A phishing campaign delivering the Rhadamanthys stealer is targeting multimedia professionals using copyright infringement lures and DLL side-loading. Phishing emails impersonating legal entities targeted users in over 20 European countries.

A new campaign involving Lumma Infostealer delivers a malicious browser extension linked to the dismantled Genesis Market. The extension targets Chrome, Edge, Opera, and Brave, exfiltrating sensitive data and enabling persistent access.

Valak has evolved from a loader to a sophisticated, multi-stage modular malware that collects plugins from its C2 server to expand its capabilities.