Obscura is a sophisticated ransomware variant identified in August 2025 that employs stealth tactics to maximize impact within domain environments. It propagates through the Windows NETLOGON share, creating scheduled tasks for remote encryption, and requires administrative privileges to disable security features and perform reconnaissance. Utilizing advanced cryptography (Curve25519 and ChaCha20), it selectively encrypts files while avoiding critical system files, embedding a base64-encoded ransom note within its binary. Its design emphasizes rapid, widespread encryption, making detection difficult due to hardcoded paths and stealth mechanisms. Concurrently, the malicious npm package Fezbox demonstrates evolving malware techniques by using QR code steganography to conceal payloads that extract and exfiltrate user credentials from browser cookies. Discovered by AI-powered scanning, Fezbox’s obfuscation and layered concealment underscore the increasing sophistication of cyber threats, emphasizing the importance of vigilant monitoring, automated security measures, and proactive defense strategies in safeguarding digital infrastructures. CTIX analysts will continue to report on the latest malware strains and attack methodologies.