Tag index

Generated from page-level ## Tags sections. Each tag below links to the pages that currently use it.

All tags

• .NET (5)
• .NET malware (6)
• .pth (1)
• /accessv2 (1)
• /dev/kvm (1)
• 146.70.139.154 (1)
• 192.42.116.105 (1)
• 192.42.116.58 (1)
• 3CX (1)
• 404 TDS (1)
• 4sync (1)
• @marketfront (1)
• @tqm-mfe (1)
• <all_urls> (1)
• Ababil of Minab (1)
• abuse response (1)
• academic research (1)
• academic sector (1)
• Accellion (1)
• access brokers (1)
• account takeover (1)
• account-takeover (1)
• act_pedit (1)
• ACTINIUM (1)
• Active Directory (1)
• active exploitation (36)
• active probing (1)
• active-exploitation (1)
• ActiveX (1)
• actor (4)
• actors (9)
• ad blocker (1)
• ad fraud (1)
• Adaptix C2 (1)
• ADB TCP/5555 (1)
• Adblock for YouTube (1)
• Admin API key theft (1)
• administrator account creation (2)
• Adobe ColdFusion (1)
• Adobe Commerce (1)
• Adspect (1)
• Adversa AI (1)
• adversary-in-the-middle (2)
• adware (3)
• adware history (1)
• AES-128-CBC (1)
• AES-256-GCM (1)
• AES-GCM (1)
• AES-GCM C2 (1)
• affiliate hijacking (1)
• Afghanistan (2)
• agent frameworks (3)
• agent memory (1)
• agent skills (1)
• agent state (1)
• agentic AI (1)
• agentic browsers (1)
• agentic malware (1)
• agentic ransomware (1)
• agentic threat actor (1)
• Agentjacking (1)
• AGENTPSD (2)
• AI (4)
• AI agent (1)
• AI agents (14)
• AI anti-analysis (1)
• AI application infrastructure (1)
• AI assistant credentials (2)
• AI assistants (4)
• AI brand impersonation (2)
• AI browsers (1)
• AI chatbot abuse (1)
• AI credential theft (1)
• AI data exfiltration (1)
• AI framework (1)
• AI gateway (1)
• AI search poisoning (1)
• AI security (1)
• AI tooling (15)
• AI vulnerability discovery (1)
• ai-abuse (1)
• ai-agent (1)
• AI-assisted malware (1)
• AI-assisted vulnerability discovery (1)
• AI-augmented operations (1)
• AI-generated malware (1)
• AI-generated narrator (1)
• Aider (1)
• AiTM (1)
• Albania (1)
• Amadey (1)
• Amazon Q Developer (1)
• AMSI bypass (2)
• Android (6)
• Android ADB (1)
• Android Debug Bridge (1)
• Android spyware (1)
• anti-analysis (1)
• anti-forensics (2)
• Anubis ransomware (1)
• Apex One (1)
• API abuse (1)
• API exposure (1)
• API key exposure (1)
• API keys (1)
• API-driven payloads (1)
• apintergrationpost (1)
• App-Bound Encryption bypass (1)
• AppDomainManager (1)
• AppDomainManager injection (2)
• AppleJeus (1)
• AppleScript (1)
• AppleSeed (1)
• appliance (1)
• application delivery controller (1)
• APSB26-68 (1)
• APT (7)
• APT27 (1)
• APT28 (1)
• APT29 (1)
• APT32 (1)
• APT36 (2)
• APT37 (1)
• APT43 (1)
• APT45 (1)
• Aptos (1)
• Aquatic Panda (2)
• AquilaRAT (1)
• arbitrary file read (1)
• arbitrary file write (3)
• arbitrary JavaScript (1)
• Arch Linux (1)
• Arctic Wolf (1)
• ArduPilot (1)
• Argo CD (1)
• ArgoCD (1)
• Arista EOS (1)
• Armageddon (1)
• Armored Likho (3)
• Artifact Signing (1)
• AryStinger (1)
• AS32167 (1)
• Asia targeting (1)
• ASNs (1)
• ASP.NET (2)
• ASP.NET machineKey (1)
• ASPX web shells (2)
• Astro (1)
• ASUS router (1)
• AsyncRAT (1)
• Atlas RAT (1)
• AUDIOFIX (2)
• audit logging (1)
• AUR (1)
• authenticated RCE (1)
• authentication bypass (10)
• authentication laundering (1)
• authentication stack (2)
• authentication-coercion (1)
• auto-execution (1)
• AUTODYN (1)
• AutoGen Studio (1)
• AutoHotKey (1)
• AutoJack (1)
• autonomous agents (1)
• Avalon (2)
• AWS (4)
• AWS CloudTrail (1)
• AWS S3 (2)
• AWS Secrets Manager (1)
• axios (1)
• Azure (3)
• Azure CLI (1)
• Azure Storage (1)
• Backblaze (1)
• backdoor (12)
• Backdoor.Mistic (1)
• Backstage (1)
• backup disruption (1)
• backup recovery keys (1)
• backup targeting (1)
• backups (1)
• Bad Epoll (1)
• BadBlocker (1)
• Badbox 2.0 (1)
• Banana RAT (1)
• banking (1)
• banking malware (1)
• banking trojan (1)
• Barracuda (1)
• BaseZipInstaller (1)
• Bash Uploader (1)
• batch loader (1)
• BeaverTail (1)
• Bedrock (1)
• behavioral integrity verification (1)
• Belarus (2)
• BELQI (1)
• BeyondTrust (1)
• binary execution (1)
• BinaryFormatter (1)
• binding.gyp (2)
• BIOPASS RAT (1)
• BioShocking (1)
• BirdCall (1)
• Bitbucket (1)
• Bitcoin (1)
• Bitwarden (1)
• BlackFile (1)
• Blackpoint Cyber (5)
• blockchain C2 (3)
• blockchain dead drop (1)
• blockchain RPC (1)
• blockchain-dead-drop (1)
• Blogger abuse (1)
• blogspot staging (1)
• BLUEBEAM (1)
• botnet (6)
• branch-compromise (1)
• branch-name-injection (1)
• brand impersonation (2)
• brand-impersonation (1)
• Brazil (4)
• Brazilian banking malware (1)
• BreachForums (1)
• BRICKSTORM (2)
• Broadcom (1)
• browser automation (1)
• browser cookie theft (1)
• browser credential theft (14)
• browser extension (6)
• browser hijacking (2)
• browser session abuse (2)
• browser session risk (3)
• browser zero-day (1)
• browser-credential-theft (1)
• browser-extensions (2)
• browser-security (1)
• browser-session risk (1)
• brute-force credentials (1)
• BSC (1)
• BTMOB (1)
• bucket hijacking (1)
• bucket squatting (1)
• build-time compromise (1)
• bulletproof hosting (1)
• Bun (2)
• Bun runtime abuse (1)
• BusySnake Stealer (3)
• Bybit (1)
• BYOVD (2)
• C# (1)
• C++/CLI (1)
• C2 (9)
• C2 framework (2)
• C2 tasking (1)
• CageFS (1)
• Calendly abuse (1)
• campaign (1)
• Canada (1)
• CANFAIL (1)
• CAP_NET_ADMIN (2)
• Casbaneiro (1)
• Catalyst SD-WAN Manager (1)
• Cav3rn (1)
• Cavern (1)
• Cavern Manticore (2)
• CCleaner (1)
• CDN (1)
• CERT-In (1)
• CERT/CC (1)
• certificate pinning (1)
• certificate theft (1)
• CFIDE (1)
• ChatGPT (1)
• chattr (1)
• Chatty Spider (1)
• CHAVECLOAK (1)
• Check Point (1)
• Check Point Research (1)
• Checkmarx (1)
• checkpointers (1)
• China (2)
• China-linked (8)
• China-nexus (10)
• China-speaking ecosystem (1)
• Chinese-language cybercrime (1)
• Chinese-language fraud ecosystem (1)
• Chinese-speaking (3)
• Chinese-speaking operator (1)
• Chisel (3)
• ChocoPoC (1)
• Chrome (2)
• Chrome extension (1)
• Chrome renderer sandbox (1)
• Chrome Web Store (4)
• chrome_settings_overrides (1)
• ChromElevator (1)
• Chromium (5)
• Chromium extension (1)
• CI-CD (2)
• CI/CD (36)
• CircleCI (1)
• CISA (1)
• CISA KEV (15)
• Cisco (2)
• Cisco Nexus (1)
• Cisco Unified CM (1)
• Cisco Unified Communications Manager (1)
• Citrine Sleet (1)
• Citrix (2)
• Citrix NetScaler (1)
• CitrixBleed (1)
• CitrixBleed 2 (1)
• CKEditor file manager (1)
• CL-CRI-1089 (1)
• CL-STA-1062 (3)
• Claude (2)
• Claude Code (3)
• Clever Cloud (1)
• ClickFix (6)
• ClickOnce (1)
• client-side exploitation (1)
• Cline (1)
• clipboard hijacker (1)
• clipboard injection (1)
• clipboard stealer (1)
• clipboard theft (5)
• clipper (2)
• Cloaked Ursa (1)
• cloaking (1)
• cloud (6)
• cloud C2 (1)
• cloud credential hunting (1)
• cloud credential risk (1)
• cloud credential theft (5)
• cloud credentials (2)
• Cloud Files Mini Filter Driver (1)
• Cloud Filter driver (1)
• cloud IAM (1)
• cloud identity (2)
• cloud identity abuse (1)
• cloud infrastructure (1)
• cloud logging (1)
• cloud secrets (4)
• cloud security (3)
• cloud service abuse (4)
• cloud storage (1)
• cloud storage exfiltration (1)
• cloud transcoding (1)
• Cloudflare (2)
• Cloudflare Tunnel (2)
• Cloudflare tunnels (1)
• Cloudflare Turnstile (1)
• Cloudflare Workers (5)
• cloudflared (1)
• CloudLinux (1)
• cluster compromise (1)
• CMS (6)
• Cobalt Strike (5)
• code execution (1)
• code sandbox scraping (1)
• code signing (3)
• Codecov (1)
• CodeQL (1)
• Codex (2)
• coding agents (1)
• Coinbase (1)
• ColdFusion (1)
• collaboration platforms (1)
• collaboration-tool phishing (1)
• COM-hijacking (1)
• command and control (1)
• command execution (5)
• command injection (6)
• command-execution (1)
• command-injection (1)
• commercial messaging applications (1)
• communications infrastructure (1)
• Composer (4)
• compromised accounts (2)
• compromised credentials (1)
• compromised infrastructure (1)
• compromised WordPress (2)
• Conditional Access (1)
• configuration theft (1)
• confused deputy (1)
• ConfuserEx (2)
• ConnectWise (1)
• ConnectWise ScreenConnect (1)
• consumer devices (1)
• consumer IoT (1)
• Contagious Interview (3)
• container (1)
• container escape (3)
• container escape pre-check (1)
• content compliance rules (1)
• context flooding (1)
• Continue (1)
• continuous visibility (1)
• control panel compromise (1)
• control plane (1)
• cookie theft (3)
• Copilot (1)
• Copy-on-Write (1)
• Coruna (1)
• COW (1)
• CPaaS (1)
• cPanel (3)
• CrackMapExec (1)
• Crates.io (1)
• credential attacks (2)
• credential exposure (2)
• credential harvesting (1)
• credential spraying (1)
• credential stuffing (2)
• credential theft (33)
• credential-theft (51)
• criminal infrastructure (1)
• critical infrastructure (4)
• critical-infrastructure (2)
• CRM data theft (1)
• cron (1)
• cron persistence (1)
• cross-platform (1)
• cross-platform malware (1)
• CrownX (2)
• crypto (2)
• crypto clipper (1)
• crypto wallets (2)
• crypto-wallets (1)
• cryptocurrency (11)
• cryptocurrency scam (1)
• cryptocurrency theft (4)
• cryptocurrency wallet theft (1)
• cryptocurrency wallets (3)
• cryptojacking (1)
• cryptominer (2)
• cryptomining (1)
• Curious Serpens (1)
• Cursor (3)
• Curve25519 (1)
• custody APIs (1)
• CVE-2013-3307 (1)
• CVE-2016-5681 (1)
• CVE-2020-17103 (1)
• CVE-2021-29441 (1)
• CVE-2022-0492 (1)
• CVE-2023-24932 (1)
• CVE-2023-2868 (1)
• CVE-2023-4966 (1)
• CVE-2024-1708 (1)
• CVE-2024-1709 (1)
• CVE-2024-20399 (1)
• CVE-2024-21182 (1)
• CVE-2024-3094 (2)
• CVE-2024-42009 (1)
• CVE-2025-11371 (1)
• CVE-2025-11837 (1)
• CVE-2025-3248 (1)
• CVE-2025-32975 (1)
• CVE-2025-34291 (1)
• CVE-2025-48595 (1)
• CVE-2025-49113 (1)
• CVE-2025-49704 (1)
• CVE-2025-49706 (1)
• CVE-2025-5777 (1)
• CVE-2025-67038 (1)
• CVE-2025-8088 (4)
• CVE-2026-0257 (1)
• CVE-2026-10520 (1)
• CVE-2026-10523 (1)
• CVE-2026-11405 (1)
• CVE-2026-11645 (1)
• CVE-2026-12569 (1)
• CVE-2026-12957 (1)
• CVE-2026-12958 (1)
• CVE-2026-20127 (1)
• CVE-2026-20182 (1)
• CVE-2026-20230 (1)
• CVE-2026-20245 (1)
• CVE-2026-20253 (1)
• CVE-2026-20262 (1)
• CVE-2026-20896 (1)
• CVE-2026-23111 (1)
• CVE-2026-26980 (1)
• CVE-2026-28318 (1)
• CVE-2026-3300 (1)
• CVE-2026-33017 (2)
• CVE-2026-33691 (1)
• CVE-2026-34908 (1)
• CVE-2026-34909 (1)
• CVE-2026-34910 (1)
• CVE-2026-34926 (1)
• CVE-2026-35273 (2)
• CVE-2026-35616 (1)
• CVE-2026-39987 (1)
• CVE-2026-40138 (1)
• CVE-2026-40139 (1)
• CVE-2026-40140 (1)
• CVE-2026-40141 (1)
• CVE-2026-4020 (1)
• CVE-2026-41091 (1)
• CVE-2026-41940 (1)
• CVE-2026-42271 (1)
• CVE-2026-43074 (1)
• CVE-2026-43284 (1)
• CVE-2026-43500 (1)
• CVE-2026-43503 (1)
• CVE-2026-44338 (1)
• CVE-2026-45247 (1)
• CVE-2026-45498 (1)
• CVE-2026-45659 (1)
• CVE-2026-46242 (1)
• CVE-2026-46300 (1)
• CVE-2026-46331 (1)
• CVE-2026-46817 (1)
• CVE-2026-48172 (1)
• CVE-2026-48276 (1)
• CVE-2026-48277 (1)
• CVE-2026-48281 (1)
• CVE-2026-48282 (1)
• CVE-2026-48283 (1)
• CVE-2026-48285 (1)
• CVE-2026-48307 (1)
• CVE-2026-48313 (1)
• CVE-2026-48314 (1)
• CVE-2026-48315 (1)
• CVE-2026-48316 (1)
• CVE-2026-48558 (3)
• CVE-2026-48907 (1)
• CVE-2026-50751 (1)
• CVE-2026-50752 (1)
• CVE-2026-53359 (1)
• CVE-2026-5426 (1)
• CVE-2026-54420 (1)
• CVE-2026-6682 (1)
• CVE-2026-6683 (1)
• CVE-2026-6684 (1)
• CVE-2026-6685 (1)
• CVE-2026-6686 (1)
• CVE-2026-6687 (1)
• CVE-2026-6688 (1)
• CVE-2026-7473 (1)
• CVE-2026-8037 (1)
• CVE-2026-8451 (1)
• CVE-2026-8461 (1)
• CVE-2026-8732 (1)
• CVE-2026-9082 (1)
• CWE-502 (1)
• CWE-77 (1)
• CWE-78 (1)
• cyber-espionage (1)
• cybercrime (11)
• cybercrime ecosystem (2)
• Cython (1)
• Czech Republic (1)
• D-Link (1)
• dangling resources (1)
• data exfiltration (6)
• data exposure (1)
• data extortion (1)
• data leak site (2)
• data theft (5)
• data-exfiltration (1)
• database extortion (1)
• DAYLIGHT (1)
• DCloud (1)
• DCloud Uni-App (1)
• DcRAT (1)
• DDNS (1)
• DDoS (2)
• DDoS-for-hire (1)
• dead drop resolver (4)
• Debian (1)
• DEBULL (1)
• declarativeNetRequest (1)
• DeepSeek (2)
• Defender Advanced Hunting (1)
• Defender evasion (2)
• Defender exclusion (1)
• defense (1)
• defense evasion (4)
• defense targeting (1)
• defense-evasion (1)
• DeFi (4)
• delayed execution (1)
• denial of service (4)
• Deno (2)
• dependency confusion (2)
• deployment_status (1)
• deserialization (4)
• destructive malware (2)
• destructive operations (1)
• detection engineering (1)
• DEV-0206 (1)
• developer credential theft (2)
• developer credentials (1)
• developer endpoints (1)
• developer machines (9)
• developer mode (1)
• developer targeting (4)
• developer tooling (2)
• developer workstations (2)
• developer-machine-fleet (1)
• developer-targeting (15)
• developer-tools (1)
• developer-workstations (2)
• device registration (1)
• device-code phishing (1)
• DevOps (1)
• DevTools (1)
• DEWMODE (1)
• DIAMONDBACK (2)
• Digital Knowledge (1)
• digital wallets (1)
• DigitalOcean (1)
• Dindoor (1)
• diplomatic targeting (2)
• DirtyClone (1)
• DirtyFrag (1)
• Discord (2)
• discovery (1)
• Djinn Stealer (3)
• DLL side-loading (3)
• DLL sideloading (16)
• DNS C2 (2)
• DNS threat intelligence (1)
• DNS tunneling (1)
• Docker (1)
• Docker credentials (1)
• Docker images (1)
• document exfiltration (1)
• document theft (3)
• domain squatting (1)
• domestic espionage (1)
• DotNetNuke (1)
• double extortion (1)
• downgrade risk (1)
• DPAPI (2)
• DPAPILoader (1)
• DPRK (4)
• driver loading (1)
• DroneLink (1)
• Dropbear (1)
• Dropbox (2)
• dropper (1)
• Drupal (1)
• duckdns (1)
• Dutch Police (1)
• DWAgent (1)
• dynamic DNS (1)
• dynamic obfuscation (1)
• Dynu (1)
• e-commerce (1)
• Eagle Werewolf (2)
• Earth Lusca (2)
• eBPF (2)
• Eclipse (1)
• edge appliance (10)
• edge appliances (2)
• edge application server (1)
• edge device (2)
• edge devices (3)
• edge exploitation (1)
• edge service (2)
• editor profile import (1)
• EDR evasion (2)
• EDR killer (1)
• EDS5000 (1)
• education (1)
• Egnyte (1)
• EKZ Infostealer (1)
• Elasticsearch (1)
• electric power sector (2)
• email (1)
• email exfiltration (1)
• email gateway (1)
• email infrastructure abuse (1)
• email theft (3)
• embedded systems (1)
• Emerald Sleet (1)
• encrypted C2 (1)
• endpoint management (1)
• endpoint management abuse (1)
• endpoint response (1)
• endpoint-detection (1)
• endpoint-security (2)
• EndpointDlp.dll (1)
• energy sector (4)
• energy-sector (1)
• engineering (1)
• engineering software (1)
• enterprise application (1)
• enterprise application exploitation (1)
• enterprise applications (1)
• Entra ID (2)
• Environment Management Hub (1)
• environment variables (1)
• environmental keying (1)
• epoll (1)
• Epsilon Stealer (1)
• ERP (1)
• eSentire TRU (1)
• ESG (1)
• espionage (43)
• Espressif ESP-IDF (1)
• EtherHiding (1)
• ETW patching (1)
• ETW tampering (1)
• Eurojust (1)
• Europe (3)
• Europe targeting (1)
• Europol (2)
• evasion (1)
• eventpoll (1)
• Everest Forms Pro (1)
• Evil Corp (1)
• EvilAI (1)
• exFAT (1)
• exfiltration (4)
• exploit-development (1)
• exploit-kit (1)
• Exploit.in (1)
• exploitation (14)
• exploitation attempts (1)
• extension supply-chain (2)
• external federation (1)
• extortion (7)
• F5 BIG-IP (1)
• fake CAPTCHA (2)
• fake crypto exchange (1)
• fake dating lures (1)
• fake gambling (1)
• fake login screen (1)
• fake plugin (1)
• fake PoC (2)
• fake recruiting (1)
• fake reputation (1)
• fake update (2)
• FakeCaptcha (1)
• Fakeset (1)
• faketivism (1)
• FakeUpdates (1)
• FallSpy (1)
• FAMOUS CHOLLIMA (2)
• Famous Chollima (1)
• Fancy Bear (1)
• Fast16 (1)
• FastAPI (1)
• FastCGI (1)
• FAT32 (1)
• FatFs (1)
• FBI (2)
• FFmpeg (1)
• FIFA (1)
• file encryption (1)
• file exfiltration (1)
• File Transmission (1)
• file upload path traversal (1)
• file-system filter (1)
• FileFiend (1)
• FILEIO (1)
• fileless execution (3)
• fileless malware (1)
• filemanager (1)
• filename-injection (1)
• filesystem parser (1)
• finance (2)
• financial fraud (2)
• financial sector (3)
• financial services (2)
• financial theft (3)
• FireAnt MetaKit (1)
• Firefox Add-ons (1)
• firewall (1)
• firmware (1)
• firmware update (1)
• FishMonger (1)
• FlexPLM (1)
• Flutter (1)
• FlutterShell (1)
• folderOpen (1)
• foreign affairs targeting (1)
• foreign policy targeting (1)
• Forest Blizzard (1)
• FortiClient EMS (1)
• FortiGate (1)
• Fortinet (2)
• FortiOS (1)
• Fox Tempest (2)
• fraud (1)
• FreeBSD (2)
• freeware impersonation (1)
• FSB (4)
• FSB Center 16 (2)
• fscan (1)
• FTA (1)
• ftp.exe (1)
• Full Disk Access social engineering (1)
• Funnull (1)
• Gamaredon (3)
• Gamaredon collaboration (1)
• GammaLoad (1)
• GammaPhish (1)
• GammaSteel (1)
• GammaWorm (1)
• Garble (1)
• GCS (1)
• GentleKiller (1)
• Ghost CMS (1)
• Ghost Networks (1)
• GHSA-6rmh-7xcm-cpxj (1)
• GHSA-6v3r-4p5c-mrp5 (1)
• GHSA-xhcr-j4j9-3gh7 (1)
• GIFTEDCROOK (1)
• Gitea (1)
• GitHub (16)
• GitHub abuse (3)
• GitHub Actions (20)
• GitHub API (1)
• GitHub App (1)
• GitHub CLI (1)
• GitHub issue spam (1)
• GitHub OAuth (1)
• GitHub Pages abuse (1)
• GitHub payload delivery (1)
• GitHub Security Advisories (1)
• GitHub tokens (2)
• GitLab (1)
• gitleaks (1)
• GitOps (1)
• Gleaming Pisces (1)
• gleeze.com (1)
• GlobalProtect (1)
• Gmail (3)
• Go (4)
• Go modules (1)
• Go2Tunnel (1)
• Godzilla (1)
• GoEdge (1)
• GoFile (1)
• Golang malware (1)
• GOLD PRELUDE (1)
• Google Ads (1)
• Google Analytics telemetry (1)
• Google API (3)
• Google Chrome (1)
• Google Cloud (1)
• Google Cloud Logging (1)
• Google Cloud Storage (1)
• Google credential theft (1)
• Google Drive (1)
• Google Notes (1)
• Google Play (1)
• Google Play Protect (1)
• Google redirect abuse (1)
• Google Stitch (1)
• Google Threat Intelligence Group (2)
• Goose (1)
• government (4)
• government targeting (10)
• government-impersonation (1)
• GPT (1)
• Grandoreiro (2)
• GraphSpy (1)
• Gravity SMTP (1)
• GRE (1)
• GREYVIBE (1)
• group (3)
• groups (13)
• gRPC (1)
• gs-netcat (1)
• GS-Netcat (1)
• GTIG (2)
• GUE (1)
• guest-to-host escape (1)
• Guildma (1)
• hack-and-leak (1)
• hacktivist persona (1)
• Hades (2)
• Hajime (1)
• hallucination (1)
• HappyDoor (1)
• HAR files (1)
• hard-coded secrets (1)
• HashiCorp Vault (1)
• HavocKiller (1)
• headless browser (2)
• healthcare (2)
• HelloDoor (1)
• HellsGate (1)
• Helm (1)
• Hermes Agent (1)
• HexKiller (1)
• hidden backdoor (1)
• hidden service (1)
• high explosives (1)
• higher education (2)
• Honduras (2)
• HONESTCUE (1)
• hospitality targeting (1)
• Host Radar (1)
• hosting control plane (1)
• hosting provider (1)
• hosting providers (1)
• hotel targeting (1)
• HR lures (1)
• HTA (4)
• HTML smuggling (1)
• HTTP C2 (1)
• HttpMalice (1)
• HTTPSpy (1)
• Hugging Face (2)
• Hunt.io (4)
• Huntress (1)
• hydropower (2)
• Hydropower Cooperation Project Proposal.zip (1)
• hypervisor escape (1)
• Hyunwoo Kim (1)
• I-SOON (2)
• ICE (1)
• ICONICSTEALER (1)
• ICS (1)
• IDE extension (1)
• IDE plugins (1)
• ide.cfm (1)
• identity (3)
• identity attacks (1)
• identity security (1)
• IDEs (1)
• IFEO persistence (1)
• IIOP (1)
• IIS (1)
• IKEv1 (1)
• iMessage (1)
• Impacket (2)
• impersonation (1)
• import-time execution (2)
• improper privilege management (1)
• in-memory DLL loading (1)
• incident response (20)
• incident-response (1)
• India (3)
• Indian government (1)
• indirect prompt injection (4)
• industrial control (1)
• industrial control systems (1)
• INFINITERED (1)
• Infoblox Threat Intel (1)
• information disclosure (1)
• infostealer (19)
• infrastructure (5)
• infrastructure disruption (2)
• initial access broker (2)
• initial-access (3)
• input capture (1)
• install-time execution (2)
• install-time-execution (1)
• install.res.1033.dll (1)
• Integration Broker (1)
• Intercolo (1)
• internet-facing admin surface (1)
• internet-facing appliance (1)
• internet-facing applications (1)
• investment scam (1)
• InvisibleFerret (1)
• iOS (1)
• IoT (3)
• IoT botnet (3)
• IP-in-IP (1)
• IPsec (1)
• IPv6 (1)
• Iran (7)
• Iran-nexus (1)
• Island Security Research (1)
• ISO image (1)
• Israel (3)
• IT providers (1)
• Italian foreign-policy targeting (1)
• Italy targeting (1)
• Ivanti Sentry (1)
• JADEPUFFER (1)
• Jamf Threat Labs (1)
• Januscape (1)
• Japan (1)
• Java malware (1)
• JavaScript (11)
• JavaScript bridge (1)
• JavaScript injection (1)
• JavaScript loader (1)
• JavaScript malware (1)
• JavaScript masquerading (1)
• JavaScript tampering (1)
• JCE (1)
• JDY (1)
• Jellyfin (1)
• JetBrains (2)
• JetBrains Marketplace (1)
• JetStream (1)
• JFrog (1)
• JFrog Security Research (2)
• JINX-0164 (2)
• joblib (1)
• Joomla (1)
• Joomla Content Editor (1)
• journalists (1)
• JSCoreRunner (1)
• JSON:API (1)
• JSONKeeper (1)
• JSONPing (1)
• JSP web shell (1)
• JuicyPotato (2)
• JXA downloader (1)
• K1MORPHER (2)
• Kairos (1)
• Kaspersky (2)
• Kaspersky Securelist (2)
• Kazakhstan (1)
• KAZUAR (2)
• KAZUAR overlap (1)
• Keitaro (1)
• Kemp LoadMaster (1)
• kernel driver (3)
• kernelCTF (1)
• KEV (3)
• keychain theft (1)
• KeyHunter (1)
• keylogger (2)
• keylogging (1)
• Kimsuky (1)
• Klue (1)
• KnowledgeDeliver (1)
• KongTuke (1)
• KORKERDS (1)
• Kubernetes (2)
• KV-botnet (1)
• KVM (1)
• KVM escape (1)
• kvmCTF (1)
• L2TP/IPSec (1)
• LA Metro (1)
• LangChain (2)
• Langflow (4)
• LangFlow (1)
• LangGraph (1)
• Language Servers for AWS (1)
• Lantronix (1)
• Laravel (2)
• lateral movement (3)
• lateral-movement (1)
• Latin America (2)
• LaunchAgent (1)
• launchctl (1)
• law enforcement (1)
• law-enforcement-disruption (1)
• LayerX (1)
• Lazarus (5)
• LD_PRELOAD (2)
• LDAP (1)
• leaked credentials (1)
• least privilege (1)
• legacy botnet hijacking (1)
• legacy infrastructure (1)
• legacy software (1)
• legal sector (1)
• LegionRelay (1)
• Leo Platform (1)
• LevelBlue (1)
• liblzma (1)
• libp2p (1)
• libpeconv (1)
• lifecycle hooks (1)
• lifecycle-hooks (1)
• Lightning Shared Scooter Co. (1)
• LinkedIn (2)
• Linksys (1)
• Linux (22)
• Linux kernel (4)
• Linux malware (1)
• LiteLLM (3)
• LiteSpeed (2)
• living off the land (1)
• living-off-the-land (1)
• living-off-the-land binaries (1)
• LLM (4)
• LLM security (1)
• LLM-driven intrusion (1)
• LLMjacking (1)
• LMS (1)
• LNK (10)
• LNK files (1)
• load balancer (1)
• loader (4)
• local LLMs (1)
• local privilege escalation (5)
• local-file-inclusion (1)
• localhost (1)
• log poisoning (1)
• logging (1)
• login item persistence (1)
• LOLBins (2)
• long-lived tokens (1)
• long-term access (1)
• LONGSTREAM (1)
• LOOKVALJS (1)
• LOOKVALPS (1)
• loopback (1)
• Loophole (1)
• low-confidence attribution (1)
• LPE (1)
• LS-DYNA (1)
• LSASS (1)
• LSHIY (1)
• LSSC (1)
• Lua (1)
• Lumen (1)
• Lumen Black Lotus Labs (1)
• Luna Moth (1)
• Lyceum (1)
• MaaS (1)
• MacCMS (1)
• Maccy impersonation (1)
• machine-learning (1)
• macOS (10)
• macOS malware (1)
• Magento (1)
• MagicYUV (1)
• mail server compromise (1)
• mailbox theft (1)
• MAIN world injection (1)
• maintainer compromise (2)
• maintainer persona (1)
• maintainer-compromise (1)
• malicious GPO (1)
• malicious releases (2)
• malvertising (4)
• malware (34)
• malware analysis (2)
• malware delivery (3)
• malware framework (1)
• Malware-as-a-Service (1)
• malware-as-a-service (2)
• malware-signing-as-a-service (1)
• MALXMR (1)
• managed file transfer (1)
• managed service provider (1)
• ManageEngine Endpoint Central (1)
• management plane (3)
• Manifest V3 (1)
• manufacturing (1)
• Mapbox (2)
• marimo (1)
• MARKETMAKER (1)
• marketplace abuse (1)
• marketplace trust (1)
• Maven Central (1)
• mawesome (1)
• Mbed (1)
• McAfee Labs (1)
• MCP (7)
• media processing (1)
• medical research (1)
• Mekotio (1)
• memfd (1)
• memory corruption (1)
• memory disclosure (1)
• memory overread (1)
• memory poisoning (1)
• memory-only malware (1)
• MeshAgent (1)
• MeshCentral (2)
• MEV bot lure (1)
• Mexico (1)
• MFA bypass (7)
• MFA fatigue (1)
• MFA-bypass (1)
• Miasma (6)
• MicroPython (1)
• Microsoft (6)
• Microsoft .NET (1)
• Microsoft 365 (3)
• Microsoft 365 Copilot (1)
• Microsoft Authentication Broker (1)
• Microsoft Defender (1)
• Microsoft Defender Security Research (1)
• Microsoft dev tunnels (2)
• Microsoft Digital Crimes Unit (1)
• Microsoft Edge (2)
• Microsoft Edge Add-ons (1)
• Microsoft Edge Extensions Security Team (1)
• Microsoft Entra ID (1)
• Microsoft Graph (2)
• Microsoft Identity Platform (1)
• Microsoft Office SharePoint (1)
• Microsoft Security Blog (1)
• Microsoft SQL Server (1)
• Microsoft Teams (2)
• Microsoft-signed binary abuse (1)
• Middle East (2)
• middleware (1)
• Midnight Blizzard (1)
• military research (1)
• Mimikatz (3)
• Minecraft DDoS (1)
• Mini Shai-Hulud (2)
• MiniJunk (1)
• MiniPlasma (1)
• MINIRAT (2)
• MINIRECON (2)
• Ministry of Finance (2)
• MiniUpdate (1)
• Mirai (3)
• Mirai-derived botnet (1)
• Mistic (1)
• MITRE ATT&CK T1005 (1)
• MITRE ATT&CK T1562 (1)
• MLTBackdoor (1)
• mobile (1)
• Mobile Access (1)
• mobile device management (1)
• mobile devices (1)
• mobile malware (1)
• MobileIron Sentry (1)
• Model Context Protocol (5)
• model poisoning (1)
• model-provider abuse (1)
• ModeloRAT (1)
• module-proxy (1)
• MOIS (5)
• Monero (2)
• Mozi (1)
• MpExtMs.exe (1)
• MPR network provider (1)
• Mr_Rot13 (1)
• MSBuild (1)
• msgpack (1)
• mshta (3)
• MSI (1)
• MSP (3)
• MSSQL (1)
• mTLS (1)
• MuddyWater (3)
• multi-tenant cloud (1)
• Mustang Panda (2)
• Mustard Tempest (1)
• mutable tags (2)
• MYRA (1)
• MySQL (1)
• Mythos (1)
• Nacos (1)
• named pipes (1)
• namespace recycling (1)
• namespace squatting (1)
• NAS targeting (1)
• nation-state (1)
• native addon (1)
• native extension (2)
• NativeAOT (2)
• NATS (1)
• NCSC-NL (1)
• Nebo (1)
• negotiation (1)
• Neo-reGeorg (1)
• nested virtualization (1)
• Netherlands (1)
• NetNut (1)
• NetScaler (2)
• NetScaler ADC (2)
• NetScaler Gateway (2)
• network infrastructure (1)
• network policies (1)
• Nextcloud (1)
• nf_tables (1)
• nftables (1)
• Nginx (1)
• Nginx module (1)
• no attribution (1)
• No-IP (1)
• node-gyp (2)
• node-ipc (1)
• node-pty (1)
• Node.js (2)
• Node.js implant (1)
• Node.js malware (1)
• North Korea (11)
• notarized malware (1)
• npm (43)
• npm lifecycle hook (3)
• npm tokens (1)
• npx (1)
• NSecKrnl.sys (1)
• NTDS.dit (2)
• NTFS ADS (2)
• NTLM (1)
• nuclear weapons (1)
• NuGet (1)
• Nuitka (1)
• NVGRE (1)
• OAuth (4)
• OAuth abuse (3)
• OAuth token abuse (1)
• OAuth token exposure (1)
• OAuth tokens (2)
• OBF networks (1)
• obfuscation (1)
• obfuscator.io (1)
• OFAC (1)
• Offshore LC (1)
• OIDC (6)
• OilRig (1)
• Okta (4)
• OKX (1)
• Ollama (1)
• Oman (1)
• Omnibox (1)
• OneDrive (3)
• OneDrive access (1)
• Open Interpreter (1)
• OpenAI (1)
• OpenAI Codex (1)
• opencode (1)
• OpenConnect (1)
• OpenHands (1)
• OpenSearch (1)
• OpenSSH (2)
• OpenVPN (1)
• OpenVPN-shaped UDP (1)
• OpenVSX (1)
• operation (2)
• Operation DangerousPassword (1)
• Operation Endgame (1)
• Operation Highland (2)
• operational relay box (1)
• operational resilience (1)
• operations (184)
• OpFauxSign (1)
• ops (190)
• opsec failure (1)
• Oracle (1)
• Oracle E-Business Suite (1)
• Oracle Payments (1)
• Oracle PeopleSoft (2)
• Oracle WebLogic Server (1)
• OT (1)
• OTA update (1)
• OTP interception (1)
• Outlook (1)
• OX Security (1)
• OxideHarvest (1)
• OYSTERBLUES (1)
• OYSTERFRESH (1)
• OYSTERSHUCK (1)
• P2P (1)
• package masquerading (1)
• package registry (3)
• package registry credentials (1)
• package scanning (1)
• package-cooldowns (1)
• package-manager-hardening (1)
• package-splitting (1)
• package-takeover (1)
• Packagist (4)
• page cache (2)
• page poisoning (1)
• Pakistan (2)
• Pakistan-linked (2)
• Palo Alto Networks (1)
• PAM (2)
• PAM credential validation (1)
• PamStealer (1)
• PAN-OS (1)
• parallel-intrusion (1)
• password spray (1)
• password spraying (2)
• Pastebin (1)
• patch management (2)
• path traversal (1)
• patterns (25)
• payload loader (1)
• payload staging (1)
• payload-as-a-service (1)
• payment fraud (1)
• payment workflow exposure (1)
• payment-card theft (2)
• payment-card-theft (2)
• payroll lures (1)
• pe_to_shellcode (1)
• PebbleDash (1)
• pedit (1)
• pentesting (1)
• people (1)
• PeopleTools (1)
• PerfWatson2.exe (1)
• Perplexity AI (1)
• persistence (24)
• pfSense (1)
• PhaaS (2)
• Phantom Gyp (3)
• PhantomClick (1)
• PhantomMail (1)
• PhantomRelay (1)
• Philippines (1)
• phishing (16)
• phishing-as-a-service (2)
• PHP (2)
• PHP code injection (1)
• PHP object injection (1)
• PHP upload (1)
• physics (1)
• PicassoLoader (1)
• pickle (1)
• pig butchering (1)
• pig-butchering (1)
• piracy (1)
• Piriform (1)
• Pix (1)
• PixelSmash (1)
• PKGBUILD (1)
• plaintext HTTP (1)
• Plandex (1)
• PLENET (2)
• plugin architecture (1)
• poisoned-branch (1)
• PolinRider (2)
• polyfill (1)
• Polymarket (1)
• polymorphic loader (1)
• polymorphic payloads (1)
• Popa (1)
• portmap (1)
• Portugal (1)
• post-authentication RCE (1)
• post-exploitation (4)
• post-exploitation framework (1)
• postal-impersonation (1)
• PostCSS (1)
• PostgreSQL (3)
• postinstall (9)
• PowerCloud (1)
• PowerShell (15)
• PowerShell malware (1)
• PowerShower (1)
• PPtP (1)
• PRA (1)
• PraisonAI (1)
• PRC (1)
• PRC-aligned (1)
• PRC-nexus (1)
• pre-auth RCE (1)
• pre-authentication (2)
• preinstall (2)
• Primitive Bear (1)
• PrincessClub (1)
• privacy (1)
• privacy exposure (1)
• private registry fallback (1)
• private-key theft (1)
• privilege escalation (8)
• Privileged Remote Access (1)
• process doppelgänging (1)
• process environment scraping (1)
• process hollowing (2)
• process injection (3)
• product lifecycle management (1)
• professional services (1)
• profile.d (1)
• Progress Kemp LoadMaster (1)
• Project Proposal.exe (1)
• prompt injection (8)
• prompt-injection (4)
• PROMPTFLUX (1)
• PROMPTSPY (1)
• proof of deletion (1)
• Proofpoint (1)
• protestware (1)
• Protobuf (1)
• provenance (1)
• proxy (6)
• proxy network (2)
• ProxyChains (1)
• PSEMHUB (1)
• PsExec (1)
• PSIGW (1)
• psychological operations (1)
• PTC (1)
• PteroBox (2)
• PteroPaste (2)
• PteroPSDoor (2)
• PteroSetup (2)
• PteroVDoor (2)
• public exploit (2)
• public file-transfer exfiltration (1)
• public sector (2)
• pull requests (1)
• PUP (1)
• PureLogs Stealer (1)
• pwn-request (1)
• PyArmor (2)
• PyPI (10)
• Python (8)
• Python extension modules (1)
• Python malware (2)
• Python stealer (1)
• QiAnXin XLab (2)
• Qilin (2)
• QNAP (1)
• QR code interception (1)
• query injection (1)
• Quest KACE SMA (1)
• QuimaRAT (1)
• RaaS (1)
• race condition (1)
• RainbowEx (1)
• RakNet flood (1)
• RAM disk (1)
• Ransom-ISAC (1)
• ransomware (9)
• ransomware access (1)
• ransomware enablement (1)
• ransomware-access (1)
• rapid exploitation (2)
• RAR archives (1)
• RAR staging (2)
• RAT (25)
• RC4 (4)
• RC4 C2 (1)
• RCE (6)
• Rclone (1)
• rclone (1)
• RCS (1)
• RDP (1)
• RDP phishing (1)
• RDS (1)
• Reality (1)
• Reaper (1)
• reconnaissance (2)
• recovery denial (1)
• recovery disruption (2)
• recruitment lures (1)
• Red Dev 10 (2)
• Red Hat (1)
• REDCap (1)
• Redis (2)
• Redis backdoor (1)
• RediSearch (1)
• reflective .NET loading (1)
• refresh token theft (1)
• refresh tokens (1)
• RegAsm process hollowing (1)
• registry persistence (5)
• registry-controls (1)
• release automation (1)
• release tampering (1)
• remote access (6)
• Remote Access VPN (1)
• remote code execution (9)
• remote debugging (2)
• remote monitoring and management (1)
• remote script injection (1)
• Remote Support (1)
• remote support (2)
• remote-access (1)
• Remotely (1)
• RemotePE (1)
• RemotePELoader (1)
• removable media (1)
• Rentry (1)
• replication (1)
• repo-server (1)
• repository poisoning (2)
• residential proxies (1)
• residential proxy (1)
• REST C2 (1)
• restart-triggered execution (1)
• reverse proxy (1)
• reverse SSH tunneling (2)
• REVERSE_PROXY_TRUSTED_PROXIES (1)
• ReverseSocks (1)
• reviewdog (1)
• RingH23 (1)
• RMM (3)
• RMM abuse (7)
• ROADrecon (1)
• ROADtools (1)
• roadtx (1)
• RokRAT (1)
• Rollup (1)
• RomulusLoader (1)
• Roo-Code (1)
• root (1)
• root escalation (1)
• root execution (2)
• rootkit (4)
• ROPC (1)
• Rouki obfuscation (1)
• Roundcube (1)
• router (1)
• router malware (1)
• RSA (1)
• RSA-2048 (1)
• RT-Thread (1)
• RTL819X (1)
• RubyGems (2)
• rundll32 (1)
• Runner.Worker (1)
• runtime execution (1)
• runtime mutation (1)
• runZero (1)
• Russia (8)
• Russia-linked (3)
• Russia-linked cybercrime (1)
• Russia-nexus (2)
• Russian Intelligence Services (1)
• Russian-speaking forums (1)
• Rust (7)
• Rust malware (2)
• S3 Browser (1)
• S3-compatible storage (1)
• s5cmd (1)
• SaaS (3)
• SaaS exposure (1)
• sabotage (2)
• Safari (1)
• SafeDep (3)
• Salesforce (2)
• SAML IdP (1)
• Samsung TizenRT (1)
• sandboxing (1)
• scam infrastructure (1)
• scambling (1)
• scanner evasion (1)
• ScarCruft (1)
• scheduled task (3)
• scheduled task persistence (5)
• scheduled tasks (4)
• scope squatting (1)
• screen capture (2)
• ScreenConnect (4)
• screenshot theft (2)
• script-injection (1)
• SD-WAN (1)
• search hijacking (1)
• search result poisoning (1)
• Secret Blizzard (3)
• secret exposure (1)
• secrets (5)
• secrets management (1)
• Secure Preferences (1)
• security platform (1)
• seed phrase theft (1)
• Seedworm (2)
• segmented networks (1)
• Sekoia (1)
• self-delete (1)
• self-hosted AI services (1)
• self-hosted media (1)
• self-propagation (1)
• semantic-release (1)
• sendit.sh (1)
• sensitive information exposure (1)
• Sentinel (1)
• Sentry (1)
• Sentry abuse (1)
• SEO poisoning (4)
• Serv-U (1)
• service accounts (1)
• service-agent (1)
• ServiceNow (1)
• session hijacking (2)
• session secret exposure (1)
• session theft (1)
• session token theft (1)
• shadow copy deletion (2)
• shadow MMU (1)
• SHADOW-AETHER-040 (1)
• SHADOW-AETHER-064 (1)
• SHADOW-EARTH-066 (1)
• SHADOW-WATER-063 (1)
• ShadowPad (2)
• Shai-Hulud (7)
• SHARDLOADER (2)
• share propagation (1)
• shared hosting (3)
• shared secrets (1)
• SharePoint (3)
• SharePoint Server (1)
• SharkLoader (1)
• shell injection (1)
• ShinyHunters (2)
• Shuckworm (1)
• SideCopy (1)
• Signal (1)
• Signal interception (1)
• signed malware (1)
• signed updates (1)
• signed-binary (1)
• Silent Ransom Group (1)
• Silent Swap (1)
• SilentCryptoMiner (1)
• SilentRunLoader (1)
• SiliconFlow (1)
• SimpleHelp (3)
• simulation tampering (1)
• Site Member permissions (1)
• skb (1)
• SkillCloak (1)
• SkillDetonate (1)
• sleeper packages (1)
• Sliver (2)
• SLSA (1)
• smart TVs (1)
• SmartScreen (1)
• SMB (1)
• SMB brute force (1)
• SMB egress (1)
• smishing (4)
• sms-phishing (1)
• SMTP (1)
• Snake (1)
• SNOWLIGHT (1)
• SocGholish (1)
• social engineering (14)
• social-engineering (2)
• Socket (1)
• Socket Security Research (1)
• Socket.IO (1)
• SOCKS tunneling (1)
• SOCKS5 (4)
• SOCKS5 tunneling (1)
• SoftEther VPN (2)
• software impersonation (1)
• software supply chain (1)
• software-deployment (1)
• SOHO router (1)
• SOHO routers (1)
• Solana (2)
• SolarWinds (1)
• Solid PDF Creator (1)
• SolidPDFCreator.dll (1)
• SolidPDFPcl2Bmp (1)
• Sophos (1)
• source control (1)
• source-code compromise (1)
• source-package drift (1)
• source-package mismatch (1)
• source-repository poisoning (3)
• SourceForge abuse (1)
• South Africa (1)
• South Asia (1)
• South Korea (2)
• Southeast Asia (5)
• spam (1)
• spear phishing (8)
• spear-phishing (2)
• spearphishing (1)
• SPECTRALVIPER (1)
• Sphinx ransomware (1)
• SpiderLabs (1)
• Splunk (1)
• SprySOCKS (2)
• SQL injection (3)
• SQLite (1)
• SquareShell (1)
• SSH (2)
• SSH bastion (1)
• SSH brute force (1)
• SSH key exposure (1)
• SSH key persistence (1)
• SSH keys (1)
• SSH lateral movement (1)
• SSH persistence (1)
• SSH tunnels (1)
• SSL VPN (1)
• SSRF (3)
• staged malicious update (1)
• stale access (1)
• stale credentials (1)
• Startup folder persistence (1)
• state-linked (1)
• state-owned enterprise (1)
• Static Kitten (1)
• stdio (3)
• StealC (1)
• stealer (2)
• steganography (1)
• StegoAd (1)
• STM32Cube (1)
• stock exchange (1)
• STOCKSTAY (3)
• storage deletion (1)
• Storm-2603 (1)
• Storm-2697 (1)
• Storm-3075 (1)
• STRD (3)
• streaming boxes (1)
• STUN (1)
• Stuxnet lineage (1)
• subject claim (1)
• SUMMIT (3)
• Supabase (1)
• supply chain (5)
• supply chain compromise (1)
• supply-chain (81)
• suspected China-aligned (1)
• SWE-agent (1)
• SWUpdate (1)
• Symantec Threat Hunter Team (1)
• symlink following (1)
• Synacktiv (1)
• Synology (1)
• Sysdig (2)
• SYSTEM (1)
• systemd-userdbd (1)
• T1204.004 (1)
• T3 (1)
• TA427 (1)
• TA569 (1)
• Tactical RMM (1)
• tag rewrite (1)
• tag tampering (4)
• TAG-124 (1)
• TAG-22 (2)
• Taiwan (7)
• takedown (3)
• TamperedChef (1)
• targeted operations (1)
• TartarusGate (1)
• TaskWeaver (3)
• tax-season phishing (1)
• tc (1)
• TCP traffic diversion (1)
• TDS (1)
• TeamPCP (8)
• TeamPCP-adjacent (1)
• Teams access (1)
• TeamViewer (1)
• TEASOUP (1)
• Tebi (1)
• technician session (1)
• telecom (2)
• telecom-impersonation (1)
• telecommunications (1)
• Telegra.ph (1)
• Telegram (6)
• telegram (1)
• Telegram C2 (3)
• Telegram exfiltration (1)
• telemetry (1)
• Teletype (1)
• Telnet brute force (1)
• Telnyx (1)
• Temp Zagros (1)
• tenant-project (1)
• Tenda (1)
• Tenet Security (1)
• Tetrade (1)
• Thailand (3)
• The Gentlemen (1)
• The Hacker News (3)
• third-party integrations (1)
• threat hunting (1)
• ThrottleBlood (1)
• thumbnail generation (1)
• TinyGo (1)
• TinyRCT (3)
• tj-actions (1)
• ToddyCat (3)
• token forgery (1)
• token replay (1)
• token theft (2)
• token-theft (1)
• TONESHELL (2)
• tool (1)
• tool output injection (1)
• tool poisoning (1)
• tool use (1)
• tooling (5)
• tools (20)
• Tor (3)
• Total Software Deployment (1)
• Trading Technologies (1)
• traffic control (1)
• traffic hijacking (1)
• traffic-distribution-system (1)
• traffic-fraud (1)
• transaction authority (1)
• transnational repression (1)
• Transparent Tribe (2)
• Trend Micro (3)
• TrendAI (1)
• TrickBot (1)
• Trident Ursa (1)
• Tron (1)
• trusted publishing (1)
• tunnel decapsulation (1)
• tunnel services (1)
• Turla (4)
• Turla collaboration (1)
• Twilio (1)
• TypeScript (1)
• typosquat (1)
• typosquatting (11)
• UAC (1)
• UAC bypass (1)
• UAC-0010 (3)
• UAC-0098 (1)
• UAC-0194 (3)
• UAC-0226 (1)
• UAT-7237 (3)
• Ubiquiti (1)
• Ubuntu (1)
• Udev persistence (1)
• UDP C2 (1)
• Ukraine (9)
• Ukraine targeting (3)
• UltraVNC (1)
• Umbrij (3)
• unauthenticated access (1)
• unauthenticated HTTP exploitation (1)
• unauthenticated RCE (3)
• UNC1543 (1)
• UNC2814 (1)
• UNC3753 (1)
• UNC4221 (1)
• UNC4736 (1)
• UNC5792 (1)
• UNC6240 (2)
• UNC6508 (1)
• UNC6671 (1)
• UNC6692 (2)
• UNC6780 (1)
• Uni-App (1)
• UniFi OS (1)
• Unified CM SME (1)
• uninitialized heap memory (1)
• Unit 42 (3)
• United States (2)
• university targeting (1)
• UNK_MassTraction (1)
• unpatched vulnerability (1)
• unsafe deserialization (1)
• unsigned installer (1)
• uranium compression (1)
• USB propagation (1)
• USB weaponizer (1)
• USB worm (2)
• use-after-free (1)
• user execution (1)
• user namespaces (2)
• UTA0355 (1)
• uTLS (1)
• V4bel (1)
• V8 (1)
• valid accounts (1)
• ValleyRAT (1)
• VBCloud (1)
• VBE (1)
• VBS (1)
• VBScript (6)
• VEIL#DROP (1)
• Velociraptor (1)
• Velvet Ant (2)
• VELVETSHELL (1)
• vendor compromise (1)
• vendor credentials (1)
• VENOMOUS BEAR (3)
• Vercel (1)
• Vertex AI (1)
• Vidar Stealer (1)
• Vietnam (2)
• Vietnam-aligned (1)
• Views (1)
• ViewState deserialization (1)
• virtualization (2)
• VirusTotal sentiment abuse (1)
• vishing (2)
• Visual Studio (1)
• Visual Studio Code Remote SSH (1)
• VLESS (1)
• vManage (1)
• VMware (2)
• VNT (2)
• Volt Typhoon (1)
• VPN (5)
• VPN gateway (1)
• VPN Go (1)
• VPN session hijacking (1)
• VS Code (8)
• VS Code tunnels (1)
• VShell (1)
• VSIX (1)
• vSphere (2)
• VU#213560 (1)
• vulnerability (18)
• vulnerability research (2)
• vulnerability-research (1)
• VXLAN (1)
• w3wp.exe (1)
• wallet address replacement (1)
• wallet drainer (1)
• wallet infrastructure (1)
• wallet replacement (1)
• wallet theft (4)
• wallet-drainer (1)
• wallet-theft (3)
• Wasabi (2)
• watchdog (1)
• watchTowr (3)
• watering hole (1)
• watering-hole (2)
• weak passwords (1)
• web application (4)
• web hosting (2)
• web IDE (1)
• web management interface (1)
• web RCE (1)
• web shell (5)
• web shells (3)
• web supply chain (1)
• web-shells (1)
• WebAssembly (1)
• WebKit (1)
• WebLogic (1)
• webmail (1)
• WebRTC (1)
• webshell (1)
• website-compromise (1)
• WebSocket (1)
• WebSocket C2 (6)
• websocket-sharp (1)
• WebView (1)
• Webworm (1)
• WhatsApp (2)
• WhatsApp phishing (1)
• WHM (3)
• Widget Factory (1)
• WILDDAY (2)
• Windchill (1)
• Windchill PDMLink (1)
• WinDirStat (1)
• Windows (23)
• Windows Defender exclusions (1)
• Windows Forms (1)
• Windows malware (5)
• Windows persistence (1)
• Windows Run dialog (1)
• Windows Script Host (2)
• Windows service persistence (1)
• Windows Terminal (1)
• Winnti Group (2)
• Winos4.0 (1)
• WinPython (1)
• WinRAR (4)
• wiper (2)
• wiper-adjacent (1)
• WireGuard (2)
• Wiz Research (1)
• WM_COPYDATA IPC (1)
• Woodgnat (1)
• WordPress (4)
• WordPress credential theft (1)
• workflow backdoor (1)
• workspace trust (1)
• World Cup (1)
• worm (12)
• WP Maps Pro (1)
• WScript (1)
• X-Secret (1)
• X-WEBAUTH-USER (1)
• X_TRADER (1)
• XChaCha20 (1)
• XenoRAT (2)
• XFRM (1)
• xlabs_v1 (1)
• XMLDecoder (1)
• XMRig (4)
• XOR (1)
• XOR obfuscation (1)
• XSLT SSRF (1)
• XSS (1)
• XSS.is (1)
• XXE (1)
• xz (1)
• Yanbian (1)
• YesWeHack (1)
• YouTube abuse (1)
• Yuechi Shared Technology (1)
• yuze (2)
• ZAPiXDESK (1)
• Zendesk (1)
• Zephyr RTOS (1)
• Zero Trust (1)
• zero-click (1)
• zero-day (3)
• zero-reputation infrastructure (1)
• Zoho Assist (2)
• Zoho WorkDrive (2)
• ZOHOMURK (2)

.NET

• Operation XENOFISCAL SideCopy XenoRAT campaign
• Sicoob.Sdk NuGet banking certificate stealer
• STOCKSTAY
• TinyRCT
• Umbrij

.NET malware

• Avalon / CrownX malware framework
• Cavern
• Cavern Manticore
• Silent Swap Google Notes crypto clipper
• ToddyCat Umbrij Gmail OAuth operation
• Turla STOCKSTAY backdoor operations

.pth

• binding.gyp npm CI/CD worm

/accessv2

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

/dev/kvm

• Januscape KVM CVE-2026-53359 guest-to-host escape

146.70.139.154

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

192.42.116.105

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

192.42.116.58

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

3CX

• 3CX desktop app compromise

404 TDS

• Backdoor.Mistic / KongTuke ModeloRAT activity

4sync

• GREYVIBE

@marketfront

• @marketfront / @tqm-mfe dependency-confusion stealer

@tqm-mfe

• @marketfront / @tqm-mfe dependency-confusion stealer

<all_urls>

• Adblock for YouTube BadBlocker remote-script injection risk

Ababil of Minab

• Ababil of Minab MOIS-linked recovery-destruction campaign

abuse response

• Malicious infrastructure provider concentration

academic research

• UNC6508

academic sector

• UNK_MassTraction Roundcube university mailserver campaign

Accellion

• Accellion FTA exploitation campaign

access brokers

• StealC / Amadey infrastructure disruption

account takeover

• Russian intelligence commercial-messaging backup-key phishing

account-takeover

• node-ipc 2026 npm maintainer-account compromise

act_pedit

• Linux pedit COW CVE-2026-46331 local privilege escalation

ACTINIUM

• Gamaredon

Active Directory

• Cavern

active exploitation

• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation
• Check Point VPN CVE-2026-50751 exploitation
• Chrome V8 CVE-2026-11645 exploitation
• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation
• Cisco Unified CM CVE-2026-20230 file-write exploitation
• Drupal Core CVE-2026-9082 exploitation
• Everest Forms Pro CVE-2026-3300 exploitation
• FortiBleed Fortinet credential exposure
• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign
• Ghost CMS CVE-2026-26980 ClickFix poisoning
• Gitea Docker CVE-2026-20896 probing
• Gravity SMTP CVE-2026-4020 exploitation
• Ivanti Sentry CVE-2026-10520 exploitation
• Joomla JCE CVE-2026-48907 exploitation
• KnowledgeDeliver CVE-2026-5426 ViewState exploitation
• Langflow CVE-2026-33017 cryptominer SSH worm
• Lantronix EDS5000 CVE-2025-67038 exploitation
• LiteLLM CVE-2026-42271 MCP stdio command injection
• LiteSpeed cPanel CVE-2026-48172 exploitation
• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation
• Microsoft SharePoint CVE-2026-45659 RCE exploitation
• MiniPlasma Windows Cloud Filter LPE exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• Oracle E-Business Suite CVE-2026-46817 exploitation
• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• Oracle WebLogic CVE-2024-21182 exploitation
• PAN-OS GlobalProtect CVE-2026-0257 exploitation
• PraisonAI CVE-2026-44338 rapid exploitation
• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE
• PTC Windchill / FlexPLM CVE-2026-12569 exploitation
• ServiceNow instance unauthenticated table-query exploitation
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• SolarWinds Serv-U CVE-2026-28318 exploitation
• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE
• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation
• WP Maps Pro CVE-2026-8732 exploitation

active probing

• Gitea Docker CVE-2026-20896 probing

active-exploitation

• DAEMON Tools Lite supply-chain compromise

ActiveX

• Crypto Clipper Tor / USB worm

actor

• Mustang Panda
• ShinyHunters
• UNC3753
• Velvet Ant

actors

• Armored Likho
• Cavern Manticore
• Fox Tempest
• JINX-0164
• Mustang Panda
• OP-512
• TA4922
• ToddyCat
• Webworm

ad blocker

• Adblock for YouTube BadBlocker remote-script injection risk

ad fraud

• StegoAd Edge extension steganography campaign

Adaptix C2

• Operation Dragon Weave Azure Blob C2 campaign

ADB TCP/5555

• xlabs_v1 DDoS-for-hire IoT botnet

Adblock for YouTube

• Adblock for YouTube BadBlocker remote-script injection risk

Admin API key theft

• Ghost CMS CVE-2026-26980 ClickFix poisoning

administrator account creation

• Everest Forms Pro CVE-2026-3300 exploitation
• WP Maps Pro CVE-2026-8732 exploitation

Adobe ColdFusion

• Adobe ColdFusion APSB26-68 CVE bonanza

Adobe Commerce

• Mirasvit Cache Warmer CVE-2026-45247 exploitation

Adspect

• Ghost CMS CVE-2026-26980 ClickFix poisoning

Adversa AI

• GuardFall AI-agent shell-guard bypass

adversary-in-the-middle

• AI-brand impersonation phishing and malvertising
• Chinese-language PhaaS wallet-tokenization ecosystem

adware

• Chrome live-wallpaper extension ad-fraud network
• Operation FlutterBridge FlutterShell macOS malvertising
• TamperedChef-style productivity malware clusters

adware history

• Adblock for YouTube BadBlocker remote-script injection risk

AES-128-CBC

• TinyRCT

AES-256-GCM

• Djinn Stealer

AES-GCM

• macOS.Gaslight Rust backdoor

AES-GCM C2

• RustDuck

affiliate hijacking

• StegoAd Edge extension steganography campaign

Afghanistan

• Operation XENOFISCAL SideCopy XenoRAT campaign
• SideCopy

agent frameworks

• Agent localhost control-plane RCE
• MCP stdio command-execution boundary
• PraisonAI CVE-2026-44338 rapid exploitation

agent memory

• AI-agent memory poisoning

agent skills

• Agent skill marketplace poisoning

agent state

• LangGraph checkpointer injection and unsafe deserialization

agentic AI

• SHADOW-AETHER AI-augmented Latin America intrusions

agentic browsers

• AI-augmented adversary operations

agentic malware

• AI-augmented adversary operations

agentic ransomware

• JADEPUFFER Langflow agentic ransomware

agentic threat actor

• JADEPUFFER Langflow agentic ransomware

Agentjacking

• Sentry MCP Agentjacking

AGENTPSD

• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation

AI

• AI-augmented adversary operations
• GREYVIBE
• Vertex AI staging-bucket squatting
• Xinference PyPI compromise

AI agent

• JADEPUFFER Langflow agentic ransomware

AI agents

• Agent localhost control-plane RCE
• Agent skill marketplace poisoning
• AI-agent memory poisoning
• Amazon Q CVE-2026-12957 MCP auto-execution
• GuardFall AI-agent shell-guard bypass
• Langflow CVE-2025-34291 exploitation
• LangGraph checkpointer injection and unsafe deserialization
• Marimo CVE-2026-39987 LLM-agent post-exploitation
• MCP stdio command-execution boundary
• MCP tool-description poisoning
• NATS-as-C2 KeyHunter credential-harvesting operation
• Phantom squatting: AI-hallucinated domains
• PraisonAI CVE-2026-44338 rapid exploitation
• Sentry MCP Agentjacking

AI anti-analysis

• macOS.Gaslight Rust backdoor

AI application infrastructure

• Langflow CVE-2026-33017 cryptominer SSH worm

AI assistant credentials

• Djinn Stealer
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation

AI assistants

• binding.gyp npm CI/CD worm
• Claude Code GitHub Action prompt-injection boundary
• Developer-tool config auto-execution
• Immobiliare Labs Backstage plugins npm compromise

AI brand impersonation

• AI-brand impersonation phishing and malvertising
• Perplexity AI-spoofing Chromium extension search hijacker

AI browsers

• AI-augmented adversary operations

AI chatbot abuse

• AI chatbot and SEO poisoning GPU-cryptojacking campaign

AI credential theft

• NATS-as-C2 KeyHunter credential-harvesting operation

AI data exfiltration

• Operation FlutterBridge FlutterShell macOS malvertising

AI framework

• Mastra easy-day-js npm scope compromise

AI gateway

• LiteLLM CVE-2026-42271 MCP stdio command injection

AI search poisoning

• AI chatbot and SEO poisoning GPU-cryptojacking campaign

AI security

• AI scanner anti-analysis

AI tooling

• @withgoogle/stitch-sdk scope squat
• Amazon Q CVE-2026-12957 MCP auto-execution
• codexui-android OpenAI token stealer
• JetBrains AI plugin API-key theft
• LangGraph checkpointer injection and unsafe deserialization
• Malware-Slop Claude user-data npm infostealer
• MCP stdio command-execution boundary
• MCP tool-description poisoning
• Ollama P2P cryptominer RAT campaign
• Phantom squatting: AI-hallucinated domains
• Polymarket npm wallet-drainer packages
• PraisonAI CVE-2026-44338 rapid exploitation
• SANDWORM_MODE AI-toolchain npm worm
• Sentry MCP Agentjacking
• TrapDoor crypto-stealer cross-ecosystem campaign

AI vulnerability discovery

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

ai-abuse

• Outsider Enterprise smishing PhaaS

ai-agent

• HackerBot Claw

AI-assisted malware

• Avalon / CrownX malware framework

AI-assisted vulnerability discovery

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

AI-augmented operations

• SHADOW-AETHER AI-augmented Latin America intrusions

AI-generated malware

• Malware-Slop Claude user-data npm infostealer

AI-generated narrator

• Fake-reputation crypto clipboard hijacker

Aider

• GuardFall AI-agent shell-guard bypass

AiTM

• BlackFile / UNC6671 vishing extortion operation

Albania

• Handala

Amadey

• StealC / Amadey infrastructure disruption

Amazon Q Developer

• Amazon Q CVE-2026-12957 MCP auto-execution

AMSI bypass

• ClickFix CPaaS API-driven payload delivery
• Operation DragonReturn India tax-season DcRAT campaign

Android

• Android Framework CVE-2025-48595 exploitation
• codexui-android OpenAI token stealer
• Grandoreiro and BTMOB Latin America / Europe malware campaigns
• Linux Bad Epoll CVE-2026-46242 local privilege escalation
• NetNut / Popa residential proxy network disruption
• ScarCruft Yanbian game-platform supply-chain attack

Android ADB

• RustDuck

Android Debug Bridge

• xlabs_v1 DDoS-for-hire IoT botnet

Android spyware

• GREYVIBE

anti-analysis

• AI scanner anti-analysis

anti-forensics

• Avalon / CrownX malware framework
• CrownX

Anubis ransomware

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

Apex One

• Trend Micro Apex One CVE-2026-34926 exploitation

API abuse

• Ollama P2P cryptominer RAT campaign

API exposure

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

API key exposure

• Gravity SMTP CVE-2026-4020 exploitation

API keys

• JetBrains AI plugin API-key theft

API-driven payloads

• ClickFix CPaaS API-driven payload delivery

apintergrationpost

• MYRA RAT

App-Bound Encryption bypass

• StealC / Amadey infrastructure disruption

AppDomainManager

• Screening Serpens

AppDomainManager injection

• CL-STA-1062 Southeast Asia government and energy intrusions
• TinyRCT

AppleJeus

• RemotePE

AppleScript

• PamStealer

AppleSeed

• Kimsuky / Emerald Sleet / TA427

appliance

• Barracuda ESG zero-day backdoor campaign

application delivery controller

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

APSB26-68

• Adobe ColdFusion APSB26-68 CVE bonanza

APT

• Armored Likho
• Armored Likho BusySnake campaign
• Cloud Atlas
• Gamaredon
• Ghostwriter
• Screening Serpens
• ToddyCat

APT27

• AI-augmented adversary operations

APT28

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

APT29

• ROADtools

APT32

• OceanLotus

APT36

• Operation XENOFISCAL SideCopy XenoRAT campaign
• SideCopy

APT37

• ScarCruft Yanbian game-platform supply-chain attack

APT43

• Kimsuky / Emerald Sleet / TA427

APT45

• AI-augmented adversary operations

Aptos

• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer

Aquatic Panda

• FishMonger
• SprySOCKS

AquilaRAT

• Armored Likho

arbitrary file read

• Adobe ColdFusion APSB26-68 CVE bonanza

arbitrary file write

• Adobe ColdFusion APSB26-68 CVE bonanza
• Cisco Unified CM CVE-2026-20230 file-write exploitation
• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE

arbitrary JavaScript

• Adblock for YouTube BadBlocker remote-script injection risk

Arch Linux

• Atomic Arch AUR package hijack

Arctic Wolf

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

ArduPilot

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

Argo CD

• Argo CD repo-server unauthenticated RCE

ArgoCD

• Argo CD repo-server unauthenticated RCE

Arista EOS

• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation

Armageddon

• Gamaredon

Armored Likho

• Armored Likho
• Armored Likho BusySnake campaign
• BusySnake Stealer

Artifact Signing

• Fox Tempest

AryStinger

• AryStinger legacy-router recon proxy network

AS32167

• Azure CLI LSHIY password-spray campaign

Asia targeting

• ToddyCat

ASNs

• Malicious infrastructure provider concentration

ASP.NET

• Oman government Iranian-nexus webshell C2
• OP-512

ASP.NET machineKey

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

ASPX web shells

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions

Astro

• Astro config blockchain C2 PR injection

ASUS router

• UNC6508

AsyncRAT

• ScreenConnect freeware / AsyncRAT SEO campaign

Atlas RAT

• TA4922

AUDIOFIX

• JINX-0164
• JINX-0164 crypto developer infrastructure campaign

audit logging

• AI-agent memory poisoning

AUR

• Atomic Arch AUR package hijack

authenticated RCE

• Microsoft SharePoint CVE-2026-45659 RCE exploitation

authentication bypass

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass
• Check Point VPN CVE-2026-50751 exploitation
• Gitea Docker CVE-2026-20896 probing
• Ivanti Sentry CVE-2026-10520 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• Oracle E-Business Suite CVE-2026-46817 exploitation
• PAN-OS GlobalProtect CVE-2026-0257 exploitation
• PraisonAI CVE-2026-44338 rapid exploitation
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• Tenda firmware CVE-2026-11405 hidden authentication backdoor

authentication laundering

• Photo ZIP hospitality Node.js implant campaign

authentication stack

• Operation Highland Velvet Ant authentication-stack backdoors
• Velvet Ant

authentication-coercion

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

auto-execution

• GuardFall AI-agent shell-guard bypass

AUTODYN

• Fast16

AutoGen Studio

• Agent localhost control-plane RCE

AutoHotKey

• UNC6692 SNOW malware social-engineering campaign

AutoJack

• Agent localhost control-plane RCE

autonomous agents

• Phantom squatting: AI-hallucinated domains

Avalon

• Avalon / CrownX malware framework
• CrownX

AWS

• Amazon Q CVE-2026-12957 MCP auto-execution
• CircleCI 2023 customer secret exposure incident
• NATS-as-C2 KeyHunter credential-harvesting operation
• vpmdhaj OpenSearch npm cloud-secret stealer

AWS CloudTrail

• Cloud logging control-plane tampering

AWS S3

• Cloud bucket namespace hijacking
• UNC6692 SNOW malware social-engineering campaign

AWS Secrets Manager

• Marimo CVE-2026-39987 LLM-agent post-exploitation

axios

• Operation DangerousPassword axios npm compromise

Azure

• Fox Tempest
• Operation Dragon Weave Azure Blob C2 campaign
• ROADtools

Azure CLI

• Azure CLI LSHIY password-spray campaign

Azure Storage

• Cloud bucket namespace hijacking

Backblaze

• Seedworm / MuddyWater

backdoor

• DAEMON Tools Lite supply-chain compromise
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• macOS.Gaslight Rust backdoor
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• Ollama P2P cryptominer RAT campaign
• Operation FlutterBridge FlutterShell macOS malvertising
• shopsprint/decimal Go typosquat DNS backdoor
• Showboat
• SprySOCKS
• STOCKSTAY
• Telnyx PyPI TeamPCP compromise
• TinyRCT

Backdoor.Mistic

• Backdoor.Mistic / KongTuke ModeloRAT activity

Backstage

• Immobiliare Labs Backstage plugins npm compromise

backup disruption

• The Gentlemen ransomware

backup recovery keys

• Russian intelligence commercial-messaging backup-key phishing

backup targeting

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

backups

• Ababil of Minab MOIS-linked recovery-destruction campaign

Bad Epoll

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

BadBlocker

• Adblock for YouTube BadBlocker remote-script injection risk

Badbox 2.0

• NetNut / Popa residential proxy network disruption

Banana RAT

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

banking

• Sicoob.Sdk NuGet banking certificate stealer

banking malware

• Grandoreiro and BTMOB Latin America / Europe malware campaigns

banking trojan

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

Barracuda

• Barracuda ESG zero-day backdoor campaign

BaseZipInstaller

• Silent Swap Google Notes crypto clipper

Bash Uploader

• Codecov Bash Uploader compromise

batch loader

• Thailand healthcare RAR / Python stealer campaign

BeaverTail

• Void Dokkaebi

Bedrock

• NATS-as-C2 KeyHunter credential-harvesting operation

behavioral integrity verification

• Agent skill marketplace poisoning

Belarus

• Cloud Atlas
• Ghostwriter

BELQI

• Kairos data-extortion government payment

BeyondTrust

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass

binary execution

• procwire / routecraft npm Windows dropper

BinaryFormatter

• Operation XENOFISCAL SideCopy XenoRAT campaign

binding.gyp

• binding.gyp npm CI/CD worm
• Immobiliare Labs Backstage plugins npm compromise

BIOPASS RAT

• FishMonger

BioShocking

• AI-augmented adversary operations

BirdCall

• ScarCruft Yanbian game-platform supply-chain attack

Bitbucket

• CircleCI 2023 customer secret exposure incident

Bitcoin

• Kairos data-extortion government payment

Bitwarden

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign

BlackFile

• BlackFile / UNC6671 vishing extortion operation

Blackpoint Cyber

• Avalon / CrownX malware framework
• CrownX
• Djinn Stealer
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• TaskWeaver

blockchain C2

• Astro config blockchain C2 PR injection
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• PolinRider cross-ecosystem supply-chain campaign

blockchain dead drop

• Silent Swap Google Notes crypto clipper

blockchain RPC

• PamStealer

blockchain-dead-drop

• Famous Chollima Packagist dev-branch loader

Blogger abuse

• VEIL#DROP Blogger-hosted PureLogs stealer chain

blogspot staging

• VEIL#DROP Blogger-hosted PureLogs stealer chain

BLUEBEAM

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

botnet

• Dutch Police / NCSC 17-million-device botnet disruption
• Glassworm developer supply-chain botnet
• JDY SOHO / IoT reconnaissance botnet
• NetNut / Popa residential proxy network disruption
• RustDuck
• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

branch-compromise

• Famous Chollima Packagist dev-branch loader

branch-name-injection

• HackerBot Claw GitHub Actions exploitation campaign

brand impersonation

• DCloud Uni-App scam infrastructure ecosystem
• GHOST STADIUM FIFA World Cup ticket phishing

brand-impersonation

• Outsider Enterprise smishing PhaaS

Brazil

• Armored Likho
• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud
• Grandoreiro and BTMOB Latin America / Europe malware campaigns
• SHADOW-AETHER AI-augmented Latin America intrusions

Brazilian banking malware

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

BreachForums

• The Gentlemen ransomware

BRICKSTORM

• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation

Broadcom

• Backdoor.Mistic / KongTuke ModeloRAT activity

browser automation

• Agent localhost control-plane RCE

browser cookie theft

• StealC / Amadey infrastructure disruption

browser credential theft

• Armored Likho BusySnake campaign
• Avalon / CrownX malware framework
• BusySnake Stealer
• Djinn Stealer
• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign
• GREYVIBE
• Lazarus-linked Rollup polyfill npm malware
• macOS.Gaslight Rust backdoor
• PamStealer
• Seedworm / MuddyWater
• Silent Swap Google Notes crypto clipper
• UAC-0226 / SHADOW-EARTH-066
• Void Dokkaebi
• VPN Go browser-extension clipboard stealer

browser extension

• Adblock for YouTube BadBlocker remote-script injection risk
• Perplexity AI-spoofing Chromium extension search hijacker
• Silent Swap Google Notes crypto clipper
• StegoAd Edge extension steganography campaign
• UNC6692 SNOW malware social-engineering campaign
• VPN Go browser-extension clipboard stealer

browser hijacking

• Operation FlutterBridge FlutterShell macOS malvertising
• Perplexity AI-spoofing Chromium extension search hijacker

browser session abuse

• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation

browser session risk

• Adblock for YouTube BadBlocker remote-script injection risk
• Perplexity AI-spoofing Chromium extension search hijacker
• VPN Go browser-extension clipboard stealer

browser zero-day

• Chrome V8 CVE-2026-11645 exploitation

browser-credential-theft

• postcss-minify-selector-parser npm RAT

browser-extensions

• Chrome live-wallpaper extension ad-fraud network
• Glassworm developer supply-chain botnet

browser-security

• Chrome live-wallpaper extension ad-fraud network

browser-session risk

• StegoAd Edge extension steganography campaign

brute-force credentials

• Kairos data-extortion government payment

BSC

• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer

BTMOB

• Grandoreiro and BTMOB Latin America / Europe malware campaigns

bucket hijacking

• Cloud bucket namespace hijacking

bucket squatting

• Vertex AI staging-bucket squatting

build-time compromise

• XZ Utils backdoor

bulletproof hosting

• DCloud Uni-App scam infrastructure ecosystem

Bun

• actions-cool GitHub Actions tag compromise
• codfish semantic-release-action tag compromise

Bun runtime abuse

• vpmdhaj OpenSearch npm cloud-secret stealer

BusySnake Stealer

• Armored Likho
• Armored Likho BusySnake campaign
• BusySnake Stealer

Bybit

• Kairos data-extortion government payment

BYOVD

• Storm-2603 parallel SharePoint ransomware intrusion
• The Gentlemen ransomware

C

• TinyRCT

C++/CLI

• Cavern

C2

• DAEMON Tools Lite supply-chain compromise
• Glassworm developer supply-chain botnet
• Malicious infrastructure provider concentration
• NATS-as-C2 KeyHunter credential-harvesting operation
• Oman government Iranian-nexus webshell C2
• Quest KACE SMA CVE-2025-32975 exploitation
• QuimaRAT
• RemotePE
• Showboat

C2 framework

• Cavern
• Cavern Manticore

C2 tasking

• BusySnake Stealer

CageFS

• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation

Calendly abuse

• Photo ZIP hospitality Node.js implant campaign

campaign

• UNK_MassTraction Roundcube university mailserver campaign

Canada

• Seedworm / MuddyWater

CANFAIL

• AI-augmented adversary operations

CAP_NET_ADMIN

• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux pedit COW CVE-2026-46331 local privilege escalation

Casbaneiro

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

Catalyst SD-WAN Manager

• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation

Cav3rn

• Cavern

Cavern

• Cavern

Cavern Manticore

• Cavern
• Cavern Manticore

CCleaner

• CCleaner signed-update compromise

CDN

• Funnull RingH23 and MacCMS supply-chain attacks

CERT-In

• Mustang Panda ZOHOMURK / MINIRECON India campaigns

CERT/CC

• Tenda firmware CVE-2026-11405 hidden authentication backdoor

certificate pinning

• macOS.Gaslight Rust backdoor

certificate theft

• Sicoob.Sdk NuGet banking certificate stealer

CFIDE

• Adobe ColdFusion APSB26-68 CVE bonanza

ChatGPT

• AI-brand impersonation phishing and malvertising

chattr

• Langflow CVE-2026-33017 cryptominer SSH worm

Chatty Spider

• UNC3753

CHAVECLOAK

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

Check Point

• Check Point VPN CVE-2026-50751 exploitation

Check Point Research

• LangGraph checkpointer injection and unsafe deserialization

Checkmarx

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign

checkpointers

• LangGraph checkpointer injection and unsafe deserialization

China

• Showboat
• Webworm

China-linked

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• FishMonger
• GHOST STADIUM FIFA World Cup ticket phishing
• OP-512
• Operation Dragon Weave Azure Blob C2 campaign
• Operation DragonReturn India tax-season DcRAT campaign
• SprySOCKS

China-nexus

• JDY SOHO / IoT reconnaissance botnet
• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• Operation GriefLure Southeast Asia LNK dropper
• Operation Highland Velvet Ant authentication-stack backdoors
• UNC6508
• UNK_MassTraction Roundcube university mailserver campaign
• Velvet Ant
• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation

China-speaking ecosystem

• TA4922

Chinese-language cybercrime

• Chinese-language PhaaS wallet-tokenization ecosystem

Chinese-language fraud ecosystem

• DCloud Uni-App scam infrastructure ecosystem

Chinese-speaking

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• GHOST STADIUM FIFA World Cup ticket phishing

Chinese-speaking operator

• WhatsApp VBScript ManageEngine RMM campaign

Chisel

• Oman government Iranian-nexus webshell C2
• PCPJack cloud SMTP relay network
• SHADOW-AETHER AI-augmented Latin America intrusions

ChocoPoC

• ChocoPoC fake PoC supply-chain campaign

Chrome

• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

Chrome extension

• PolinRider cross-ecosystem supply-chain campaign

Chrome renderer sandbox

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

Chrome Web Store

• Adblock for YouTube BadBlocker remote-script injection risk
• Chrome live-wallpaper extension ad-fraud network
• Perplexity AI-spoofing Chromium extension search hijacker
• VPN Go browser-extension clipboard stealer

chrome_settings_overrides

• Perplexity AI-spoofing Chromium extension search hijacker

ChromElevator

• Seedworm / MuddyWater

Chromium

• Chrome V8 CVE-2026-11645 exploitation
• Perplexity AI-spoofing Chromium extension search hijacker
• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

Chromium extension

• Silent Swap Google Notes crypto clipper

CI-CD

• Atomic Arch AUR package hijack
• npm install explicit-trust controls

CI/CD

• @marketfront / @tqm-mfe dependency-confusion stealer
• actions-cool GitHub Actions tag compromise
• Argo CD repo-server unauthenticated RCE
• Astro config blockchain C2 PR injection
• binding.gyp npm CI/CD worm
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BufferZoneCorp RubyGems / Go module CI poisoning
• CircleCI 2023 customer secret exposure incident
• Claude Code GitHub Action prompt-injection boundary
• Codecov Bash Uploader compromise
• codfish semantic-release-action tag compromise
• Crypto supply-chain path to transaction authority
• GitHub Actions deployment poisoning
• GitHub Actions OIDC subject-claim collisions
• GuardFall AI-agent shell-guard bypass
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• Immobiliare Labs Backstage plugins npm compromise
• JINX-0164
• JINX-0164 crypto developer infrastructure campaign
• Laravel-Lang Composer tag-rewrite compromise
• Leo Platform npm Miasma-style compromise
• LiteLLM compromise
• Mastra easy-day-js npm scope compromise
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• oob.moika.tech dependency-confusion environment stealer
• Operation DangerousPassword axios npm compromise
• SANDWORM_MODE AI-toolchain npm worm
• simonecorsi/mawesome GitHub Action compromise
• TeamPCP
• Telnyx PyPI TeamPCP compromise
• tj-actions and reviewdog compromise
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• vpmdhaj OpenSearch npm cloud-secret stealer

CircleCI

• CircleCI 2023 customer secret exposure incident

CISA

• FortiBleed Fortinet credential exposure

CISA KEV

• Android Framework CVE-2025-48595 exploitation
• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation
• Ivanti Sentry CVE-2026-10520 exploitation
• Joomla JCE CVE-2026-48907 exploitation
• Lantronix EDS5000 CVE-2025-67038 exploitation
• Linux Kernel CVE-2022-0492 cgroup release_agent exploitation
• LiteLLM CVE-2026-42271 MCP stdio command injection
• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Microsoft SharePoint CVE-2026-45659 RCE exploitation
• Mirasvit Cache Warmer CVE-2026-45247 exploitation
• PTC Windchill / FlexPLM CVE-2026-12569 exploitation
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE
• Trend Micro Apex One CVE-2026-34926 exploitation
• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

Cisco

• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation
• Cisco Unified CM CVE-2026-20230 file-write exploitation

Cisco Nexus

• Velvet Ant

Cisco Unified CM

• Cisco Unified CM CVE-2026-20230 file-write exploitation

Cisco Unified Communications Manager

• Cisco Unified CM CVE-2026-20230 file-write exploitation

Citrine Sleet

• RemotePE

Citrix

• Citrix NetScaler CVE-2026-8451 memory overread
• CitrixBleed session-hijack wave

Citrix NetScaler

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

CitrixBleed

• Citrix NetScaler CVE-2026-8451 memory overread

CitrixBleed 2

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

CKEditor file manager

• Adobe ColdFusion APSB26-68 CVE bonanza

CL-CRI-1089

• Operation FlutterBridge FlutterShell macOS malvertising

CL-STA-1062

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• TinyRCT

Claude

• AI-brand impersonation phishing and malvertising
• Malware-Slop Claude user-data npm infostealer

Claude Code

• @withgoogle/stitch-sdk scope squat
• Claude Code GitHub Action prompt-injection boundary
• Sentry MCP Agentjacking

Clever Cloud

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

ClickFix

• Backdoor.Mistic / KongTuke ModeloRAT activity
• ClickFix CPaaS API-driven payload delivery
• Ghost CMS CVE-2026-26980 ClickFix poisoning
• GREYVIBE
• JINX-0164 crypto developer infrastructure campaign
• StealC / Amadey infrastructure disruption

ClickOnce

• ClickOnce COM hijacking abuse

client-side exploitation

• Chrome V8 CVE-2026-11645 exploitation

Cline

• GuardFall AI-agent shell-guard bypass

clipboard hijacker

• Fake-reputation crypto clipboard hijacker

clipboard injection

• ClickFix CPaaS API-driven payload delivery

clipboard stealer

• VPN Go browser-extension clipboard stealer

clipboard theft

• BusySnake Stealer
• Crypto Clipper Tor / USB worm
• PamStealer
• Silent Swap Google Notes crypto clipper
• VPN Go browser-extension clipboard stealer

clipper

• Crypto Clipper Tor / USB worm
• Fake-reputation crypto clipboard hijacker

Cloaked Ursa

• Microsoft Teams external-chat phishing

cloaking

• Ghost CMS CVE-2026-26980 ClickFix poisoning

cloud

• APT29
• PCPJack cloud SMTP relay network
• ROADtools
• Vertex AI staging-bucket squatting
• Webworm
• Xinference PyPI compromise

cloud C2

• Operation Dragon Weave Azure Blob C2 campaign

cloud credential hunting

• JADEPUFFER Langflow agentic ransomware

cloud credential risk

• VEIL#DROP Blogger-hosted PureLogs stealer chain

cloud credential theft

• AI-augmented adversary operations
• Djinn Stealer
• Marimo CVE-2026-39987 LLM-agent post-exploitation
• NATS-as-C2 KeyHunter credential-harvesting operation
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation

cloud credentials

• Amazon Q CVE-2026-12957 MCP auto-execution
• wshu.net npm credential-stealer campaign

Cloud Files Mini Filter Driver

• MiniPlasma Windows Cloud Filter LPE exploitation

Cloud Filter driver

• MiniPlasma Windows Cloud Filter LPE exploitation

cloud IAM

• GitHub Actions OIDC subject-claim collisions

cloud identity

• Crypto supply-chain path to transaction authority
• Kali365 device-code phishing expansion

cloud identity abuse

• Azure CLI LSHIY password-spray campaign

cloud infrastructure

• PCPJack cloud SMTP relay network

cloud logging

• Cloud logging control-plane tampering

cloud secrets

• @marketfront / @tqm-mfe dependency-confusion stealer
• JINX-0164 crypto developer infrastructure campaign
• oob.moika.tech dependency-confusion environment stealer
• vpmdhaj OpenSearch npm cloud-secret stealer

cloud security

• Cloud bucket namespace hijacking
• Cloud logging control-plane tampering
• PraisonAI CVE-2026-44338 rapid exploitation

cloud service abuse

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• Stock exchange executive mailbox espionage

cloud storage

• Cloud bucket namespace hijacking

cloud storage exfiltration

• Gamaredon

cloud transcoding

• FFmpeg PixelSmash CVE-2026-8461 media-file RCE

Cloudflare

• GHOST STADIUM FIFA World Cup ticket phishing
• Okta support-system compromise

Cloudflare Tunnel

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Storm-2603 parallel SharePoint ransomware intrusion

Cloudflare tunnels

• Kimsuky / Emerald Sleet / TA427

Cloudflare Turnstile

• Photo ZIP hospitality Node.js implant campaign

Cloudflare Workers

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Marimo CVE-2026-39987 LLM-agent post-exploitation
• Polymarket npm wallet-drainer packages
• StegoAd Edge extension steganography campaign

cloudflared

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

CloudLinux

• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation

cluster compromise

• Argo CD repo-server unauthenticated RCE

CMS

• Drupal Core CVE-2026-9082 exploitation
• Everest Forms Pro CVE-2026-3300 exploitation
• Ghost CMS CVE-2026-26980 ClickFix poisoning
• Gravity SMTP CVE-2026-4020 exploitation
• Joomla JCE CVE-2026-48907 exploitation
• WP Maps Pro CVE-2026-8732 exploitation

Cobalt Strike

• FishMonger
• Ghostwriter
• KnowledgeDeliver CVE-2026-5426 ViewState exploitation
• Malicious infrastructure provider concentration
• StrikeShark SharkLoader / Cobalt Strike campaign

code execution

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

code sandbox scraping

• NATS-as-C2 KeyHunter credential-harvesting operation

code signing

• AI-brand impersonation phishing and malvertising
• Fox Tempest
• TamperedChef-style productivity malware clusters

Codecov

• Codecov Bash Uploader compromise

CodeQL

• Argo CD repo-server unauthenticated RCE

Codex

• codexui-android OpenAI token stealer
• Sentry MCP Agentjacking

coding agents

• GuardFall AI-agent shell-guard bypass

Coinbase

• tj-actions and reviewdog compromise

ColdFusion

• Adobe ColdFusion APSB26-68 CVE bonanza

collaboration platforms

• Microsoft SharePoint CVE-2026-45659 RCE exploitation

collaboration-tool phishing

• Microsoft Teams external-chat phishing

COM-hijacking

• ClickOnce COM hijacking abuse

command and control

• Malicious infrastructure provider concentration

command execution

• Agent localhost control-plane RCE
• Argo CD repo-server unauthenticated RCE
• GuardFall AI-agent shell-guard bypass
• MCP stdio command-execution boundary
• Ollama P2P cryptominer RAT campaign

command injection

• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation
• Ivanti Sentry CVE-2026-10520 exploitation
• Lantronix EDS5000 CVE-2025-67038 exploitation
• LiteLLM CVE-2026-42271 MCP stdio command injection
• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE
• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

command-execution

• shopsprint/decimal Go typosquat DNS backdoor

command-injection

• GitHub Actions deployment poisoning

commercial messaging applications

• Russian intelligence commercial-messaging backup-key phishing

communications infrastructure

• Cisco Unified CM CVE-2026-20230 file-write exploitation

Composer

• Famous Chollima Packagist dev-branch loader
• GitHub / Packagist postinstall hook campaign
• Laravel-Lang Composer tag-rewrite compromise
• PolinRider cross-ecosystem supply-chain campaign

compromised accounts

• Ghostwriter
• WhatsApp VBScript ManageEngine RMM campaign

compromised credentials

• Operation DangerousPassword axios npm compromise

compromised infrastructure

• Turla STOCKSTAY backdoor operations

compromised WordPress

• Backdoor.Mistic / KongTuke ModeloRAT activity
• ClickFix CPaaS API-driven payload delivery

Conditional Access

• Azure CLI LSHIY password-spray campaign

configuration theft

• FortiBleed Fortinet credential exposure

confused deputy

• Agent localhost control-plane RCE

ConfuserEx

• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

ConnectWise

• ConnectWise ScreenConnect exploitation wave

ConnectWise ScreenConnect

• ScreenConnect freeware / AsyncRAT SEO campaign

consumer devices

• Dutch Police / NCSC 17-million-device botnet disruption

consumer IoT

• NetNut / Popa residential proxy network disruption

Contagious Interview

• Famous Chollima Packagist dev-branch loader
• PolinRider cross-ecosystem supply-chain campaign
• StegaBin Pastebin-steganography npm campaign

container

• Linux Kernel CVE-2022-0492 cgroup release_agent exploitation

container escape

• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux nftables CVE-2026-23111 public LPE exploits
• Linux pedit COW CVE-2026-46331 local privilege escalation

container escape pre-check

• JADEPUFFER Langflow agentic ransomware

content compliance rules

• UNC6508

context flooding

• AI scanner anti-analysis

Continue

• GuardFall AI-agent shell-guard bypass

continuous visibility

• Cloud logging control-plane tampering

control panel compromise

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

control plane

• ServiceNow instance unauthenticated table-query exploitation

cookie theft

• Armored Likho BusySnake campaign
• BusySnake Stealer
• StegoAd Edge extension steganography campaign

Copilot

• MCP tool-description poisoning

Copy-on-Write

• Linux pedit COW CVE-2026-46331 local privilege escalation

Coruna

• art-template Coruna-style iOS watering-hole compromise

COW

• Linux pedit COW CVE-2026-46331 local privilege escalation

CPaaS

• ClickFix CPaaS API-driven payload delivery

cPanel

• LiteSpeed cPanel CVE-2026-48172 exploitation
• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

CrackMapExec

• SHADOW-AETHER AI-augmented Latin America intrusions

Crates.io

• TrapDoor crypto-stealer cross-ecosystem campaign

credential attacks

• Kairos data-extortion government payment
• NetNut / Popa residential proxy network disruption

credential exposure

• FortiBleed Fortinet credential exposure
• Sentry MCP Agentjacking

credential harvesting

• UNC6508

credential spraying

• Quest KACE SMA CVE-2025-32975 exploitation

credential stuffing

• Azure CLI LSHIY password-spray campaign
• FortiBleed Fortinet credential exposure

credential theft

• @withgoogle/stitch-sdk scope squat
• Agent skill marketplace poisoning
• AI-brand impersonation phishing and malvertising
• Amazon Q CVE-2026-12957 MCP auto-execution
• Avalon / CrownX malware framework
• Browser-based developer IDE OAuth token theft
• Chinese-language PhaaS wallet-tokenization ecosystem
• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign
• FortiBleed Fortinet credential exposure
• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign
• GHOST STADIUM FIFA World Cup ticket phishing
• Langflow CVE-2025-34291 exploitation
• Lazarus-linked Rollup polyfill npm malware
• LiteLLM compromise
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• Operation FlutterBridge FlutterShell macOS malvertising
• Operation Highland Velvet Ant authentication-stack backdoors
• PCPJack cloud SMTP relay network
• PolinRider cross-ecosystem supply-chain campaign
• QuimaRAT
• ScreenConnect freeware / AsyncRAT SEO campaign
• Seedworm / MuddyWater
• Solana FakeFix npm / PyPI developer stealer
• StealC / Amadey infrastructure disruption
• StegoAd Edge extension steganography campaign
• Stock exchange executive mailbox espionage
• Telnyx PyPI TeamPCP compromise
• Trivy compromise
• Umbrij
• UNC6692 SNOW malware social-engineering campaign
• UNK_MassTraction Roundcube university mailserver campaign
• VEIL#DROP Blogger-hosted PureLogs stealer chain

credential-theft

• @marketfront / @tqm-mfe dependency-confusion stealer
• actions-cool GitHub Actions tag compromise
• APT29
• Atomic Arch AUR package hijack
• binding.gyp npm CI/CD worm
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BufferZoneCorp RubyGems / Go module CI poisoning
• codexui-android OpenAI token stealer
• codfish semantic-release-action tag compromise
• DAEMON Tools Lite supply-chain compromise
• Developer-tool config auto-execution
• Famous Chollima Packagist dev-branch loader
• faster-axios / turbo-axios Epsilon Stealer npm campaign
• forge-jsxy
• GitHub / Packagist postinstall hook campaign
• Glassworm developer supply-chain botnet
• Grandoreiro and BTMOB Latin America / Europe malware campaigns
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• Hunt.io global smishing infrastructure campaign
• Immobiliare Labs Backstage plugins npm compromise
• IronWorm npm Rust infostealer campaign
• JetBrains AI plugin API-key theft
• JINX-0164
• JINX-0164 crypto developer infrastructure campaign
• js-logger-pack Hugging Face exfiltration campaign
• Kali365 device-code phishing expansion
• Laravel-Lang Composer tag-rewrite compromise
• Leo Platform npm Miasma-style compromise
• Malware-Slop Claude user-data npm infostealer
• Mastra easy-day-js npm scope compromise
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• node-ipc 2026 npm maintainer-account compromise
• Nx Console VS Code extension compromise
• Oman government Iranian-nexus webshell C2
• oob.moika.tech dependency-confusion environment stealer
• Operation DangerousPassword axios npm compromise
• Operation GriefLure Southeast Asia LNK dropper
• Outsider Enterprise smishing PhaaS
• postcss-minify-selector-parser npm RAT
• SANDWORM_MODE AI-toolchain npm worm
• Sicoob.Sdk NuGet banking certificate stealer
• simonecorsi/mawesome GitHub Action compromise
• StegaBin Pastebin-steganography npm campaign
• Storm-2603 parallel SharePoint ransomware intrusion
• TA4922
• TrapDoor crypto-stealer cross-ecosystem campaign
• UNK_DeadDrop developer repository phishing
• vpmdhaj OpenSearch npm cloud-secret stealer
• wshu.net npm credential-stealer campaign
• Xinference PyPI compromise

criminal infrastructure

• First VPN

critical infrastructure

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• Operation Highland Velvet Ant authentication-stack backdoors
• Velvet Ant

critical-infrastructure

• Dragonfly
• Showboat

CRM data theft

• Klue Salesforce OAuth token abuse

cron

• MYRA RAT

cron persistence

• Langflow CVE-2026-33017 cryptominer SSH worm

cross-platform

• Djinn Stealer

cross-platform malware

• QuimaRAT

CrownX

• Avalon / CrownX malware framework
• CrownX

crypto

• Polymarket npm wallet-drainer packages
• TrapDoor crypto-stealer cross-ecosystem campaign

crypto clipper

• Silent Swap Google Notes crypto clipper

crypto wallets

• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• wshu.net npm credential-stealer campaign

crypto-wallets

• faster-axios / turbo-axios Epsilon Stealer npm campaign

cryptocurrency

• Crypto Clipper Tor / USB worm
• Crypto supply-chain path to transaction authority
• IronWorm npm Rust infostealer campaign
• JINX-0164
• JINX-0164 crypto developer infrastructure campaign
• Mastra easy-day-js npm scope compromise
• Polymarket npm wallet-drainer packages
• RemotePE
• SANDWORM_MODE AI-toolchain npm worm
• Solana FakeFix npm / PyPI developer stealer
• UNK_DeadDrop developer repository phishing

cryptocurrency scam

• DCloud Uni-App scam infrastructure ecosystem

cryptocurrency theft

• Fake-reputation crypto clipboard hijacker
• Funnull RingH23 and MacCMS supply-chain attacks
• Silent Swap Google Notes crypto clipper
• Void Dokkaebi

cryptocurrency wallet theft

• Avalon / CrownX malware framework

cryptocurrency wallets

• Djinn Stealer
• Lazarus-linked Rollup polyfill npm malware
• PamStealer

cryptojacking

• AI chatbot and SEO poisoning GPU-cryptojacking campaign

cryptominer

• Ollama P2P cryptominer RAT campaign
• Pirated media SilentCryptoMiner RAT campaign

cryptomining

• Langflow CVE-2026-33017 cryptominer SSH worm

Curious Serpens

• ROADtools

Cursor

• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• Sentry MCP Agentjacking
• UNK_DeadDrop developer repository phishing

Curve25519

• The Gentlemen ransomware

custody APIs

• Crypto supply-chain path to transaction authority

CVE-2013-3307

• AryStinger legacy-router recon proxy network

CVE-2016-5681

• AryStinger legacy-router recon proxy network

CVE-2020-17103

• MiniPlasma Windows Cloud Filter LPE exploitation

CVE-2021-29441

• JADEPUFFER Langflow agentic ransomware

CVE-2022-0492

• Linux Kernel CVE-2022-0492 cgroup release_agent exploitation

CVE-2023-24932

• SprySOCKS

CVE-2023-2868

• Barracuda ESG zero-day backdoor campaign

CVE-2023-4966

• CitrixBleed session-hijack wave

CVE-2024-1708

• ConnectWise ScreenConnect exploitation wave

CVE-2024-1709

• ConnectWise ScreenConnect exploitation wave

CVE-2024-20399

• Velvet Ant

CVE-2024-21182

• Oracle WebLogic CVE-2024-21182 exploitation

CVE-2024-3094

• JiaT75
• XZ Utils backdoor

CVE-2024-42009

• UNK_MassTraction Roundcube university mailserver campaign

CVE-2025-11371

• Storm-2603 parallel SharePoint ransomware intrusion

CVE-2025-11837

• AryStinger legacy-router recon proxy network

CVE-2025-3248

• JADEPUFFER Langflow agentic ransomware

CVE-2025-32975

• Quest KACE SMA CVE-2025-32975 exploitation

CVE-2025-34291

• Langflow CVE-2025-34291 exploitation

CVE-2025-48595

• Android Framework CVE-2025-48595 exploitation

CVE-2025-49113

• UNK_MassTraction Roundcube university mailserver campaign

CVE-2025-49704

• Storm-2603 parallel SharePoint ransomware intrusion

CVE-2025-49706

• Storm-2603 parallel SharePoint ransomware intrusion

CVE-2025-5777

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

CVE-2025-67038

• Lantronix EDS5000 CVE-2025-67038 exploitation

CVE-2025-8088

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• UAC-0226 / SHADOW-EARTH-066

CVE-2026-0257

• PAN-OS GlobalProtect CVE-2026-0257 exploitation

CVE-2026-10520

• Ivanti Sentry CVE-2026-10520 exploitation

CVE-2026-10523

• Ivanti Sentry CVE-2026-10520 exploitation

CVE-2026-11405

• Tenda firmware CVE-2026-11405 hidden authentication backdoor

CVE-2026-11645

• Chrome V8 CVE-2026-11645 exploitation

CVE-2026-12569

• PTC Windchill / FlexPLM CVE-2026-12569 exploitation

CVE-2026-12957

• Amazon Q CVE-2026-12957 MCP auto-execution

CVE-2026-12958

• Amazon Q CVE-2026-12957 MCP auto-execution

CVE-2026-20127

• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation

CVE-2026-20182

• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation

CVE-2026-20230

• Cisco Unified CM CVE-2026-20230 file-write exploitation

CVE-2026-20245

• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation

CVE-2026-20253

• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE

CVE-2026-20262

• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation

CVE-2026-20896

• Gitea Docker CVE-2026-20896 probing

CVE-2026-23111

• Linux nftables CVE-2026-23111 public LPE exploits

CVE-2026-26980

• Ghost CMS CVE-2026-26980 ClickFix poisoning

CVE-2026-28318

• SolarWinds Serv-U CVE-2026-28318 exploitation

CVE-2026-3300

• Everest Forms Pro CVE-2026-3300 exploitation

CVE-2026-33017

• Langflow CVE-2026-33017 cryptominer SSH worm
• NATS-as-C2 KeyHunter credential-harvesting operation

CVE-2026-33691

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

CVE-2026-34908

• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

CVE-2026-34909

• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

CVE-2026-34910

• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

CVE-2026-34926

• Trend Micro Apex One CVE-2026-34926 exploitation

CVE-2026-35273

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• ShinyHunters

CVE-2026-35616

• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign

CVE-2026-39987

• Marimo CVE-2026-39987 LLM-agent post-exploitation

CVE-2026-40138

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass

CVE-2026-40139

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass

CVE-2026-40140

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass

CVE-2026-40141

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass

CVE-2026-4020

• Gravity SMTP CVE-2026-4020 exploitation

CVE-2026-41091

• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation

CVE-2026-41940

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

CVE-2026-42271

• LiteLLM CVE-2026-42271 MCP stdio command injection

CVE-2026-43074

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

CVE-2026-43284

• Linux DirtyClone CVE-2026-43503 local privilege escalation

CVE-2026-43500

• Linux DirtyClone CVE-2026-43503 local privilege escalation

CVE-2026-43503

• Linux DirtyClone CVE-2026-43503 local privilege escalation

CVE-2026-44338

• PraisonAI CVE-2026-44338 rapid exploitation

CVE-2026-45247

• Mirasvit Cache Warmer CVE-2026-45247 exploitation

CVE-2026-45498

• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation

CVE-2026-45659

• Microsoft SharePoint CVE-2026-45659 RCE exploitation

CVE-2026-46242

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

CVE-2026-46300

• Linux DirtyClone CVE-2026-43503 local privilege escalation

CVE-2026-46331

• Linux pedit COW CVE-2026-46331 local privilege escalation

CVE-2026-46817

• Oracle E-Business Suite CVE-2026-46817 exploitation

CVE-2026-48172

• LiteSpeed cPanel CVE-2026-48172 exploitation

CVE-2026-48276

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48277

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48281

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48282

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48283

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48285

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48307

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48313

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48314

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48315

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48316

• Adobe ColdFusion APSB26-68 CVE bonanza

CVE-2026-48558

• Djinn Stealer
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• TaskWeaver

CVE-2026-48907

• Joomla JCE CVE-2026-48907 exploitation

CVE-2026-50751

• Check Point VPN CVE-2026-50751 exploitation

CVE-2026-50752

• Check Point VPN CVE-2026-50751 exploitation

CVE-2026-53359

• Januscape KVM CVE-2026-53359 guest-to-host escape

CVE-2026-5426

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

CVE-2026-54420

• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation

CVE-2026-6682

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

CVE-2026-6683

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

CVE-2026-6684

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

CVE-2026-6685

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

CVE-2026-6686

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

CVE-2026-6687

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

CVE-2026-6688

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

CVE-2026-7473

• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation

CVE-2026-8037

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

CVE-2026-8451

• Citrix NetScaler CVE-2026-8451 memory overread

CVE-2026-8461

• FFmpeg PixelSmash CVE-2026-8461 media-file RCE

CVE-2026-8732

• WP Maps Pro CVE-2026-8732 exploitation

CVE-2026-9082

• Drupal Core CVE-2026-9082 exploitation

CWE-502

• Microsoft SharePoint CVE-2026-45659 RCE exploitation

CWE-77

• LiteLLM CVE-2026-42271 MCP stdio command injection

CWE-78

• LiteLLM CVE-2026-42271 MCP stdio command injection

cyber-espionage

• Armored Likho

cybercrime

• Dutch Police / NCSC 17-million-device botnet disruption
• First VPN
• Fox Tempest
• Funnull RingH23 and MacCMS supply-chain attacks
• Hunt.io global smishing infrastructure campaign
• JINX-0164
• Operation FlutterBridge FlutterShell macOS malvertising
• Outsider Enterprise smishing PhaaS
• Pirated media SilentCryptoMiner RAT campaign
• TA4922
• The Gentlemen ransomware

cybercrime ecosystem

• Chinese-language PhaaS wallet-tokenization ecosystem
• GREYVIBE

Cython

• Void Dokkaebi

Czech Republic

• Operation Dragon Weave Azure Blob C2 campaign

D-Link

• AryStinger legacy-router recon proxy network

dangling resources

• Cloud bucket namespace hijacking

data exfiltration

• Ababil of Minab MOIS-linked recovery-destruction campaign
• AI-agent memory poisoning
• Cloud bucket namespace hijacking
• MCP tool-description poisoning
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• SHADOW-AETHER AI-augmented Latin America intrusions

data exposure

• ServiceNow instance unauthenticated table-query exploitation

data extortion

• Kairos data-extortion government payment

data leak site

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• ShinyHunters

data theft

• Accellion FTA exploitation campaign
• Kairos data-extortion government payment
• Malware-Slop Claude user-data npm infostealer
• ShinyHunters
• UNC3753

data-exfiltration

• Oman government Iranian-nexus webshell C2

database extortion

• JADEPUFFER Langflow agentic ransomware

DAYLIGHT

• GREYVIBE

DCloud

• DCloud Uni-App scam infrastructure ecosystem

DCloud Uni-App

• DCloud Uni-App scam infrastructure ecosystem

DcRAT

• Operation DragonReturn India tax-season DcRAT campaign

DDNS

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

DDoS

• Dutch Police / NCSC 17-million-device botnet disruption
• RustDuck

DDoS-for-hire

• xlabs_v1 DDoS-for-hire IoT botnet

dead drop resolver

• ChocoPoC
• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain

Debian

• Linux pedit COW CVE-2026-46331 local privilege escalation

DEBULL

• Kali365 device-code phishing expansion

declarativeNetRequest

• Perplexity AI-spoofing Chromium extension search hijacker

DeepSeek

• AI-brand impersonation phishing and malvertising
• JetBrains AI plugin API-key theft

Defender Advanced Hunting

• AI-agent memory poisoning

Defender evasion

• AI chatbot and SEO poisoning GPU-cryptojacking campaign
• The Gentlemen ransomware

Defender exclusion

• Photo ZIP hospitality Node.js implant campaign

defense

• Kimsuky / Emerald Sleet / TA427

defense evasion

• Cloud logging control-plane tampering
• Ollama P2P cryptominer RAT campaign
• Pirated media SilentCryptoMiner RAT campaign
• ROADtools

defense targeting

• Turla

defense-evasion

• ClickOnce COM hijacking abuse

DeFi

• JINX-0164
• JINX-0164 crypto developer infrastructure campaign
• RemotePE
• TrapDoor crypto-stealer cross-ecosystem campaign

delayed execution

• AI-agent memory poisoning

denial of service

• Citrix NetScaler CVE-2026-8451 memory overread
• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster
• FFmpeg PixelSmash CVE-2026-8461 media-file RCE
• SolarWinds Serv-U CVE-2026-28318 exploitation

Deno

• Seedworm / MuddyWater
• Solana FakeFix npm / PyPI developer stealer

dependency confusion

• @marketfront / @tqm-mfe dependency-confusion stealer
• oob.moika.tech dependency-confusion environment stealer

deployment_status

• GitHub Actions deployment poisoning

deserialization

• Microsoft SharePoint CVE-2026-45659 RCE exploitation
• Mirasvit Cache Warmer CVE-2026-45247 exploitation
• PTC Windchill / FlexPLM CVE-2026-12569 exploitation
• Vertex AI staging-bucket squatting

destructive malware

• Avalon / CrownX malware framework
• CrownX

destructive operations

• Ababil of Minab MOIS-linked recovery-destruction campaign

detection engineering

• ClickFix CPaaS API-driven payload delivery

DEV-0206

• Operation Endgame SocGholish disruption

developer credential theft

• Djinn Stealer
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation

developer credentials

• @withgoogle/stitch-sdk scope squat

developer endpoints

• Crypto supply-chain path to transaction authority

developer machines

• Agent localhost control-plane RCE
• Astro config blockchain C2 PR injection
• BufferZoneCorp RubyGems / Go module CI poisoning
• GuardFall AI-agent shell-guard bypass
• MCP stdio command-execution boundary
• PolinRider cross-ecosystem supply-chain campaign
• Polymarket npm wallet-drainer packages
• Telnyx PyPI TeamPCP compromise
• Trivy compromise

developer mode

• Silent Swap Google Notes crypto clipper

developer targeting

• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign
• Solana FakeFix npm / PyPI developer stealer
• Void Dokkaebi

developer tooling

• Browser-based developer IDE OAuth token theft
• Phantom squatting: AI-hallucinated domains

developer workstations

• Lazarus-linked Rollup polyfill npm malware
• Sentry MCP Agentjacking

developer-machine-fleet

• npm install explicit-trust controls

developer-targeting

• @marketfront / @tqm-mfe dependency-confusion stealer
• codexui-android OpenAI token stealer
• Famous Chollima Packagist dev-branch loader
• Glassworm developer supply-chain botnet
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• JetBrains AI plugin API-key theft
• JINX-0164
• JINX-0164 crypto developer infrastructure campaign
• Malware-Slop Claude user-data npm infostealer
• Mastra easy-day-js npm scope compromise
• Operation DangerousPassword axios npm compromise
• procwire / routecraft npm Windows dropper
• StegaBin Pastebin-steganography npm campaign
• UNK_DeadDrop developer repository phishing
• wshu.net npm credential-stealer campaign

developer-tools

• Developer-tool config auto-execution

developer-workstations

• Atomic Arch AUR package hijack
• npm install explicit-trust controls

device registration

• ROADtools

device-code phishing

• Kali365 device-code phishing expansion

DevOps

• Gitea Docker CVE-2026-20896 probing

DevTools

• Umbrij

DEWMODE

• Accellion FTA exploitation campaign

DIAMONDBACK

• Turla
• Turla STOCKSTAY backdoor operations

Digital Knowledge

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

digital wallets

• Chinese-language PhaaS wallet-tokenization ecosystem

DigitalOcean

• PraisonAI CVE-2026-44338 rapid exploitation

Dindoor

• Seedworm / MuddyWater

diplomatic targeting

• Cloud Atlas
• Mustang Panda

DirtyClone

• Linux DirtyClone CVE-2026-43503 local privilege escalation

DirtyFrag

• Linux DirtyClone CVE-2026-43503 local privilege escalation

Discord

• forge-jsxy
• Webworm

discovery

• ROADtools

Djinn Stealer

• Djinn Stealer
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• TaskWeaver

DLL side-loading

• OceanLotus
• Pirated media SilentCryptoMiner RAT campaign
• SprySOCKS

DLL sideloading

• AI chatbot and SEO poisoning GPU-cryptojacking campaign
• Backdoor.Mistic / KongTuke ModeloRAT activity
• Cavern
• Grandoreiro and BTMOB Latin America / Europe malware campaigns
• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• Operation Dragon Weave Azure Blob C2 campaign
• Operation GriefLure Southeast Asia LNK dropper
• ScreenConnect freeware / AsyncRAT SEO campaign
• Screening Serpens
• Seedworm / MuddyWater
• Storm-2603 parallel SharePoint ransomware intrusion
• StrikeShark SharkLoader / Cobalt Strike campaign
• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

DNS C2

• OP-512
• shopsprint/decimal Go typosquat DNS backdoor

DNS threat intelligence

• DCloud Uni-App scam infrastructure ecosystem

DNS tunneling

• Pirated media SilentCryptoMiner RAT campaign

Docker

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign

Docker credentials

• @withgoogle/stitch-sdk scope squat

Docker images

• Gitea Docker CVE-2026-20896 probing

document exfiltration

• BusySnake Stealer

document theft

• Gamaredon
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• UAC-0226 / SHADOW-EARTH-066

domain squatting

• Phantom squatting: AI-hallucinated domains

domestic espionage

• OceanLotus

DotNetNuke

• Oman government Iranian-nexus webshell C2

double extortion

• The Gentlemen ransomware

downgrade risk

• UNC6508

DPAPI

• Cavern
• RemotePE

DPAPILoader

• RemotePE

DPRK

• AI-augmented adversary operations
• Astro config blockchain C2 PR injection
• macOS.Gaslight Rust backdoor
• PolinRider cross-ecosystem supply-chain campaign

driver loading

• SprySOCKS

DroneLink

• GREYVIBE

Dropbear

• AryStinger legacy-router recon proxy network

Dropbox

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Stock exchange executive mailbox espionage

dropper

• procwire / routecraft npm Windows dropper

Drupal

• Drupal Core CVE-2026-9082 exploitation

duckdns

• RustDuck

Dutch Police

• Dutch Police / NCSC 17-million-device botnet disruption

DWAgent

• Kimsuky / Emerald Sleet / TA427

dynamic DNS

• AI chatbot and SEO poisoning GPU-cryptojacking campaign

dynamic obfuscation

• ClickFix CPaaS API-driven payload delivery

Dynu

• AI chatbot and SEO poisoning GPU-cryptojacking campaign

e-commerce

• Mirasvit Cache Warmer CVE-2026-45247 exploitation

Eagle Werewolf

• Armored Likho
• Armored Likho BusySnake campaign

Earth Lusca

• FishMonger
• SprySOCKS

eBPF

• Atomic Arch AUR package hijack
• IronWorm npm Rust infostealer campaign

Eclipse

• Amazon Q CVE-2026-12957 MCP auto-execution

edge appliance

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass
• Check Point VPN CVE-2026-50751 exploitation
• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation
• Cisco Unified CM CVE-2026-20230 file-write exploitation
• Citrix NetScaler CVE-2026-8451 memory overread
• CitrixBleed session-hijack wave
• Ivanti Sentry CVE-2026-10520 exploitation
• PAN-OS GlobalProtect CVE-2026-0257 exploitation
• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE
• Quest KACE SMA CVE-2025-32975 exploitation

edge appliances

• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation

edge application server

• Oracle WebLogic CVE-2024-21182 exploitation

edge device

• FortiBleed Fortinet credential exposure
• Tenda firmware CVE-2026-11405 hidden authentication backdoor

edge devices

• Dutch Police / NCSC 17-million-device botnet disruption
• Lantronix EDS5000 CVE-2025-67038 exploitation
• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

edge exploitation

• StrikeShark SharkLoader / Cobalt Strike campaign

edge service

• SolarWinds Serv-U CVE-2026-28318 exploitation
• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE

editor profile import

• Joomla JCE CVE-2026-48907 exploitation

EDR evasion

• Avalon / CrownX malware framework
• RemotePE

EDR killer

• The Gentlemen ransomware

EDS5000

• Lantronix EDS5000 CVE-2025-67038 exploitation

education

• Seedworm / MuddyWater

Egnyte

• VerdantBamboo appliance BRICKSTORM operation

EKZ Infostealer

• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign

Elasticsearch

• vpmdhaj OpenSearch npm cloud-secret stealer

electric power sector

• Armored Likho
• Armored Likho BusySnake campaign

email

• APT29

email exfiltration

• UNC6508

email gateway

• Barracuda ESG zero-day backdoor campaign

email infrastructure abuse

• Gravity SMTP CVE-2026-4020 exploitation

email theft

• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

embedded systems

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

Emerald Sleet

• Kimsuky / Emerald Sleet / TA427

encrypted C2

• TaskWeaver

endpoint management

• Quest KACE SMA CVE-2025-32975 exploitation

endpoint management abuse

• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign

endpoint response

• Chrome V8 CVE-2026-11645 exploitation

endpoint-detection

• ClickOnce COM hijacking abuse

endpoint-security

• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Trend Micro Apex One CVE-2026-34926 exploitation

EndpointDlp.dll

• Backdoor.Mistic / KongTuke ModeloRAT activity

energy sector

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns

energy-sector

• Dragonfly

engineering

• UNK_MassTraction Roundcube university mailserver campaign

engineering software

• Fast16

enterprise application

• PTC Windchill / FlexPLM CVE-2026-12569 exploitation

enterprise application exploitation

• Oracle E-Business Suite CVE-2026-46817 exploitation

enterprise applications

• Microsoft SharePoint CVE-2026-45659 RCE exploitation

Entra ID

• Kali365 device-code phishing expansion
• ROADtools

Environment Management Hub

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

environment variables

• oob.moika.tech dependency-confusion environment stealer

environmental keying

• RemotePE

epoll

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

Epsilon Stealer

• faster-axios / turbo-axios Epsilon Stealer npm campaign

ERP

• Oracle E-Business Suite CVE-2026-46817 exploitation

eSentire TRU

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

ESG

• Barracuda ESG zero-day backdoor campaign

espionage

• APT29
• Barracuda ESG zero-day backdoor campaign
• Cavern Manticore
• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• Cloud Atlas
• Dragonfly
• FishMonger
• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• Ghostwriter
• GREYVIBE
• Kimsuky / Emerald Sleet / TA427
• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• OceanLotus
• Oman government Iranian-nexus webshell C2
• OP-512
• Operation Dragon Weave Azure Blob C2 campaign
• Operation DragonReturn India tax-season DcRAT campaign
• Operation GriefLure Southeast Asia LNK dropper
• Operation Highland Velvet Ant authentication-stack backdoors
• Operation XENOFISCAL SideCopy XenoRAT campaign
• RemotePE
• ROADtools
• ScarCruft Yanbian game-platform supply-chain attack
• Screening Serpens
• Seedworm / MuddyWater
• Showboat
• SideCopy
• SprySOCKS
• Stock exchange executive mailbox espionage
• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation
• Turla
• Turla STOCKSTAY backdoor operations
• UNC6508
• UNC6692 SNOW malware social-engineering campaign
• Velvet Ant
• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation
• Webworm

Espressif ESP-IDF

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

EtherHiding

• Silent Swap Google Notes crypto clipper

ETW patching

• RemotePE

ETW tampering

• Avalon / CrownX malware framework

Eurojust

• First VPN

Europe

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• Grandoreiro and BTMOB Latin America / Europe malware campaigns
• Webworm

Europe targeting

• ToddyCat

Europol

• First VPN
• StealC / Amadey infrastructure disruption

evasion

• procwire / routecraft npm Windows dropper

eventpoll

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

Everest Forms Pro

• Everest Forms Pro CVE-2026-3300 exploitation

Evil Corp

• Operation Endgame SocGholish disruption

EvilAI

• TamperedChef-style productivity malware clusters

exFAT

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

exfiltration

• codexui-android OpenAI token stealer
• JetBrains AI plugin API-key theft
• js-logger-pack Hugging Face exfiltration campaign
• Malware-Slop Claude user-data npm infostealer

exploit-development

• AI-augmented adversary operations

exploit-kit

• art-template Coruna-style iOS watering-hole compromise

Exploit.in

• First VPN

exploitation

• Android Framework CVE-2025-48595 exploitation
• Januscape KVM CVE-2026-53359 guest-to-host escape
• Langflow CVE-2025-34291 exploitation
• Linux Bad Epoll CVE-2026-46242 local privilege escalation
• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux Kernel CVE-2022-0492 cgroup release_agent exploitation
• Linux nftables CVE-2026-23111 public LPE exploits
• Linux pedit COW CVE-2026-46331 local privilege escalation
• Marimo CVE-2026-39987 LLM-agent post-exploitation
• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Mirasvit Cache Warmer CVE-2026-45247 exploitation
• PraisonAI CVE-2026-44338 rapid exploitation
• Quest KACE SMA CVE-2025-32975 exploitation
• Trend Micro Apex One CVE-2026-34926 exploitation

exploitation attempts

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

extension supply-chain

• Adblock for YouTube BadBlocker remote-script injection risk
• StegoAd Edge extension steganography campaign

external federation

• Microsoft Teams external-chat phishing

extortion

• Accellion FTA exploitation campaign
• BlackFile / UNC6671 vishing extortion operation
• CrownX
• Klue Salesforce OAuth token abuse
• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• ShinyHunters
• UNC3753

F5 BIG-IP

• Velvet Ant

fake CAPTCHA

• ClickFix CPaaS API-driven payload delivery
• GREYVIBE

fake crypto exchange

• DCloud Uni-App scam infrastructure ecosystem

fake dating lures

• GREYVIBE

fake gambling

• DCloud Uni-App scam infrastructure ecosystem

fake login screen

• Backdoor.Mistic / KongTuke ModeloRAT activity

fake plugin

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

fake PoC

• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign

fake recruiting

• Void Dokkaebi

fake reputation

• Fake-reputation crypto clipboard hijacker

fake update

• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign
• Pirated media SilentCryptoMiner RAT campaign

FakeCaptcha

• Ghost CMS CVE-2026-26980 ClickFix poisoning

Fakeset

• Seedworm / MuddyWater

faketivism

• Handala

FakeUpdates

• Operation Endgame SocGholish disruption

FallSpy

• GREYVIBE

FAMOUS CHOLLIMA

• Famous Chollima Packagist dev-branch loader
• StegaBin Pastebin-steganography npm campaign

Famous Chollima

• PolinRider cross-ecosystem supply-chain campaign

Fancy Bear

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

Fast16

• Fast16

FastAPI

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

FastCGI

• Operation Highland Velvet Ant authentication-stack backdoors

FAT32

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

FatFs

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

FBI

• First VPN
• NetNut / Popa residential proxy network disruption

FFmpeg

• FFmpeg PixelSmash CVE-2026-8461 media-file RCE

FIFA

• GHOST STADIUM FIFA World Cup ticket phishing

file encryption

• CrownX

file exfiltration

• TinyRCT

File Transmission

• Oracle E-Business Suite CVE-2026-46817 exploitation

file upload path traversal

• Adobe ColdFusion APSB26-68 CVE bonanza

file-system filter

• Fast16

FileFiend

• Ababil of Minab MOIS-linked recovery-destruction campaign

FILEIO

• Adobe ColdFusion APSB26-68 CVE bonanza

fileless execution

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud
• MYRA RAT
• QuimaRAT

fileless malware

• VEIL#DROP Blogger-hosted PureLogs stealer chain

filemanager

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

filename-injection

• HackerBot Claw GitHub Actions exploitation campaign

filesystem parser

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

finance

• oob.moika.tech dependency-confusion environment stealer
• Sicoob.Sdk NuGet banking certificate stealer

financial fraud

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud
• Grandoreiro and BTMOB Latin America / Europe malware campaigns

financial sector

• RemotePE
• SHADOW-AETHER AI-augmented Latin America intrusions
• Stock exchange executive mailbox espionage

financial services

• Seedworm / MuddyWater
• UNC3753

financial theft

• JINX-0164
• JINX-0164 crypto developer infrastructure campaign
• RemotePE

FireAnt MetaKit

• OceanLotus

Firefox Add-ons

• VPN Go browser-extension clipboard stealer

firewall

• FortiBleed Fortinet credential exposure

firmware

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

firmware update

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

FishMonger

• SprySOCKS

FlexPLM

• PTC Windchill / FlexPLM CVE-2026-12569 exploitation

Flutter

• Operation FlutterBridge FlutterShell macOS malvertising

FlutterShell

• Operation FlutterBridge FlutterShell macOS malvertising

folderOpen

• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer

foreign affairs targeting

• Turla

foreign policy targeting

• Turla STOCKSTAY backdoor operations

Forest Blizzard

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

FortiClient EMS

• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign

FortiGate

• FortiBleed Fortinet credential exposure

Fortinet

• FortiBleed Fortinet credential exposure
• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign

FortiOS

• FortiBleed Fortinet credential exposure

Fox Tempest

• AI-brand impersonation phishing and malvertising
• Fox Tempest

fraud

• GHOST STADIUM FIFA World Cup ticket phishing

FreeBSD

• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation

freeware impersonation

• ScreenConnect freeware / AsyncRAT SEO campaign

FSB

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• Russian intelligence commercial-messaging backup-key phishing

FSB Center 16

• STOCKSTAY
• Turla

fscan

• CL-STA-1062 Southeast Asia government and energy intrusions

FTA

• Accellion FTA exploitation campaign

ftp.exe

• Operation GriefLure Southeast Asia LNK dropper

Full Disk Access social engineering

• PamStealer

Funnull

• Funnull RingH23 and MacCMS supply-chain attacks

Gamaredon

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain

Gamaredon collaboration

• Turla

GammaLoad

• Gamaredon GammaPhish / GammaWorm / GammaSteel chain

GammaPhish

• Gamaredon GammaPhish / GammaWorm / GammaSteel chain

GammaSteel

• Gamaredon GammaPhish / GammaWorm / GammaSteel chain

GammaWorm

• Gamaredon GammaPhish / GammaWorm / GammaSteel chain

Garble

• The Gentlemen ransomware

GCS

• Codecov Bash Uploader compromise

GentleKiller

• The Gentlemen ransomware

Ghost CMS

• Ghost CMS CVE-2026-26980 ClickFix poisoning

Ghost Networks

• Fake-reputation crypto clipboard hijacker

GHSA-6rmh-7xcm-cpxj

• PraisonAI CVE-2026-44338 rapid exploitation

GHSA-6v3r-4p5c-mrp5

• Amazon Q CVE-2026-12957 MCP auto-execution

GHSA-xhcr-j4j9-3gh7

• Amazon Q CVE-2026-12957 MCP auto-execution

GIFTEDCROOK

• UAC-0226 / SHADOW-EARTH-066

Gitea

• Gitea Docker CVE-2026-20896 probing

GitHub

• Astro config blockchain C2 PR injection
• Browser-based developer IDE OAuth token theft
• BufferZoneCorp RubyGems / Go module CI poisoning
• ChocoPoC fake PoC supply-chain campaign
• Crypto supply-chain path to transaction authority
• Developer-tool config auto-execution
• GitHub / Packagist postinstall hook campaign
• Glassworm developer supply-chain botnet
• IronWorm npm Rust infostealer campaign
• JiaT75
• JINX-0164 crypto developer infrastructure campaign
• Malware-Slop Claude user-data npm infostealer
• Nx Console VS Code extension compromise
• PolinRider cross-ecosystem supply-chain campaign
• UNK_DeadDrop developer repository phishing
• Webworm

GitHub abuse

• AI-brand impersonation phishing and malvertising
• Armored Likho BusySnake campaign
• Fake-reputation crypto clipboard hijacker

GitHub Actions

• actions-cool GitHub Actions tag compromise
• binding.gyp npm CI/CD worm
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BufferZoneCorp RubyGems / Go module CI poisoning
• Claude Code GitHub Action prompt-injection boundary
• codfish semantic-release-action tag compromise
• GitHub Actions deployment poisoning
• GitHub Actions OIDC subject-claim collisions
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• Immobiliare Labs Backstage plugins npm compromise
• Leo Platform npm Miasma-style compromise
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• SANDWORM_MODE AI-toolchain npm worm
• simonecorsi/mawesome GitHub Action compromise
• TeamPCP
• tj-actions and reviewdog compromise
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline

GitHub API

• Malware-Slop Claude user-data npm infostealer

GitHub App

• Claude Code GitHub Action prompt-injection boundary

GitHub CLI

• @withgoogle/stitch-sdk scope squat

GitHub issue spam

• Solana FakeFix npm / PyPI developer stealer

GitHub OAuth

• CircleCI 2023 customer secret exposure incident

GitHub Pages abuse

• StegoAd Edge extension steganography campaign

GitHub payload delivery

• Thailand healthcare RAR / Python stealer campaign

GitHub Security Advisories

• LangGraph checkpointer injection and unsafe deserialization

GitHub tokens

• codfish semantic-release-action tag compromise
• Malware-Slop Claude user-data npm infostealer

GitLab

• UNK_DeadDrop developer repository phishing

gitleaks

• NATS-as-C2 KeyHunter credential-harvesting operation

GitOps

• Argo CD repo-server unauthenticated RCE

Gleaming Pisces

• RemotePE

gleeze.com

• AI chatbot and SEO poisoning GPU-cryptojacking campaign

GlobalProtect

• PAN-OS GlobalProtect CVE-2026-0257 exploitation

Gmail

• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

Go

• BufferZoneCorp RubyGems / Go module CI poisoning
• Ollama P2P cryptominer RAT campaign
• shopsprint/decimal Go typosquat DNS backdoor
• The Gentlemen ransomware

Go modules

• PolinRider cross-ecosystem supply-chain campaign

Go2Tunnel

• Armored Likho

Godzilla

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

GoEdge

• Funnull RingH23 and MacCMS supply-chain attacks

GoFile

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

Golang malware

• Silent Swap Google Notes crypto clipper

GOLD PRELUDE

• Operation Endgame SocGholish disruption

Google Ads

• Operation FlutterBridge FlutterShell macOS malvertising

Google Analytics telemetry

• StegoAd Edge extension steganography campaign

Google API

• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

Google Chrome

• Chrome V8 CVE-2026-11645 exploitation

Google Cloud

• Vertex AI staging-bucket squatting

Google Cloud Logging

• Cloud logging control-plane tampering

Google Cloud Storage

• Cloud bucket namespace hijacking

Google credential theft

• StegoAd Edge extension steganography campaign

Google Drive

• GREYVIBE

Google Notes

• Silent Swap Google Notes crypto clipper

Google Play

• codexui-android OpenAI token stealer

Google Play Protect

• NetNut / Popa residential proxy network disruption

Google redirect abuse

• Photo ZIP hospitality Node.js implant campaign

Google Stitch

• @withgoogle/stitch-sdk scope squat

Google Threat Intelligence Group

• NetNut / Popa residential proxy network disruption
• UNC6508

Goose

• GuardFall AI-agent shell-guard bypass

government

• Cavern Manticore
• Kairos data-extortion government payment
• Kimsuky / Emerald Sleet / TA427
• Oman government Iranian-nexus webshell C2

government targeting

• Armored Likho
• Armored Likho BusySnake campaign
• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• Cloud Atlas
• FishMonger
• Mustang Panda
• Russian intelligence commercial-messaging backup-key phishing
• SHADOW-AETHER AI-augmented Latin America intrusions
• SprySOCKS

government-impersonation

• Hunt.io global smishing infrastructure campaign

GPT

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

Grandoreiro

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud
• Grandoreiro and BTMOB Latin America / Europe malware campaigns

GraphSpy

• Kali365 device-code phishing expansion

Gravity SMTP

• Gravity SMTP CVE-2026-4020 exploitation

GRE

• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation

GREYVIBE

• AI-augmented adversary operations

group

• HackerBot Claw
• ShinyHunters
• Velvet Ant

groups

• APT29
• CL-STA-1062
• Dragonfly
• Fox Tempest
• JINX-0164
• OP-512
• TA4922
• Turla
• UNC3753
• UNC6508
• VerdantBamboo
• Void Dokkaebi
• Webworm

gRPC

• Argo CD repo-server unauthenticated RCE

gs-netcat

• AryStinger legacy-router recon proxy network

GS-Netcat

• Operation Highland Velvet Ant authentication-stack backdoors

GTIG

• NetNut / Popa residential proxy network disruption
• UNC6508

GUE

• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation

guest-to-host escape

• Januscape KVM CVE-2026-53359 guest-to-host escape

Guildma

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

hack-and-leak

• Handala

hacktivist persona

• Ababil of Minab MOIS-linked recovery-destruction campaign

Hades

• AI scanner anti-analysis
• binding.gyp npm CI/CD worm

Hajime

• Malicious infrastructure provider concentration

hallucination

• Phantom squatting: AI-hallucinated domains

HappyDoor

• Kimsuky / Emerald Sleet / TA427

HAR files

• Okta support-system compromise

hard-coded secrets

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

HashiCorp Vault

• vpmdhaj OpenSearch npm cloud-secret stealer

HavocKiller

• The Gentlemen ransomware

headless browser

• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

healthcare

• Operation GriefLure Southeast Asia LNK dropper
• Thailand healthcare RAR / Python stealer campaign

HelloDoor

• Kimsuky / Emerald Sleet / TA427

HellsGate

• RemotePE

Helm

• Argo CD repo-server unauthenticated RCE

Hermes Agent

• GuardFall AI-agent shell-guard bypass

HexKiller

• The Gentlemen ransomware

hidden backdoor

• Tenda firmware CVE-2026-11405 hidden authentication backdoor

hidden service

• Crypto Clipper Tor / USB worm

high explosives

• Fast16

higher education

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• ShinyHunters

Honduras

• FishMonger
• SprySOCKS

HONESTCUE

• AI-augmented adversary operations

hospitality targeting

• Photo ZIP hospitality Node.js implant campaign

Host Radar

• Malicious infrastructure provider concentration

hosting control plane

• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation

hosting provider

• Dutch Police / NCSC 17-million-device botnet disruption

hosting providers

• Malicious infrastructure provider concentration

hotel targeting

• Photo ZIP hospitality Node.js implant campaign

HR lures

• TA4922

HTA

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• Operation XENOFISCAL SideCopy XenoRAT campaign
• SideCopy

HTML smuggling

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

HTTP C2

• TinyRCT

HttpMalice

• Kimsuky / Emerald Sleet / TA427

HTTPSpy

• Kimsuky / Emerald Sleet / TA427

Hugging Face

• forge-jsxy
• js-logger-pack Hugging Face exfiltration campaign

Hunt.io

• GHOST STADIUM FIFA World Cup ticket phishing
• Malicious infrastructure provider concentration
• Quest KACE SMA CVE-2025-32975 exploitation
• xlabs_v1 DDoS-for-hire IoT botnet

Huntress

• Azure CLI LSHIY password-spray campaign

hydropower

• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns

Hydropower Cooperation Project Proposal.zip

• Mustang Panda ZOHOMURK / MINIRECON India campaigns

hypervisor escape

• Januscape KVM CVE-2026-53359 guest-to-host escape

Hyunwoo Kim

• Januscape KVM CVE-2026-53359 guest-to-host escape

I-SOON

• FishMonger
• SprySOCKS

ICE

• Grandoreiro and BTMOB Latin America / Europe malware campaigns

ICONICSTEALER

• 3CX desktop app compromise

ICS

• Dragonfly

IDE extension

• Nx Console VS Code extension compromise

IDE plugins

• JetBrains AI plugin API-key theft

ide.cfm

• Adobe ColdFusion APSB26-68 CVE bonanza

identity

• 0ktapus phishing campaign
• BlackFile / UNC6671 vishing extortion operation
• ROADtools

identity attacks

• Azure CLI LSHIY password-spray campaign

identity security

• Microsoft Teams external-chat phishing

IDEs

• Developer-tool config auto-execution

IFEO persistence

• Fast16

IIOP

• Oracle WebLogic CVE-2024-21182 exploitation

IIS

• OP-512

IKEv1

• Check Point VPN CVE-2026-50751 exploitation

iMessage

• Chinese-language PhaaS wallet-tokenization ecosystem

Impacket

• PAN-OS GlobalProtect CVE-2026-0257 exploitation
• SHADOW-AETHER AI-augmented Latin America intrusions

impersonation

• Sicoob.Sdk NuGet banking certificate stealer

import-time execution

• Lazarus-linked Rollup polyfill npm malware
• Solana FakeFix npm / PyPI developer stealer

improper privilege management

• Oracle E-Business Suite CVE-2026-46817 exploitation

in-memory DLL loading

• UAC-0226 / SHADOW-EARTH-066

incident response

• Check Point VPN CVE-2026-50751 exploitation
• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation
• Cisco Unified CM CVE-2026-20230 file-write exploitation
• FortiBleed Fortinet credential exposure
• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign
• Funnull RingH23 and MacCMS supply-chain attacks
• Klue Salesforce OAuth token abuse
• LiteSpeed cPanel CVE-2026-48172 exploitation
• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation
• Malicious infrastructure provider concentration
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• Oracle E-Business Suite CVE-2026-46817 exploitation
• Oracle WebLogic CVE-2024-21182 exploitation
• PAN-OS GlobalProtect CVE-2026-0257 exploitation
• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE
• PTC Windchill / FlexPLM CVE-2026-12569 exploitation
• ServiceNow instance unauthenticated table-query exploitation
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• SolarWinds Serv-U CVE-2026-28318 exploitation
• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE

incident-response

• Storm-2603 parallel SharePoint ransomware intrusion

India

• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• Operation DragonReturn India tax-season DcRAT campaign

Indian government

• Mustang Panda ZOHOMURK / MINIRECON India campaigns

indirect prompt injection

• AI-agent memory poisoning
• AI-augmented adversary operations
• MCP tool-description poisoning
• Sentry MCP Agentjacking

industrial control

• Fast16

industrial control systems

• Lantronix EDS5000 CVE-2025-67038 exploitation

INFINITERED

• UNC6508

Infoblox Threat Intel

• DCloud Uni-App scam infrastructure ecosystem

information disclosure

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

infostealer

• Armored Likho
• Armored Likho BusySnake campaign
• BusySnake Stealer
• codexui-android OpenAI token stealer
• Djinn Stealer
• Famous Chollima Packagist dev-branch loader
• faster-axios / turbo-axios Epsilon Stealer npm campaign
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• IronWorm npm Rust infostealer campaign
• JINX-0164 crypto developer infrastructure campaign
• macOS.Gaslight Rust backdoor
• Malware-Slop Claude user-data npm infostealer
• PamStealer
• StealC / Amadey infrastructure disruption
• StegaBin Pastebin-steganography npm campaign
• TamperedChef-style productivity malware clusters
• Telnyx PyPI TeamPCP compromise
• VEIL#DROP Blogger-hosted PureLogs stealer chain
• wshu.net npm credential-stealer campaign

infrastructure

• First VPN
• Funnull RingH23 and MacCMS supply-chain attacks
• GHOST STADIUM FIFA World Cup ticket phishing
• Hunt.io global smishing infrastructure campaign
• Malicious infrastructure provider concentration

infrastructure disruption

• NetNut / Popa residential proxy network disruption
• StealC / Amadey infrastructure disruption

initial access broker

• Backdoor.Mistic / KongTuke ModeloRAT activity
• FortiBleed Fortinet credential exposure

initial-access

• AI-augmented adversary operations
• ClickOnce COM hijacking abuse
• Operation Endgame SocGholish disruption

input capture

• Perplexity AI-spoofing Chromium extension search hijacker

install-time execution

• MYRA RAT
• Solana FakeFix npm / PyPI developer stealer

install-time-execution

• npm install explicit-trust controls

install.res.1033.dll

• ScreenConnect freeware / AsyncRAT SEO campaign

Integration Broker

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

Intercolo

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

internet-facing admin surface

• Adobe ColdFusion APSB26-68 CVE bonanza

internet-facing appliance

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

internet-facing applications

• Microsoft SharePoint CVE-2026-45659 RCE exploitation

investment scam

• DCloud Uni-App scam infrastructure ecosystem

InvisibleFerret

• Void Dokkaebi

iOS

• art-template Coruna-style iOS watering-hole compromise

IoT

• Dutch Police / NCSC 17-million-device botnet disruption
• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster
• JDY SOHO / IoT reconnaissance botnet

IoT botnet

• AryStinger legacy-router recon proxy network
• RustDuck
• xlabs_v1 DDoS-for-hire IoT botnet

IP-in-IP

• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation

IPsec

• Linux DirtyClone CVE-2026-43503 local privilege escalation

IPv6

• Azure CLI LSHIY password-spray campaign

Iran

• Ababil of Minab MOIS-linked recovery-destruction campaign
• Cavern
• Cavern Manticore
• Handala
• Langflow CVE-2025-34291 exploitation
• Screening Serpens
• Seedworm / MuddyWater

Iran-nexus

• Oman government Iranian-nexus webshell C2

Island Security Research

• Adblock for YouTube BadBlocker remote-script injection risk

ISO image

• Avalon / CrownX malware framework

Israel

• Cavern Manticore
• Handala
• Seedworm / MuddyWater

IT providers

• Cavern Manticore

Italian foreign-policy targeting

• STOCKSTAY

Italy targeting

• Turla STOCKSTAY backdoor operations

Ivanti Sentry

• Ivanti Sentry CVE-2026-10520 exploitation

JADEPUFFER

• JADEPUFFER Langflow agentic ransomware

Jamf Threat Labs

• PamStealer

Januscape

• Januscape KVM CVE-2026-53359 guest-to-host escape

Japan

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

Java malware

• QuimaRAT

JavaScript

• Astro config blockchain C2 PR injection
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• Lazarus-linked Rollup polyfill npm malware
• Mastra easy-day-js npm scope compromise
• npm install explicit-trust controls
• Operation DangerousPassword axios npm compromise
• Operation XENOFISCAL SideCopy XenoRAT campaign
• postcss-minify-selector-parser npm RAT
• procwire / routecraft npm Windows dropper
• TaskWeaver
• wshu.net npm credential-stealer campaign

JavaScript bridge

• Operation FlutterBridge FlutterShell macOS malvertising

JavaScript injection

• Funnull RingH23 and MacCMS supply-chain attacks

JavaScript loader

• Ghost CMS CVE-2026-26980 ClickFix poisoning

JavaScript malware

• Ghostwriter

JavaScript masquerading

• VEIL#DROP Blogger-hosted PureLogs stealer chain

JavaScript tampering

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

JCE

• Joomla JCE CVE-2026-48907 exploitation

JDY

• JDY SOHO / IoT reconnaissance botnet

Jellyfin

• FFmpeg PixelSmash CVE-2026-8461 media-file RCE

JetBrains

• Amazon Q CVE-2026-12957 MCP auto-execution
• JetBrains AI plugin API-key theft

JetBrains Marketplace

• JetBrains AI plugin API-key theft

JetStream

• NATS-as-C2 KeyHunter credential-harvesting operation

JFrog

• Lazarus-linked Rollup polyfill npm malware

JFrog Security Research

• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Solana FakeFix npm / PyPI developer stealer

JINX-0164

• JINX-0164
• JINX-0164 crypto developer infrastructure campaign

joblib

• Vertex AI staging-bucket squatting

Joomla

• Joomla JCE CVE-2026-48907 exploitation

Joomla Content Editor

• Joomla JCE CVE-2026-48907 exploitation

journalists

• Russian intelligence commercial-messaging backup-key phishing

JSCoreRunner

• Operation FlutterBridge FlutterShell macOS malvertising

JSON:API

• Drupal Core CVE-2026-9082 exploitation

JSONKeeper

• Lazarus-linked Rollup polyfill npm malware

JSONPing

• Kimsuky / Emerald Sleet / TA427

JSP web shell

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

JuicyPotato

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions

JXA downloader

• PamStealer

K1MORPHER

• STOCKSTAY
• Turla STOCKSTAY backdoor operations

Kairos

• Kairos data-extortion government payment

Kaspersky

• MiniPlasma Windows Cloud Filter LPE exploitation
• Pirated media SilentCryptoMiner RAT campaign

Kaspersky Securelist

• Kali365 device-code phishing expansion
• ScreenConnect freeware / AsyncRAT SEO campaign

Kazakhstan

• Armored Likho

KAZUAR

• Turla
• Turla STOCKSTAY backdoor operations

KAZUAR overlap

• STOCKSTAY

Keitaro

• Malicious infrastructure provider concentration

Kemp LoadMaster

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

kernel driver

• Fast16
• FishMonger
• SprySOCKS

kernelCTF

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

KEV

• Drupal Core CVE-2026-9082 exploitation
• Langflow CVE-2025-34291 exploitation
• PAN-OS GlobalProtect CVE-2026-0257 exploitation

keychain theft

• macOS.Gaslight Rust backdoor

KeyHunter

• NATS-as-C2 KeyHunter credential-harvesting operation

keylogger

• forge-jsxy
• js-logger-pack Hugging Face exfiltration campaign

keylogging

• Operation Highland Velvet Ant authentication-stack backdoors

Kimsuky

• Kimsuky / Emerald Sleet / TA427

Klue

• Klue Salesforce OAuth token abuse

KnowledgeDeliver

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

KongTuke

• Backdoor.Mistic / KongTuke ModeloRAT activity

KORKERDS

• Langflow CVE-2026-33017 cryptominer SSH worm

Kubernetes

• Argo CD repo-server unauthenticated RCE
• Crypto supply-chain path to transaction authority

KV-botnet

• JDY SOHO / IoT reconnaissance botnet

KVM

• Januscape KVM CVE-2026-53359 guest-to-host escape

KVM escape

• Januscape KVM CVE-2026-53359 guest-to-host escape

kvmCTF

• Januscape KVM CVE-2026-53359 guest-to-host escape

L2TP/IPSec

• First VPN

LA Metro

• Ababil of Minab MOIS-linked recovery-destruction campaign

LangChain

• LangGraph checkpointer injection and unsafe deserialization
• MCP stdio command-execution boundary

Langflow

• JADEPUFFER Langflow agentic ransomware
• Langflow CVE-2025-34291 exploitation
• Langflow CVE-2026-33017 cryptominer SSH worm
• NATS-as-C2 KeyHunter credential-harvesting operation

LangFlow

• MCP stdio command-execution boundary

LangGraph

• LangGraph checkpointer injection and unsafe deserialization

Language Servers for AWS

• Amazon Q CVE-2026-12957 MCP auto-execution

Lantronix

• Lantronix EDS5000 CVE-2025-67038 exploitation

Laravel

• Famous Chollima Packagist dev-branch loader
• Laravel-Lang Composer tag-rewrite compromise

lateral movement

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Quest KACE SMA CVE-2025-32975 exploitation
• The Gentlemen ransomware

lateral-movement

• TrapDoor crypto-stealer cross-ecosystem campaign

Latin America

• Grandoreiro and BTMOB Latin America / Europe malware campaigns
• SHADOW-AETHER AI-augmented Latin America intrusions

LaunchAgent

• macOS.Gaslight Rust backdoor

launchctl

• JINX-0164 crypto developer infrastructure campaign

law enforcement

• Dutch Police / NCSC 17-million-device botnet disruption

law-enforcement-disruption

• Operation Endgame SocGholish disruption

LayerX

• AI-augmented adversary operations

Lazarus

• Famous Chollima Packagist dev-branch loader
• Lazarus-linked Rollup polyfill npm malware
• Operation DangerousPassword axios npm compromise
• RemotePE
• StegaBin Pastebin-steganography npm campaign

LD_PRELOAD

• Funnull RingH23 and MacCMS supply-chain attacks
• MYRA RAT

LDAP

• Cavern

leaked credentials

• FortiBleed Fortinet credential exposure

least privilege

• Cloud bucket namespace hijacking

legacy botnet hijacking

• Turla

legacy infrastructure

• OP-512

legacy software

• Accellion FTA exploitation campaign

legal sector

• UNC3753

LegionRelay

• GREYVIBE

Leo Platform

• Leo Platform npm Miasma-style compromise

LevelBlue

• QuimaRAT

liblzma

• XZ Utils backdoor

libp2p

• Ollama P2P cryptominer RAT campaign

libpeconv

• RemotePE

lifecycle hooks

• GitHub / Packagist postinstall hook campaign

lifecycle-hooks

• npm install explicit-trust controls

Lightning Shared Scooter Co.

• DCloud Uni-App scam infrastructure ecosystem

LinkedIn

• JINX-0164
• JINX-0164 crypto developer infrastructure campaign

Linksys

• AryStinger legacy-router recon proxy network

Linux

• Atomic Arch AUR package hijack
• Djinn Stealer
• GitHub / Packagist postinstall hook campaign
• IronWorm npm Rust infostealer campaign
• Januscape KVM CVE-2026-53359 guest-to-host escape
• js-logger-pack Hugging Face exfiltration campaign
• Linux Bad Epoll CVE-2026-46242 local privilege escalation
• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux Kernel CVE-2022-0492 cgroup release_agent exploitation
• Linux nftables CVE-2026-23111 public LPE exploits
• Linux pedit COW CVE-2026-46331 local privilege escalation
• MYRA RAT
• Ollama P2P cryptominer RAT campaign
• Operation DangerousPassword axios npm compromise
• Operation Highland Velvet Ant authentication-stack backdoors
• PCPJack cloud SMTP relay network
• QuimaRAT
• Showboat
• Velvet Ant
• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation
• XZ Utils backdoor

Linux kernel

• Januscape KVM CVE-2026-53359 guest-to-host escape
• Linux Bad Epoll CVE-2026-46242 local privilege escalation
• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux pedit COW CVE-2026-46331 local privilege escalation

Linux malware

• Langflow CVE-2026-33017 cryptominer SSH worm

LiteLLM

• LiteLLM CVE-2026-42271 MCP stdio command injection
• MCP stdio command-execution boundary
• Telnyx PyPI TeamPCP compromise

LiteSpeed

• LiteSpeed cPanel CVE-2026-48172 exploitation
• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation

living off the land

• Stock exchange executive mailbox espionage

living-off-the-land

• Operation GriefLure Southeast Asia LNK dropper

living-off-the-land binaries

• VEIL#DROP Blogger-hosted PureLogs stealer chain

LLM

• AI-augmented adversary operations
• GREYVIBE
• Marimo CVE-2026-39987 LLM-agent post-exploitation
• Ollama P2P cryptominer RAT campaign

LLM security

• AI scanner anti-analysis

LLM-driven intrusion

• JADEPUFFER Langflow agentic ransomware

LLMjacking

• NATS-as-C2 KeyHunter credential-harvesting operation

LMS

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

LNK

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• Armored Likho BusySnake campaign
• Avalon / CrownX malware framework
• Crypto Clipper Tor / USB worm
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• Operation GriefLure Southeast Asia LNK dropper
• Operation XENOFISCAL SideCopy XenoRAT campaign
• Photo ZIP hospitality Node.js implant campaign
• SideCopy
• UAC-0226 / SHADOW-EARTH-066

LNK files

• Cloud Atlas

load balancer

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

loader

• Famous Chollima Packagist dev-branch loader
• RustDuck
• StealC / Amadey infrastructure disruption
• TaskWeaver

local LLMs

• AI-augmented adversary operations

local privilege escalation

• Januscape KVM CVE-2026-53359 guest-to-host escape
• Linux Bad Epoll CVE-2026-46242 local privilege escalation
• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux pedit COW CVE-2026-46331 local privilege escalation
• MiniPlasma Windows Cloud Filter LPE exploitation

local-file-inclusion

• Storm-2603 parallel SharePoint ransomware intrusion

localhost

• Agent localhost control-plane RCE

log poisoning

• Cloud logging control-plane tampering

logging

• Cloud bucket namespace hijacking

login item persistence

• PamStealer

LOLBins

• ClickFix CPaaS API-driven payload delivery
• VEIL#DROP Blogger-hosted PureLogs stealer chain

long-lived tokens

• codexui-android OpenAI token stealer

long-term access

• RemotePE

LONGSTREAM

• AI-augmented adversary operations

LOOKVALJS

• GREYVIBE

LOOKVALPS

• GREYVIBE

loopback

• Agent localhost control-plane RCE

Loophole

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

low-confidence attribution

• WhatsApp VBScript ManageEngine RMM campaign

LPE

• MiniPlasma Windows Cloud Filter LPE exploitation

LS-DYNA

• Fast16

LSASS

• UNC6692 SNOW malware social-engineering campaign

LSHIY

• Azure CLI LSHIY password-spray campaign

LSSC

• DCloud Uni-App scam infrastructure ecosystem

Lua

• Fast16

Lumen

• NetNut / Popa residential proxy network disruption

Lumen Black Lotus Labs

• JDY SOHO / IoT reconnaissance botnet

Luna Moth

• UNC3753

Lyceum

• Cavern Manticore

MaaS

• QuimaRAT

MacCMS

• Funnull RingH23 and MacCMS supply-chain attacks

Maccy impersonation

• PamStealer

machine-learning

• Vertex AI staging-bucket squatting

macOS

• 3CX desktop app compromise
• Djinn Stealer
• JINX-0164
• JINX-0164 crypto developer infrastructure campaign
• js-logger-pack Hugging Face exfiltration campaign
• macOS.Gaslight Rust backdoor
• Operation DangerousPassword axios npm compromise
• Operation FlutterBridge FlutterShell macOS malvertising
• PamStealer
• QuimaRAT

macOS malware

• Fake-reputation crypto clipboard hijacker

Magento

• Mirasvit Cache Warmer CVE-2026-45247 exploitation

MagicYUV

• FFmpeg PixelSmash CVE-2026-8461 media-file RCE

mail server compromise

• UNK_MassTraction Roundcube university mailserver campaign

mailbox theft

• Stock exchange executive mailbox espionage

MAIN world injection

• Adblock for YouTube BadBlocker remote-script injection risk

maintainer compromise

• Mastra easy-day-js npm scope compromise
• Operation DangerousPassword axios npm compromise

maintainer persona

• JiaT75

maintainer-compromise

• node-ipc 2026 npm maintainer-account compromise

malicious GPO

• Turla STOCKSTAY backdoor operations

malicious releases

• LiteLLM compromise
• Telnyx PyPI TeamPCP compromise

malvertising

• AI-brand impersonation phishing and malvertising
• Operation FlutterBridge FlutterShell macOS malvertising
• StealC / Amadey infrastructure disruption
• TamperedChef-style productivity malware clusters

malware

• AI-augmented adversary operations
• Backdoor.Mistic / KongTuke ModeloRAT activity
• binding.gyp npm CI/CD worm
• BusySnake Stealer
• CanisterWorm
• Cavern
• ChocoPoC
• CrownX
• Crypto Clipper Tor / USB worm
• Djinn Stealer
• Fast16
• forge-jsxy
• IronWorm npm Rust infostealer campaign
• macOS.Gaslight Rust backdoor
• MYRA RAT
• Operation Endgame SocGholish disruption
• PamStealer
• postcss-minify-selector-parser npm RAT
• QuimaRAT
• RemotePE
• RustDuck
• Showboat
• SprySOCKS
• StealC / Amadey infrastructure disruption
• STOCKSTAY
• StrikeShark SharkLoader / Cobalt Strike campaign
• TA4922
• TamperedChef-style productivity malware clusters
• TaskWeaver
• TeamPCP
• The Gentlemen ransomware
• TinyRCT
• Umbrij
• UNC6692 SNOW malware social-engineering campaign

malware analysis

• AI scanner anti-analysis
• macOS.Gaslight Rust backdoor

malware delivery

• ClickFix CPaaS API-driven payload delivery
• Ghost CMS CVE-2026-26980 ClickFix poisoning
• VEIL#DROP Blogger-hosted PureLogs stealer chain

malware framework

• Avalon / CrownX malware framework

Malware-as-a-Service

• Grandoreiro and BTMOB Latin America / Europe malware campaigns

malware-as-a-service

• QuimaRAT
• StealC / Amadey infrastructure disruption

malware-signing-as-a-service

• Fox Tempest

MALXMR

• Langflow CVE-2026-33017 cryptominer SSH worm

managed file transfer

• SolarWinds Serv-U CVE-2026-28318 exploitation

managed service provider

• Quest KACE SMA CVE-2025-32975 exploitation

ManageEngine Endpoint Central

• WhatsApp VBScript ManageEngine RMM campaign

management plane

• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign
• Lantronix EDS5000 CVE-2025-67038 exploitation
• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

Manifest V3

• Perplexity AI-spoofing Chromium extension search hijacker

manufacturing

• Seedworm / MuddyWater

Mapbox

• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign

marimo

• Marimo CVE-2026-39987 LLM-agent post-exploitation

MARKETMAKER

• STOCKSTAY

marketplace abuse

• Agent skill marketplace poisoning

marketplace trust

• JetBrains AI plugin API-key theft

Maven Central

• AI-augmented adversary operations

mawesome

• simonecorsi/mawesome GitHub Action compromise

Mbed

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

McAfee Labs

• Silent Swap Google Notes crypto clipper

MCP

• Agent localhost control-plane RCE
• Amazon Q CVE-2026-12957 MCP auto-execution
• LiteLLM CVE-2026-42271 MCP stdio command injection
• MCP stdio command-execution boundary
• MCP tool-description poisoning
• SANDWORM_MODE AI-toolchain npm worm
• Sentry MCP Agentjacking

media processing

• FFmpeg PixelSmash CVE-2026-8461 media-file RCE

medical research

• UNC6508

Mekotio

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

memfd

• MYRA RAT

memory corruption

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

memory disclosure

• Citrix NetScaler CVE-2026-8451 memory overread

memory overread

• Citrix NetScaler CVE-2026-8451 memory overread

memory poisoning

• AI-agent memory poisoning

memory-only malware

• RemotePE

MeshAgent

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

MeshCentral

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• ShinyHunters

MEV bot lure

• Solana FakeFix npm / PyPI developer stealer

Mexico

• SHADOW-AETHER AI-augmented Latin America intrusions

MFA bypass

• 0ktapus phishing campaign
• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• Azure CLI LSHIY password-spray campaign
• Chinese-language PhaaS wallet-tokenization ecosystem
• CitrixBleed session-hijack wave
• ROADtools
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation

MFA fatigue

• Microsoft Teams external-chat phishing

MFA-bypass

• BlackFile / UNC6671 vishing extortion operation

Miasma

• AI scanner anti-analysis
• binding.gyp npm CI/CD worm
• Developer-tool config auto-execution
• Immobiliare Labs Backstage plugins npm compromise
• Leo Platform npm Miasma-style compromise
• npm install explicit-trust controls

MicroPython

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

Microsoft

• Agent localhost control-plane RCE
• AI-agent memory poisoning
• AI-brand impersonation phishing and malvertising
• Fox Tempest
• MCP tool-description poisoning
• Microsoft SharePoint CVE-2026-45659 RCE exploitation

Microsoft .NET

• AI chatbot and SEO poisoning GPU-cryptojacking campaign

Microsoft 365

• Azure CLI LSHIY password-spray campaign
• BlackFile / UNC6671 vishing extortion operation
• Kali365 device-code phishing expansion

Microsoft 365 Copilot

• AI-agent memory poisoning

Microsoft Authentication Broker

• Kali365 device-code phishing expansion

Microsoft Defender

• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation

Microsoft Defender Security Research

• Perplexity AI-spoofing Chromium extension search hijacker

Microsoft dev tunnels

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

Microsoft Digital Crimes Unit

• StealC / Amadey infrastructure disruption

Microsoft Edge

• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

Microsoft Edge Add-ons

• StegoAd Edge extension steganography campaign

Microsoft Edge Extensions Security Team

• StegoAd Edge extension steganography campaign

Microsoft Entra ID

• Azure CLI LSHIY password-spray campaign

Microsoft Graph

• ROADtools
• Webworm

Microsoft Identity Platform

• Kali365 device-code phishing expansion

Microsoft Office SharePoint

• Microsoft SharePoint CVE-2026-45659 RCE exploitation

Microsoft Security Blog

• Perplexity AI-spoofing Chromium extension search hijacker

Microsoft SQL Server

• OceanLotus

Microsoft Teams

• Microsoft Teams external-chat phishing
• UNC6692 SNOW malware social-engineering campaign

Microsoft-signed binary abuse

• ScreenConnect freeware / AsyncRAT SEO campaign

Middle East

• Malicious infrastructure provider concentration
• Showboat

middleware

• Oracle WebLogic CVE-2024-21182 exploitation

Midnight Blizzard

• ROADtools

military research

• UNC6508

Mimikatz

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions

Minecraft DDoS

• xlabs_v1 DDoS-for-hire IoT botnet

Mini Shai-Hulud

• Immobiliare Labs Backstage plugins npm compromise
• Leo Platform npm Miasma-style compromise

MiniJunk

• Screening Serpens

MiniPlasma

• MiniPlasma Windows Cloud Filter LPE exploitation

MINIRAT

• JINX-0164
• JINX-0164 crypto developer infrastructure campaign

MINIRECON

• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns

Ministry of Finance

• Operation DragonReturn India tax-season DcRAT campaign
• Operation XENOFISCAL SideCopy XenoRAT campaign

MiniUpdate

• Screening Serpens

Mirai

• Malicious infrastructure provider concentration
• NetNut / Popa residential proxy network disruption
• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

Mirai-derived botnet

• xlabs_v1 DDoS-for-hire IoT botnet

Mistic

• Backdoor.Mistic / KongTuke ModeloRAT activity

MITRE ATT&CK T1005

• Cloud logging control-plane tampering

MITRE ATT&CK T1562

• Cloud logging control-plane tampering

MLTBackdoor

• Backdoor.Mistic / KongTuke ModeloRAT activity

mobile

• Android Framework CVE-2025-48595 exploitation

Mobile Access

• Check Point VPN CVE-2026-50751 exploitation

mobile device management

• Ivanti Sentry CVE-2026-10520 exploitation

mobile devices

• Dutch Police / NCSC 17-million-device botnet disruption

mobile malware

• Grandoreiro and BTMOB Latin America / Europe malware campaigns

MobileIron Sentry

• Ivanti Sentry CVE-2026-10520 exploitation

Model Context Protocol

• Agent localhost control-plane RCE
• Amazon Q CVE-2026-12957 MCP auto-execution
• LiteLLM CVE-2026-42271 MCP stdio command injection
• MCP stdio command-execution boundary
• MCP tool-description poisoning

model poisoning

• Vertex AI staging-bucket squatting

model-provider abuse

• PraisonAI CVE-2026-44338 rapid exploitation

ModeloRAT

• Backdoor.Mistic / KongTuke ModeloRAT activity

module-proxy

• shopsprint/decimal Go typosquat DNS backdoor

MOIS

• Ababil of Minab MOIS-linked recovery-destruction campaign
• Cavern
• Cavern Manticore
• Handala
• Seedworm / MuddyWater

Monero

• Langflow CVE-2026-33017 cryptominer SSH worm
• Ollama P2P cryptominer RAT campaign

Mozi

• Malicious infrastructure provider concentration

MpExtMs.exe

• Backdoor.Mistic / KongTuke ModeloRAT activity

MPR network provider

• Fast16

Mr_Rot13

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

MSBuild

• Avalon / CrownX malware framework

msgpack

• LangGraph checkpointer injection and unsafe deserialization

mshta

• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• Operation XENOFISCAL SideCopy XenoRAT campaign
• SideCopy

MSI

• StealC / Amadey infrastructure disruption

MSP

• ConnectWise ScreenConnect exploitation wave
• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation

MSSQL

• FortiBleed Fortinet credential exposure

mTLS

• Sicoob.Sdk NuGet banking certificate stealer

MuddyWater

• Cavern Manticore
• Langflow CVE-2025-34291 exploitation
• Seedworm / MuddyWater

multi-tenant cloud

• Januscape KVM CVE-2026-53359 guest-to-host escape

Mustang Panda

• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns

Mustard Tempest

• Operation Endgame SocGholish disruption

mutable tags

• codfish semantic-release-action tag compromise
• simonecorsi/mawesome GitHub Action compromise

MYRA

• MYRA RAT

MySQL

• JADEPUFFER Langflow agentic ransomware

Mythos

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

Nacos

• JADEPUFFER Langflow agentic ransomware

named pipes

• OceanLotus

namespace recycling

• GitHub Actions OIDC subject-claim collisions

namespace squatting

• Cloud bucket namespace hijacking

NAS targeting

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

nation-state

• ROADtools

native addon

• MYRA RAT

native extension

• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign

NativeAOT

• Cavern
• Cavern Manticore

NATS

• NATS-as-C2 KeyHunter credential-harvesting operation

NCSC-NL

• Dutch Police / NCSC 17-million-device botnet disruption

Nebo

• GREYVIBE

negotiation

• Kairos data-extortion government payment

Neo-reGeorg

• SHADOW-AETHER AI-augmented Latin America intrusions

nested virtualization

• Januscape KVM CVE-2026-53359 guest-to-host escape

Netherlands

• Dutch Police / NCSC 17-million-device botnet disruption

NetNut

• NetNut / Popa residential proxy network disruption

NetScaler

• Citrix NetScaler CVE-2026-8451 memory overread
• CitrixBleed session-hijack wave

NetScaler ADC

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• Citrix NetScaler CVE-2026-8451 memory overread

NetScaler Gateway

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• Citrix NetScaler CVE-2026-8451 memory overread

network infrastructure

• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation

network policies

• Argo CD repo-server unauthenticated RCE

Nextcloud

• FFmpeg PixelSmash CVE-2026-8461 media-file RCE

nf_tables

• Linux nftables CVE-2026-23111 public LPE exploits

nftables

• Linux nftables CVE-2026-23111 public LPE exploits

Nginx

• Operation Highland Velvet Ant authentication-stack backdoors

Nginx module

• Funnull RingH23 and MacCMS supply-chain attacks

no attribution

• Thailand healthcare RAR / Python stealer campaign

No-IP

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

node-gyp

• binding.gyp npm CI/CD worm
• Immobiliare Labs Backstage plugins npm compromise

node-ipc

• node-ipc 2026 npm maintainer-account compromise

node-pty

• Lazarus-linked Rollup polyfill npm malware

Node.js

• Seedworm / MuddyWater
• TaskWeaver

Node.js implant

• Photo ZIP hospitality Node.js implant campaign

Node.js malware

• SimpleHelp CVE-2026-48558 authentication-bypass exploitation

North Korea

• Famous Chollima Packagist dev-branch loader
• Kimsuky / Emerald Sleet / TA427
• Lazarus-linked Rollup polyfill npm malware
• macOS.Gaslight Rust backdoor
• Operation DangerousPassword axios npm compromise
• PolinRider cross-ecosystem supply-chain campaign
• RemotePE
• ScarCruft Yanbian game-platform supply-chain attack
• StegaBin Pastebin-steganography npm campaign
• UNK_DeadDrop developer repository phishing
• Void Dokkaebi

notarized malware

• Operation FlutterBridge FlutterShell macOS malvertising

npm

• @marketfront / @tqm-mfe dependency-confusion stealer
• @withgoogle/stitch-sdk scope squat
• AI scanner anti-analysis
• art-template Coruna-style iOS watering-hole compromise
• Atomic Arch AUR package hijack
• binding.gyp npm CI/CD worm
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• CanisterWorm
• codexui-android OpenAI token stealer
• faster-axios / turbo-axios Epsilon Stealer npm campaign
• forge-jsxy
• GitHub / Packagist postinstall hook campaign
• Glassworm developer supply-chain botnet
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• Immobiliare Labs Backstage plugins npm compromise
• IronWorm npm Rust infostealer campaign
• JINX-0164
• JINX-0164 crypto developer infrastructure campaign
• js-logger-pack Hugging Face exfiltration campaign
• Lazarus-linked Rollup polyfill npm malware
• Leo Platform npm Miasma-style compromise
• Malware-Slop Claude user-data npm infostealer
• Mastra easy-day-js npm scope compromise
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• MYRA RAT
• node-ipc 2026 npm maintainer-account compromise
• npm install explicit-trust controls
• oob.moika.tech dependency-confusion environment stealer
• Operation DangerousPassword axios npm compromise
• PolinRider cross-ecosystem supply-chain campaign
• Polymarket npm wallet-drainer packages
• postcss-minify-selector-parser npm RAT
• procwire / routecraft npm Windows dropper
• SANDWORM_MODE AI-toolchain npm worm
• Sentry MCP Agentjacking
• Solana FakeFix npm / PyPI developer stealer
• StegaBin Pastebin-steganography npm campaign
• TeamPCP
• TrapDoor crypto-stealer cross-ecosystem campaign
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• vpmdhaj OpenSearch npm cloud-secret stealer
• wshu.net npm credential-stealer campaign

npm lifecycle hook

• Mastra easy-day-js npm scope compromise
• Operation DangerousPassword axios npm compromise
• procwire / routecraft npm Windows dropper

npm tokens

• @withgoogle/stitch-sdk scope squat

npx

• Sentry MCP Agentjacking

NSecKrnl.sys

• Storm-2603 parallel SharePoint ransomware intrusion

NTDS.dit

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• Storm-2603 parallel SharePoint ransomware intrusion

NTFS ADS

• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• UAC-0226 / SHADOW-EARTH-066

NTLM

• PAN-OS GlobalProtect CVE-2026-0257 exploitation

nuclear weapons

• Fast16

NuGet

• Sicoob.Sdk NuGet banking certificate stealer

Nuitka

• postcss-minify-selector-parser npm RAT

NVGRE

• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation

OAuth

• Azure CLI LSHIY password-spray campaign
• Browser-based developer IDE OAuth token theft
• Kali365 device-code phishing expansion
• Klue Salesforce OAuth token abuse

OAuth abuse

• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

OAuth token abuse

• Mustang Panda ZOHOMURK / MINIRECON India campaigns

OAuth token exposure

• Gravity SMTP CVE-2026-4020 exploitation

OAuth tokens

• codexui-android OpenAI token stealer
• Klue Salesforce OAuth token abuse

OBF networks

• UNC6508

obfuscation

• AI-augmented adversary operations

obfuscator.io

• @marketfront / @tqm-mfe dependency-confusion stealer

OFAC

• Funnull RingH23 and MacCMS supply-chain attacks

Offshore LC

• xlabs_v1 DDoS-for-hire IoT botnet

OIDC

• Claude Code GitHub Action prompt-injection boundary
• codfish semantic-release-action tag compromise
• GitHub Actions OIDC subject-claim collisions
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation

OilRig

• Cavern Manticore

Okta

• 0ktapus phishing campaign
• BlackFile / UNC6671 vishing extortion operation
• Kali365 device-code phishing expansion
• Okta support-system compromise

OKX

• Kairos data-extortion government payment

Ollama

• Ollama P2P cryptominer RAT campaign

Oman

• Oman government Iranian-nexus webshell C2

Omnibox

• Perplexity AI-spoofing Chromium extension search hijacker

OneDrive

• BlackFile / UNC6671 vishing extortion operation
• Stock exchange executive mailbox espionage
• Webworm

OneDrive access

• Kali365 device-code phishing expansion

Open Interpreter

• GuardFall AI-agent shell-guard bypass

OpenAI

• JetBrains AI plugin API-key theft

OpenAI Codex

• codexui-android OpenAI token stealer

opencode

• GuardFall AI-agent shell-guard bypass

OpenConnect

• First VPN

OpenHands

• GuardFall AI-agent shell-guard bypass

OpenSearch

• vpmdhaj OpenSearch npm cloud-secret stealer

OpenSSH

• Operation Highland Velvet Ant authentication-stack backdoors
• Velvet Ant

OpenVPN

• First VPN

OpenVPN-shaped UDP

• xlabs_v1 DDoS-for-hire IoT botnet

OpenVSX

• Glassworm developer supply-chain botnet

operation

• ChocoPoC fake PoC supply-chain campaign
• ToddyCat Umbrij Gmail OAuth operation

Operation DangerousPassword

• Operation DangerousPassword axios npm compromise

Operation Endgame

• Operation Endgame SocGholish disruption

Operation Highland

• Operation Highland Velvet Ant authentication-stack backdoors
• Velvet Ant

operational relay box

• AryStinger legacy-router recon proxy network

operational resilience

• Ababil of Minab MOIS-linked recovery-destruction campaign

operations

• 0ktapus phishing campaign
• 3CX desktop app compromise
• @marketfront / @tqm-mfe dependency-confusion stealer
• @withgoogle/stitch-sdk scope squat
• Ababil of Minab MOIS-linked recovery-destruction campaign
• Accellion FTA exploitation campaign
• actions-cool GitHub Actions tag compromise
• Adblock for YouTube BadBlocker remote-script injection risk
• Adobe ColdFusion APSB26-68 CVE bonanza
• AI chatbot and SEO poisoning GPU-cryptojacking campaign
• Amazon Q CVE-2026-12957 MCP auto-execution
• Android Framework CVE-2025-48595 exploitation
• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• Argo CD repo-server unauthenticated RCE
• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation
• Armored Likho BusySnake campaign
• art-template Coruna-style iOS watering-hole compromise
• AryStinger legacy-router recon proxy network
• Astro config blockchain C2 PR injection
• Atomic Arch AUR package hijack
• Avalon / CrownX malware framework
• Azure CLI LSHIY password-spray campaign
• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud
• Barracuda ESG zero-day backdoor campaign
• binding.gyp npm CI/CD worm
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BlackFile / UNC6671 vishing extortion operation
• BufferZoneCorp RubyGems / Go module CI poisoning
• CanisterWorm
• CCleaner signed-update compromise
• Check Point VPN CVE-2026-50751 exploitation
• Chinese-language PhaaS wallet-tokenization ecosystem
• Chrome live-wallpaper extension ad-fraud network
• Chrome V8 CVE-2026-11645 exploitation
• CircleCI 2023 customer secret exposure incident
• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation
• Cisco Unified CM CVE-2026-20230 file-write exploitation
• Citrix NetScaler CVE-2026-8451 memory overread
• CitrixBleed session-hijack wave
• CL-STA-1062 Southeast Asia government and energy intrusions
• ClickFix CPaaS API-driven payload delivery
• Codecov Bash Uploader compromise
• codexui-android OpenAI token stealer
• codfish semantic-release-action tag compromise
• ConnectWise ScreenConnect exploitation wave
• Crypto Clipper Tor / USB worm
• DAEMON Tools Lite supply-chain compromise
• DCloud Uni-App scam infrastructure ecosystem
• Drupal Core CVE-2026-9082 exploitation
• Dutch Police / NCSC 17-million-device botnet disruption
• Everest Forms Pro CVE-2026-3300 exploitation
• Fake-reputation crypto clipboard hijacker
• Famous Chollima Packagist dev-branch loader
• faster-axios / turbo-axios Epsilon Stealer npm campaign
• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster
• FFmpeg PixelSmash CVE-2026-8461 media-file RCE
• FortiBleed Fortinet credential exposure
• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign
• Funnull RingH23 and MacCMS supply-chain attacks
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• Ghost CMS CVE-2026-26980 ClickFix poisoning
• GHOST STADIUM FIFA World Cup ticket phishing
• Gitea Docker CVE-2026-20896 probing
• GitHub / Packagist postinstall hook campaign
• Glassworm developer supply-chain botnet
• Grandoreiro and BTMOB Latin America / Europe malware campaigns
• Gravity SMTP CVE-2026-4020 exploitation
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• Hunt.io global smishing infrastructure campaign
• Immobiliare Labs Backstage plugins npm compromise
• IronWorm npm Rust infostealer campaign
• Ivanti Sentry CVE-2026-10520 exploitation
• JADEPUFFER Langflow agentic ransomware
• Januscape KVM CVE-2026-53359 guest-to-host escape
• JDY SOHO / IoT reconnaissance botnet
• JetBrains AI plugin API-key theft
• JINX-0164 crypto developer infrastructure campaign
• Joomla JCE CVE-2026-48907 exploitation
• js-logger-pack Hugging Face exfiltration campaign
• Kairos data-extortion government payment
• Kali365 device-code phishing expansion
• Klue Salesforce OAuth token abuse
• KnowledgeDeliver CVE-2026-5426 ViewState exploitation
• Langflow CVE-2025-34291 exploitation
• Langflow CVE-2026-33017 cryptominer SSH worm
• Lantronix EDS5000 CVE-2025-67038 exploitation
• Laravel-Lang Composer tag-rewrite compromise
• Lazarus-linked Rollup polyfill npm malware
• Leo Platform npm Miasma-style compromise
• Linux Bad Epoll CVE-2026-46242 local privilege escalation
• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux Kernel CVE-2022-0492 cgroup release_agent exploitation
• Linux nftables CVE-2026-23111 public LPE exploits
• Linux pedit COW CVE-2026-46331 local privilege escalation
• LiteLLM compromise
• LiteLLM CVE-2026-42271 MCP stdio command injection
• LiteSpeed cPanel CVE-2026-48172 exploitation
• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation
• macOS.Gaslight Rust backdoor
• Malware-Slop Claude user-data npm infostealer
• Marimo CVE-2026-39987 LLM-agent post-exploitation
• Mastra easy-day-js npm scope compromise
• Megalodon GitHub Actions workflow backdooring
• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Microsoft SharePoint CVE-2026-45659 RCE exploitation
• Mini Shai-Hulud npm/PyPI worm campaign
• MiniPlasma Windows Cloud Filter LPE exploitation
• Mirasvit Cache Warmer CVE-2026-45247 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• NATS-as-C2 KeyHunter credential-harvesting operation
• node-ipc 2026 npm maintainer-account compromise
• Nx Console VS Code extension compromise
• Okta support-system compromise
• Ollama P2P cryptominer RAT campaign
• Oman government Iranian-nexus webshell C2
• oob.moika.tech dependency-confusion environment stealer
• Operation DangerousPassword axios npm compromise
• Operation Dragon Weave Azure Blob C2 campaign
• Operation DragonReturn India tax-season DcRAT campaign
• Operation Endgame SocGholish disruption
• Operation FlutterBridge FlutterShell macOS malvertising
• Operation GriefLure Southeast Asia LNK dropper
• Operation Highland Velvet Ant authentication-stack backdoors
• Operation XENOFISCAL SideCopy XenoRAT campaign
• Oracle E-Business Suite CVE-2026-46817 exploitation
• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• Oracle WebLogic CVE-2024-21182 exploitation
• Outsider Enterprise smishing PhaaS
• PAN-OS GlobalProtect CVE-2026-0257 exploitation
• Perplexity AI-spoofing Chromium extension search hijacker
• Photo ZIP hospitality Node.js implant campaign
• Pirated media SilentCryptoMiner RAT campaign
• PolinRider cross-ecosystem supply-chain campaign
• Polymarket npm wallet-drainer packages
• postcss-minify-selector-parser npm RAT
• PraisonAI CVE-2026-44338 rapid exploitation
• procwire / routecraft npm Windows dropper
• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE
• PTC Windchill / FlexPLM CVE-2026-12569 exploitation
• Quest KACE SMA CVE-2025-32975 exploitation
• Russian intelligence commercial-messaging backup-key phishing
• SANDWORM_MODE AI-toolchain npm worm
• ScarCruft Yanbian game-platform supply-chain attack
• ScreenConnect freeware / AsyncRAT SEO campaign
• ServiceNow instance unauthenticated table-query exploitation
• SHADOW-AETHER AI-augmented Latin America intrusions
• shopsprint/decimal Go typosquat DNS backdoor
• Sicoob.Sdk NuGet banking certificate stealer
• Silent Swap Google Notes crypto clipper
• simonecorsi/mawesome GitHub Action compromise
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• SolarWinds Serv-U CVE-2026-28318 exploitation
• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE
• StealC / Amadey infrastructure disruption
• StegaBin Pastebin-steganography npm campaign
• StegoAd Edge extension steganography campaign
• Stock exchange executive mailbox espionage
• Storm-2603 parallel SharePoint ransomware intrusion
• TamperedChef-style productivity malware clusters
• TeamPCP
• Telnyx PyPI TeamPCP compromise
• Thailand healthcare RAR / Python stealer campaign
• tj-actions and reviewdog compromise
• TrapDoor crypto-stealer cross-ecosystem campaign
• Trend Micro Apex One CVE-2026-34926 exploitation
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• Turla STOCKSTAY backdoor operations
• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation
• UNK_DeadDrop developer repository phishing
• VEIL#DROP Blogger-hosted PureLogs stealer chain
• VerdantBamboo appliance BRICKSTORM operation
• vpmdhaj OpenSearch npm cloud-secret stealer
• VPN Go browser-extension clipboard stealer
• WhatsApp VBScript ManageEngine RMM campaign
• WP Maps Pro CVE-2026-8732 exploitation
• wshu.net npm credential-stealer campaign
• Xinference PyPI compromise
• XZ Utils backdoor

OpFauxSign

• Fox Tempest

ops

• 0ktapus phishing campaign
• 3CX desktop app compromise
• @marketfront / @tqm-mfe dependency-confusion stealer
• @withgoogle/stitch-sdk scope squat
• Ababil of Minab MOIS-linked recovery-destruction campaign
• Accellion FTA exploitation campaign
• actions-cool GitHub Actions tag compromise
• Adblock for YouTube BadBlocker remote-script injection risk
• Adobe ColdFusion APSB26-68 CVE bonanza
• AI chatbot and SEO poisoning GPU-cryptojacking campaign
• Amazon Q CVE-2026-12957 MCP auto-execution
• Android Framework CVE-2025-48595 exploitation
• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• Argo CD repo-server unauthenticated RCE
• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation
• Armored Likho BusySnake campaign
• art-template Coruna-style iOS watering-hole compromise
• AryStinger legacy-router recon proxy network
• Astro config blockchain C2 PR injection
• Atomic Arch AUR package hijack
• Avalon / CrownX malware framework
• Azure CLI LSHIY password-spray campaign
• Backdoor.Mistic / KongTuke ModeloRAT activity
• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud
• Barracuda ESG zero-day backdoor campaign
• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass
• binding.gyp npm CI/CD worm
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BlackFile / UNC6671 vishing extortion operation
• BufferZoneCorp RubyGems / Go module CI poisoning
• CCleaner signed-update compromise
• Check Point VPN CVE-2026-50751 exploitation
• Chinese-language PhaaS wallet-tokenization ecosystem
• ChocoPoC fake PoC supply-chain campaign
• Chrome live-wallpaper extension ad-fraud network
• Chrome V8 CVE-2026-11645 exploitation
• CircleCI 2023 customer secret exposure incident
• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation
• Cisco Unified CM CVE-2026-20230 file-write exploitation
• Citrix NetScaler CVE-2026-8451 memory overread
• CitrixBleed session-hijack wave
• CL-STA-1062 Southeast Asia government and energy intrusions
• ClickFix CPaaS API-driven payload delivery
• Codecov Bash Uploader compromise
• codexui-android OpenAI token stealer
• codfish semantic-release-action tag compromise
• ConnectWise ScreenConnect exploitation wave
• Crypto Clipper Tor / USB worm
• DAEMON Tools Lite supply-chain compromise
• DCloud Uni-App scam infrastructure ecosystem
• Drupal Core CVE-2026-9082 exploitation
• Dutch Police / NCSC 17-million-device botnet disruption
• Everest Forms Pro CVE-2026-3300 exploitation
• Fake-reputation crypto clipboard hijacker
• Famous Chollima Packagist dev-branch loader
• faster-axios / turbo-axios Epsilon Stealer npm campaign
• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster
• FFmpeg PixelSmash CVE-2026-8461 media-file RCE
• FortiBleed Fortinet credential exposure
• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign
• Funnull RingH23 and MacCMS supply-chain attacks
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• Ghost CMS CVE-2026-26980 ClickFix poisoning
• GHOST STADIUM FIFA World Cup ticket phishing
• Gitea Docker CVE-2026-20896 probing
• GitHub / Packagist postinstall hook campaign
• Glassworm developer supply-chain botnet
• Grandoreiro and BTMOB Latin America / Europe malware campaigns
• Gravity SMTP CVE-2026-4020 exploitation
• HackerBot Claw GitHub Actions exploitation campaign
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• Hunt.io global smishing infrastructure campaign
• Immobiliare Labs Backstage plugins npm compromise
• IronWorm npm Rust infostealer campaign
• Ivanti Sentry CVE-2026-10520 exploitation
• JADEPUFFER Langflow agentic ransomware
• Januscape KVM CVE-2026-53359 guest-to-host escape
• JDY SOHO / IoT reconnaissance botnet
• JetBrains AI plugin API-key theft
• JINX-0164 crypto developer infrastructure campaign
• Joomla JCE CVE-2026-48907 exploitation
• js-logger-pack Hugging Face exfiltration campaign
• Kairos data-extortion government payment
• Kali365 device-code phishing expansion
• Klue Salesforce OAuth token abuse
• KnowledgeDeliver CVE-2026-5426 ViewState exploitation
• Langflow CVE-2025-34291 exploitation
• Langflow CVE-2026-33017 cryptominer SSH worm
• Lantronix EDS5000 CVE-2025-67038 exploitation
• Laravel-Lang Composer tag-rewrite compromise
• Lazarus-linked Rollup polyfill npm malware
• Leo Platform npm Miasma-style compromise
• Linux Bad Epoll CVE-2026-46242 local privilege escalation
• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux Kernel CVE-2022-0492 cgroup release_agent exploitation
• Linux nftables CVE-2026-23111 public LPE exploits
• Linux pedit COW CVE-2026-46331 local privilege escalation
• LiteLLM compromise
• LiteLLM CVE-2026-42271 MCP stdio command injection
• LiteSpeed cPanel CVE-2026-48172 exploitation
• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation
• macOS.Gaslight Rust backdoor
• Malware-Slop Claude user-data npm infostealer
• Marimo CVE-2026-39987 LLM-agent post-exploitation
• Mastra easy-day-js npm scope compromise
• Megalodon GitHub Actions workflow backdooring
• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Microsoft SharePoint CVE-2026-45659 RCE exploitation
• Mini Shai-Hulud npm/PyPI worm campaign
• MiniPlasma Windows Cloud Filter LPE exploitation
• Mirasvit Cache Warmer CVE-2026-45247 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• NATS-as-C2 KeyHunter credential-harvesting operation
• node-ipc 2026 npm maintainer-account compromise
• Nx Console VS Code extension compromise
• Okta support-system compromise
• Ollama P2P cryptominer RAT campaign
• Oman government Iranian-nexus webshell C2
• oob.moika.tech dependency-confusion environment stealer
• Operation DangerousPassword axios npm compromise
• Operation Dragon Weave Azure Blob C2 campaign
• Operation DragonReturn India tax-season DcRAT campaign
• Operation Endgame SocGholish disruption
• Operation FlutterBridge FlutterShell macOS malvertising
• Operation GriefLure Southeast Asia LNK dropper
• Operation Highland Velvet Ant authentication-stack backdoors
• Operation XENOFISCAL SideCopy XenoRAT campaign
• Oracle E-Business Suite CVE-2026-46817 exploitation
• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• Oracle WebLogic CVE-2024-21182 exploitation
• Outsider Enterprise smishing PhaaS
• PAN-OS GlobalProtect CVE-2026-0257 exploitation
• Perplexity AI-spoofing Chromium extension search hijacker
• Photo ZIP hospitality Node.js implant campaign
• Pirated media SilentCryptoMiner RAT campaign
• PolinRider cross-ecosystem supply-chain campaign
• Polymarket npm wallet-drainer packages
• postcss-minify-selector-parser npm RAT
• PraisonAI CVE-2026-44338 rapid exploitation
• procwire / routecraft npm Windows dropper
• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE
• PTC Windchill / FlexPLM CVE-2026-12569 exploitation
• Quest KACE SMA CVE-2025-32975 exploitation
• Russian intelligence commercial-messaging backup-key phishing
• SANDWORM_MODE AI-toolchain npm worm
• ScarCruft Yanbian game-platform supply-chain attack
• ScreenConnect freeware / AsyncRAT SEO campaign
• ServiceNow instance unauthenticated table-query exploitation
• SHADOW-AETHER AI-augmented Latin America intrusions
• shopsprint/decimal Go typosquat DNS backdoor
• Sicoob.Sdk NuGet banking certificate stealer
• Silent Swap Google Notes crypto clipper
• simonecorsi/mawesome GitHub Action compromise
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• Solana FakeFix npm / PyPI developer stealer
• SolarWinds Serv-U CVE-2026-28318 exploitation
• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE
• StealC / Amadey infrastructure disruption
• StegaBin Pastebin-steganography npm campaign
• StegoAd Edge extension steganography campaign
• Stock exchange executive mailbox espionage
• Storm-2603 parallel SharePoint ransomware intrusion
• StrikeShark SharkLoader / Cobalt Strike campaign
• TamperedChef-style productivity malware clusters
• Telnyx PyPI TeamPCP compromise
• Tenda firmware CVE-2026-11405 hidden authentication backdoor
• Thailand healthcare RAR / Python stealer campaign
• tj-actions and reviewdog compromise
• ToddyCat Umbrij Gmail OAuth operation
• TrapDoor crypto-stealer cross-ecosystem campaign
• Trend Micro Apex One CVE-2026-34926 exploitation
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• Turla STOCKSTAY backdoor operations
• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation
• UNC6692 SNOW malware social-engineering campaign
• UNK_DeadDrop developer repository phishing
• UNK_MassTraction Roundcube university mailserver campaign
• VEIL#DROP Blogger-hosted PureLogs stealer chain
• VerdantBamboo appliance BRICKSTORM operation
• vpmdhaj OpenSearch npm cloud-secret stealer
• VPN Go browser-extension clipboard stealer
• WhatsApp VBScript ManageEngine RMM campaign
• WP Maps Pro CVE-2026-8732 exploitation
• wshu.net npm credential-stealer campaign
• Xinference PyPI compromise
• XZ Utils backdoor

opsec failure

• Malware-Slop Claude user-data npm infostealer

Oracle

• Oracle E-Business Suite CVE-2026-46817 exploitation

Oracle E-Business Suite

• Oracle E-Business Suite CVE-2026-46817 exploitation

Oracle Payments

• Oracle E-Business Suite CVE-2026-46817 exploitation

Oracle PeopleSoft

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• ShinyHunters

Oracle WebLogic Server

• Oracle WebLogic CVE-2024-21182 exploitation

OT

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

OTA update

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

OTP interception

• Chinese-language PhaaS wallet-tokenization ecosystem

Outlook

• Stock exchange executive mailbox espionage

OX Security

• MCP stdio command-execution boundary

OxideHarvest

• The Gentlemen ransomware

OYSTERBLUES

• Ghostwriter

OYSTERFRESH

• Ghostwriter

OYSTERSHUCK

• Ghostwriter

P2P

• Ollama P2P cryptominer RAT campaign

package masquerading

• Lazarus-linked Rollup polyfill npm malware

package registry

• Mastra easy-day-js npm scope compromise
• Operation DangerousPassword axios npm compromise
• Telnyx PyPI TeamPCP compromise

package registry credentials

• Djinn Stealer

package scanning

• AI scanner anti-analysis

package-cooldowns

• npm install explicit-trust controls

package-manager-hardening

• npm install explicit-trust controls

package-splitting

• procwire / routecraft npm Windows dropper

package-takeover

• art-template Coruna-style iOS watering-hole compromise

Packagist

• Famous Chollima Packagist dev-branch loader
• GitHub / Packagist postinstall hook campaign
• Laravel-Lang Composer tag-rewrite compromise
• PolinRider cross-ecosystem supply-chain campaign

page cache

• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux pedit COW CVE-2026-46331 local privilege escalation

page poisoning

• Ghost CMS CVE-2026-26980 ClickFix poisoning

Pakistan

• FishMonger
• SprySOCKS

Pakistan-linked

• Operation XENOFISCAL SideCopy XenoRAT campaign
• SideCopy

Palo Alto Networks

• PAN-OS GlobalProtect CVE-2026-0257 exploitation

PAM

• Operation Highland Velvet Ant authentication-stack backdoors
• Velvet Ant

PAM credential validation

• PamStealer

PamStealer

• PamStealer

PAN-OS

• PAN-OS GlobalProtect CVE-2026-0257 exploitation

parallel-intrusion

• Storm-2603 parallel SharePoint ransomware intrusion

password spray

• NetNut / Popa residential proxy network disruption

password spraying

• Azure CLI LSHIY password-spray campaign
• FortiBleed Fortinet credential exposure

Pastebin

• StegaBin Pastebin-steganography npm campaign

patch management

• Chrome V8 CVE-2026-11645 exploitation
• Microsoft SharePoint CVE-2026-45659 RCE exploitation

path traversal

• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

patterns

• Agent localhost control-plane RCE
• Agent skill marketplace poisoning
• AI scanner anti-analysis
• AI-agent memory poisoning
• AI-augmented adversary operations
• AI-brand impersonation phishing and malvertising
• Browser-based developer IDE OAuth token theft
• Claude Code GitHub Action prompt-injection boundary
• ClickOnce COM hijacking abuse
• Cloud bucket namespace hijacking
• Cloud logging control-plane tampering
• Crypto supply-chain path to transaction authority
• Developer-tool config auto-execution
• GitHub Actions deployment poisoning
• GitHub Actions OIDC subject-claim collisions
• GuardFall AI-agent shell-guard bypass
• LangGraph checkpointer injection and unsafe deserialization
• Malicious infrastructure provider concentration
• MCP stdio command-execution boundary
• MCP tool-description poisoning
• Microsoft Teams external-chat phishing
• npm install explicit-trust controls
• Phantom squatting: AI-hallucinated domains
• Sentry MCP Agentjacking
• Vertex AI staging-bucket squatting

payload loader

• TaskWeaver

payload staging

• procwire / routecraft npm Windows dropper

payload-as-a-service

• ClickFix CPaaS API-driven payload delivery

payment fraud

• Chinese-language PhaaS wallet-tokenization ecosystem

payment workflow exposure

• Oracle E-Business Suite CVE-2026-46817 exploitation

payment-card theft

• AI-brand impersonation phishing and malvertising
• GHOST STADIUM FIFA World Cup ticket phishing

payment-card-theft

• Hunt.io global smishing infrastructure campaign
• Outsider Enterprise smishing PhaaS

payroll lures

• TA4922

pe_to_shellcode

• RemotePE

PebbleDash

• Kimsuky / Emerald Sleet / TA427

pedit

• Linux pedit COW CVE-2026-46331 local privilege escalation

pentesting

• ChocoPoC fake PoC supply-chain campaign

people

• JiaT75

PeopleTools

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

PerfWatson2.exe

• TinyRCT

Perplexity AI

• Perplexity AI-spoofing Chromium extension search hijacker

persistence

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• CanisterWorm
• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign
• ClickOnce COM hijacking abuse
• forge-jsxy
• Mastra easy-day-js npm scope compromise
• MYRA RAT
• Nx Console VS Code extension compromise
• Ollama P2P cryptominer RAT campaign
• Operation Highland Velvet Ant authentication-stack backdoors
• Pirated media SilentCryptoMiner RAT campaign
• postcss-minify-selector-parser npm RAT
• QuimaRAT
• ROADtools
• Showboat
• Stock exchange executive mailbox espionage
• TamperedChef-style productivity malware clusters
• TeamPCP
• TrapDoor crypto-stealer cross-ecosystem campaign
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• Velvet Ant
• wshu.net npm credential-stealer campaign

pfSense

• VerdantBamboo appliance BRICKSTORM operation

PhaaS

• Chinese-language PhaaS wallet-tokenization ecosystem
• Kali365 device-code phishing expansion

Phantom Gyp

• binding.gyp npm CI/CD worm
• Immobiliare Labs Backstage plugins npm compromise
• Leo Platform npm Miasma-style compromise

PhantomClick

• GREYVIBE

PhantomMail

• GREYVIBE

PhantomRelay

• GREYVIBE

Philippines

• Operation GriefLure Southeast Asia LNK dropper

phishing

• AI-brand impersonation phishing and malvertising
• Avalon / CrownX malware framework
• Chinese-language PhaaS wallet-tokenization ecosystem
• Cloud Atlas
• Dutch Police / NCSC 17-million-device botnet disruption
• GHOST STADIUM FIFA World Cup ticket phishing
• Ghostwriter
• Grandoreiro and BTMOB Latin America / Europe malware campaigns
• Hunt.io global smishing infrastructure campaign
• Kali365 device-code phishing expansion
• Outsider Enterprise smishing PhaaS
• Phantom squatting: AI-hallucinated domains
• Photo ZIP hospitality Node.js implant campaign
• Russian intelligence commercial-messaging backup-key phishing
• TA4922
• UNK_DeadDrop developer repository phishing

phishing-as-a-service

• Chinese-language PhaaS wallet-tokenization ecosystem
• Outsider Enterprise smishing PhaaS

PHP

• Famous Chollima Packagist dev-branch loader
• Laravel-Lang Composer tag-rewrite compromise

PHP code injection

• Everest Forms Pro CVE-2026-3300 exploitation

PHP object injection

• Mirasvit Cache Warmer CVE-2026-45247 exploitation

PHP upload

• Joomla JCE CVE-2026-48907 exploitation

physics

• UNK_MassTraction Roundcube university mailserver campaign

PicassoLoader

• Ghostwriter

pickle

• Vertex AI staging-bucket squatting

pig butchering

• DCloud Uni-App scam infrastructure ecosystem

pig-butchering

• Funnull RingH23 and MacCMS supply-chain attacks

piracy

• Pirated media SilentCryptoMiner RAT campaign

Piriform

• CCleaner signed-update compromise

Pix

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

PixelSmash

• FFmpeg PixelSmash CVE-2026-8461 media-file RCE

PKGBUILD

• Atomic Arch AUR package hijack

plaintext HTTP

• JetBrains AI plugin API-key theft

Plandex

• GuardFall AI-agent shell-guard bypass

PLENET

• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation

plugin architecture

• QuimaRAT

poisoned-branch

• Famous Chollima Packagist dev-branch loader

PolinRider

• Astro config blockchain C2 PR injection
• PolinRider cross-ecosystem supply-chain campaign

polyfill

• Lazarus-linked Rollup polyfill npm malware

Polymarket

• Polymarket npm wallet-drainer packages

polymorphic loader

• VEIL#DROP Blogger-hosted PureLogs stealer chain

polymorphic payloads

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

Popa

• NetNut / Popa residential proxy network disruption

portmap

• Showboat

Portugal

• Grandoreiro and BTMOB Latin America / Europe malware campaigns

post-authentication RCE

• UNK_MassTraction Roundcube university mailserver campaign

post-exploitation

• AI-augmented adversary operations
• Marimo CVE-2026-39987 LLM-agent post-exploitation
• Showboat
• TaskWeaver

post-exploitation framework

• Cavern

postal-impersonation

• Hunt.io global smishing infrastructure campaign

PostCSS

• postcss-minify-selector-parser npm RAT

PostgreSQL

• Drupal Core CVE-2026-9082 exploitation
• Marimo CVE-2026-39987 LLM-agent post-exploitation
• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE

postinstall

• @marketfront / @tqm-mfe dependency-confusion stealer
• faster-axios / turbo-axios Epsilon Stealer npm campaign
• Malware-Slop Claude user-data npm infostealer
• Mastra easy-day-js npm scope compromise
• MYRA RAT
• oob.moika.tech dependency-confusion environment stealer
• Operation DangerousPassword axios npm compromise
• Polymarket npm wallet-drainer packages
• wshu.net npm credential-stealer campaign

PowerCloud

• Cloud Atlas

PowerShell

• Armored Likho BusySnake campaign
• ClickFix CPaaS API-driven payload delivery
• Cloud Atlas
• FortiClient EMS CVE-2026-35616 EKZ Infostealer campaign
• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• GREYVIBE
• Oman government Iranian-nexus webshell C2
• Photo ZIP hospitality Node.js implant campaign
• postcss-minify-selector-parser npm RAT
• Seedworm / MuddyWater
• StealC / Amadey infrastructure disruption
• UAC-0226 / SHADOW-EARTH-066
• VEIL#DROP Blogger-hosted PureLogs stealer chain

PowerShell malware

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

PowerShower

• Cloud Atlas

PPtP

• First VPN

PRA

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass

PraisonAI

• PraisonAI CVE-2026-44338 rapid exploitation

PRC

• AI-augmented adversary operations

PRC-aligned

• Showboat

PRC-nexus

• UNC6508

pre-auth RCE

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

pre-authentication

• Citrix NetScaler CVE-2026-8451 memory overread
• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE

preinstall

• @withgoogle/stitch-sdk scope squat
• procwire / routecraft npm Windows dropper

Primitive Bear

• Gamaredon

PrincessClub

• GREYVIBE

privacy

• Chrome live-wallpaper extension ad-fraud network

privacy exposure

• Perplexity AI-spoofing Chromium extension search hijacker

private registry fallback

• @marketfront / @tqm-mfe dependency-confusion stealer

private-key theft

• Polymarket npm wallet-drainer packages

privilege escalation

• Android Framework CVE-2025-48595 exploitation
• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation
• Drupal Core CVE-2026-9082 exploitation
• Linux Kernel CVE-2022-0492 cgroup release_agent exploitation
• Linux nftables CVE-2026-23111 public LPE exploits
• LiteSpeed cPanel CVE-2026-48172 exploitation
• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation
• WP Maps Pro CVE-2026-8732 exploitation

Privileged Remote Access

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass

process doppelgänging

• SprySOCKS

process environment scraping

• Djinn Stealer

process hollowing

• AI chatbot and SEO poisoning GPU-cryptojacking campaign
• Pirated media SilentCryptoMiner RAT campaign

process injection

• OceanLotus
• Operation DragonReturn India tax-season DcRAT campaign
• Operation GriefLure Southeast Asia LNK dropper

product lifecycle management

• PTC Windchill / FlexPLM CVE-2026-12569 exploitation

professional services

• UNC3753

profile.d

• MYRA RAT

Progress Kemp LoadMaster

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

Project Proposal.exe

• Mustang Panda ZOHOMURK / MINIRECON India campaigns

prompt injection

• Agent localhost control-plane RCE
• Agent skill marketplace poisoning
• AI scanner anti-analysis
• AI-agent memory poisoning
• Claude Code GitHub Action prompt-injection boundary
• GuardFall AI-agent shell-guard bypass
• macOS.Gaslight Rust backdoor
• MCP tool-description poisoning

prompt-injection

• AI-augmented adversary operations
• HackerBot Claw GitHub Actions exploitation campaign
• SANDWORM_MODE AI-toolchain npm worm
• TrapDoor crypto-stealer cross-ecosystem campaign

PROMPTFLUX

• AI-augmented adversary operations

PROMPTSPY

• AI-augmented adversary operations

proof of deletion

• Kairos data-extortion government payment

Proofpoint

• UNK_MassTraction Roundcube university mailserver campaign

protestware

• AI-augmented adversary operations

Protobuf

• AryStinger legacy-router recon proxy network

provenance

• AI-agent memory poisoning

proxy

• First VPN
• PCPJack cloud SMTP relay network
• Showboat
• TamperedChef-style productivity malware clusters
• VPN Go browser-extension clipboard stealer
• Webworm

proxy network

• AryStinger legacy-router recon proxy network
• NetNut / Popa residential proxy network disruption

ProxyChains

• SHADOW-AETHER AI-augmented Latin America intrusions

PSEMHUB

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

PsExec

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

PSIGW

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

psychological operations

• Handala

PTC

• PTC Windchill / FlexPLM CVE-2026-12569 exploitation

PteroBox

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

PteroPaste

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

PteroPSDoor

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

PteroSetup

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

PteroVDoor

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

public exploit

• Linux Bad Epoll CVE-2026-46242 local privilege escalation
• MiniPlasma Windows Cloud Filter LPE exploitation

public file-transfer exfiltration

• Seedworm / MuddyWater

public sector

• Kairos data-extortion government payment
• Seedworm / MuddyWater

pull requests

• Astro config blockchain C2 PR injection

PUP

• Chrome live-wallpaper extension ad-fraud network

PureLogs Stealer

• VEIL#DROP Blogger-hosted PureLogs stealer chain

pwn-request

• GitHub Actions deployment poisoning

PyArmor

• Armored Likho BusySnake campaign
• BusySnake Stealer

PyPI

• binding.gyp npm CI/CD worm
• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign
• Glassworm developer supply-chain botnet
• LiteLLM compromise
• Mini Shai-Hulud npm/PyPI worm campaign
• Solana FakeFix npm / PyPI developer stealer
• Telnyx PyPI TeamPCP compromise
• TrapDoor crypto-stealer cross-ecosystem campaign
• Xinference PyPI compromise

Python

• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• macOS.Gaslight Rust backdoor
• postcss-minify-selector-parser npm RAT
• Seedworm / MuddyWater
• Telnyx PyPI TeamPCP compromise
• Xinference PyPI compromise

Python extension modules

• Void Dokkaebi

Python malware

• Armored Likho BusySnake campaign
• BusySnake Stealer

Python stealer

• Thailand healthcare RAR / Python stealer campaign

QiAnXin XLab

• AryStinger legacy-router recon proxy network
• RustDuck

Qilin

• Backdoor.Mistic / KongTuke ModeloRAT activity
• Check Point VPN CVE-2026-50751 exploitation

QNAP

• AryStinger legacy-router recon proxy network

QR code interception

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

query injection

• LangGraph checkpointer injection and unsafe deserialization

Quest KACE SMA

• Quest KACE SMA CVE-2025-32975 exploitation

QuimaRAT

• QuimaRAT

RaaS

• The Gentlemen ransomware

race condition

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

RainbowEx

• DCloud Uni-App scam infrastructure ecosystem

RakNet flood

• xlabs_v1 DDoS-for-hire IoT botnet

RAM disk

• Ollama P2P cryptominer RAT campaign

Ransom-ISAC

• Kairos data-extortion government payment

ransomware

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• Avalon / CrownX malware framework
• Check Point VPN CVE-2026-50751 exploitation
• CrownX
• First VPN
• Fox Tempest
• Kairos data-extortion government payment
• Storm-2603 parallel SharePoint ransomware intrusion
• The Gentlemen ransomware

ransomware access

• Backdoor.Mistic / KongTuke ModeloRAT activity

ransomware enablement

• StealC / Amadey infrastructure disruption

ransomware-access

• Operation Endgame SocGholish disruption

rapid exploitation

• AI-augmented adversary operations
• PraisonAI CVE-2026-44338 rapid exploitation

RAR archives

• Thailand healthcare RAR / Python stealer campaign

RAR staging

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions

RAT

• Armored Likho
• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign
• DAEMON Tools Lite supply-chain compromise
• Famous Chollima Packagist dev-branch loader
• faster-axios / turbo-axios Epsilon Stealer npm campaign
• forge-jsxy
• Glassworm developer supply-chain botnet
• Grandoreiro and BTMOB Latin America / Europe malware campaigns
• GREYVIBE
• JINX-0164 crypto developer infrastructure campaign
• Mastra easy-day-js npm scope compromise
• MYRA RAT
• Ollama P2P cryptominer RAT campaign
• Operation DangerousPassword axios npm compromise
• Pirated media SilentCryptoMiner RAT campaign
• postcss-minify-selector-parser npm RAT
• QuimaRAT
• RemotePE
• Screening Serpens
• SprySOCKS
• StegaBin Pastebin-steganography npm campaign
• STOCKSTAY
• TamperedChef-style productivity malware clusters
• TinyRCT

RC4

• @marketfront / @tqm-mfe dependency-confusion stealer
• OP-512
• StealC / Amadey infrastructure disruption
• UAC-0226 / SHADOW-EARTH-066

RC4 C2

• Backdoor.Mistic / KongTuke ModeloRAT activity

RCE

• Agent localhost control-plane RCE
• LangGraph checkpointer injection and unsafe deserialization
• LiteLLM CVE-2026-42271 MCP stdio command injection
• MCP stdio command-execution boundary
• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE
• Vertex AI staging-bucket squatting

Rclone

• Seedworm / MuddyWater

rclone

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

RCS

• Chinese-language PhaaS wallet-tokenization ecosystem

RDP

• GREYVIBE

RDP phishing

• Turla STOCKSTAY backdoor operations

RDS

• Adobe ColdFusion APSB26-68 CVE bonanza

Reality

• First VPN

Reaper

• ScarCruft Yanbian game-platform supply-chain attack

reconnaissance

• AryStinger legacy-router recon proxy network
• JDY SOHO / IoT reconnaissance botnet

recovery denial

• Ababil of Minab MOIS-linked recovery-destruction campaign

recovery disruption

• Avalon / CrownX malware framework
• CrownX

recruitment lures

• Screening Serpens

Red Dev 10

• FishMonger
• SprySOCKS

Red Hat

• Linux pedit COW CVE-2026-46331 local privilege escalation

REDCap

• UNC6508

Redis

• Argo CD repo-server unauthenticated RCE
• LangGraph checkpointer injection and unsafe deserialization

Redis backdoor

• Funnull RingH23 and MacCMS supply-chain attacks

RediSearch

• LangGraph checkpointer injection and unsafe deserialization

reflective .NET loading

• VEIL#DROP Blogger-hosted PureLogs stealer chain

refresh token theft

• Kali365 device-code phishing expansion

refresh tokens

• codexui-android OpenAI token stealer

RegAsm process hollowing

• ScreenConnect freeware / AsyncRAT SEO campaign

registry persistence

• Operation XENOFISCAL SideCopy XenoRAT campaign
• Photo ZIP hospitality Node.js implant campaign
• SideCopy
• The Gentlemen ransomware
• Turla STOCKSTAY backdoor operations

registry-controls

• npm install explicit-trust controls

release automation

• simonecorsi/mawesome GitHub Action compromise

release tampering

• Trivy compromise

remote access

• Citrix NetScaler CVE-2026-8451 memory overread
• ConnectWise ScreenConnect exploitation wave
• FortiBleed Fortinet credential exposure
• Lazarus-linked Rollup polyfill npm malware
• Pirated media SilentCryptoMiner RAT campaign
• WhatsApp VBScript ManageEngine RMM campaign

Remote Access VPN

• Check Point VPN CVE-2026-50751 exploitation

remote code execution

• Crypto Clipper Tor / USB worm
• Drupal Core CVE-2026-9082 exploitation
• Everest Forms Pro CVE-2026-3300 exploitation
• FFmpeg PixelSmash CVE-2026-8461 media-file RCE
• Ivanti Sentry CVE-2026-10520 exploitation
• Joomla JCE CVE-2026-48907 exploitation
• Microsoft SharePoint CVE-2026-45659 RCE exploitation
• PTC Windchill / FlexPLM CVE-2026-12569 exploitation
• StegoAd Edge extension steganography campaign

remote debugging

• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

remote monitoring and management

• ScreenConnect freeware / AsyncRAT SEO campaign

remote script injection

• Adblock for YouTube BadBlocker remote-script injection risk

Remote Support

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass

remote support

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation

remote-access

• TA4922

Remotely

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

RemotePE

• RemotePE

RemotePELoader

• RemotePE

removable media

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

Rentry

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

replication

• Cloud bucket namespace hijacking

repo-server

• Argo CD repo-server unauthenticated RCE

repository poisoning

• Amazon Q CVE-2026-12957 MCP auto-execution
• Claude Code GitHub Action prompt-injection boundary

residential proxies

• Dutch Police / NCSC 17-million-device botnet disruption

residential proxy

• NetNut / Popa residential proxy network disruption

REST C2

• GREYVIBE

restart-triggered execution

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

reverse proxy

• Gitea Docker CVE-2026-20896 probing

reverse SSH tunneling

• Armored Likho BusySnake campaign
• BusySnake Stealer

REVERSE_PROXY_TRUSTED_PROXIES

• Gitea Docker CVE-2026-20896 probing

ReverseSocks

• Cloud Atlas

reviewdog

• tj-actions and reviewdog compromise

RingH23

• Funnull RingH23 and MacCMS supply-chain attacks

RMM

• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• UNC3753

RMM abuse

• AI chatbot and SEO poisoning GPU-cryptojacking campaign
• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• Cavern
• Cavern Manticore
• ScreenConnect freeware / AsyncRAT SEO campaign
• TaskWeaver
• WhatsApp VBScript ManageEngine RMM campaign

ROADrecon

• ROADtools

ROADtools

• ROADtools

roadtx

• ROADtools

RokRAT

• ScarCruft Yanbian game-platform supply-chain attack

Rollup

• Lazarus-linked Rollup polyfill npm malware

RomulusLoader

• TA4922

Roo-Code

• GuardFall AI-agent shell-guard bypass

root

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

root escalation

• Cisco Unified CM CVE-2026-20230 file-write exploitation

root execution

• Lantronix EDS5000 CVE-2025-67038 exploitation
• LiteSpeed cPanel CVE-2026-48172 exploitation

rootkit

• Atomic Arch AUR package hijack
• Funnull RingH23 and MacCMS supply-chain attacks
• IronWorm npm Rust infostealer campaign
• MYRA RAT

ROPC

• Azure CLI LSHIY password-spray campaign

Rouki obfuscation

• Thailand healthcare RAR / Python stealer campaign

Roundcube

• UNK_MassTraction Roundcube university mailserver campaign

router

• Tenda firmware CVE-2026-11405 hidden authentication backdoor

router malware

• AryStinger legacy-router recon proxy network

RSA

• OP-512

RSA-2048

• Djinn Stealer

RT-Thread

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

RTL819X

• AryStinger legacy-router recon proxy network

RubyGems

• binding.gyp npm CI/CD worm
• BufferZoneCorp RubyGems / Go module CI poisoning

rundll32

• StealC / Amadey infrastructure disruption

Runner.Worker

• actions-cool GitHub Actions tag compromise

runtime execution

• wshu.net npm credential-stealer campaign

runtime mutation

• VEIL#DROP Blogger-hosted PureLogs stealer chain

runZero

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

Russia

• APT29
• Armored Likho
• Cloud Atlas
• Dragonfly
• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• UAC-0226 / SHADOW-EARTH-066

Russia-linked

• STOCKSTAY
• Turla
• Turla STOCKSTAY backdoor operations

Russia-linked cybercrime

• Glassworm developer supply-chain botnet

Russia-nexus

• AI-augmented adversary operations
• GREYVIBE

Russian Intelligence Services

• Russian intelligence commercial-messaging backup-key phishing

Russian-speaking forums

• First VPN

Rust

• Atomic Arch AUR package hijack
• IronWorm npm Rust infostealer campaign
• macOS.Gaslight Rust backdoor
• Operation Dragon Weave Azure Blob C2 campaign
• RustDuck
• TrapDoor crypto-stealer cross-ecosystem campaign
• wshu.net npm credential-stealer campaign

Rust malware

• Fake-reputation crypto clipboard hijacker
• PamStealer

S3 Browser

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

S3-compatible storage

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

s5cmd

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

SaaS

• BlackFile / UNC6671 vishing extortion operation
• Klue Salesforce OAuth token abuse
• ServiceNow instance unauthenticated table-query exploitation

SaaS exposure

• Adblock for YouTube BadBlocker remote-script injection risk

sabotage

• Fast16
• Handala

Safari

• art-template Coruna-style iOS watering-hole compromise

SafeDep

• @marketfront / @tqm-mfe dependency-confusion stealer
• @withgoogle/stitch-sdk scope squat
• MYRA RAT

Salesforce

• BlackFile / UNC6671 vishing extortion operation
• Klue Salesforce OAuth token abuse

SAML IdP

• Citrix NetScaler CVE-2026-8451 memory overread

Samsung TizenRT

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

sandboxing

• GuardFall AI-agent shell-guard bypass

scam infrastructure

• DCloud Uni-App scam infrastructure ecosystem

scambling

• DCloud Uni-App scam infrastructure ecosystem

scanner evasion

• Agent skill marketplace poisoning

ScarCruft

• ScarCruft Yanbian game-platform supply-chain attack

scheduled task

• Crypto Clipper Tor / USB worm
• StealC / Amadey infrastructure disruption
• TinyRCT

scheduled task persistence

• Armored Likho BusySnake campaign
• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud
• BusySnake Stealer
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• ScreenConnect freeware / AsyncRAT SEO campaign

scheduled tasks

• Operation XENOFISCAL SideCopy XenoRAT campaign
• Stock exchange executive mailbox espionage
• StrikeShark SharkLoader / Cobalt Strike campaign
• The Gentlemen ransomware

scope squatting

• @withgoogle/stitch-sdk scope squat

screen capture

• MYRA RAT
• TinyRCT

ScreenConnect

• AI chatbot and SEO poisoning GPU-cryptojacking campaign
• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• ConnectWise ScreenConnect exploitation wave
• ScreenConnect freeware / AsyncRAT SEO campaign

screenshot theft

• BusySnake Stealer
• Crypto Clipper Tor / USB worm

script-injection

• HackerBot Claw GitHub Actions exploitation campaign

SD-WAN

• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation

search hijacking

• Perplexity AI-spoofing Chromium extension search hijacker

search result poisoning

• ScreenConnect freeware / AsyncRAT SEO campaign

Secret Blizzard

• STOCKSTAY
• Turla
• Turla STOCKSTAY backdoor operations

secret exposure

• tj-actions and reviewdog compromise

secrets

• binding.gyp npm CI/CD worm
• CircleCI 2023 customer secret exposure incident
• Claude Code GitHub Action prompt-injection boundary
• Codecov Bash Uploader compromise
• GitHub Actions deployment poisoning

secrets management

• Crypto supply-chain path to transaction authority

Secure Preferences

• Silent Swap Google Notes crypto clipper

security platform

• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE

seed phrase theft

• Silent Swap Google Notes crypto clipper

Seedworm

• Cavern Manticore
• Seedworm / MuddyWater

segmented networks

• Operation Highland Velvet Ant authentication-stack backdoors

Sekoia

• ChocoPoC fake PoC supply-chain campaign

self-delete

• TinyRCT

self-hosted AI services

• LangGraph checkpointer injection and unsafe deserialization

self-hosted media

• FFmpeg PixelSmash CVE-2026-8461 media-file RCE

self-propagation

• The Gentlemen ransomware

semantic-release

• codfish semantic-release-action tag compromise

sendit.sh

• Seedworm / MuddyWater

sensitive information exposure

• Gravity SMTP CVE-2026-4020 exploitation

Sentinel

• AI-agent memory poisoning

Sentry

• Sentry MCP Agentjacking

Sentry abuse

• Sicoob.Sdk NuGet banking certificate stealer

SEO poisoning

• AI chatbot and SEO poisoning GPU-cryptojacking campaign
• AI-brand impersonation phishing and malvertising
• ScreenConnect freeware / AsyncRAT SEO campaign
• StealC / Amadey infrastructure disruption

Serv-U

• SolarWinds Serv-U CVE-2026-28318 exploitation

service accounts

• Crypto supply-chain path to transaction authority

service-agent

• Vertex AI staging-bucket squatting

ServiceNow

• ServiceNow instance unauthenticated table-query exploitation

session hijacking

• CitrixBleed session-hijack wave
• Okta support-system compromise

session secret exposure

• Citrix NetScaler CVE-2026-8451 memory overread

session theft

• CircleCI 2023 customer secret exposure incident

session token theft

• StealC / Amadey infrastructure disruption

shadow copy deletion

• Avalon / CrownX malware framework
• CrownX

shadow MMU

• Januscape KVM CVE-2026-53359 guest-to-host escape

SHADOW-AETHER-040

• SHADOW-AETHER AI-augmented Latin America intrusions

SHADOW-AETHER-064

• SHADOW-AETHER AI-augmented Latin America intrusions

SHADOW-EARTH-066

• UAC-0226 / SHADOW-EARTH-066

SHADOW-WATER-063

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

ShadowPad

• CCleaner signed-update compromise
• FishMonger

Shai-Hulud

• AI scanner anti-analysis
• binding.gyp npm CI/CD worm
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• Developer-tool config auto-execution
• Mini Shai-Hulud npm/PyPI worm campaign
• npm install explicit-trust controls
• SANDWORM_MODE AI-toolchain npm worm

SHARDLOADER

• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns

share propagation

• Fast16

shared hosting

• LiteSpeed cPanel CVE-2026-48172 exploitation
• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

shared secrets

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

SharePoint

• BlackFile / UNC6671 vishing extortion operation
• Microsoft SharePoint CVE-2026-45659 RCE exploitation
• Storm-2603 parallel SharePoint ransomware intrusion

SharePoint Server

• Microsoft SharePoint CVE-2026-45659 RCE exploitation

SharkLoader

• StrikeShark SharkLoader / Cobalt Strike campaign

shell injection

• GuardFall AI-agent shell-guard bypass

ShinyHunters

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• ShinyHunters

Shuckworm

• Gamaredon

SideCopy

• Operation XENOFISCAL SideCopy XenoRAT campaign

Signal

• Russian intelligence commercial-messaging backup-key phishing

Signal interception

• Turla

signed malware

• Operation FlutterBridge FlutterShell macOS malvertising

signed updates

• CCleaner signed-update compromise

signed-binary

• DAEMON Tools Lite supply-chain compromise

Silent Ransom Group

• UNC3753

Silent Swap

• Silent Swap Google Notes crypto clipper

SilentCryptoMiner

• Pirated media SilentCryptoMiner RAT campaign

SilentRunLoader

• TA4922

SiliconFlow

• JetBrains AI plugin API-key theft

SimpleHelp

• Djinn Stealer
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• TaskWeaver

simulation tampering

• Fast16

Site Member permissions

• Microsoft SharePoint CVE-2026-45659 RCE exploitation

skb

• Linux DirtyClone CVE-2026-43503 local privilege escalation

SkillCloak

• Agent skill marketplace poisoning

SkillDetonate

• Agent skill marketplace poisoning

sleeper packages

• BufferZoneCorp RubyGems / Go module CI poisoning

Sliver

• Malicious infrastructure provider concentration
• PCPJack cloud SMTP relay network

SLSA

• Mini Shai-Hulud npm/PyPI worm campaign

smart TVs

• NetNut / Popa residential proxy network disruption

SmartScreen

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

SMB

• PAN-OS GlobalProtect CVE-2026-0257 exploitation

SMB brute force

• Cavern

SMB egress

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

smishing

• 0ktapus phishing campaign
• Crypto supply-chain path to transaction authority
• Hunt.io global smishing infrastructure campaign
• Outsider Enterprise smishing PhaaS

sms-phishing

• Outsider Enterprise smishing PhaaS

SMTP

• PCPJack cloud SMTP relay network

Snake

• Turla

SNOWLIGHT

• UNK_MassTraction Roundcube university mailserver campaign

SocGholish

• Operation Endgame SocGholish disruption

social engineering

• AI-brand impersonation phishing and malvertising
• Chinese-language PhaaS wallet-tokenization ecosystem
• ClickFix CPaaS API-driven payload delivery
• Fake-reputation crypto clipboard hijacker
• JINX-0164
• JINX-0164 crypto developer infrastructure campaign
• Microsoft Teams external-chat phishing
• Polymarket npm wallet-drainer packages
• Russian intelligence commercial-messaging backup-key phishing
• Screening Serpens
• UNC3753
• UNC6692 SNOW malware social-engineering campaign
• Void Dokkaebi
• WhatsApp VBScript ManageEngine RMM campaign

social-engineering

• BlackFile / UNC6671 vishing extortion operation
• Kali365 device-code phishing expansion

Socket

• VPN Go browser-extension clipboard stealer

Socket Security Research

• Chrome live-wallpaper extension ad-fraud network

Socket.IO

• Lazarus-linked Rollup polyfill npm malware

SOCKS tunneling

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

SOCKS5

• Cavern
• Operation Highland Velvet Ant authentication-stack backdoors
• Seedworm / MuddyWater
• Showboat

SOCKS5 tunneling

• SHADOW-AETHER AI-augmented Latin America intrusions

SoftEther VPN

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions

software impersonation

• AI chatbot and SEO poisoning GPU-cryptojacking campaign

software supply chain

• GuardFall AI-agent shell-guard bypass

software-deployment

• ClickOnce COM hijacking abuse

SOHO router

• Tenda firmware CVE-2026-11405 hidden authentication backdoor

SOHO routers

• JDY SOHO / IoT reconnaissance botnet

Solana

• Glassworm developer supply-chain botnet
• Solana FakeFix npm / PyPI developer stealer

SolarWinds

• SolarWinds Serv-U CVE-2026-28318 exploitation

Solid PDF Creator

• Mustang Panda ZOHOMURK / MINIRECON India campaigns

SolidPDFCreator.dll

• Mustang Panda ZOHOMURK / MINIRECON India campaigns

SolidPDFPcl2Bmp

• Mustang Panda ZOHOMURK / MINIRECON India campaigns

Sophos

• FortiBleed Fortinet credential exposure

source control

• Gitea Docker CVE-2026-20896 probing

source-code compromise

• JINX-0164 crypto developer infrastructure campaign

source-package drift

• codexui-android OpenAI token stealer

source-package mismatch

• Sicoob.Sdk NuGet banking certificate stealer

source-repository poisoning

• Astro config blockchain C2 PR injection
• Developer-tool config auto-execution
• PolinRider cross-ecosystem supply-chain campaign

SourceForge abuse

• Fake-reputation crypto clipboard hijacker

South Africa

• Webworm

South Asia

• SideCopy

South Korea

• Kimsuky / Emerald Sleet / TA427
• Seedworm / MuddyWater

Southeast Asia

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• OceanLotus
• Operation GriefLure Southeast Asia LNK dropper
• Showboat

spam

• Dutch Police / NCSC 17-million-device botnet disruption

spear phishing

• Armored Likho
• Armored Likho BusySnake campaign
• Kimsuky / Emerald Sleet / TA427
• Operation DragonReturn India tax-season DcRAT campaign
• Operation XENOFISCAL SideCopy XenoRAT campaign
• SideCopy
• Thailand healthcare RAR / Python stealer campaign
• UAC-0226 / SHADOW-EARTH-066

spear-phishing

• GREYVIBE
• Operation GriefLure Southeast Asia LNK dropper

spearphishing

• Dragonfly

SPECTRALVIPER

• OceanLotus

Sphinx ransomware

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

SpiderLabs

• QuimaRAT

Splunk

• Splunk Enterprise CVE-2026-20253 pre-auth file write / RCE

SprySOCKS

• FishMonger
• SprySOCKS

SQL injection

• Drupal Core CVE-2026-9082 exploitation
• Ghost CMS CVE-2026-26980 ClickFix poisoning
• LangGraph checkpointer injection and unsafe deserialization

SQLite

• LangGraph checkpointer injection and unsafe deserialization

SquareShell

• UNK_MassTraction Roundcube university mailserver campaign

SSH

• SHADOW-AETHER AI-augmented Latin America intrusions
• XZ Utils backdoor

SSH bastion

• Marimo CVE-2026-39987 LLM-agent post-exploitation

SSH brute force

• RustDuck

SSH key exposure

• Langflow CVE-2026-33017 cryptominer SSH worm

SSH key persistence

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

SSH keys

• Djinn Stealer

SSH lateral movement

• Langflow CVE-2026-33017 cryptominer SSH worm

SSH persistence

• BufferZoneCorp RubyGems / Go module CI poisoning

SSH tunnels

• Cloud Atlas

SSL VPN

• FortiBleed Fortinet credential exposure

SSRF

• Cisco Unified CM CVE-2026-20230 file-write exploitation
• GitHub Actions deployment poisoning
• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

staged malicious update

• VPN Go browser-extension clipboard stealer

stale access

• Mastra easy-day-js npm scope compromise

stale credentials

• Klue Salesforce OAuth token abuse

Startup folder persistence

• Thailand healthcare RAR / Python stealer campaign

state-linked

• APT29

state-owned enterprise

• CL-STA-1062 Southeast Asia government and energy intrusions

Static Kitten

• Seedworm / MuddyWater

stdio

• Agent localhost control-plane RCE
• LiteLLM CVE-2026-42271 MCP stdio command injection
• MCP stdio command-execution boundary

StealC

• StealC / Amadey infrastructure disruption

stealer

• Crypto Clipper Tor / USB worm
• Ghost CMS CVE-2026-26980 ClickFix poisoning

steganography

• StegoAd Edge extension steganography campaign

StegoAd

• StegoAd Edge extension steganography campaign

STM32Cube

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

stock exchange

• Stock exchange executive mailbox espionage

STOCKSTAY

• STOCKSTAY
• Turla
• Turla STOCKSTAY backdoor operations

storage deletion

• Ababil of Minab MOIS-linked recovery-destruction campaign

Storm-2603

• Storm-2603 parallel SharePoint ransomware intrusion

Storm-2697

• The Gentlemen ransomware

Storm-3075

• AI-brand impersonation phishing and malvertising

STRD

• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

streaming boxes

• NetNut / Popa residential proxy network disruption

STUN

• Grandoreiro and BTMOB Latin America / Europe malware campaigns

Stuxnet lineage

• Fast16

subject claim

• GitHub Actions OIDC subject-claim collisions

SUMMIT

• STOCKSTAY
• Turla
• Turla STOCKSTAY backdoor operations

Supabase

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

supply chain

• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign
• FFmpeg PixelSmash CVE-2026-8461 media-file RCE
• MYRA RAT
• Solana FakeFix npm / PyPI developer stealer

supply chain compromise

• OceanLotus

supply-chain

• 3CX desktop app compromise
• @marketfront / @tqm-mfe dependency-confusion stealer
• @withgoogle/stitch-sdk scope squat
• actions-cool GitHub Actions tag compromise
• Agent skill marketplace poisoning
• AI scanner anti-analysis
• AI-augmented adversary operations
• APT29
• art-template Coruna-style iOS watering-hole compromise
• Astro config blockchain C2 PR injection
• Atomic Arch AUR package hijack
• binding.gyp npm CI/CD worm
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• Browser-based developer IDE OAuth token theft
• BufferZoneCorp RubyGems / Go module CI poisoning
• CanisterWorm
• Claude Code GitHub Action prompt-injection boundary
• Codecov Bash Uploader compromise
• codexui-android OpenAI token stealer
• codfish semantic-release-action tag compromise
• Crypto supply-chain path to transaction authority
• DAEMON Tools Lite supply-chain compromise
• Developer-tool config auto-execution
• Famous Chollima Packagist dev-branch loader
• faster-axios / turbo-axios Epsilon Stealer npm campaign
• forge-jsxy
• Funnull RingH23 and MacCMS supply-chain attacks
• GitHub / Packagist postinstall hook campaign
• GitHub Actions deployment poisoning
• GitHub Actions OIDC subject-claim collisions
• Glassworm developer supply-chain botnet
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• Immobiliare Labs Backstage plugins npm compromise
• IronWorm npm Rust infostealer campaign
• JetBrains AI plugin API-key theft
• JiaT75
• JINX-0164
• JINX-0164 crypto developer infrastructure campaign
• js-logger-pack Hugging Face exfiltration campaign
• Klue Salesforce OAuth token abuse
• Laravel-Lang Composer tag-rewrite compromise
• Lazarus-linked Rollup polyfill npm malware
• Leo Platform npm Miasma-style compromise
• LiteLLM compromise
• Malware-Slop Claude user-data npm infostealer
• Mastra easy-day-js npm scope compromise
• MCP stdio command-execution boundary
• MCP tool-description poisoning
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• node-ipc 2026 npm maintainer-account compromise
• npm install explicit-trust controls
• Nx Console VS Code extension compromise
• oob.moika.tech dependency-confusion environment stealer
• Operation DangerousPassword axios npm compromise
• Phantom squatting: AI-hallucinated domains
• PolinRider cross-ecosystem supply-chain campaign
• Polymarket npm wallet-drainer packages
• postcss-minify-selector-parser npm RAT
• procwire / routecraft npm Windows dropper
• SANDWORM_MODE AI-toolchain npm worm
• ScarCruft Yanbian game-platform supply-chain attack
• shopsprint/decimal Go typosquat DNS backdoor
• Sicoob.Sdk NuGet banking certificate stealer
• simonecorsi/mawesome GitHub Action compromise
• StegaBin Pastebin-steganography npm campaign
• TeamPCP
• Telnyx PyPI TeamPCP compromise
• tj-actions and reviewdog compromise
• TrapDoor crypto-stealer cross-ecosystem campaign
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• Vertex AI staging-bucket squatting
• Void Dokkaebi
• vpmdhaj OpenSearch npm cloud-secret stealer
• VPN Go browser-extension clipboard stealer
• wshu.net npm credential-stealer campaign
• Xinference PyPI compromise
• XZ Utils backdoor

suspected China-aligned

• UNK_MassTraction Roundcube university mailserver campaign

SWE-agent

• GuardFall AI-agent shell-guard bypass

SWUpdate

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

Symantec Threat Hunter Team

• Backdoor.Mistic / KongTuke ModeloRAT activity

symlink following

• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation

Synacktiv

• Argo CD repo-server unauthenticated RCE

Synology

• VerdantBamboo appliance BRICKSTORM operation

Sysdig

• Gitea Docker CVE-2026-20896 probing
• JADEPUFFER Langflow agentic ransomware

SYSTEM

• MiniPlasma Windows Cloud Filter LPE exploitation

systemd-userdbd

• MYRA RAT

T1204.004

• ClickFix CPaaS API-driven payload delivery

T3

• Oracle WebLogic CVE-2024-21182 exploitation

TA427

• Kimsuky / Emerald Sleet / TA427

TA569

• Operation Endgame SocGholish disruption

Tactical RMM

• Malicious infrastructure provider concentration

tag rewrite

• Laravel-Lang Composer tag-rewrite compromise

tag tampering

• actions-cool GitHub Actions tag compromise
• codfish semantic-release-action tag compromise
• simonecorsi/mawesome GitHub Action compromise
• tj-actions and reviewdog compromise

TAG-124

• Backdoor.Mistic / KongTuke ModeloRAT activity

TAG-22

• FishMonger
• SprySOCKS

Taiwan

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• FishMonger
• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• Operation Dragon Weave Azure Blob C2 campaign
• SprySOCKS

takedown

• Dutch Police / NCSC 17-million-device botnet disruption
• First VPN
• Glassworm developer supply-chain botnet

TamperedChef

• TamperedChef-style productivity malware clusters

targeted operations

• Fast16

TartarusGate

• RemotePE

TaskWeaver

• Djinn Stealer
• SimpleHelp CVE-2026-48558 authentication-bypass exploitation
• TaskWeaver

tax-season phishing

• Operation DragonReturn India tax-season DcRAT campaign

tc

• Linux pedit COW CVE-2026-46331 local privilege escalation

TCP traffic diversion

• SprySOCKS

TDS

• Operation Endgame SocGholish disruption

TeamPCP

• actions-cool GitHub Actions tag compromise
• AI-augmented adversary operations
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• Mini Shai-Hulud npm/PyPI worm campaign
• Nx Console VS Code extension compromise
• Telnyx PyPI TeamPCP compromise
• Trivy compromise
• Xinference PyPI compromise

TeamPCP-adjacent

• PCPJack cloud SMTP relay network

Teams access

• Kali365 device-code phishing expansion

TeamViewer

• CCleaner signed-update compromise

TEASOUP

• GREYVIBE

Tebi

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

technician session

• SimpleHelp CVE-2026-48558 authentication-bypass exploitation

telecom

• Operation GriefLure Southeast Asia LNK dropper
• Showboat

telecom-impersonation

• Hunt.io global smishing infrastructure campaign

telecommunications

• Malicious infrastructure provider concentration

Telegra.ph

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

Telegram

• 0ktapus phishing campaign
• Chinese-language PhaaS wallet-tokenization ecosystem
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• GREYVIBE
• UAC-0226 / SHADOW-EARTH-066

telegram

• Outsider Enterprise smishing PhaaS

Telegram C2

• macOS.Gaslight Rust backdoor
• Solana FakeFix npm / PyPI developer stealer
• wshu.net npm credential-stealer campaign

Telegram exfiltration

• Thailand healthcare RAR / Python stealer campaign

telemetry

• Chrome live-wallpaper extension ad-fraud network

Teletype

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

Telnet brute force

• RustDuck

Telnyx

• Telnyx PyPI TeamPCP compromise

Temp Zagros

• Seedworm / MuddyWater

tenant-project

• Vertex AI staging-bucket squatting

Tenda

• Tenda firmware CVE-2026-11405 hidden authentication backdoor

Tenet Security

• Sentry MCP Agentjacking

Tetrade

• Banana RAT / SHADOW-WATER-063 Brazilian banking fraud

Thailand

• FishMonger
• SprySOCKS
• Thailand healthcare RAR / Python stealer campaign

The Gentlemen

• The Gentlemen ransomware

The Hacker News

• Azure CLI LSHIY password-spray campaign
• Gitea Docker CVE-2026-20896 probing
• StegoAd Edge extension steganography campaign

third-party integrations

• Klue Salesforce OAuth token abuse

threat hunting

• Operation Highland Velvet Ant authentication-stack backdoors

ThrottleBlood

• The Gentlemen ransomware

thumbnail generation

• FFmpeg PixelSmash CVE-2026-8461 media-file RCE

TinyGo

• Glassworm developer supply-chain botnet

TinyRCT

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• TinyRCT

tj-actions

• tj-actions and reviewdog compromise

ToddyCat

• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

token forgery

• SimpleHelp CVE-2026-48558 authentication-bypass exploitation

token replay

• ROADtools

token theft

• Okta support-system compromise
• ROADtools

token-theft

• Kali365 device-code phishing expansion

TONESHELL

• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns

tool

• ChocoPoC

tool output injection

• Sentry MCP Agentjacking

tool poisoning

• MCP tool-description poisoning

tool use

• AI-agent memory poisoning

tooling

• CanisterWorm
• HackerBot Claw
• LiteLLM compromise
• TeamPCP
• Trivy → TeamPCP → CanisterWorm: compromise timeline

tools

• BusySnake Stealer
• Cavern
• CrownX
• Djinn Stealer
• Fast16
• First VPN
• forge-jsxy
• MYRA RAT
• PamStealer
• QuimaRAT
• RemotePE
• ROADtools
• RustDuck
• Showboat
• SprySOCKS
• STOCKSTAY
• TaskWeaver
• The Gentlemen ransomware
• TinyRCT
• Umbrij

Tor

• Cloud Atlas
• Crypto Clipper Tor / USB worm
• IronWorm npm Rust infostealer campaign

Total Software Deployment

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

Trading Technologies

• 3CX desktop app compromise

traffic control

• Linux pedit COW CVE-2026-46331 local privilege escalation

traffic hijacking

• Funnull RingH23 and MacCMS supply-chain attacks

traffic-distribution-system

• Operation Endgame SocGholish disruption

traffic-fraud

• Chrome live-wallpaper extension ad-fraud network

transaction authority

• Crypto supply-chain path to transaction authority

transnational repression

• Handala

Transparent Tribe

• Operation XENOFISCAL SideCopy XenoRAT campaign
• SideCopy

Trend Micro

• Langflow CVE-2026-33017 cryptominer SSH worm
• SHADOW-AETHER AI-augmented Latin America intrusions
• Trend Micro Apex One CVE-2026-34926 exploitation

TrendAI

• SHADOW-AETHER AI-augmented Latin America intrusions

TrickBot

• GREYVIBE

Trident Ursa

• Gamaredon

Tron

• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer

trusted publishing

• GitHub Actions OIDC subject-claim collisions

tunnel decapsulation

• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation

tunnel services

• Gamaredon

Turla

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• STOCKSTAY
• Turla
• Turla STOCKSTAY backdoor operations

Turla collaboration

• Gamaredon

Twilio

• 0ktapus phishing campaign

TypeScript

• Mastra easy-day-js npm scope compromise

typosquat

• Polymarket npm wallet-drainer packages

typosquatting

• @withgoogle/stitch-sdk scope squat
• faster-axios / turbo-axios Epsilon Stealer npm campaign
• Funnull RingH23 and MacCMS supply-chain attacks
• Hunt.io global smishing infrastructure campaign
• Lazarus-linked Rollup polyfill npm malware
• Microsoft Teams external-chat phishing
• SANDWORM_MODE AI-toolchain npm worm
• ScreenConnect freeware / AsyncRAT SEO campaign
• shopsprint/decimal Go typosquat DNS backdoor
• StegaBin Pastebin-steganography npm campaign
• vpmdhaj OpenSearch npm cloud-secret stealer

UAC

• Pirated media SilentCryptoMiner RAT campaign

UAC bypass

• ScreenConnect freeware / AsyncRAT SEO campaign

UAC-0010

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain

UAC-0098

• GREYVIBE

UAC-0194

• STOCKSTAY
• Turla
• Turla STOCKSTAY backdoor operations

UAC-0226

• UAC-0226 / SHADOW-EARTH-066

UAT-7237

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• TinyRCT

Ubiquiti

• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

Ubuntu

• Linux pedit COW CVE-2026-46331 local privilege escalation

Udev persistence

• Funnull RingH23 and MacCMS supply-chain attacks

UDP C2

• SprySOCKS

Ukraine

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• Ghostwriter
• GREYVIBE
• Russian intelligence commercial-messaging backup-key phishing
• Showboat
• UAC-0226 / SHADOW-EARTH-066

Ukraine targeting

• STOCKSTAY
• Turla
• Turla STOCKSTAY backdoor operations

UltraVNC

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

Umbrij

• ToddyCat
• ToddyCat Umbrij Gmail OAuth operation
• Umbrij

unauthenticated access

• ServiceNow instance unauthenticated table-query exploitation

unauthenticated HTTP exploitation

• Oracle E-Business Suite CVE-2026-46817 exploitation

unauthenticated RCE

• Argo CD repo-server unauthenticated RCE
• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

UNC1543

• Operation Endgame SocGholish disruption

UNC2814

• AI-augmented adversary operations

UNC3753

• UNC3753

UNC4221

• Russian intelligence commercial-messaging backup-key phishing

UNC4736

• RemotePE

UNC5792

• Russian intelligence commercial-messaging backup-key phishing

UNC6240

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation
• ShinyHunters

UNC6508

• UNC6508

UNC6671

• BlackFile / UNC6671 vishing extortion operation

UNC6692

• Microsoft Teams external-chat phishing
• UNC6692 SNOW malware social-engineering campaign

UNC6780

• AI-augmented adversary operations

Uni-App

• DCloud Uni-App scam infrastructure ecosystem

UniFi OS

• Ubiquiti UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 exploitation

Unified CM SME

• Cisco Unified CM CVE-2026-20230 file-write exploitation

uninitialized heap memory

• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

Unit 42

• FortiBleed Fortinet credential exposure
• Operation FlutterBridge FlutterShell macOS malvertising
• Phantom squatting: AI-hallucinated domains

United States

• Seedworm / MuddyWater
• UNC3753

university targeting

• UNK_MassTraction Roundcube university mailserver campaign

UNK_MassTraction

• UNK_MassTraction Roundcube university mailserver campaign

unpatched vulnerability

• Argo CD repo-server unauthenticated RCE

unsafe deserialization

• LangGraph checkpointer injection and unsafe deserialization

unsigned installer

• Silent Swap Google Notes crypto clipper

uranium compression

• Fast16

USB propagation

• Crypto Clipper Tor / USB worm

USB weaponizer

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration

USB worm

• Gamaredon
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain

use-after-free

• Linux Bad Epoll CVE-2026-46242 local privilege escalation

user execution

• ClickFix CPaaS API-driven payload delivery

user namespaces

• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux pedit COW CVE-2026-46331 local privilege escalation

UTA0355

• ROADtools

uTLS

• NATS-as-C2 KeyHunter credential-harvesting operation

V4bel

• Januscape KVM CVE-2026-53359 guest-to-host escape

V8

• Chrome V8 CVE-2026-11645 exploitation

valid accounts

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

ValleyRAT

• TA4922

VBCloud

• Cloud Atlas

VBE

• WhatsApp VBScript ManageEngine RMM campaign

VBS

• WhatsApp VBScript ManageEngine RMM campaign

VBScript

• BusySnake Stealer
• Cloud Atlas
• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• WhatsApp VBScript ManageEngine RMM campaign

VEIL#DROP

• VEIL#DROP Blogger-hosted PureLogs stealer chain

Velociraptor

• Storm-2603 parallel SharePoint ransomware intrusion

Velvet Ant

• Operation Highland Velvet Ant authentication-stack backdoors
• Velvet Ant

VELVETSHELL

• Velvet Ant

vendor compromise

• Klue Salesforce OAuth token abuse

vendor credentials

• Crypto supply-chain path to transaction authority

VENOMOUS BEAR

• STOCKSTAY
• Turla
• Turla STOCKSTAY backdoor operations

Vercel

• StegaBin Pastebin-steganography npm campaign

Vertex AI

• Vertex AI staging-bucket squatting

Vidar Stealer

• AI-brand impersonation phishing and malvertising

Vietnam

• OceanLotus
• Operation GriefLure Southeast Asia LNK dropper

Vietnam-aligned

• OceanLotus

Views

• Drupal Core CVE-2026-9082 exploitation

ViewState deserialization

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

virtualization

• Ababil of Minab MOIS-linked recovery-destruction campaign
• Januscape KVM CVE-2026-53359 guest-to-host escape

VirusTotal sentiment abuse

• Fake-reputation crypto clipboard hijacker

vishing

• BlackFile / UNC6671 vishing extortion operation
• UNC3753

Visual Studio

• Amazon Q CVE-2026-12957 MCP auto-execution

Visual Studio Code Remote SSH

• Storm-2603 parallel SharePoint ransomware intrusion

VLESS

• First VPN

vManage

• Cisco Catalyst SD-WAN Manager CVE-2026-20245 / CVE-2026-20262 exploitation

VMware

• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation

VNT

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions

Volt Typhoon

• JDY SOHO / IoT reconnaissance botnet

VPN

• Check Point VPN CVE-2026-50751 exploitation
• Citrix NetScaler CVE-2026-8451 memory overread
• First VPN
• PAN-OS GlobalProtect CVE-2026-0257 exploitation
• VPN Go browser-extension clipboard stealer

VPN gateway

• FortiBleed Fortinet credential exposure

VPN Go

• VPN Go browser-extension clipboard stealer

VPN session hijacking

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions

VS Code

• Amazon Q CVE-2026-12957 MCP auto-execution
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• Browser-based developer IDE OAuth token theft
• Glassworm developer supply-chain botnet
• html-to-gutenberg / fetch-page-assets VS Code blockchain stealer
• Nx Console VS Code extension compromise
• PolinRider cross-ecosystem supply-chain campaign
• UNK_DeadDrop developer repository phishing

VS Code tunnels

• Kimsuky / Emerald Sleet / TA427

VShell

• UNK_MassTraction Roundcube university mailserver campaign

VSIX

• UNK_DeadDrop developer repository phishing

vSphere

• VerdantBamboo
• VerdantBamboo appliance BRICKSTORM operation

VU#213560

• Tenda firmware CVE-2026-11405 hidden authentication backdoor

vulnerability

• Adobe ColdFusion APSB26-68 CVE bonanza
• Amazon Q CVE-2026-12957 MCP auto-execution
• Android Framework CVE-2025-48595 exploitation
• BeyondTrust RS / PRA CVE-2026-40138 and CVE-2026-40139 authentication bypass
• Citrix NetScaler CVE-2026-8451 memory overread
• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster
• Januscape KVM CVE-2026-53359 guest-to-host escape
• Linux Bad Epoll CVE-2026-46242 local privilege escalation
• Linux DirtyClone CVE-2026-43503 local privilege escalation
• Linux Kernel CVE-2022-0492 cgroup release_agent exploitation
• Linux nftables CVE-2026-23111 public LPE exploits
• Linux pedit COW CVE-2026-46331 local privilege escalation
• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Mirasvit Cache Warmer CVE-2026-45247 exploitation
• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE
• Quest KACE SMA CVE-2025-32975 exploitation
• Tenda firmware CVE-2026-11405 hidden authentication backdoor
• Trend Micro Apex One CVE-2026-34926 exploitation

vulnerability research

• ChocoPoC
• ChocoPoC fake PoC supply-chain campaign

vulnerability-research

• AI-augmented adversary operations

VXLAN

• Arista EOS CVE-2026-7473 tunnel decapsulation exploitation

w3wp.exe

• OP-512

wallet address replacement

• Silent Swap Google Notes crypto clipper

wallet drainer

• DCloud Uni-App scam infrastructure ecosystem

wallet infrastructure

• Crypto supply-chain path to transaction authority

wallet replacement

• Funnull RingH23 and MacCMS supply-chain attacks

wallet theft

• Fake-reputation crypto clipboard hijacker
• Mastra easy-day-js npm scope compromise
• Solana FakeFix npm / PyPI developer stealer
• Void Dokkaebi

wallet-drainer

• Polymarket npm wallet-drainer packages

wallet-theft

• forge-jsxy
• Polymarket npm wallet-drainer packages
• TrapDoor crypto-stealer cross-ecosystem campaign

Wasabi

• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Seedworm / MuddyWater

watchdog

• Pirated media SilentCryptoMiner RAT campaign

watchTowr

• Adobe ColdFusion APSB26-68 CVE bonanza
• Citrix NetScaler CVE-2026-8451 memory overread
• Progress Kemp LoadMaster CVE-2026-8037 pre-auth RCE

watering hole

• FishMonger

watering-hole

• art-template Coruna-style iOS watering-hole compromise
• Dragonfly

weak passwords

• RustDuck

web application

• Drupal Core CVE-2026-9082 exploitation
• Everest Forms Pro CVE-2026-3300 exploitation
• Gravity SMTP CVE-2026-4020 exploitation
• WP Maps Pro CVE-2026-8732 exploitation

web hosting

• LiteSpeed cPanel CVE-2026-48172 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

web IDE

• Browser-based developer IDE OAuth token theft

web management interface

• Tenda firmware CVE-2026-11405 hidden authentication backdoor

web RCE

• RustDuck

web shell

• Everest Forms Pro CVE-2026-3300 exploitation
• KnowledgeDeliver CVE-2026-5426 ViewState exploitation
• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation
• Oman government Iranian-nexus webshell C2
• UNC6508

web shells

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions
• StrikeShark SharkLoader / Cobalt Strike campaign

web supply chain

• Funnull RingH23 and MacCMS supply-chain attacks

web-shells

• OP-512

WebAssembly

• Glassworm developer supply-chain botnet

WebKit

• art-template Coruna-style iOS watering-hole compromise

WebLogic

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

webmail

• UNK_MassTraction Roundcube university mailserver campaign

WebRTC

• Grandoreiro and BTMOB Latin America / Europe malware campaigns

webshell

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

website-compromise

• Operation Endgame SocGholish disruption

WebSocket

• Agent localhost control-plane RCE

WebSocket C2

• Cavern
• GREYVIBE
• Mustang Panda ZOHOMURK / MINIRECON India campaigns
• SprySOCKS
• STOCKSTAY
• Turla STOCKSTAY backdoor operations

websocket-sharp

• STOCKSTAY

WebView

• Operation FlutterBridge FlutterShell macOS malvertising

Webworm

• Webworm

WhatsApp

• GREYVIBE
• WhatsApp VBScript ManageEngine RMM campaign

WhatsApp phishing

• DCloud Uni-App scam infrastructure ecosystem

WHM

• LiteSpeed cPanel CVE-2026-48172 exploitation
• LiteSpeed cPanel Plugin CVE-2026-54420 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

Widget Factory

• Joomla JCE CVE-2026-48907 exploitation

WILDDAY

• Turla
• Turla STOCKSTAY backdoor operations

Windchill

• PTC Windchill / FlexPLM CVE-2026-12569 exploitation

Windchill PDMLink

• PTC Windchill / FlexPLM CVE-2026-12569 exploitation

WinDirStat

• Cavern

Windows

• 3CX desktop app compromise
• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• Backdoor.Mistic / KongTuke ModeloRAT activity
• BusySnake Stealer
• CCleaner signed-update compromise
• ClickOnce COM hijacking abuse
• Crypto Clipper Tor / USB worm
• DAEMON Tools Lite supply-chain compromise
• Djinn Stealer
• faster-axios / turbo-axios Epsilon Stealer npm campaign
• js-logger-pack Hugging Face exfiltration campaign
• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• MiniPlasma Windows Cloud Filter LPE exploitation
• Operation DangerousPassword axios npm compromise
• Pirated media SilentCryptoMiner RAT campaign
• postcss-minify-selector-parser npm RAT
• procwire / routecraft npm Windows dropper
• QuimaRAT
• ScarCruft Yanbian game-platform supply-chain attack
• StrikeShark SharkLoader / Cobalt Strike campaign
• TamperedChef-style productivity malware clusters
• The Gentlemen ransomware
• TinyRCT

Windows Defender exclusions

• ScreenConnect freeware / AsyncRAT SEO campaign

Windows Forms

• STOCKSTAY

Windows malware

• Armored Likho BusySnake campaign
• CrownX
• Fake-reputation crypto clipboard hijacker
• Thailand healthcare RAR / Python stealer campaign
• WhatsApp VBScript ManageEngine RMM campaign

Windows persistence

• Solana FakeFix npm / PyPI developer stealer

Windows Run dialog

• ClickFix CPaaS API-driven payload delivery

Windows Script Host

• VEIL#DROP Blogger-hosted PureLogs stealer chain
• WhatsApp VBScript ManageEngine RMM campaign

Windows service persistence

• Operation DragonReturn India tax-season DcRAT campaign

Windows Terminal

• ClickFix CPaaS API-driven payload delivery

Winnti Group

• FishMonger
• SprySOCKS

Winos4.0

• TA4922

WinPython

• Backdoor.Mistic / KongTuke ModeloRAT activity

WinRAR

• Gamaredon
• Gamaredon 2025 tunnels, workers, dead drops, and cloud exfiltration
• Gamaredon GammaPhish / GammaWorm / GammaSteel chain
• UAC-0226 / SHADOW-EARTH-066

wiper

• Handala
• SANDWORM_MODE AI-toolchain npm worm

wiper-adjacent

• Ababil of Minab MOIS-linked recovery-destruction campaign

WireGuard

• First VPN
• GREYVIBE

Wiz Research

• Amazon Q CVE-2026-12957 MCP auto-execution

WM_COPYDATA IPC

• STOCKSTAY

Woodgnat

• Backdoor.Mistic / KongTuke ModeloRAT activity

WordPress

• Everest Forms Pro CVE-2026-3300 exploitation
• Gravity SMTP CVE-2026-4020 exploitation
• Operation Endgame SocGholish disruption
• WP Maps Pro CVE-2026-8732 exploitation

WordPress credential theft

• StegoAd Edge extension steganography campaign

workflow backdoor

• Megalodon GitHub Actions workflow backdooring

workspace trust

• Amazon Q CVE-2026-12957 MCP auto-execution

World Cup

• GHOST STADIUM FIFA World Cup ticket phishing

worm

• binding.gyp npm CI/CD worm
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• CanisterWorm
• Crypto Clipper Tor / USB worm
• Immobiliare Labs Backstage plugins npm compromise
• IronWorm npm Rust infostealer campaign
• Leo Platform npm Miasma-style compromise
• Mini Shai-Hulud npm/PyPI worm campaign
• PCPJack cloud SMTP relay network
• SANDWORM_MODE AI-toolchain npm worm
• TeamPCP
• Trivy → TeamPCP → CanisterWorm: compromise timeline

WP Maps Pro

• WP Maps Pro CVE-2026-8732 exploitation

WScript

• Crypto Clipper Tor / USB worm

X-Secret

• @marketfront / @tqm-mfe dependency-confusion stealer

X-WEBAUTH-USER

• Gitea Docker CVE-2026-20896 probing

X_TRADER

• 3CX desktop app compromise

XChaCha20

• The Gentlemen ransomware

XenoRAT

• Operation XENOFISCAL SideCopy XenoRAT campaign
• SideCopy

XFRM

• Linux DirtyClone CVE-2026-43503 local privilege escalation

xlabs_v1

• xlabs_v1 DDoS-for-hire IoT botnet

XMLDecoder

• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

XMRig

• GREYVIBE
• Langflow CVE-2026-33017 cryptominer SSH worm
• Ollama P2P cryptominer RAT campaign
• Pirated media SilentCryptoMiner RAT campaign

XOR

• AryStinger legacy-router recon proxy network

XOR obfuscation

• VEIL#DROP Blogger-hosted PureLogs stealer chain

XSLT SSRF

• Adobe ColdFusion APSB26-68 CVE bonanza

XSS

• UNK_MassTraction Roundcube university mailserver campaign

XSS.is

• First VPN

XXE

• Adobe ColdFusion APSB26-68 CVE bonanza

xz

• JiaT75

Yanbian

• ScarCruft Yanbian game-platform supply-chain attack

YesWeHack

• ChocoPoC fake PoC supply-chain campaign

YouTube abuse

• Fake-reputation crypto clipboard hijacker

Yuechi Shared Technology

• DCloud Uni-App scam infrastructure ecosystem

yuze

• CL-STA-1062
• CL-STA-1062 Southeast Asia government and energy intrusions

ZAPiXDESK

• GREYVIBE

Zendesk

• BlackFile / UNC6671 vishing extortion operation

Zephyr RTOS

• FatFs CVE-2026-6682 to CVE-2026-6688 embedded-filesystem bug cluster

Zero Trust

• Okta support-system compromise

zero-click

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

zero-day

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation
• MiniPlasma Windows Cloud Filter LPE exploitation
• Oracle PeopleSoft CVE-2026-35273 ShinyHunters exploitation

zero-reputation infrastructure

• Phantom squatting: AI-hallucinated domains

Zoho Assist

• Anubis ransomware CitrixBleed 2 / RMM / cloudflared intrusions
• Storm-2603 parallel SharePoint ransomware intrusion

Zoho WorkDrive

• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns

ZOHOMURK

• Mustang Panda
• Mustang Panda ZOHOMURK / MINIRECON India campaigns