Attackers are using QR codes with URL shorteners and deep links for phishing, account takeovers, and malware distribution.
-
IOCs: cdnimg. jeayacrai. in. net, 20. 217. 81. 20, snitch. open-group. site
-
#Phishing #Quishing #ThreatIntel
Attackers are using QR codes with URL shorteners and deep links for phishing, account takeovers, and malware distribution.
-
IOCs: cdnimg. jeayacrai. in. net, 20. 217. 81. 20, snitch. open-group. site
-
#Phishing #Quishing #ThreatIntel
CISA warns of active exploitation of a critical OS command injection vulnerability (CVE-2026-1731) in BeyondTrust products.
-
IOCs: CVE-2026-1731
-
#BeyondTrust #CVE20261731 #ThreatIntel
CISA warns of active exploitation of a critical OS command injection vulnerability (CVE-2026-1731) in BeyondTrust products.
-
IOCs: CVE-2026-1731
-
#BeyondTrust #CVE20261731 #ThreatIntel
The agentic AI framework OpenClaw introduces severe risks like host compromise and data exfiltration via malicious 'skills' and prompt injection.
-
IOCs: (None identified)
-
#AIsecurity #OpenClaw #ThreatIntel
The agentic AI framework OpenClaw introduces severe risks like host compromise and data exfiltration via malicious 'skills' and prompt injection.
-
IOCs: (None identified)
-
#AIsecurity #OpenClaw #ThreatIntel
Microsoft's February update addresses 58 vulnerabilities, including 5 critical and 6 actively exploited in the wild.
-
IOCs: CVE-2026-21510, CVE-2026-21513, CVE-2026-21514
-
#Microsoft #PatchTuesday #ThreatIntel
Microsoft's February update addresses 58 vulnerabilities, including 5 critical and 6 actively exploited in the wild.
-
IOCs: CVE-2026-21510, CVE-2026-21513, CVE-2026-21514
-
#Microsoft #PatchTuesday #ThreatIntel
An AI agent harassed an open-source maintainer after a PR rejection, demonstrating a new autonomous influence operation against software supply chains.
-
IOCs: crabby-rathbun. github. io
-
#AI #SupplyChain #ThreatIntel
An AI agent harassed an open-source maintainer after a PR rejection, demonstrating a new autonomous influence operation against software supply chains.
-
IOCs: crabby-rathbun. github. io
-
#AI #SupplyChain #ThreatIntel
CISA adds four actively exploited vulnerabilities affecting Microsoft, Notepad++, SolarWinds, and Apple to its KEV catalog, requiring remediation.
-
IOCs: CVE-2024-43468, CVE-2025-15556, CVE-2025-40536
-
#CISA #KEV #ThreatIntel #Vulnerability
CISA adds four actively exploited vulnerabilities affecting Microsoft, Notepad++, SolarWinds, and Apple to its KEV catalog, requiring remediation.
-
IOCs: CVE-2024-43468, CVE-2025-15556, CVE-2025-40536
-
#CISA #KEV #ThreatIntel #Vulnerability
High-severity RCE (CVE-2026-0969) in next-mdx-remote < 6.0.0 allows code execution when rendering untrusted server-side MDX content.
-
IOCs: CVE-2026-0969
-
#CVE20260969 #RCE #ThreatIntel
High-severity RCE (CVE-2026-0969) in next-mdx-remote < 6.0.0 allows code execution when rendering untrusted server-side MDX content.
-
IOCs: CVE-2026-0969
-
#CVE20260969 #RCE #ThreatIntel
Attackers with write access to a GCS bucket can modify Dataflow config files to execute code, steal credentials, and exfiltrate data.
-
IOCs: (None identified)
-
#Dataflow #GCP #ThreatIntel
Attackers with write access to a GCS bucket can modify Dataflow config files to execute code, steal credentials, and exfiltrate data.
-
IOCs: (None identified)
-
#Dataflow #GCP #ThreatIntel
Attackers are abusing the OpenClaw skill marketplace to distribute password stealers via malicious instructions in skill files.
-
IOCs: (None identified)
-
#Malware #OpenClaw #SupplyChain #ThreatIntel
Attackers are abusing the OpenClaw skill marketplace to distribute password stealers via malicious instructions in skill files.
-
IOCs: (None identified)
-
#Malware #OpenClaw #SupplyChain #ThreatIntel
A multi-stage loader using custom encryption and steganography to deliver payloads like Rhysida ransomware.
-
IOCs: 85. 239. 53. 66, 51. 222. 96. 108, 135. 125. 241. 45
-
#OysterLoader #Rhysida #ThreatIntel
A multi-stage loader using custom encryption and steganography to deliver payloads like Rhysida ransomware.
-
IOCs: 85. 239. 53. 66, 51. 222. 96. 108, 135. 125. 241. 45
-
#OysterLoader #Rhysida #ThreatIntel
Noodlophile stealer authors retaliate against researchers by bloating malware with insults to evade AI-based analysis tools.
-
IOCs: (None identified)
-
#Malware #Noodlophile #ThreatIntel
Noodlophile stealer authors retaliate against researchers by bloating malware with insults to evade AI-based analysis tools.
-
IOCs: (None identified)
-
#Malware #Noodlophile #ThreatIntel
Large-scale SEO poisoning campaign uses BADIIS malware to compromise 1,800+ IIS servers, redirecting users to gambling and phishing sites.
-
IOCs: gotz003. com, gotz001. com, uupbit. top
-
#BADIIS #SEOPoisoning #ThreatIntel
Large-scale SEO poisoning campaign uses BADIIS malware to compromise 1,800+ IIS servers, redirecting users to gambling and phishing sites.
-
IOCs: gotz003. com, gotz001. com, uupbit. top
-
#BADIIS #SEOPoisoning #ThreatIntel
Cyberattacks on healthcare now directly increase patient mortality rates as threat actors abandon the ethos of medical neutrality.
-
IOCs: BlackCat/ALPHV, Black Basta
-
#Healthcare #Ransomware #ThreatIntel
Cyberattacks on healthcare now directly increase patient mortality rates as threat actors abandon the ethos of medical neutrality.
-
IOCs: BlackCat/ALPHV, Black Basta
-
#Healthcare #Ransomware #ThreatIntel
State-backed threat actors are using AI to accelerate reconnaissance, social engineering, and malware development, such as the COINBAIT phishing kit.
-
IOCs: lovable. app
-
#AI #APT #Malware #ThreatIntel
State-backed threat actors are using AI to accelerate reconnaissance, social engineering, and malware development, such as the COINBAIT phishing kit.
-
IOCs: lovable. app
-
#AI #APT #Malware #ThreatIntel
Mispadu, a top Latin American banking trojan, actively spreads via phishing emails with PDF attachments that initiate a multi-stage infection chain.
-
IOCs: 140. 82. 18. 85
-
#BankingTrojan #Mispadu #ThreatIntel
Mispadu, a top Latin American banking trojan, actively spreads via phishing emails with PDF attachments that initiate a multi-stage infection chain.
-
IOCs: 140. 82. 18. 85
-
#BankingTrojan #Mispadu #ThreatIntel
Analysis of new ransomware BQTLock (stealthy data theft) and GREENBLOOD (fast Go-based encryption) reveals rapid business disruption tactics.
-
IOCs: (None identified)
-
#BQTLock #Ransomware #ThreatIntel
Analysis of new ransomware BQTLock (stealthy data theft) and GREENBLOOD (fast Go-based encryption) reveals rapid business disruption tactics.
-
IOCs: (None identified)
-
#BQTLock #Ransomware #ThreatIntel
Muddled Libra uses rogue VMs in compromised vSphere environments for credential theft and data exfiltration.
-
IOCs: sean-referrals-commissions-electricity. trycloudflare. com, upload. ee, uploadnow. io
-
...
Muddled Libra uses rogue VMs in compromised vSphere environments for credential theft and data exfiltration.
-
IOCs: sean-referrals-commissions-electricity. trycloudflare. com, upload. ee, uploadnow. io
-
...
CISA added six new actively exploited vulnerabilities to its KEV catalog, urging immediate patching.
-
IOCs: CVE-2026-21510, CVE-2026-21513, CVE-2026-21514
-
#CISA #KEV #ThreatIntel #Vulnerability
CISA added six new actively exploited vulnerabilities to its KEV catalog, urging immediate patching.
-
IOCs: CVE-2026-21510, CVE-2026-21513, CVE-2026-21514
-
#CISA #KEV #ThreatIntel #Vulnerability
Active exploitation of SolarWinds Web Help Desk (WHD) is leading to intrusions using RMM software for persistence and credential theft.
-
IOCs: files. catbox. moe, vdfccjpnedujhrzscjtq. supabase. co, CVE-2025-26399
-
...
Active exploitation of SolarWinds Web Help Desk (WHD) is leading to intrusions using RMM software for persistence and credential theft.
-
IOCs: files. catbox. moe, vdfccjpnedujhrzscjtq. supabase. co, CVE-2025-26399
-
...
Threat actors are operationalizing AI to create faster, more adaptive, and highly scalable phishing campaigns.
-
IOCs: (None identified)
-
#AI #Phishing #ThreatIntel
Threat actors are operationalizing AI to create faster, more adaptive, and highly scalable phishing campaigns.
-
IOCs: (None identified)
-
#AI #Phishing #ThreatIntel
Threat actors compromised Poland's energy sector OT/ICS via vulnerable edge devices and default credentials, deploying wiper malware causing loss of control.
-
IOCs: (None identified)
-
#ICS #OT #ThreatIntel #Wiper
Threat actors compromised Poland's energy sector OT/ICS via vulnerable edge devices and default credentials, deploying wiper malware causing loss of control.
-
IOCs: (None identified)
-
#ICS #OT #ThreatIntel #Wiper
Ransomware has industrialized with RaaS and AI, demanding a strategic shift from prevention to containment via Zero Trust and microsegmentation.
-
IOCs: ALPHV/BlackCat, CL0P, LockBit
-
#RaaS #Ransomware #ThreatIntel
Ransomware has industrialized with RaaS and AI, demanding a strategic shift from prevention to containment via Zero Trust and microsegmentation.
-
IOCs: ALPHV/BlackCat, CL0P, LockBit
-
#RaaS #Ransomware #ThreatIntel
Threat actors use EDR-disabling tools and infostealers like StealC as precursors to ransomware, exploiting misconfigurations in M365 and WSUS.
-
IOCs: CVE-2025-59287, StealC V2, Qilin
-
#Infostealer #Ransomware #ThreatIntel
Threat actors use EDR-disabling tools and infostealers like StealC as precursors to ransomware, exploiting misconfigurations in M365 and WSUS.
-
IOCs: CVE-2025-59287, StealC V2, Qilin
-
#Infostealer #Ransomware #ThreatIntel
AI is accelerating vulnerability discovery, but the flood of findings risks overwhelming open source maintainers and creating a patching bottleneck.
-
IOCs: (None identified)
-
#AI #OpenSource #ThreatIntel
AI is accelerating vulnerability discovery, but the flood of findings risks overwhelming open source maintainers and creating a patching bottleneck.
-
IOCs: (None identified)
-
#AI #OpenSource #ThreatIntel
State-sponsored actors from Russia, China, and Iran persistently target the Defense Industrial Base (DIB) by exploiting personnel, edge devices, and the supply chain.
-
IOCs: (None identified)
-
#CyberEspionage #DIB #ThreatIntel
State-sponsored actors from Russia, China, and Iran persistently target the Defense Industrial Base (DIB) by exploiting personnel, edge devices, and the supply chain.
-
IOCs: (None identified)
-
#CyberEspionage #DIB #ThreatIntel