Threat Intelligence Center

Google has filed suit against a Chinese cybercrime network leveraging Gemini AI to execute smishing attacks at scale. The network, operating under multiple identities including Lighthouse, Outsider, and Sniper Dz, targets e-commerce platforms, financial services firms, and mobile carriers.

Security researchers have confirmed the return of Evil MSI Background malware, a campaign attributed to thread-actor that leverages Microsoft.Win32.TaskScheduler for persistence and deploys Remittance Advice.js as a secondary payload. This malware family targets Windows environments through malicious MSI installers, exploiting legitimate Windows components to evade detection.

Security researchers have uncovered a large-scale supply chain attack targeting the Arch Linux package repository. Threat actor Shai Hulud compromised over 400 packages to distribute rootkit and infostealer malware through atomic-lockfile and deps dependencies.

TeamPCP has maintained an active supply chain campaign targeting cloud services, software development, and voice communications platforms through at least June 7, 2026. The campaign leverages multiple malware variants including Megalodon, Miasma, Mini Shai-Hulud, and Phantom Gyp to exploit critical vulnerabilities CVE-2026-45321, CVE-2026-48027, and CVE-2026-8398.

A detailed investigation has exposed the operational infrastructure behind a massive malicious domain network spanning 1.5 million sites. This coordinated campaign targets communication platforms, cryptocurrency exchanges, financial services firms, gambling operations, and technology companies with systematic precision.

ShinyHunters and affiliated threat actor UNC6240 are actively exploiting CVE-2026-35273, an unpatched zero-day vulnerability in Oracle PeopleSoft, to breach education and higher education institutions. The attackers leverage MeshCentral remote management tools to establish persistence and move laterally through compromised networks, enabling large-scale data theft and extortion operations.