ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Dissecting the JWR phishing framework

“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel

UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign

UAT-7810 continues building ORB networks using new malware

ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365