Threat Intelligence Center

Identity-as-a-Service describes the commodification of stolen personal data on dark web marketplaces, where Social Security numbers and supporting identity records tied to executives are packaged for repeat buyers rather than sold in one-off dumps. Marketplaces and tools identified in this analysis include Bankom, Bankomat, PeopleFinder and Xilo.

JavaScript obfuscation began as something close to a party trick, a way to make readable code unreadable without changing what it does. That same technique now appears as standard tooling in phishing kits, where hidden script logic makes malicious pages harder to inspect and classify.

A Spark RAT campaign aimed at Cambodia delivers the implant through Inno Setup installers and pairs it with a vulnerable signed driver. Operators load ardrv.sys, the OPSWAT AppRemover driver based on the Zemana Anti-Malware SDK and tracked as CVE-2026-36425, to terminate endpoint security from the kernel. Silver Fox tooling including ValleyRAT and Winos 4.0 is referenced.

A phishing campaign timed to post-DEF CON follow-up traffic uses a malicious Google Doc as the entry point. Targets are steered to a DecryptPanel.html lure page that serves GAPIUpdate.dmg, which installs the AMOS (Atomic macOS Stealer) payload alongside NetSupport RAT and a Ledger wallet implant. Persistence is established through a com.xdivcmp.

LiteLLM sits between applications and the models they call, making it a control point worth attacking. Three vulnerabilities, CVE-2026-42271, CVE-2026-48710 and CVE-2026-49869, affect that gateway layer, with XMRig cryptomining payloads pulled down via curl and wget. AI infrastructure needs the same patch discipline and egress controls as any internet-facing service.

Threat actors impersonating recruiters are targeting high-value corporate credentials, with mobile devices as the delivery surface. Job-offer and hiring-themed messages reach employees on phones, where sender details are truncated, links are harder to inspect, and credential prompts look routine. The result is corporate account access obtained without a single exploit against a corporate network.