Mailbox Rule Abuse Emerges as Stealthy Post-Compromise Threat

This feed highlights a surge in active post-compromise and supply‑chain threats, widespread phishing and MaaS activity, and several high‑impact vulnerabilities. Notable items include abuse of Microsoft 365 mailbox rules for stealthy persistence and exfiltration; the Mirax Android banking trojan using MaaS, remote access and residential proxying; dismantling of the $20M W3LL phishing operation and Operation Atlantic’s $12M crypto seizure; concentration of ransomware activity from Qilin, Akira and Dragonforce; emerging stealth RATs and infostealers (STX RAT, Storm, Venom, Phantom, Atomic Stealer