Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)

SANS Internet Storm Center digest covering Guildma/Astaroth malware delivered through Brazilian Portuguese email, phishing campaigns including polymorphic pages, exposure risks from malicious operators abusing free LLM endpoints and coding-agent data, Entra ID administrative privilege governance, malicious PE metadata analysis, and YARA-X updates. The most direct active-threat item is a phishing-led Guildma/Astaroth infection; the LLM honeypot report highlights potential credential, filesystem, path, and tool-manifest disclosure risks.