Blog - RH-ISAC

Summary A highly capable threat campaign, codenamed EvilAI by Trend Micro, is using seemingly legitimate, digitally signed AI-enhanced productivity software, such as PDF editors, to secretly deliver various malware strains globally. These applications, which appear functional, serve as initial access conduits to perform reconnaissance, exfiltrate browser data, and prepare systems for secondary payloads. The campaign has…

Fraud and scams are no longer isolated incidents—they’re a national crisis. Every day, criminals steal an estimated $430 million from Americans, exploiting digital platforms, financial systems, and communication networks. These scams fund transnational criminal organizations and erode trust in our economy and institutions. To address this growing threat, the Aspen Institute Financial Security Program has released the proposed National Strategy to…

Context CISA has released Emergency Directive 25-03 in response to an advanced threat actor actively exploiting zero-day vulnerabilities in Cisco Adaptive Security Appliances (ASA) devices. This alert comes as the United Kingdom National Cyber Security Centre releases a parallel advisory warning of active exploitation. This persistent threat utilizes new malware strains, RayInitiator and LINE VIPER, to maintain control and…

Security teams don’t just need alerts, they need answers. At Stairwell, we’ve seen how easily malware evades detection when defenders rely solely on behavior, logs, or static IOCs. Some threats hide inside image files. Others remain dormant for months. Many are missed not because they’re advanced, but because no one was looking in the right…

Executive Summary A widespread, opportunistic data theft campaign against Salesforce, attributed to the group UNC6395, has expanded in scope beyond initial reports. The attacks leverage compromised OAuth tokens from Salesloft Drift, an AI chat agent, to gain unauthorized access to customer instances of various services, including Salesforce and Google Workspace. Cybersecurity firms Zscaler and Palo Alto Networks have publicly confirmed impact,…