The best and worst ways to get users to improve their account security

This Talos weekly roundup highlights active macro-based malware campaigns created with MacroPack that deliver post-exploitation frameworks (Havoc, Brute Ratel) and a PhantomCore RAT, documents multiple nation-state and mercenary actor activities — including APT29 watering-hole exploitation of WebKit/Chrome vulnerabilities and North Korea’s Citrine Sleet using a Chrome zero-day (CVE-2024-7971) to steal cryptocurrency — and notes defensive actions (Snort/ClamAV signatures) plus IoCs released to help detection and mitigation.