Criminal LLMs are going mainstream: MessiahGPT and Kriminal sell jailbroken AI for phishing and KYC fraud. https://intel.threadlinqs.com/threat/TL-2026-3813 #ThreatIntel #MessiahGPT #Kriminal #WormGPT

Vexy ransomware claims 12 GB from IT firm Data-Core - hunt its VSS wipes and PsExec moves. https://intel.threadlinqs.com/threat/TL-2026-3812 #ThreatIntel #Vexy #PSEXEC #Ransomware

YuanKong Android RAT pairs with the phone's own ADB - and stamps its operators' IDs into every build. https://intel.threadlinqs.com/threat/TL-2026-3810 #ThreatIntel #YuanKong #Nova #RemoteControl

SideCopy's ReverseRAT loads in memory inside mshta.exe via a ZIP/LNK lure aimed at Indian academia. https://intel.threadlinqs.com/threat/TL-2026-3806 #ThreatIntel #ReverseRAT #XenoRAT #RemCom

GhostAction hides a credential stealer in a fake Font Awesome file, run by a hidden VS Code task. https://intel.threadlinqs.com/threat/TL-2026-3805 #ThreatIntel #GhostAction #curl #GitHub

A 37-year-old OpenBSD kernel bug now has a public root exploit that sidesteps KARL, SMAP and SMEP. https://intel.threadlinqs.com/threat/TL-2026-3804 #ThreatIntel #Big #BigFish #OpenBSD

🇲🇽 We tracked Returnero listing Secretaria de Salud, Mexico's Ministry of Health, in a data breach claim. Sample includes user profiles, plaintext passwords, emails, and health official names. #DataBreach #ThreatIntel

This entry + more → go.darkwebsonar.io/returnero-bl...

@zscalerinc.bsky.social
GenAI enables more convincing phishing, faster data discovery, and rapidly changing bespoke malware after initial access.
-
IOCs: (None identified)
-
#GenAI #Ransomware #ThreatIntel

@zscalerinc.bsky.social
Unauthenticated NetScaler RCE is under active exploitation; patch immediately.
-
IOCs: 209[.]141[.]43[.]95, 45[.]153[.]212[.]101, 46[.]233[.]40[.]20
-
#CVE202688771 #NetScaler #ThreatIntel

@huntress.com
Stolen ConnectWise credentials enabled unauthorized M365 access across 162 tenants.
-
IOCs: 144[.]172[.]64[.]128, 506e08f9-6e9a-4da4-942b-a099a03644ae, 24205314-2b89-4e07-a2a4-579e898a5640
-
#CloudSecurity #M365 #ThreatIntel

Chrome patches a Critical Prerender use-after-free - a crafted page can run code in the sandbox. https://intel.threadlinqs.com/threat/TL-2026-3801 #ThreatIntel #CVE_2026_110922 #CVE_2026_110913 #Chrome

LockBit has claimed 3328 victims and counting. We track the whole ransomware ecosystem and call what's next. https://ninjalabz.io/intel-report/ #ransomware #threatintel

MALFEX's npm imgdecode hides a DLL loader that injects into dllhost.exe the moment you require() it. https://intel.threadlinqs.com/threat/TL-2026-3799 #ThreatIntel #Rakhni #MALFEX #imgdecode

A stolen ConnectWise vendor credential let an actor walk into 173 Microsoft 365 tenants. https://intel.threadlinqs.com/threat/TL-2026-3798 #ThreatIntel #Pythonurllib #pythonrequests #ConnectWise

🗞 BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs

via Dark Reading
https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs
#cybersecurity #infosec #threatintel

🔴 Company #86 — listed by N0n

📍 United States · 17 Oct 2026
🏴 N0n has listed 9 victims since September 2026.

https://cyberthreatintelligence.net/ransomware-victim/company-86-n0n-2026

#ransomware #n0n #threatintel

🇦🇷 We tracked cantpwn claiming to distribute ~903,000 records from Municipio de Vicente Lopez (Argentina), a municipal government body. Dataset allegedly spans 2015-2026 with names, national IDs, and contact details. #DataLeak #ThreatIntel

Details + live feed → go.darkwebsonar.io/cantpwn-bluesky

Vulnerability Management Isn't About the Score — It's About How It Applies to You

www.darkreading.com/cybersecurit...

#Cybersecurity #ThreatIntel #Vulnerability

📊 Ransomware data-drop: up 65% week-on-week (311 claims). Most active: N0n. Hot sector: Not Found.

📦 ninjasignal: 20 installs this week · 35 clones.

Live data + the Python client → ninjalabz.io/developers
#ransomware #threatintel