Phishing operations leveraged trusted services, including Google Firebase and Translate, enabling GTFire campaigns to route victims through benign-looking links and capture credentials across more than 100 countries.

Endpoint security vulnerabilities were addressed with patches to Trend Micro Apex One, which included two critical remote code execution flaws and six high-severity local privilege escalation issues.

Developer-targeting campaigns used trojanised Next.js repositories to compromise build-time workflows, establish in-memory command-and-control, and exfiltrate sensitive environment variables.

Abuse of infrastructure for phishing extended to unconventional domains, with the .arpa TLD exploited using IPv6 reverse DNS and hijacked CNAMEs to host short-lived malicious content and bypass detection.

Supply-chain attacks continued, highlighted by a malicious Go module, github[.]com/xinfeisoft/crypto, that captures credentials and deploys a Rekoobe Linux backdoor through staged GitHub-hosted payloads.

Password security risks emerged as LLM-generated credentials were found to be highly predictable, reducing effective entropy and potentially introducing weak credentials into development environments.

NuGet ecosystems faced automated package cloning threats, with attacker scripts replicating and inflating malicious packages, reflecting recurring supply-chain manipulation tactics observed in prior incidents.

Researchers have detailed a large-scale phishing operation known as GTFire that exploits Google Firebase and Google Translate to host and disguise credential-harvesting pages. Victims are first routed through translate.goog links before being redirected to phishing sites hosted on *.web.app domains, enabling attackers to blend malicious traffic with trusted Google infrastructure.

Group-IB identified more than 120 phishing domains affecting over 1,000 organisations across 100 countries, with thousands of credentials exposed. The campaign uses multi-step login prompts, Base64-encoded data exfiltration and centralised command-and-control servers to systematically collect and organise stolen account details.

Trend Micro has released patches for eight vulnerabilities affecting its Apex One endpoint security solution for Windows and macOS, including two critical remote code execution flaws in the management console. Tracked as CVE-2025-71210 and CVE-2025-71211, the issues could allow remote attackers to upload malicious code and execute commands on vulnerable on-premises installations.

Six additional high-severity vulnerabilities, identified as CVE-2025-71212 through CVE-2025-71217, enable local privilege escalation if an attacker already has access to a targeted system. The flaws were reported through the Zero Day Initiative, and Trend Micro said it is not aware of in-the-wild exploitation.

Microsoft has uncovered a coordinated campaign that uses trojanised Next.js repositories disguised as job assessments to compromise developers. The projects trigger malicious code execution through Visual Studio Code tasks, build-time scripts or backend modules, ultimately fetching attacker-controlled JavaScript and establishing staged command-and-control channels.

The activity uses multi-stage loaders, in-memory execution and environment variable exfiltration to access sensitive data such as source code and cloud credentials. Microsoft linked the repositories through shared naming patterns, infrastructure and execution logic, identifying a broader cluster focused on infiltrating developer workflows.

Research from Irregular shows that passwords created directly by large language models exhibit strong patterns, repeated outputs and highly uneven character distributions, significantly reducing their effective entropy. Testing across models including GPT, Claude and Gemini found that seemingly complex 16–20 character passwords often contained as little as 20–30 bits of entropy, making them far more guessable than they appear. The study also observed coding agents frequently defaulting to LLM-generated credentials in development workflows, potentially introducing weak passwords into real-world systems.

ReversingLabs researchers analysed two NuGet packages accidentally published with internal attacker scripts, uncovering a full toolchain for cloning, publishing and inflating the popularity of malicious packages. The scripts replicate package metadata, create semi-functional versions, and manipulate download counts, reflecting tactics observed in prior NuGet supply chain attacks.

Infoblox researchers identified phishing campaigns abusing the .arpa top-level domain, normally reserved for reverse DNS lookups, to host malicious content via IPv6 reverse domains. The actors combine this with traffic distribution systems, hijacked CNAMEs, and domain shadowing to evade detection and create short-lived phishing links. This approach leverages trusted internet infrastructure, bypassing conventional security tools that rely on domain reputation and registration checks.

Socket Threat Research uncovered a Go module, github[.]com/xinfeisoft/crypto, that impersonates the widely used golang.org/x/crypto library while backdooring ReadPassword to capture credentials. The module exfiltrates passwords to actor-controlled endpoints and executes a staged payload chain on Linux hosts, installing SSH keys, weakening iptables, and deploying a Rekoobe backdoor. The campaign leverages GitHub-hosted pointers for infrastructure rotation and disguises binaries as media files to evade detection.