October 7, 2026
- Iran-aligned CL-STA-1178 ran "Blinder Tunnel" against an Iraqi critical-infrastructure target, likely a software engineer. The lure was a fake Dubai Airports recruiter with an offline careers portal and HR questionnaire, followed by a Visual Studio "coding test" whose weaponised
.csprojexecutes the moment the project is opened in the IDE — before any build — chaining into AppDomainManager hijacking (Unit 42). · Threat Activity
in Pre-Auth File Read Hits Eight Atlassian Data Center Products