Sophos says Claude Code, Cursor, and Codex triggered Windows endpoint rules for credential access, LOLBin downloads, and ...
The Armored Likho APT is targeting government and electric power organizations with modular RATs and information stealers.