New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations

Cisco Talos published a series of investigations and analysis highlighting active targeted campaigns and broader trending threats. The most notable item describes a new Lua-based malware family dubbed “LucidRook” delivered via spear-phishing by a cluster tracked as UAT-10362 against Taiwanese NGOs and suspected universities. Other coverage includes: a large-scale automated credential-harvesting operation using a framework called NEXUS Listener (UAT-10608); an Axios NPM supply-chain incident and broader supply-chain advisories; abuse of SaaS notification pipelines to deliver phishing/spam; QILN