Incident responders, s'il vous plait: Invites lead to odd malware events

Multiple Sophos posts report active and emerging threats: a phishing campaign (tagged STAC6405) that delivers remote monitoring/management (RMM) tools to multiple organizations via invite lures — likely exploratory access-as-a-service activity and potential info-stealer risk; the NICKEL ALLEY campaign—attributed to North Korean actors—targets software developers with fake companies/repos to steal cryptocurrency and credentials; Android devices have been found shipping with Keenadu firmware-level malware that provides persistent device control and appears to be used primarily for ad fraud; and,