Tag index

Generated from page-level ## Tags sections. Each tag below links to the pages that currently use it.

All tags

• 3CX (1)
• Ababil of Minab (1)
• Accellion (1)
• account-takeover (1)
• active exploitation (5)
• actors (2)
• Admin API key theft (1)
• Adspect (1)
• adware (1)
• AI (2)
• AI agents (1)
• AI tooling (4)
• ai-agent (1)
• Albania (1)
• Android (1)
• Apex One (1)
• API abuse (1)
• AppDomainManager (1)
• AppleJeus (1)
• appliance (1)
• APT (2)
• APT27 (1)
• APT28 (1)
• APT29 (1)
• APT37 (1)
• APT45 (1)
• Artifact Signing (1)
• ASP.NET machineKey (1)
• authentication bypass (1)
• authentication-coercion (1)
• AWS (1)
• Azure (2)
• backdoor (4)
• backups (1)
• Barracuda (1)
• Bash Uploader (1)
• Belarus (1)
• BirdCall (1)
• Bitbucket (1)
• Bitwarden (1)
• BLUEBEAM (1)
• branch-name-injection (1)
• browser credential theft (1)
• build-time compromise (1)
• Bun (1)
• C2 (2)
• CANFAIL (1)
• CCleaner (1)
• CDN (1)
• Checkmarx (1)
• China (2)
• ChromElevator (1)
• CI/CD (17)
• CircleCI (1)
• CISA KEV (2)
• Citrine Sleet (1)
• Citrix (1)
• ClickFix (1)
• cloaking (1)
• cloud (4)
• Cloudflare (1)
• Cloudflare Workers (1)
• CMS (2)
• Cobalt Strike (2)
• code signing (2)
• Codecov (1)
• Coinbase (1)
• command execution (1)
• command-execution (1)
• command-injection (1)
• Composer (2)
• compromised accounts (1)
• ConnectWise (1)
• control panel compromise (1)
• Coruna (1)
• cPanel (2)
• Crates.io (1)
• credential theft (5)
• credential-theft (14)
• criminal infrastructure (1)
• critical-infrastructure (2)
• crypto (2)
• cryptocurrency (3)
• cryptocurrency theft (1)
• cryptominer (1)
• Curious Serpens (1)
• CVE-2023-2868 (1)
• CVE-2023-4966 (1)
• CVE-2024-1708 (1)
• CVE-2024-1709 (1)
• CVE-2024-3094 (2)
• CVE-2025-34291 (1)
• CVE-2026-26980 (1)
• CVE-2026-34926 (1)
• CVE-2026-41091 (1)
• CVE-2026-41940 (1)
• CVE-2026-45498 (1)
• CVE-2026-48172 (1)
• CVE-2026-5426 (1)
• CVE-2026-9082 (1)
• cybercrime (3)
• data exfiltration (1)
• data theft (1)
• defense evasion (2)
• DeFi (2)
• deployment_status (1)
• destructive operations (1)
• developer machines (3)
• device registration (1)
• DEWMODE (1)
• Digital Knowledge (1)
• Discord (1)
• discovery (1)
• DLL sideloading (2)
• DNS C2 (1)
• Docker (1)
• DPAPI (1)
• DPAPILoader (1)
• DPRK (1)
• Drupal (1)
• edge appliance (1)
• EDR evasion (1)
• education (1)
• email (1)
• email gateway (1)
• endpoint-security (2)
• energy-sector (1)
• Entra ID (1)
• environmental keying (1)
• ESG (1)
• espionage (11)
• ETW patching (1)
• Eurojust (1)
• Europe (2)
• Europol (1)
• EvilAI (1)
• exfiltration (1)
• exploit-development (1)
• exploit-kit (1)
• Exploit.in (1)
• exploitation (3)
• extortion (1)
• fake plugin (1)
• FakeCaptcha (1)
• faketivism (1)
• Fancy Bear (1)
• FBI (1)
• FileFiend (1)
• filemanager (1)
• filename-injection (1)
• financial sector (1)
• financial services (1)
• financial theft (1)
• Forest Blizzard (1)
• Fox Tempest (1)
• FTA (1)
• Funnull (1)
• GCS (1)
• Ghost CMS (1)
• GitHub (5)
• GitHub Actions (13)
• GitHub OAuth (1)
• Gleaming Pisces (1)
• Go (3)
• Godzilla (1)
• GoEdge (1)
• group (1)
• groups (4)
• hack-and-leak (1)
• hacktivist persona (1)
• HAR files (1)
• hard-coded secrets (1)
• HellsGate (1)
• HONESTCUE (1)
• Hugging Face (1)
• ICONICSTEALER (1)
• ICS (1)
• IDE extension (1)
• identity (2)
• incident response (3)
• infostealer (1)
• infrastructure (2)
• initial-access (1)
• iOS (1)
• Iran (5)
• Israel (1)
• Japan (1)
• JavaScript injection (1)
• JavaScript loader (1)
• JavaScript malware (1)
• JavaScript tampering (1)
• JSON:API (1)
• KEV (2)
• keylogger (1)
• KnowledgeDeliver (1)
• L2TP/IPSec (1)
• LA Metro (1)
• Langflow (1)
• Laravel (1)
• lateral-movement (1)
• Lazarus (1)
• LD_PRELOAD (1)
• legacy software (1)
• liblzma (1)
• libp2p (1)
• libpeconv (1)
• lifecycle hooks (1)
• Linux (5)
• LiteSpeed (1)
• LLM (2)
• LMS (1)
• LNK (1)
• long-term access (1)
• LONGSTREAM (1)
• MacCMS (1)
• macOS (2)
• maintainer persona (1)
• maintainer-compromise (1)
• malicious releases (1)
• malvertising (1)
• malware (6)
• malware delivery (1)
• malware-signing-as-a-service (1)
• manufacturing (1)
• MCP (1)
• memory-only malware (1)
• MFA bypass (3)
• Microsoft (1)
• Microsoft Defender (1)
• Microsoft Graph (2)
• Middle East (1)
• Midnight Blizzard (1)
• MiniJunk (1)
• MiniUpdate (1)
• module-proxy (1)
• MOIS (3)
• Monero (1)
• Mr_Rot13 (1)
• MSP (1)
• MuddyWater (2)
• nation-state (1)
• NetScaler (1)
• Nginx module (1)
• node-ipc (1)
• Node.js (1)
• North Korea (2)
• npm (13)
• obfuscation (1)
• OFAC (1)
• OIDC (2)
• Okta (2)
• Ollama (1)
• OneDrive (1)
• OpenConnect (1)
• OpenVPN (1)
• operational resilience (1)
• operations (49)
• OpFauxSign (1)
• ops (46)
• OYSTERBLUES (1)
• OYSTERFRESH (1)
• OYSTERSHUCK (1)
• P2P (1)
• package-takeover (1)
• Packagist (2)
• page poisoning (1)
• patterns (2)
• pe_to_shellcode (1)
• people (1)
• persistence (11)
• phishing (1)
• PHP (1)
• pig-butchering (1)
• Piriform (1)
• Polymarket (1)
• portmap (1)
• post-exploitation (1)
• PostgreSQL (1)
• postinstall (1)
• PowerShell (1)
• PPtP (1)
• PRC (1)
• PRC-aligned (1)
• private-key theft (1)
• privilege escalation (2)
• prompt-injection (3)
• PROMPTFLUX (1)
• PROMPTSPY (1)
• proxy (4)
• psychological operations (1)
• public file-transfer exfiltration (1)
• public sector (1)
• pwn-request (1)
• PyPI (4)
• Python (1)
• RAM disk (1)
• ransomware (2)
• RAT (4)
• Reality (1)
• Reaper (1)
• recovery denial (1)
• recruitment lures (1)
• Redis backdoor (1)
• release tampering (1)
• remote access (1)
• remote code execution (1)
• RemotePE (1)
• RemotePELoader (1)
• reviewdog (1)
• RingH23 (1)
• ROADrecon (1)
• ROADtools (1)
• roadtx (1)
• RokRAT (1)
• root execution (1)
• rootkit (1)
• RubyGems (1)
• Runner.Worker (1)
• Russia (2)
• Russia-nexus (1)
• Russian-speaking forums (1)
• Rust (1)
• sabotage (1)
• Safari (1)
• ScarCruft (1)
• ScreenConnect (1)
• script-injection (1)
• secret exposure (1)
• secrets (3)
• Seedworm (1)
• sendit.sh (1)
• session hijacking (2)
• session theft (1)
• ShadowPad (1)
• Shai-Hulud (3)
• shared hosting (2)
• shared secrets (1)
• signed updates (1)
• sleeper packages (1)
• SLSA (1)
• SmartScreen (1)
• smishing (1)
• social engineering (2)
• SOCKS5 (2)
• South Africa (1)
• South Korea (1)
• Southeast Asia (1)
• spearphishing (1)
• SQL injection (2)
• SSH (1)
• SSH key persistence (1)
• SSH persistence (1)
• SSRF (1)
• state-linked (1)
• Static Kitten (1)
• stealer (1)
• storage deletion (1)
• supply-chain (33)
• tag rewrite (1)
• tag tampering (2)
• takedown (1)
• TamperedChef (1)
• TartarusGate (1)
• TeamPCP (7)
• TeamViewer (1)
• telecom (1)
• Telegram (1)
• Temp Zagros (1)
• tj-actions (1)
• token replay (1)
• token theft (2)
• tooling (5)
• tools (4)
• Trading Technologies (1)
• traffic hijacking (1)
• transnational repression (1)
• Trend Micro (1)
• Twilio (1)
• typosquat (1)
• typosquatting (3)
• Udev persistence (1)
• Ukraine (3)
• UNC2814 (1)
• UNC4736 (1)
• UNC6780 (1)
• UTA0355 (1)
• Views (1)
• ViewState deserialization (1)
• virtualization (1)
• VLESS (1)
• VPN (1)
• VS Code (2)
• vulnerability (2)
• vulnerability-research (1)
• wallet replacement (1)
• wallet-drainer (1)
• wallet-theft (2)
• watering-hole (2)
• web application (1)
• web hosting (2)
• web shell (1)
• web supply chain (1)
• WebKit (1)
• webshell (1)
• Webworm (1)
• WHM (2)
• Windows (7)
• wiper (2)
• wiper-adjacent (1)
• WireGuard (1)
• workflow backdoor (1)
• worm (6)
• X_TRADER (1)
• XMRig (1)
• XSS.is (1)
• xz (1)
• Yanbian (1)
• Zero Trust (1)
• zero-click (1)
• zero-day (1)

3CX

• 3CX desktop app compromise

Ababil of Minab

• Ababil of Minab MOIS-linked recovery-destruction campaign

Accellion

• Accellion FTA exploitation campaign

account-takeover

• node-ipc 2026 npm maintainer-account compromise

active exploitation

• Drupal Core CVE-2026-9082 exploitation
• Ghost CMS CVE-2026-26980 ClickFix poisoning
• KnowledgeDeliver CVE-2026-5426 ViewState exploitation
• LiteSpeed cPanel CVE-2026-48172 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

actors

• Fox Tempest
• Webworm

Admin API key theft

• Ghost CMS CVE-2026-26980 ClickFix poisoning

Adspect

• Ghost CMS CVE-2026-26980 ClickFix poisoning

adware

• TamperedChef-style productivity malware clusters

AI

• AI-augmented adversary operations
• Xinference PyPI compromise

AI agents

• Langflow CVE-2025-34291 exploitation

AI tooling

• Ollama P2P cryptominer RAT campaign
• Polymarket npm wallet-drainer packages
• SANDWORM_MODE AI-toolchain npm worm
• TrapDoor crypto-stealer cross-ecosystem campaign

ai-agent

• HackerBot Claw

Albania

• Handala

Android

• ScarCruft Yanbian game-platform supply-chain attack

Apex One

• Trend Micro Apex One CVE-2026-34926 exploitation

API abuse

• Ollama P2P cryptominer RAT campaign

AppDomainManager

• Screening Serpens

AppleJeus

• RemotePE

appliance

• Barracuda ESG zero-day backdoor campaign

APT

• Ghostwriter
• Screening Serpens

APT27

• AI-augmented adversary operations

APT28

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

APT29

• ROADtools

APT37

• ScarCruft Yanbian game-platform supply-chain attack

APT45

• AI-augmented adversary operations

Artifact Signing

• Fox Tempest

ASP.NET machineKey

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

authentication bypass

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

authentication-coercion

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

AWS

• CircleCI 2023 customer secret exposure incident

Azure

• Fox Tempest
• ROADtools

backdoor

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• Ollama P2P cryptominer RAT campaign
• shopsprint/decimal Go typosquat DNS backdoor
• Showboat

backups

• Ababil of Minab MOIS-linked recovery-destruction campaign

Barracuda

• Barracuda ESG zero-day backdoor campaign

Bash Uploader

• Codecov Bash Uploader compromise

Belarus

• Ghostwriter

BirdCall

• ScarCruft Yanbian game-platform supply-chain attack

Bitbucket

• CircleCI 2023 customer secret exposure incident

Bitwarden

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign

BLUEBEAM

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

branch-name-injection

• HackerBot Claw GitHub Actions exploitation campaign

browser credential theft

• Seedworm / MuddyWater

build-time compromise

• XZ Utils backdoor

Bun

• actions-cool GitHub Actions tag compromise

C2

• RemotePE
• Showboat

CANFAIL

• AI-augmented adversary operations

CCleaner

• CCleaner signed-update compromise

CDN

• Funnull RingH23 and MacCMS supply-chain attacks

Checkmarx

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign

China

• Showboat
• Webworm

ChromElevator

• Seedworm / MuddyWater

CI/CD

• actions-cool GitHub Actions tag compromise
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BufferZoneCorp RubyGems / Go module CI poisoning
• CircleCI 2023 customer secret exposure incident
• Codecov Bash Uploader compromise
• GitHub Actions deployment poisoning
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• Laravel-Lang Composer tag-rewrite compromise
• LiteLLM compromise
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• SANDWORM_MODE AI-toolchain npm worm
• TeamPCP
• tj-actions and reviewdog compromise
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline

CircleCI

• CircleCI 2023 customer secret exposure incident

CISA KEV

• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Trend Micro Apex One CVE-2026-34926 exploitation

Citrine Sleet

• RemotePE

Citrix

• CitrixBleed session-hijack wave

ClickFix

• Ghost CMS CVE-2026-26980 ClickFix poisoning

cloaking

• Ghost CMS CVE-2026-26980 ClickFix poisoning

cloud

• APT29
• ROADtools
• Webworm
• Xinference PyPI compromise

Cloudflare

• Okta support-system compromise

Cloudflare Workers

• Polymarket npm wallet-drainer packages

CMS

• Drupal Core CVE-2026-9082 exploitation
• Ghost CMS CVE-2026-26980 ClickFix poisoning

Cobalt Strike

• Ghostwriter
• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

code signing

• Fox Tempest
• TamperedChef-style productivity malware clusters

Codecov

• Codecov Bash Uploader compromise

Coinbase

• tj-actions and reviewdog compromise

command execution

• Ollama P2P cryptominer RAT campaign

command-execution

• shopsprint/decimal Go typosquat DNS backdoor

command-injection

• GitHub Actions deployment poisoning

Composer

• GitHub / Packagist postinstall hook campaign
• Laravel-Lang Composer tag-rewrite compromise

compromised accounts

• Ghostwriter

ConnectWise

• ConnectWise ScreenConnect exploitation wave

control panel compromise

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

Coruna

• art-template Coruna-style iOS watering-hole compromise

cPanel

• LiteSpeed cPanel CVE-2026-48172 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

Crates.io

• TrapDoor crypto-stealer cross-ecosystem campaign

credential theft

• Langflow CVE-2025-34291 exploitation
• LiteLLM compromise
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• Seedworm / MuddyWater
• Trivy compromise

credential-theft

• actions-cool GitHub Actions tag compromise
• APT29
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BufferZoneCorp RubyGems / Go module CI poisoning
• GitHub / Packagist postinstall hook campaign
• js-logger-pack Hugging Face exfiltration campaign
• Laravel-Lang Composer tag-rewrite compromise
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• node-ipc 2026 npm maintainer-account compromise
• Nx Console VS Code extension compromise
• SANDWORM_MODE AI-toolchain npm worm
• TrapDoor crypto-stealer cross-ecosystem campaign
• Xinference PyPI compromise

criminal infrastructure

• First VPN

critical-infrastructure

• Dragonfly
• Showboat

crypto

• Polymarket npm wallet-drainer packages
• TrapDoor crypto-stealer cross-ecosystem campaign

cryptocurrency

• Polymarket npm wallet-drainer packages
• RemotePE
• SANDWORM_MODE AI-toolchain npm worm

cryptocurrency theft

• Funnull RingH23 and MacCMS supply-chain attacks

cryptominer

• Ollama P2P cryptominer RAT campaign

Curious Serpens

• ROADtools

CVE-2023-2868

• Barracuda ESG zero-day backdoor campaign

CVE-2023-4966

• CitrixBleed session-hijack wave

CVE-2024-1708

• ConnectWise ScreenConnect exploitation wave

CVE-2024-1709

• ConnectWise ScreenConnect exploitation wave

CVE-2024-3094

• JiaT75
• XZ Utils backdoor

CVE-2025-34291

• Langflow CVE-2025-34291 exploitation

CVE-2026-26980

• Ghost CMS CVE-2026-26980 ClickFix poisoning

CVE-2026-34926

• Trend Micro Apex One CVE-2026-34926 exploitation

CVE-2026-41091

• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation

CVE-2026-41940

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

CVE-2026-45498

• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation

CVE-2026-48172

• LiteSpeed cPanel CVE-2026-48172 exploitation

CVE-2026-5426

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

CVE-2026-9082

• Drupal Core CVE-2026-9082 exploitation

cybercrime

• First VPN
• Fox Tempest
• Funnull RingH23 and MacCMS supply-chain attacks

data exfiltration

• Ababil of Minab MOIS-linked recovery-destruction campaign

data theft

• Accellion FTA exploitation campaign

defense evasion

• Ollama P2P cryptominer RAT campaign
• ROADtools

DeFi

• RemotePE
• TrapDoor crypto-stealer cross-ecosystem campaign

deployment_status

• GitHub Actions deployment poisoning

destructive operations

• Ababil of Minab MOIS-linked recovery-destruction campaign

developer machines

• BufferZoneCorp RubyGems / Go module CI poisoning
• Polymarket npm wallet-drainer packages
• Trivy compromise

device registration

• ROADtools

DEWMODE

• Accellion FTA exploitation campaign

Digital Knowledge

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

Discord

• Webworm

discovery

• ROADtools

DLL sideloading

• Screening Serpens
• Seedworm / MuddyWater

DNS C2

• shopsprint/decimal Go typosquat DNS backdoor

Docker

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign

DPAPI

• RemotePE

DPAPILoader

• RemotePE

DPRK

• AI-augmented adversary operations

Drupal

• Drupal Core CVE-2026-9082 exploitation

edge appliance

• CitrixBleed session-hijack wave

EDR evasion

• RemotePE

education

• Seedworm / MuddyWater

email

• APT29

email gateway

• Barracuda ESG zero-day backdoor campaign

endpoint-security

• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Trend Micro Apex One CVE-2026-34926 exploitation

energy-sector

• Dragonfly

Entra ID

• ROADtools

environmental keying

• RemotePE

ESG

• Barracuda ESG zero-day backdoor campaign

espionage

• APT29
• Barracuda ESG zero-day backdoor campaign
• Dragonfly
• Ghostwriter
• RemotePE
• ROADtools
• ScarCruft Yanbian game-platform supply-chain attack
• Screening Serpens
• Seedworm / MuddyWater
• Showboat
• Webworm

ETW patching

• RemotePE

Eurojust

• First VPN

Europe

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• Webworm

Europol

• First VPN

EvilAI

• TamperedChef-style productivity malware clusters

exfiltration

• js-logger-pack Hugging Face exfiltration campaign

exploit-development

• AI-augmented adversary operations

exploit-kit

• art-template Coruna-style iOS watering-hole compromise

Exploit.in

• First VPN

exploitation

• Langflow CVE-2025-34291 exploitation
• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Trend Micro Apex One CVE-2026-34926 exploitation

extortion

• Accellion FTA exploitation campaign

fake plugin

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

FakeCaptcha

• Ghost CMS CVE-2026-26980 ClickFix poisoning

faketivism

• Handala

Fancy Bear

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

FBI

• First VPN

FileFiend

• Ababil of Minab MOIS-linked recovery-destruction campaign

filemanager

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

filename-injection

• HackerBot Claw GitHub Actions exploitation campaign

financial sector

• RemotePE

financial services

• Seedworm / MuddyWater

financial theft

• RemotePE

Forest Blizzard

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

Fox Tempest

• Fox Tempest

FTA

• Accellion FTA exploitation campaign

Funnull

• Funnull RingH23 and MacCMS supply-chain attacks

GCS

• Codecov Bash Uploader compromise

Ghost CMS

• Ghost CMS CVE-2026-26980 ClickFix poisoning

GitHub

• BufferZoneCorp RubyGems / Go module CI poisoning
• GitHub / Packagist postinstall hook campaign
• JiaT75
• Nx Console VS Code extension compromise
• Webworm

GitHub Actions

• actions-cool GitHub Actions tag compromise
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BufferZoneCorp RubyGems / Go module CI poisoning
• GitHub Actions deployment poisoning
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• SANDWORM_MODE AI-toolchain npm worm
• TeamPCP
• tj-actions and reviewdog compromise
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline

GitHub OAuth

• CircleCI 2023 customer secret exposure incident

Gleaming Pisces

• RemotePE

Go

• BufferZoneCorp RubyGems / Go module CI poisoning
• Ollama P2P cryptominer RAT campaign
• shopsprint/decimal Go typosquat DNS backdoor

Godzilla

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

GoEdge

• Funnull RingH23 and MacCMS supply-chain attacks

group

• HackerBot Claw

groups

• APT29
• Dragonfly
• Fox Tempest
• Webworm

hack-and-leak

• Handala

hacktivist persona

• Ababil of Minab MOIS-linked recovery-destruction campaign

HAR files

• Okta support-system compromise

hard-coded secrets

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

HellsGate

• RemotePE

HONESTCUE

• AI-augmented adversary operations

Hugging Face

• js-logger-pack Hugging Face exfiltration campaign

ICONICSTEALER

• 3CX desktop app compromise

ICS

• Dragonfly

IDE extension

• Nx Console VS Code extension compromise

identity

• 0ktapus phishing campaign
• ROADtools

incident response

• Funnull RingH23 and MacCMS supply-chain attacks
• LiteSpeed cPanel CVE-2026-48172 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

infostealer

• TamperedChef-style productivity malware clusters

infrastructure

• First VPN
• Funnull RingH23 and MacCMS supply-chain attacks

initial-access

• AI-augmented adversary operations

iOS

• art-template Coruna-style iOS watering-hole compromise

Iran

• Ababil of Minab MOIS-linked recovery-destruction campaign
• Handala
• Langflow CVE-2025-34291 exploitation
• Screening Serpens
• Seedworm / MuddyWater

Israel

• Handala

Japan

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

JavaScript injection

• Funnull RingH23 and MacCMS supply-chain attacks

JavaScript loader

• Ghost CMS CVE-2026-26980 ClickFix poisoning

JavaScript malware

• Ghostwriter

JavaScript tampering

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

JSON:API

• Drupal Core CVE-2026-9082 exploitation

KEV

• Drupal Core CVE-2026-9082 exploitation
• Langflow CVE-2025-34291 exploitation

keylogger

• js-logger-pack Hugging Face exfiltration campaign

KnowledgeDeliver

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

L2TP/IPSec

• First VPN

LA Metro

• Ababil of Minab MOIS-linked recovery-destruction campaign

Langflow

• Langflow CVE-2025-34291 exploitation

Laravel

• Laravel-Lang Composer tag-rewrite compromise

lateral-movement

• TrapDoor crypto-stealer cross-ecosystem campaign

Lazarus

• RemotePE

LD_PRELOAD

• Funnull RingH23 and MacCMS supply-chain attacks

legacy software

• Accellion FTA exploitation campaign

liblzma

• XZ Utils backdoor

libp2p

• Ollama P2P cryptominer RAT campaign

libpeconv

• RemotePE

lifecycle hooks

• GitHub / Packagist postinstall hook campaign

Linux

• GitHub / Packagist postinstall hook campaign
• js-logger-pack Hugging Face exfiltration campaign
• Ollama P2P cryptominer RAT campaign
• Showboat
• XZ Utils backdoor

LiteSpeed

• LiteSpeed cPanel CVE-2026-48172 exploitation

LLM

• AI-augmented adversary operations
• Ollama P2P cryptominer RAT campaign

LMS

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

LNK

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

long-term access

• RemotePE

LONGSTREAM

• AI-augmented adversary operations

MacCMS

• Funnull RingH23 and MacCMS supply-chain attacks

macOS

• 3CX desktop app compromise
• js-logger-pack Hugging Face exfiltration campaign

maintainer persona

• JiaT75

maintainer-compromise

• node-ipc 2026 npm maintainer-account compromise

malicious releases

• LiteLLM compromise

malvertising

• TamperedChef-style productivity malware clusters

malware

• AI-augmented adversary operations
• CanisterWorm
• RemotePE
• Showboat
• TamperedChef-style productivity malware clusters
• TeamPCP

malware delivery

• Ghost CMS CVE-2026-26980 ClickFix poisoning

malware-signing-as-a-service

• Fox Tempest

manufacturing

• Seedworm / MuddyWater

MCP

• SANDWORM_MODE AI-toolchain npm worm

memory-only malware

• RemotePE

MFA bypass

• 0ktapus phishing campaign
• CitrixBleed session-hijack wave
• ROADtools

Microsoft

• Fox Tempest

Microsoft Defender

• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation

Microsoft Graph

• ROADtools
• Webworm

Middle East

• Showboat

Midnight Blizzard

• ROADtools

MiniJunk

• Screening Serpens

MiniUpdate

• Screening Serpens

module-proxy

• shopsprint/decimal Go typosquat DNS backdoor

MOIS

• Ababil of Minab MOIS-linked recovery-destruction campaign
• Handala
• Seedworm / MuddyWater

Monero

• Ollama P2P cryptominer RAT campaign

Mr_Rot13

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

MSP

• ConnectWise ScreenConnect exploitation wave

MuddyWater

• Langflow CVE-2025-34291 exploitation
• Seedworm / MuddyWater

nation-state

• ROADtools

NetScaler

• CitrixBleed session-hijack wave

Nginx module

• Funnull RingH23 and MacCMS supply-chain attacks

node-ipc

• node-ipc 2026 npm maintainer-account compromise

Node.js

• Seedworm / MuddyWater

North Korea

• RemotePE
• ScarCruft Yanbian game-platform supply-chain attack

npm

• art-template Coruna-style iOS watering-hole compromise
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• CanisterWorm
• GitHub / Packagist postinstall hook campaign
• js-logger-pack Hugging Face exfiltration campaign
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• node-ipc 2026 npm maintainer-account compromise
• Polymarket npm wallet-drainer packages
• SANDWORM_MODE AI-toolchain npm worm
• TeamPCP
• TrapDoor crypto-stealer cross-ecosystem campaign
• Trivy → TeamPCP → CanisterWorm: compromise timeline

obfuscation

• AI-augmented adversary operations

OFAC

• Funnull RingH23 and MacCMS supply-chain attacks

OIDC

• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign

Okta

• 0ktapus phishing campaign
• Okta support-system compromise

Ollama

• Ollama P2P cryptominer RAT campaign

OneDrive

• Webworm

OpenConnect

• First VPN

OpenVPN

• First VPN

operational resilience

• Ababil of Minab MOIS-linked recovery-destruction campaign

operations

• 0ktapus phishing campaign
• 3CX desktop app compromise
• Ababil of Minab MOIS-linked recovery-destruction campaign
• Accellion FTA exploitation campaign
• actions-cool GitHub Actions tag compromise
• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• art-template Coruna-style iOS watering-hole compromise
• Barracuda ESG zero-day backdoor campaign
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BufferZoneCorp RubyGems / Go module CI poisoning
• CanisterWorm
• CCleaner signed-update compromise
• CircleCI 2023 customer secret exposure incident
• CitrixBleed session-hijack wave
• Codecov Bash Uploader compromise
• ConnectWise ScreenConnect exploitation wave
• Drupal Core CVE-2026-9082 exploitation
• Funnull RingH23 and MacCMS supply-chain attacks
• Ghost CMS CVE-2026-26980 ClickFix poisoning
• GitHub / Packagist postinstall hook campaign
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• js-logger-pack Hugging Face exfiltration campaign
• KnowledgeDeliver CVE-2026-5426 ViewState exploitation
• Langflow CVE-2025-34291 exploitation
• Laravel-Lang Composer tag-rewrite compromise
• LiteLLM compromise
• LiteSpeed cPanel CVE-2026-48172 exploitation
• Megalodon GitHub Actions workflow backdooring
• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Mini Shai-Hulud npm/PyPI worm campaign
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• node-ipc 2026 npm maintainer-account compromise
• Nx Console VS Code extension compromise
• Okta support-system compromise
• Ollama P2P cryptominer RAT campaign
• Polymarket npm wallet-drainer packages
• SANDWORM_MODE AI-toolchain npm worm
• ScarCruft Yanbian game-platform supply-chain attack
• shopsprint/decimal Go typosquat DNS backdoor
• TamperedChef-style productivity malware clusters
• TeamPCP
• tj-actions and reviewdog compromise
• TrapDoor crypto-stealer cross-ecosystem campaign
• Trend Micro Apex One CVE-2026-34926 exploitation
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• Xinference PyPI compromise
• XZ Utils backdoor

OpFauxSign

• Fox Tempest

ops

• 0ktapus phishing campaign
• 3CX desktop app compromise
• Ababil of Minab MOIS-linked recovery-destruction campaign
• Accellion FTA exploitation campaign
• actions-cool GitHub Actions tag compromise
• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• art-template Coruna-style iOS watering-hole compromise
• Barracuda ESG zero-day backdoor campaign
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BufferZoneCorp RubyGems / Go module CI poisoning
• CCleaner signed-update compromise
• CircleCI 2023 customer secret exposure incident
• CitrixBleed session-hijack wave
• Codecov Bash Uploader compromise
• ConnectWise ScreenConnect exploitation wave
• Drupal Core CVE-2026-9082 exploitation
• Funnull RingH23 and MacCMS supply-chain attacks
• Ghost CMS CVE-2026-26980 ClickFix poisoning
• GitHub / Packagist postinstall hook campaign
• HackerBot Claw GitHub Actions exploitation campaign
• js-logger-pack Hugging Face exfiltration campaign
• KnowledgeDeliver CVE-2026-5426 ViewState exploitation
• Langflow CVE-2025-34291 exploitation
• Laravel-Lang Composer tag-rewrite compromise
• LiteLLM compromise
• LiteSpeed cPanel CVE-2026-48172 exploitation
• Megalodon GitHub Actions workflow backdooring
• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Mini Shai-Hulud npm/PyPI worm campaign
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign
• node-ipc 2026 npm maintainer-account compromise
• Nx Console VS Code extension compromise
• Okta support-system compromise
• Ollama P2P cryptominer RAT campaign
• Polymarket npm wallet-drainer packages
• SANDWORM_MODE AI-toolchain npm worm
• ScarCruft Yanbian game-platform supply-chain attack
• shopsprint/decimal Go typosquat DNS backdoor
• TamperedChef-style productivity malware clusters
• tj-actions and reviewdog compromise
• TrapDoor crypto-stealer cross-ecosystem campaign
• Trend Micro Apex One CVE-2026-34926 exploitation
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• Xinference PyPI compromise
• XZ Utils backdoor

OYSTERBLUES

• Ghostwriter

OYSTERFRESH

• Ghostwriter

OYSTERSHUCK

• Ghostwriter

P2P

• Ollama P2P cryptominer RAT campaign

package-takeover

• art-template Coruna-style iOS watering-hole compromise

Packagist

• GitHub / Packagist postinstall hook campaign
• Laravel-Lang Composer tag-rewrite compromise

page poisoning

• Ghost CMS CVE-2026-26980 ClickFix poisoning

patterns

• AI-augmented adversary operations
• GitHub Actions deployment poisoning

pe_to_shellcode

• RemotePE

people

• JiaT75

persistence

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• CanisterWorm
• Nx Console VS Code extension compromise
• Ollama P2P cryptominer RAT campaign
• ROADtools
• Showboat
• TamperedChef-style productivity malware clusters
• TeamPCP
• TrapDoor crypto-stealer cross-ecosystem campaign
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline

phishing

• Ghostwriter

PHP

• Laravel-Lang Composer tag-rewrite compromise

pig-butchering

• Funnull RingH23 and MacCMS supply-chain attacks

Piriform

• CCleaner signed-update compromise

Polymarket

• Polymarket npm wallet-drainer packages

portmap

• Showboat

post-exploitation

• Showboat

PostgreSQL

• Drupal Core CVE-2026-9082 exploitation

postinstall

• Polymarket npm wallet-drainer packages

PowerShell

• Seedworm / MuddyWater

PPtP

• First VPN

PRC

• AI-augmented adversary operations

PRC-aligned

• Showboat

private-key theft

• Polymarket npm wallet-drainer packages

privilege escalation

• Drupal Core CVE-2026-9082 exploitation
• LiteSpeed cPanel CVE-2026-48172 exploitation

prompt-injection

• HackerBot Claw GitHub Actions exploitation campaign
• SANDWORM_MODE AI-toolchain npm worm
• TrapDoor crypto-stealer cross-ecosystem campaign

PROMPTFLUX

• AI-augmented adversary operations

PROMPTSPY

• AI-augmented adversary operations

proxy

• First VPN
• Showboat
• TamperedChef-style productivity malware clusters
• Webworm

psychological operations

• Handala

public file-transfer exfiltration

• Seedworm / MuddyWater

public sector

• Seedworm / MuddyWater

pwn-request

• GitHub Actions deployment poisoning

PyPI

• LiteLLM compromise
• Mini Shai-Hulud npm/PyPI worm campaign
• TrapDoor crypto-stealer cross-ecosystem campaign
• Xinference PyPI compromise

Python

• Xinference PyPI compromise

RAM disk

• Ollama P2P cryptominer RAT campaign

ransomware

• First VPN
• Fox Tempest

RAT

• Ollama P2P cryptominer RAT campaign
• RemotePE
• Screening Serpens
• TamperedChef-style productivity malware clusters

Reality

• First VPN

Reaper

• ScarCruft Yanbian game-platform supply-chain attack

recovery denial

• Ababil of Minab MOIS-linked recovery-destruction campaign

recruitment lures

• Screening Serpens

Redis backdoor

• Funnull RingH23 and MacCMS supply-chain attacks

release tampering

• Trivy compromise

remote access

• ConnectWise ScreenConnect exploitation wave

remote code execution

• Drupal Core CVE-2026-9082 exploitation

RemotePE

• RemotePE

RemotePELoader

• RemotePE

reviewdog

• tj-actions and reviewdog compromise

RingH23

• Funnull RingH23 and MacCMS supply-chain attacks

ROADrecon

• ROADtools

ROADtools

• ROADtools

roadtx

• ROADtools

RokRAT

• ScarCruft Yanbian game-platform supply-chain attack

root execution

• LiteSpeed cPanel CVE-2026-48172 exploitation

rootkit

• Funnull RingH23 and MacCMS supply-chain attacks

RubyGems

• BufferZoneCorp RubyGems / Go module CI poisoning

Runner.Worker

• actions-cool GitHub Actions tag compromise

Russia

• APT29
• Dragonfly

Russia-nexus

• AI-augmented adversary operations

Russian-speaking forums

• First VPN

Rust

• TrapDoor crypto-stealer cross-ecosystem campaign

sabotage

• Handala

Safari

• art-template Coruna-style iOS watering-hole compromise

ScarCruft

• ScarCruft Yanbian game-platform supply-chain attack

ScreenConnect

• ConnectWise ScreenConnect exploitation wave

script-injection

• HackerBot Claw GitHub Actions exploitation campaign

secret exposure

• tj-actions and reviewdog compromise

secrets

• CircleCI 2023 customer secret exposure incident
• Codecov Bash Uploader compromise
• GitHub Actions deployment poisoning

Seedworm

• Seedworm / MuddyWater

sendit.sh

• Seedworm / MuddyWater

session hijacking

• CitrixBleed session-hijack wave
• Okta support-system compromise

session theft

• CircleCI 2023 customer secret exposure incident

ShadowPad

• CCleaner signed-update compromise

Shai-Hulud

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• Mini Shai-Hulud npm/PyPI worm campaign
• SANDWORM_MODE AI-toolchain npm worm

shared hosting

• LiteSpeed cPanel CVE-2026-48172 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

shared secrets

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

signed updates

• CCleaner signed-update compromise

sleeper packages

• BufferZoneCorp RubyGems / Go module CI poisoning

SLSA

• Mini Shai-Hulud npm/PyPI worm campaign

SmartScreen

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

smishing

• 0ktapus phishing campaign

social engineering

• Polymarket npm wallet-drainer packages
• Screening Serpens

SOCKS5

• Seedworm / MuddyWater
• Showboat

South Africa

• Webworm

South Korea

• Seedworm / MuddyWater

Southeast Asia

• Showboat

spearphishing

• Dragonfly

SQL injection

• Drupal Core CVE-2026-9082 exploitation
• Ghost CMS CVE-2026-26980 ClickFix poisoning

SSH

• XZ Utils backdoor

SSH key persistence

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

SSH persistence

• BufferZoneCorp RubyGems / Go module CI poisoning

SSRF

• GitHub Actions deployment poisoning

state-linked

• APT29

Static Kitten

• Seedworm / MuddyWater

stealer

• Ghost CMS CVE-2026-26980 ClickFix poisoning

storage deletion

• Ababil of Minab MOIS-linked recovery-destruction campaign

supply-chain

• 3CX desktop app compromise
• actions-cool GitHub Actions tag compromise
• AI-augmented adversary operations
• APT29
• art-template Coruna-style iOS watering-hole compromise
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• BufferZoneCorp RubyGems / Go module CI poisoning
• CanisterWorm
• Codecov Bash Uploader compromise
• Funnull RingH23 and MacCMS supply-chain attacks
• GitHub / Packagist postinstall hook campaign
• GitHub Actions deployment poisoning
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• JiaT75
• js-logger-pack Hugging Face exfiltration campaign
• Laravel-Lang Composer tag-rewrite compromise
• LiteLLM compromise
• Megalodon GitHub Actions workflow backdooring
• Mini Shai-Hulud npm/PyPI worm campaign
• node-ipc 2026 npm maintainer-account compromise
• Nx Console VS Code extension compromise
• Polymarket npm wallet-drainer packages
• SANDWORM_MODE AI-toolchain npm worm
• ScarCruft Yanbian game-platform supply-chain attack
• shopsprint/decimal Go typosquat DNS backdoor
• TeamPCP
• tj-actions and reviewdog compromise
• TrapDoor crypto-stealer cross-ecosystem campaign
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• Xinference PyPI compromise
• XZ Utils backdoor

tag rewrite

• Laravel-Lang Composer tag-rewrite compromise

tag tampering

• actions-cool GitHub Actions tag compromise
• tj-actions and reviewdog compromise

takedown

• First VPN

TamperedChef

• TamperedChef-style productivity malware clusters

TartarusGate

• RemotePE

TeamPCP

• actions-cool GitHub Actions tag compromise
• AI-augmented adversary operations
• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• Mini Shai-Hulud npm/PyPI worm campaign
• Nx Console VS Code extension compromise
• Trivy compromise
• Xinference PyPI compromise

TeamViewer

• CCleaner signed-update compromise

telecom

• Showboat

Telegram

• 0ktapus phishing campaign

Temp Zagros

• Seedworm / MuddyWater

tj-actions

• tj-actions and reviewdog compromise

token replay

• ROADtools

token theft

• Okta support-system compromise
• ROADtools

tooling

• CanisterWorm
• HackerBot Claw
• LiteLLM compromise
• TeamPCP
• Trivy → TeamPCP → CanisterWorm: compromise timeline

tools

• First VPN
• RemotePE
• ROADtools
• Showboat

Trading Technologies

• 3CX desktop app compromise

traffic hijacking

• Funnull RingH23 and MacCMS supply-chain attacks

transnational repression

• Handala

Trend Micro

• Trend Micro Apex One CVE-2026-34926 exploitation

Twilio

• 0ktapus phishing campaign

typosquat

• Polymarket npm wallet-drainer packages

typosquatting

• Funnull RingH23 and MacCMS supply-chain attacks
• SANDWORM_MODE AI-toolchain npm worm
• shopsprint/decimal Go typosquat DNS backdoor

Udev persistence

• Funnull RingH23 and MacCMS supply-chain attacks

Ukraine

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• Ghostwriter
• Showboat

UNC2814

• AI-augmented adversary operations

UNC4736

• RemotePE

UNC6780

• AI-augmented adversary operations

UTA0355

• ROADtools

Views

• Drupal Core CVE-2026-9082 exploitation

ViewState deserialization

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

virtualization

• Ababil of Minab MOIS-linked recovery-destruction campaign

VLESS

• First VPN

VPN

• First VPN

VS Code

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• Nx Console VS Code extension compromise

vulnerability

• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• Trend Micro Apex One CVE-2026-34926 exploitation

vulnerability-research

• AI-augmented adversary operations

wallet replacement

• Funnull RingH23 and MacCMS supply-chain attacks

wallet-drainer

• Polymarket npm wallet-drainer packages

wallet-theft

• Polymarket npm wallet-drainer packages
• TrapDoor crypto-stealer cross-ecosystem campaign

watering-hole

• art-template Coruna-style iOS watering-hole compromise
• Dragonfly

web application

• Drupal Core CVE-2026-9082 exploitation

web hosting

• LiteSpeed cPanel CVE-2026-48172 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

web shell

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation

web supply chain

• Funnull RingH23 and MacCMS supply-chain attacks

WebKit

• art-template Coruna-style iOS watering-hole compromise

webshell

• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

Webworm

• Webworm

WHM

• LiteSpeed cPanel CVE-2026-48172 exploitation
• Mr_Rot13 cPanel CVE-2026-41940 backdoor campaign

Windows

• 3CX desktop app compromise
• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain
• CCleaner signed-update compromise
• js-logger-pack Hugging Face exfiltration campaign
• Microsoft Defender CVE-2026-41091 / CVE-2026-45498 exploitation
• ScarCruft Yanbian game-platform supply-chain attack
• TamperedChef-style productivity malware clusters

wiper

• Handala
• SANDWORM_MODE AI-toolchain npm worm

wiper-adjacent

• Ababil of Minab MOIS-linked recovery-destruction campaign

WireGuard

• First VPN

workflow backdoor

• Megalodon GitHub Actions workflow backdooring

worm

• Bitwarden / Checkmarx Shai-Hulud Third Coming campaign
• CanisterWorm
• Mini Shai-Hulud npm/PyPI worm campaign
• SANDWORM_MODE AI-toolchain npm worm
• TeamPCP
• Trivy → TeamPCP → CanisterWorm: compromise timeline

X_TRADER

• 3CX desktop app compromise

XMRig

• Ollama P2P cryptominer RAT campaign

XSS.is

• First VPN

xz

• JiaT75

Yanbian

• ScarCruft Yanbian game-platform supply-chain attack

Zero Trust

• Okta support-system compromise

zero-click

• APT28 LNK SmartScreen bypass and CVE-2026-32202 coercion chain

zero-day

• KnowledgeDeliver CVE-2026-5426 ViewState exploitation