Tim Peck

A high-severity out-of-bounds write vulnerability in the Node.js Brotli decoder (Node2Shell) allows remote code execution when processing malformed compressed data.

The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.

A suspected Chinese threat actor is using SEO poisoning targeting DeepSeek AI users to deliver Kong RAT through a complex multi-stage infection chain.

MadApe is an undocumented phishing kit that abuses Microsoft Device Code authentication via business-themed PDF lures and multi-stage redirects to compromise Microsoft 365 accounts.

The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.

An operator exfiltrated over 68 GB of SQL Server backups from a Philippine government agency and staged a rebranded GodPotato tool named Wrqsnx on an open directory.

Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.

The Gheist campaign utilizes stolen GitHub tokens to plant malicious workflows that exfiltrate secrets via base32-encoded logs, circumventing traditional security masks.

An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.

The Yoba campaign utilizes SEO-poisoned GitHub repositories and fake AI desktop applications to distribute a custom loader that delivers XMRig miners via DLL sideloading.