The threat hunter’s gambit

Cisco Talos blog feed highlights multiple active and emerging threats: a Lua-based malware family dubbed “LucidRook” (cluster UAT-10362) delivered via spear‑phishing against Taiwanese NGOs and universities; a large-scale automated credential‑harvesting campaign (UAT-10608) leveraging a framework called NEXUS Listener against web applications; Qilin ransomware activity using a malicious msimg32.dll EDR‑evasion/kill chain; and a recent Axios NPM supply‑chain incident. Talos also reports increased abuse of SaaS notification pipelines for phishing/spam, ongoing exploitation of legacy/enmeshed deps