⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More

This weekly recap highlights a broad surge in active exploitation, malware campaigns, supply-chain abuse, and novel attack techniques. Notable vulnerabilities include Bad Epoll (CVE-2026-46242) — a Linux/Android local privilege escalation — and SharePoint RCE (CVE-2026-45659) added to CISA's KEV after active exploitation; ransomware actors continue to exploit Citrix Bleed 2 (CVE-2025-5777). Reported threats span cross-platform RATs and MaaS (QuimaRAT), modular ransomware-capable frameworks (Avalon/CrownX), credential-theft operations tied to FortiGate leaks, targeted campaigns delivering DcRAT