Two (2) recent campaigns highlight a growing shift in cybercrime where attackers exploit trusted platforms and everyday user actions, rather than software flaws, to cause harm. In the first campaign, threat actors exploited the popular note‑taking app Obsidian by posing as venture capital investors and convincing finance and cryptocurrency professionals to enable a normally disabled plugin feature. That single action allowed malicious configurations to run silently inside a legitimate, signed application, bypassing traditional antivirus tools and installing hidden remote‑access malware. In a separate campaign dubbed Pushpaganda, attackers used AI‑generated news content and search optimization to push fake stories into Google’s Discover feed. Victims who clicked were pressured into enabling browser notifications, which then delivered fake legal threats, scareware, and financial scams directly to their devices. Both campaigns relied on legitimate features, trusted brands, and user consent, allowing malicious activity to blend into normal behavior. Together, they show how cyber risk is increasingly driven by social engineering and manipulated trust, making user awareness and visibility into real behavior just as important as patching vulnerabilities. CTIX analysts will continue to report on the latest malware strains and attack methodologies.