Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)

SANS Internet Storm Center feed containing reports on Guildma (Astaroth) malware delivered through Brazilian Portuguese phishing email, polymorphic phishing pages, malicious PE-file characteristics, and risks from internet-exposed LLM inference endpoints leaking coding-agent sessions and local environment data. It also includes defensive content on Entra ID administrative privileges and a YARA-X release. The primary security-relevant item is an active malware/phishing campaign involving Guildma/Astaroth.