Cybersecurity researchers have identified two emerging threats that highlight how attackers are evolving their tactics to target both enterprise defenses and modern development workflows. The newly observed GodDamn ransomware leverages a malicious kernel-level driver called PoisonX to disable endpoint security tools. This allows attackers to evade detection while deploying ransomware and conducting credential theft activities. At the same time, researchers uncovered a new “HalluSquatting” technique that exploits AI coding assistants by taking advantage of hallucinated package names. This potentially tricks developers into installing malicious dependencies that can deliver malware or join infected systems to a botnet. Together, these campaigns demonstrate a growing trend in which threat actors are focusing on trust relationships, whether by abusing legitimate drivers to bypass security controls or manipulating AI assisted development processes and open-source ecosystems. The findings reinforce the need for organizations to strengthen endpoint protection, closely monitor privileged activity, validate software dependencies, and implement stricter oversight of AI-generated code before they are incorporated into production environments. CTIX analysts will continue to report on the latest malware strains and attack methodologies.