"The C2 hosts a web-based graphical user interface (GUI) titled 'NEXUS Listener' that can be used to view stolen information ...
An emerging threat cluster is exploiting vulnerable Web-exposed Next.js apps and using an automated tool to steal credentials ...
Phishing surge, LinkedIn tracking claims, spyware use, and rising stealers expose growing abuse of trusted systems.