August 6, 2026
- SideWinder deployed a new multi-stage chain abusing ClickOnce .application files delivered via phishing PDFs. The chain uses white-binary side-loading to run RC4/XOR-encrypted Rust backdoors that persist via the registry and take C2 over Cloudflare Workers, with malicious Office macros as an alternate initial-access vector (blackorbird). · Threat Activity
in OpenAI's Rogue-Agent Post-Mortem: A Swarm That Rebuilt Its Own Message Board