other

SUPERSTOMP

Loader malware used to fetch and install a follow-on browser extension payload from a remote server.

Current clusters

A reflected XSS on a US university site launched a three-CVE Chrome chain at NGOs

Volexity attributes September 1 spear-phishing at multiple NGOs to the Chinese cluster UTA0560. The chain used two Chrome flaws and one in Windows ALPC, and a second China-nexus actor ran the same chain.

Publishers:thehackernews.com

Reality

Evidence64
Adoption58
Hype gap+8
Incentives45
Confidence62