KONNI operators hijack Google accounts, pivot into Find Hub, track target locations, and trigger remote resets on Android blending valid features with malicious intent while evading conventional controls.
Threat actors now pair generative AI with trusted cloud apps to breach manufacturing. They deliver malware through OneDrive/GitHub, steal API keys and tokens, and persist via OAuth consent. Without governed AI usage, Cloud DLP, and consent controls, factories face quiet IP theft and escalating downtime risks.
ClickFix campaigns scale by coaching users to “fix” access issues with copy-paste commands. After the click, actors steal Microsoft 365 tokens or credentials and, in some cases, drop PureRAT for persistence. Break the flow by enforcing admin-only app consent, requiring phishing-resistant MFA, and blocking browser-to-shell chains. Investigate mailbox rules, token reuse, and OAuth grants whenever ClickFix pages appear in referral logs.
Smishing texts now target lost iPhone owners with fake “found” alerts and cloned iCloud pages. Verify only in Find My, keep Activation Lock tied to your Apple ID, and avoid links in messages. Set a SIM PIN, rotate your Apple ID password, and review trusted devices to prevent account takeover.
LandFall is a commercial-grade Android spyware that weaponized WhatsApp images to exploit a Samsung zero-day in the image pipeline. The payload rode malformed DNG files, then modified SELinux and deployed modules for full-device surveillance. Patch promptly and restrict media auto-download.
EndClient RAT arrives as a signed MSI named “StressClear.msi,” which abuses code-signing trust and SmartScreen gaps. The package decoys with a VeraPort component while an obfuscated AutoIt loader executes in memory, establishes the IoKlTr task, and opens a JSON-over-TCP C2. To reduce risk, restrict MSI installs, enforce SmartScreen blocking, instrument MSI→AutoIt lineage, and remove scheduled tasks used for persistence.
Gootloader is active again. Attackers poison search results for legal templates, hide content with glyph-mapped fonts, and ship malformed ZIP files that drop JavaScript. The post-compromise tempo increases, so defenders must harden browsers, restrict scripts, and tune detections now.
Game-themed extensions on a popular code editor pretended to add Pokémon or Minecraft flair for “vibe coders.” Instead, they executed malware on install, mined Monero, and attempted persistence. Consequently, teams should validate developer workstations, remove suspicious add-ons, rotate secrets, and harden marketplace policies before the next wave appears.
Abandoned apps, APIs, and identities keep resurfacing. Hunt them continuously, retire them completely, and verify they stay dead—before attackers exploit them.
Attackers hide malware behind invisible npm dependencies and install-time scripts, which bypass static scanners and drain tokens. Close install-time egress, ban URL dependencies, and add dynamic checks.