Threat Intelligence
ConsentFix v3 Runs on Cloudflare, Dropbox, and ZoomInfo
The OAuth phishing kit is plumbed end-to-end through legitimate SaaS, which is exactly the point.
Trending
LiteLLM CVE-2026-42208: SQL Injection Exploited in 36 Hours — AI Gateway Credentials at Risk
CVE-2026-42208 in LiteLLM — the open-source AI gateway with 45K GitHub stars — was exploited within 36 hours of disclosure with no public PoC. A successful attack yields OpenAI org keys, Anthropic workspace admin keys, and AWS Bedrock credentials.
Trending
SAP npm Packages Compromised in Mini Shai-Hulud Supply Chain Attack — Browser Passwords Now Targeted
Official SAP npm packages were backdoored on April 29 in the latest Mini Shai-Hulud wave — adding browser credential theft across Chrome, Safari, and Edge to the campaign's existing cloud secret harvesting. Over 1,100 victim repositories confirmed.
Trending
Shadow-Earth-053: Trend Micro Details China-Aligned Spy Group Targeting Journalists and Activists Alongside Governments and Defense
Trend Micro publishes full technical analysis of Shadow-Earth-053 — a China-aligned cluster targeting journalists and civil society activists alongside governments and defense across Asia and Poland, with no strong overlap to any publicly reported group.
Policy & Government
Europol IOCTA 2026: AI, Encryption, and Cybercrime-as-a-Service Are Widening the Velocity Gap Between Criminals and Defenders
Europol's IOCTA 2026 warns that cybercrime has industrialized — AI, encryption, and CaaS are widening the velocity gap between criminal innovation and law enforcement capability, with 120+ ransomware variants and $10.5T in projected 2026 costs.
Trending
Cordial Spider and Snarky Spider: Two New Com-Affiliated Groups Are Running the Scattered Spider Playbook at Scale
CrowdStrike documents Cordial Spider and Snarky Spider — two new Com-affiliated groups running vishing and SSO phishing campaigns against enterprise SaaS environments with seven-figure extortion demands and no malware deployed.
Trending
PyTorch Lightning Compromised in Supply Chain Attack — Malware Steals Credentials Automatically on Import
Versions 2.6.2 and 2.6.3 of PyTorch Lightning were compromised in a supply chain attack — executing credential-stealing malware automatically on import, targeting SSH keys, cloud credentials, GitHub tokens, and crypto wallets.
Trending
Silver Fox Uses New ABCDoor Backdoor to Target Organizations in Russia and India via Tax Impersonation
Silver Fox has launched a tax-themed phishing campaign across India, Russia, Indonesia, and Japan — deploying ValleyRAT and the newly documented ABCDoor Python backdoor via fake tax authority notifications.
Trending
Novel China-Linked Group Shadow-Earth-053 Found Lurking in Critical Networks Across Poland and Asia
A previously undocumented China-linked threat group tracked as Shadow-Earth-053 has infiltrated 12+ critical networks across Poland and Asian nations — targeting defense contractors, government agencies, and transport infrastructure.
Data Breaches
Vimeo Confirms Data Breach via Third-Party Vendor Anodot — ShinyHunters Attributed
Vimeo has confirmed a data breach affecting portions of its user database following a compromise at Anodot, a third-party analytics vendor. The breach has been attributed to ShinyHunters, which exploited trusted API connections between Anodot and its enterprise clients to access Vimeo's environment without directly targeting Vimeo&
Cyber Attacks
Attacker Bought 31 WordPress Plugins, Hid a Backdoor for 8 Months, Then Activated It with an Ethereum C2
An attacker purchased a portfolio of 31 trusted WordPress plugins on a public marketplace, embedded a PHP backdoor in a routine-looking update, and left it dormant for eight months before activating it to distribute hidden SEO spam to thousands of websites — with the malware resolving its command-and-control
Threat Intelligence
BlueNoroff Used AI-Generated Zoom Deepfakes to Hide a 66-Day Fileless Implant in a Web3 Firm
BlueNoroff compromised a North American Web3 company using a fake Zoom meeting interface populated with AI-generated deepfakes, deploying a fileless PowerShell implant that maintained persistent access for 66 days while stealing cryptocurrency wallet credentials, browser data, and live webcam footage repurposed to lure future victims. GLOBAL — Arctic Wolf Labs