Threat Intelligence Center

Researchers have uncovered a large-scale campaign involving more than 100 malicious extensions distributed through the official Chrome Web Store. These extensions employ credential harvesting and data exfiltration techniques to compromise user accounts across email, banking, and productivity platforms.

Security researchers have identified a growing campaign where threat actors are misusing n8n, a popular open-source workflow automation platform, to deploy malware and exfiltrate sensitive data from regulated organizations.

Microsoft has rolled out a streamlined reinstatement pathway for Windows hardware developers whose accounts faced suspension due to compliance violations or security concerns. The fast-track process reduces review timelines and provides clear remediation steps for hardware manufacturers, device partners, and driver developers seeking to restore their development privileges. Because these accounts sign kernel-level drivers, a hijacked one lets attackers ship malware bearing stolen code-signing certificates that Windows trusts by default.

Capstone's threat intelligence team has identified active scanning activity targeting professional service firms for EncystPHP webshell vulnerabilities. EncystPHP is a persistent web-based backdoor that allows attackers to maintain unauthorized access to compromised servers. This reconnaissance phase typically precedes exploitation attempts against unpatched or misconfigured web applications.

Security researchers have identified mailbox rule abuse as a persistent post-compromise technique deployed by Scripted Sparrow against education sector organizations. This attack method allows threat actors to maintain covert access to compromised mailboxes by creating forwarding rules that hide email traffic from legitimate users.

The Cybersecurity and Infrastructure Security Agency has added six known exploited vulnerabilities to its official catalog, spanning Fortinet FortiOS, Microsoft Windows and Office, and Adobe products. Threat actor Storm-1175 and the Medusa ransomware operation are actively exploiting these flaws in targeted attacks.