Security Risk Advisors

Group-IB disclosed a significantly enhanced version of the RedHook Android remote access trojan (RAT), introducing advanced privilege abuse, persistence, and command-and-control capabilities. Previously documented in 2025, the latest variant expands its targeting beyond Vietnam into Indonesia and continues to spread through fake government a...

OX Security researchers identified a malicious npm package named polymarket-kit that impersonates the popular prediction market platform Polymarket while delivering a multi-stage malware campaign targeting cryptocurrency users and cloud environments. Once installed, the package downloads an obfuscated second-stage payload from atta...

Researchers from the University of Missouri-Kansas City’s ASSET Research Group disclosed Ghostcommit, a proof-of-concept software supply chain attack that abuses AI-assisted development workflows by embedding prompt injection instructions inside PNG images. Rather than targeting developers directly, the attack exploits the growing use of AI ...

Palo Alto Networks Unit 42 disclosed a financially motivated malware campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small and medium sized business victims worldwide. The campaign primarily targets users in the United States and European Union and is assessed to be operated by a Vidar stealer malware as ...

ReliaQuest disclosed a previously unreported data extortion group tracked as “Helix,” running a multi-target campaign built on vishing, device code phishing, and automated SharePoint exfiltration. ReliaQuest assesses Helix likely emerged from the same ecosystem as the now-defunct “BlackFile” group and shares infrastructure and tradecraft ove...