Field notes from the edge.
What our engineers learned this week. Hands-on technical deep-dives, postmortems, and strategy frameworks.
AIWeedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content
McAfee Labs has identified a malware-as-a-service campaign dubbed Weedhack that targets Minecraft players through YouTube, distributing malware disguised as legitimate Minecraft clients and mods. The campaign, active since January 2026, aims to gain control of victims' systems by exploiting the gaming community's trust in content shared via social media platforms.
AIHow Leading Organizations Are Turning EDR Into Operational Resilience
Organizations are increasingly adopting endpoint detection and response (EDR) solutions as traditional endpoint protection proves insufficient against modern cyber threats. EDR provides the continuous visibility and monitoring capabilities needed to detect and respond to sophisticated attacks that evade conventional prevention controls. However, simply deploying EDR technology is not enough—leadin
AIThreat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer
Threat actors are actively exploiting a critical, patched vulnerability in FortiClient Endpoint Management Server (EMS) to deploy credential-stealing malware across enterprise networks. The attackers leveraged trusted endpoint management infrastructure to distribute malicious payloads disguised as legitimate Fortinet endpoint components, allowing them to compromise managed endpoints at scale.
AIIvanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access
Ivanti has issued a warning about CVE-2026-6973, a high-severity remote code execution vulnerability in Endpoint Manager Mobile (EPMM) that is being actively exploited in limited attacks. The flaw, caused by improper input validation, allows authenticated users with administrative access to execute remote code on affected systems running EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1.
AIAttacks Abuse Windows Phone Link to Steal Texts & Bypass 2FA
Cybercriminals are exploiting Windows Phone Link functionality to intercept SMS messages and bypass two-factor authentication through a new attack campaign. The attacks deploy CloudZ RAT malware alongside a novel plugin called Pheno to compromise the connection between Windows PCs and smartphones, enabling unauthorized access to text messages and authentication codes.