Threat Hunt Feed (2026-05-26)
BleepingComputer
- Anthropic’s restricted Claude Mythos model may be coming to Claude Code — Mon, 25 May 2026 13:07:33 -0400
- Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Domains (T1584.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), At (T1053.002)
- FBI warns of Kali365 phishing service targeting Microsoft 365 accounts — Mon, 25 May 2026 08:45:54 -0400
- Matched TTPs: Adversary-in-the-Middle (T1557), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Domains (T1584.001), Tool (T1588.002), Phishing (T1566), Multi-Factor Authentication (T1556.006), Software (T1592.002), Conditional Access Policies (T1556.009), At (T1053.002)
The Hacker News
- ⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos — Mon, 25 May 2026 19:43:27 +0530
- Matched TTPs: Artificial Intelligence (T1588.007), IP Addresses (T1590.005), Malware (T1588.001), Hardware (T1592.001), Browser Extensions (T1176.001), Vulnerabilities (T1588.006), DLL (T1574.001), Botnet (T1584.005), Server (T1584.004), Local Groups (T1069.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Impersonation (T1656), Python (T1059.006), SEO Poisoning (T1608.006), At (T1053.002)
- Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks — Mon, 25 May 2026 17:32:46 +0530
- Matched TTPs: Rundll32 (T1218.011), Artificial Intelligence (T1588.007), JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), DLL (T1574.001), Server (T1584.004), PowerShell (T1059.001), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
- Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms — Mon, 25 May 2026 15:02:54 +0530
- Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), DLL (T1574.001), Domains (T1584.001), Server (T1584.004), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), File Deletion (T1070.004), Environmental Keying (T1480.001)
- TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO — Mon, 25 May 2026 11:29:13 +0530
- Matched TTPs: Artificial Intelligence (T1588.007), JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Cron (T1053.003), Vulnerabilities (T1588.006), SSH (T1021.004), Trap (T1546.005), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)