Void Dokkaebi has turned infected developer repositories into self-propagating malware delivery channels by abusing VS Code workspace tasks and injecting obfuscated JavaScript that rewrites git history. The campaign uses blockchain-staged loaders to fetch payloads and has delivered variants such as DEV#POPPER, enabling compromise of individual developers and amplification into organizations like...

Cruciferra uses BYOVD, API unhooking, and Process Ghosting to hide RAT and stealer payloads delivered through phishing campaigns

UNC6692 uses social engineering and Microsoft Teams helpdesk impersonation to deploy a custom malware suite called "Snow," which combines a Chrome extension, a tunneler, and a Python backdoor to establish covert persistence and relay commands. The group conducts deep network compromise—dumping LSASS, using pass-the-hash, and exfiltrating Active Directory data (via FTK Imager and LimeWire) to steal credentials and take over domains. #Snow #UNC6692

Cloudflare services — particularly Workers and Tunnels — are being abused by threat actors to host convincing AiTM phishing pages and to stage covert connections that deliver malware, including Xeno RAT and XWorm RAT. These attacks leverage trusted Cloudflare domains and free tiers (e.g., *.workers[.]dev, *.trycloudflare[.]com, *.pages[.]dev, *.r2[.]dev) to bypass email and network defenses and evade detection. #XenoRAT #XWormRAT

The major IT outage caused by CrowdStrike is being leveraged by threat actors for phishing, scams, and malware delivery.

Microsoft patches CVE-2024-29988 and CVE-2024-26234, two zero-day vulnerabilities exploited by threat actors to deliver malware.

The website for the popular JDownloader download manager was compromised earlier this week to distribute malicious Windows and Linux installers, with the Windows payload found deploying a…