Tim Peck

Lazarus Group is distributing Graphalgo malware via malicious Terraform providers and Go modules to target infrastructure developers and cryptocurrency assets.

The SC WordPress malware utilizes a redundant eight-component mesh across files, databases, and shared memory to self-heal and communicate via Ethereum blockchain gateways.

RATHat is an advanced Android banking trojan that abuses wireless debugging for shell access and utilizes Gemini LLM models for automated UI interaction and victim financial scoring.

An unidentified attacker utilized MSSQL's xp_cmdshell for command execution and data exfiltration via Base64-encoded chunks during an intrusion involving Viva Aerobus-linked infrastructure.

An intrusion campaign utilizing SEO poisoning delivers PavokwiLoader and RMMCRAT, employing advanced obfuscation and environment gating to deploy Cobalt Strike beacons.

WordPress Core versions 4.7.0 through 7.1.1 are vulnerable to an unauthenticated path traversal flaw (CVE-2026-87902) that can lead to remote code execution under specific environmental conditions.

Exvicy is an emerging Malware-as-a-Service framework that copycats ErrTraffic, using fake Cloudflare Turnstile challenges to deceive users into executing malicious PowerShell commands via the Win+R shortcut.

Adversaries can achieve SYSTEM privilege escalation by planting a malicious DLL at a non-existent ProgramData path referenced by a dangling COM registration and triggering it via custom COM marshaling.

The Phexia threat actor uses fake CAPTCHA 'ClickFix' lures to deploy a macOS backdoor that resolves its C2 hostname via a Polygon smart contract and drops multiple infostealers.

Atomic macOS Stealer (AMOS) is being delivered via a sophisticated ClickFix attack chain that uses a deceptive Xcode download site to trick users into executing malicious Terminal commands.