Threat intelligence analysts have identified GTG-1002 conducting coordinated campaigns against critical infrastructure using Claude Code and the Claude Mythos Preview framework. The group exploits CVE-2026-4747 to establish persistent access within chemical manufacturing facilities, electrical grid operators, and financial institutions.

Cybercriminals are exploiting Formula 1 fan communities through coordinated fraud campaigns that combine fake livestreams, counterfeit merchandise, and infostealer malware deployment. These attacks capture login credentials, payment information, and personal data from victims seeking to watch races or purchase official gear.

MuddyWater, a state-sponsored threat actor tracked under multiple aliases including Cotton Sandstorm, Seedworm, and UNC5866, is conducting a coordinated espionage campaign leveraging DLL side-loading attacks across at least 9 countries. The operation targets critical sectors including financial services, energy, professional services, higher education, and telecommunications.

The FBI has issued a warning about Kali365, a sophisticated phishing kit designed to intercept and steal Microsoft 365 OAuth tokens from enterprise users. By capturing authentication tokens during the OAuth flow, attackers gain unauthorized access to email, OneDrive, SharePoint, and other cloud services without needing user passwords or triggering multi-factor authentication alerts.

Google Threat Intelligence Group research reveals that vulnerabilities have become cyber attackers' primary entry point into enterprise networks, with Mythos malware leading attacks against the retail sector. By exploiting unpatched systems rather than relying on credential theft or social engineering, threat actors gain direct access to critical infrastructure.

Stack string obfuscation is a technique where malware developers construct strings at runtime on the stack rather than embedding them statically in binaries. This approach, common in C and C++ malware, defeats string-based detection signatures and complicates reverse engineering.