Threat actor

PoisonSeed

In 2 briefs, most recently 21 July 2025. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. SharePoint zero-days (CVE-2025-53770/53771) breached 75+ servers, 3,500 sites ran stealth crypto miners, and npm packages were trojanized via phishing.
  2. Salt Typhoon's long-running access to US National Guard systems and CrowdStrike outage hit 750+ US hospitals; PoisonSeed bypasses FIDO2 MFA via WebAuthn …