This week’s threats leaned on lookalike repos, trojanized installers, weak defaults, and old flaws to quietly turn trusted software and services into attack paths. The activity spanned fake NuGet packages, Starland RAT, WLDR agent, Spirals ransomware, Chrome Sync abuse, and multiple abuse campaigns tied to GitHub, GitHub Releases, and Hugging Face. #StarlandRAT #WLDRagent #Spirals #ChromeSync #GitHub #HuggingFace
Keypoints
- Fake NuGet game tools dropped a second-stage payload called pepesoft.exe.
- UAT-11795 used trojanized installers to deploy Starland RAT and WLDR agent.
- Spirals ransomware encrypted a South Asia IT services network within 24 hours.
- CISA added Oracle E-Business Suite CVE-2026-46817 and KNX CVE-2023-4346 to its KEV catalog.
- Attackers abused fake GitHub repos, Chrome Sync, and device code phishing to steal credentials and data.
Read More: https://thehackernews.com/2026/07/threatsday-game-cheat-spyware-24-hour.html