The SideWinder advanced persistent threat group has developed a sophisticated attack methodology utilizing ClickOnce applications to deploy StealerBot malware against diplomatic and governmental targets in South Asia. This campaign marks a significant evolution in their tactics, employing spear-phishing emails and advanced evasion techniques.

Researchers have identified a new wave of cybersecurity attacks against European drone makers by the Lazarus Group, a North Korean government-affiliated threat actor. This campaign, part of 'Operation DreamJob,' uses social engineering tactics to exfiltrate proprietary information.

Caminho, a Brazilian Loader-as-a-Service (LaaS), uses Least Significant Bit (LSB) steganography to hide .NET payloads in images, allowing malware to bypass defenses. This threat targets businesses across South America, Africa, and Eastern Europe, utilizing spear-phishing tactics to deliver its payloads.

The Astaroth banking trojan has resurfaced, utilizing GitHub as a platform for malware configuration updates. This sophisticated malware employs targeted phishing tactics to steal banking and cryptocurrency credentials while evading detection through advanced techniques.

The Beamglea campaign has exploited 175 malicious npm packages to conduct phishing attacks, primarily targeting tech and energy firms across Europe and APAC. Researchers discovered that these packages, which have over 26,000 downloads, redirect users to phishing sites designed to steal credentials.