Researchers detail FLEXRAT, a stealer and remote-access tool delivered through fake ChilloutVR mod sites and Dropbox downloads. It steals browser credentials and Discord data, captures screens, enables remote control, and establishes persistence.
STORESOCKS distributes signed, trojanized Microsoft Store utilities that install a Go proxy with startup persistence. The campaign remained active in June 2026, using infected hosts for encrypted TCP and UDP relays.
Hexastrike details CodeStorm, an ongoing Microsoft 365 AiTM phishing campaign linked with moderate confidence to Storm-1167. The kit intercepts credentials, MFA and session material; over 100 tenant compromises were confirmed in incident-response telemetry.
Researchers identified 109 fake GitHub repositories across 103 accounts distributing SmartLoader and StealC. The loader hides execution, collects and exfiltrates host data, resolves C2 through a Polygon contract, and persists with scheduled tasks.
A threat actor used Reddit posts promoting cracked TradingView builds to distribute Vidar on Windows and AMOS on macOS. The active campaign used hijacked websites, password-protected archives, and social engineering to steal credentials and other data.
A technical report says TeamPCP uploaded malicious telnyx Python SDK versions 4.87.1 and 4.87.2 to PyPI. The packages triggered credential theft and persistent payloads across Windows, Linux, macOS, and Kubernetes environments before PyPI quarantined them.
Researchers detail Silver Fox’s active campaign targeting Chinese-speaking users with trojanized app installers that deploy Atlas RAT, evade security controls, and disrupt security software. The report includes infrastructure and detection guidance.
Analysis of a Silver Fox campaign found fake installers dropping a signed kernel driver that terminates targeted security processes. The report details the driver-loading and termination mechanisms, detection guidance, and containment considerations.