Quick findings and new research, as posted to @filescan_itsec.

1. 2026-08-20 Two new samples from a single Hunting query — a ScreenConnect downloader and a PowerShell backdoorNew
2. 2026-07-27 Tracing a live ClickFix chain via EtherHiding — lure page to Polygon contract to stager domain
3. 2026-06-12 ShinyHunters PeopleSoft — two unreported Go dropper variants share one MeshCentral C2 via azurenetfiles[.]net
4. 2026-05-27 Syntrix RAT caught pre-deployment — four-stage chain, AMSI and UAC bypass, ETW patching, C2 still on 127.0.0.1:4782
5. 2026-05-18 ClickFix did not die with 2025 — fake Cloudflare CAPTCHA hijacks the clipboard to drop a malicious OCX