Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

BlueVoyant’s Threat Fusion Cell (TFC) and Security Operations Center (SOC) have uncovered a cyber campaign that signals a concerning evolution in the threat landscape: the rise of the "LLM-Enabled Developer." In-depth analysis suggests the actor behind an ongoing ClickFix campaign leveraged publicly documented advanced attack chains, powered by AI-generated code, to deploy a less sophisticated, but capable Node.js RAT.

The package states it is for the GitHub Actions Toolkit, which has a legitimate npm package @actions/artifact. Therefore this malware package is a clear typosquat with the swapping of the letters “ti” for “it”. We took a look at the “harness” binary as indicated in version 4.0.13.

In the autumn of 2025, well-crafted emails landed in inboxes with subject lines that read like routine diplomacy: invitations to regional workshops, follow-ups on border-facilitation talks, agendas for logistics and procurement. The attachments looked ordinary — a short, convenient file that promised to open a document or shortcut to a resource. But inside those tiny shortcuts lived a trap.

The battle against cyber threats is never-ending — and mobile is the new battleground. Modern workers now rely on mobile devices to access sensitive information, often using a single device for personal and professional purposes. As a result, malicious actors have sensed a blind spot and are using these devices as the first line of attack to gain a foothold into secure systems. 1.2 million enterprise employees were exposed to mobile phishing attacks in Q2 2025.

Government administration, defense, and finance sector organizations are the primary areas Advanced Persistent Threat (APT) groups are targeting, according to the most recent data from the Trustwave SpiderLabs’ Cyber Threat Intelligence (CTI) team. The team found most attacks are launched from China, Russia, and Iran, with the primary targets residing in the US, Ukraine, and, interestingly, Russia. The groups tracked include Lapsus$, ShinyHunters, and Silk Typhoon.

Government administration, defense, and finance sector organizations are the primary areas Advanced Persistent Threat (APT) groups are targeting, according to the most recent data from the Trustwave SpiderLabs’ Cyber Threat Intelligence (CTI) team. The team found most attacks are launched from China, Russia, and Iran, with the primary targets residing in the US, Ukraine, and, interestingly, Russia. The groups tracked include Lapsus$, ShinyHunters, and Silk Typhoon.