A trojanized Atera RMM installer disguised as a bank eStatement PDF grants attackers persistent remote access including terminal, remote desktop, and arbitrary code execution — all through legitimately signed, commercially trusted infrastructure. Zero public detections at time of analysis. Likely Luna Moth / Silent Ransom Group campaign.
On March 24, 2026, threat actor TeamPCP published backdoored versions of the LiteLLM Python package (3.4M daily downloads) after compromising Trivy and Checkmarx security scanners to steal PyPI credentials from CI/CD pipelines. The malware harvested credentials, deployed Kubernetes worms, and established persistent C2 — all triggered by a Python .pth file that fires on every interpreter startup.
Microsoft Threat Intelligence published a technique profile on malicious npm lifecycle scripts — the mechanism behind Shai-Hulud 2.0, Contagious Interview, and multiple North Korean campaigns. This post breaks down how lifecycle scripts work as an attack vector, the real-world campaigns exploiting them, and a layered defense strategy for dev teams and CI/CD pipelines.
Google GTIG and iVerify independently disclosed Coruna, an iOS exploit kit containing 23 exploits across 5 full chains targeting iOS 13 through 17.2.1. Originally built for a commercial surveillance vendor, it proliferated to a Russian espionage group (UNC6353) for watering hole attacks against Ukraine, then to a Chinese financially motivated actor (UNC6691) mass-deploying it via fake crypto sites to steal wallet credentials. This post breaks down the exploit chains, payload architecture, detection artifacts, and IOCs.