Threat Intelligence Center

Security researchers have identified a sustained campaign by ShinyHunters deploying Phantom Stealer and Win.Worm.Coinminer against government agencies, networking and firewall vendors, and sports broadcasting organizations. The threat actor leverages the vbdec obfuscation technique to evade detection while stealing credentials and establishing persistent access.

Security researchers have identified AutoJack, a critical vulnerability affecting AI agent deployments that enables remote code execution on host systems through malicious web pages. The vulnerability chains improper input validation (CWE-1385), missing authentication checks (CWE-306), and command injection flaws (CWE-78) to compromise the underlying infrastructure.

Many regulated firms assume Microsoft 365's built-in backup capabilities provide sufficient data protection. In reality, Microsoft 365 backup has significant limitations that create compliance risk, ransomware exposure, and recovery challenges for financial services, healthcare, and legal practices.

Developer endpoints represent a critical blind spot in most security programs. Threat actors including Megalodon, Miasma, NX, Shai-Hulud, and TrapDoor actively target these systems to extract hardcoded credentials, API keys, and authentication tokens.

Security researchers have identified Trojan: Win32/CryptoBandits.A, a cryptocurrency clipper malware that combines worm-like propagation with Tor-based command and control infrastructure. This malware intercepts and modifies cryptocurrency wallet addresses during transactions, redirecting funds to attacker-controlled accounts.

Security researchers have identified a sophisticated malware campaign deploying SprySOCKS variants that abuse legitimate Windows kernel drivers to evade detection mechanisms. The attack chain leverages DriverLoader and RawWNPF to load malicious drivers like fsdiskbit.