⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More

This weekly recap highlights a recurring pattern of attacks that abuse trusted paths — third‑party tools, download/update channels, and browser extensions — to gain internal access and deliver multi‑stage malware. Notable items include a supply‑chain/data breach affecting Vercel via a compromised third‑party AI tool, active malware campaigns (PHANTOMPULSE, STX RAT, PowMix, various Android RATs and stealers), hijacked installers and update mechanisms, a list of trending high‑severity CVEs to patch, and evolving cybercrime behaviors such as infostealer lookup services and ransomware partnerships; defenders are urged to validate trusted integrations, prioritize patching, and monitor for stealthy, in‑memory activity.