaign uses localized copyright violation lures and a multi-stage, fileless execution chain to target multiple global sectors.

An ongoing campaign, dubbed ForceMemo, compromises developer GitHub accounts to inject malware into Python repositories using a stealthy force-push technique and a Solana-based C2.

The threat actor TeamPCP compromised Aqua Security's Trivy project, injecting credential-stealing malware into official releases and forcing malicious updates to GitHub Actions.