Cybersecurity experts have identified two (2) significant ongoing threats. First, a malicious actor known as TigerJack targets developers by creating harmful extensions for platforms like Microsoft’s VSCode marketplace and OpenVSX, an open-source alternative. These extensions (some downloaded thousands of times), contain dangerous features such as stealing source code, secretly mining cryptocurrency, and executing malicious commands from remote servers. Despite some being removed from VSCode, TigerJack continues re-uploading similar malicious tools under different names. Operating with multiple fake accounts to appear legitimate and to push new payloads without updating the extensions. Second, researchers uncovered Operation Zero Disco. A cyberattack campaign exploiting a recent security flaw in older Cisco devices. The flaw, CVE-2025-20352, allowed hackers to remotely execute malicious code on vulnerable systems, especially older models like the 9400, 9300, and 3750G series. Even though Cisco patched the vulnerability, attackers had already installed Linux rootkits that granted persistent access by setting universal passwords containing “disco” and hooking into core software. Making detection difficult. They also attempted to exploit a Telnet vulnerability for deeper access. The attacks mainly targeted outdated Linux systems lacking modern security tools, but newer Cisco devices with protections like ASLR can still be targeted through repeated efforts, highlighting the need for cautious security practices. CTIX analysts will continue to report on the latest malware strains and attack methodologies.