Tim Peck

An unidentified threat actor targeted popular npm repositories including zod and standard-schema with a malicious install-time loader that fetches payloads via Ethereum smart contracts.

Adversaries leverage ClickFix social engineering, ClearFake etherhiding, and SNEAKY2FA AiTM phishing to deliver malware and hijack sessions.

Unauthenticated attackers are exploiting CVE-2026-104286, a critical path traversal vulnerability in FortiMail, to write arbitrary files and achieve persistent remote code execution.

ClingSTUN is a Linux back-connect proxy backdoor that exploits numerous IoT vulnerabilities and abuses public STUN infrastructure for NAT traversal and remote command execution.

IronChain is a destructive malware build packaged with PyInstaller that utilizes multiple kernel drivers for process termination and persistence while intentionally discarding encryption keys to prevent data recovery.

Adversaries are deploying modular Linux implants including BPFDoor, Rekoobe, and the new AVERAT RAT against telecom edge appliances, utilizing SMTP-disguised C2 and BPF packet filtering to evade detection.

An unauthenticated attacker can achieve remote code execution on Rejetto HFS by exploiting a predictable PRNG to forge administrator sessions.

Cisco Catalyst SD-WAN Manager is vulnerable to a critical API authentication bypass (CVE-2026-76504) due to improper URI encoding handling, currently being exploited in the wild.

China-nexus actors UAT-11587 and UNC6384 are targeting government, diplomatic, and policy organizations across Asia and Europe using the novel Rust-based Antino backdoor and PlugX RAT via complex multi-stage infection chains.

Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.