This Week in Threat Intelligence: When Trust Becomes the Attack Surface
This week's roundup covers five stories with a common thread:
macOS
Trending Topics
TRENDING TOPICS
June 17, 2026
Rokarolla Android Trojan Emerges as Major Threat
Trending Topics
OpenVPN Connect flaw (CVE-2026-9560) lets local macOS users gain root. A fake Sicoob NuGet package steals Brazilian banking credentials. Kimsuky (APT43, Velvet Chollima) deploys HTTPSpy against South Korean targets. JINX-0164 uses LinkedIn lures to drop macOS infostealer AUDIOFIX on crypto firms.
Trending Topics
CISA flags an actively exploited Windows Shell zero-day, CVE-2026-32202. A GitHub race condition could have enabled mass repo hijacking. LiteLLM SQL injection exposes AI provider keys. Lazarus Group targets macOS crypto users via fake meeting invites.
Trending Topics
Aura discloses targeted account compromise. FancyBear (APT28) server leak exposes live espionage operations across NATO-aligned governments. Apple patches critical WebKit same-origin flaw.
Trending Topics
TRENDING TOPICS
MAR 12, 2026
CastleRAT Campaign Abuses Deno Runtime and Steganography
Trending Topics
UNC6426 turns a stolen GitHub token into a full AWS takeover. State actors weaponize AI directly into malware. BlackSanta EDR killer targets HR departments. March Patch Tuesday fixes critical Copilot, Excel, SQL Server, and Azure MCP flaws.
Trending Topics
npm package ambar-src infects 50,000+ hosts across Windows, Linux, macOS. Fake Next.js repos backdoor developer workflows. NCryptYo, DOMOAuth2, IRAOAuth2.0, and SimpleWriter hijack ASP.NET authorization. SafePay ransomware breach at Conduent exposes 25M+ records.
Trending Topics
Lazarus subgroup Andariel (Stonefly) joins the Medusa ransomware ecosystem, targeting U.S. healthcare. Anthropic alleges Chinese AI labs ran industrial-scale Claude distillation via 24,000 fake accounts. A malicious npm package hides Pulsar RAT inside PNG steganography.
Trending Topics
TRENDING TOPICS
FEB 18, 2026
Update: OpenClaw Ecosystem Hit by Skill Marketplace
Surge in Fake Installers and Malvertisement Campaigns
Fake installer and malvertising campaigns now span Windows and macOS alike, using trojanized DMG and EXE files, delayed activation, and hardware-gated payloads to harvest browser, keychain, and developer credentials while still installing the expected app.
Trending Topics
Critical Severity
5 CVEs
CVE-2026-21522
Microsoft ACI Confidential Containers Elevation