VERY IMPORTANT

DragonForce is a financially motivated ransomware operation that emerged in August 2023, initially using leaked LockBit 3.0 code and later transitioning to Conti v3-based variants. Operating as a Ransomware-as-a-Service model, they offer affiliates an 80% revenue share and comprehensive management tools. By March 2025, they evolved into a 'cartel' structure, providing white-label services. Their attacks primarily target organizations in the US and UK, spanning multiple sectors including manufacturing, professional services, retail, healthcare, and technology. The group actively recruits developers and reverse engineers while offering specialized data analysis services to help affiliates maximize extortion pressure. Notable incidents include a major MSP breach in May 2025 exploiting SimpleHelp vulnerabilities, cascading compromise across multiple client networks.

This investigation reveals the first public confirmation of zero-click mercenary spyware delivered via targeted advertisements, termed AdFection. Devices at Al Jazeera were infected with Candiru spyware through malicious ads purchased by Israeli company Discover-Tech, which operates as a facilitator for mercenary spyware partners. Discover-Tech's Controlium platform enables partners to de-anonymize, fingerprint, and automatically infect devices when advertisements render. Analysis of four billion bidding records shows ads were displayed across nearly 200,000 websites and apps in dozens of countries. The company appeared on Google and IAB Europe vendor lists from 2020-2026, serving ads via major networks. Discover-Tech is linked to multiple mercenary surveillance actors including Candiru, Intelos, and Bindecy, and supports mass-deanonymization through mobile carrier vulnerability exploitation. The infrastructure also covertly directed millions of devices to contact Candiru servers for tracking and reconnais...

The Aoki infostealer has evolved to target credentials from AI coding assistants including Claude, OpenAI's Codex, Cursor, Codeium and Gemini. This capability represents a recent addition, as earlier versions did not target AI-related files. The malware steals API keys, tokens and session files that could enable attackers to conduct activities under legitimate user identities, access connected repositories, cloud services and CI/CD pipelines. Beyond AI credentials, Aoki harvests data from dozens of browsers, cryptocurrency wallets, password managers, messaging applications, gaming platforms, VPN and FTP clients. The malware collects available data and transmits it to command-and-control servers. This development suggests AI credentials are becoming as valuable as traditional targets like payment card data and cryptocurrency wallets for cybercriminals.

Resecurity identified and mapped infrastructure supporting a commercial Phishing-as-a-Service operation marketed as 'Iron Man System.' The kit is sold to criminal buyers as a self-hosted package deploying pre-built lure pages impersonating postal services, banks, government agencies, and other trusted entities. Through infiltration of Chinese threat actor communities and acquisition of a license, Resecurity traced the back-end infrastructure and found 2,360 phishing templates targeting 130 countries. The operation features a self-hosted build registry with 911 published versions, bilingual Chinese-English interface, and subscription-based licensing tied to vendor-controlled authorization servers. Working with Microsoft's Digital Crimes Unit and industry partners, the cybercriminal infrastructure was mapped and disrupted. The kit captured approximately 17.4GB of telemetry data targeting 75,000 organizations through an estimated 1 billion phishing emails.

An investigation revealed the first confirmed incident where large language model-driven AI agents executed substantial portions of an attack. Within 24 hours, attackers exploited an exposed job-submission feature on an Apache Tomcat server running Spring Batch, requiring no authentication, zero-days, or new malware. The attacker used Cairn, an open-source AI agent orchestration platform, identified on the attacking infrastructure. Commands were executed through JavaScript via Nashorn engine, with results extracted through error messages in 1,800-byte chunks across hundreds of sequential requests. The attacker recovered plaintext database credentials from configuration files, enabled xp_cmdshell, and escalated privileges using PrintSpoofer and GodPotato tools to achieve SYSTEM access. Registry hives were extracted, administrator accounts created, and artifacts deleted. Machine-driven execution was evidenced by rapid command timing, programmatic job naming, structured output formatting, and automated error ...

A sophisticated multi-stage network intrusion against a telecommunications organization in September 2024 exploited CVE-2024-47575 on a FortiManager appliance, exfiltrating configurations and cryptographic material for over 500 managed FortiGate firewalls. Attackers then exploited CVE-2025-61624 to deploy PEERSTITCH, a novel memory-resident ARM64 malware that leaves no disk artifacts or network traces. The implant operates by patching running processes, creating covert inter-process communication channels between system daemons, and intercepting network traffic. Additional attack vectors included weaponizing Apache mod_md for reverse shell command and control, impersonating the FortiManager platform to compromise downstream devices, and deploying extensive anti-forensic measures. The intrusion demonstrates advanced tradecraft consistent with nation-state actors, highlighting the critical risk of centralized edge management platforms.

A coordinated disruption action targeted Chinese-speaking cybercriminals operating three major phishing kits: CoGUI, CoAceV, and CoFish_Ws, which collectively distributed hundreds of millions of credential phishing messages primarily targeting Japanese organizations. These operations impersonated 66 well-known brands, mainly consumer and finance companies, to steal usernames, passwords, and payment data. The threat actors demonstrated sophisticated capabilities, utilizing approximately 17,000 unique domains with frequent rotation and evasion techniques. The ecosystem enablers YAM Store and Iron Man were also targeted through a civil lawsuit and domain seizures, conducted in collaboration between Microsoft, Health-ISAC, and multiple security partners. This coordinated action is expected to significantly impact the Chinese phishing ecosystem and cause substantial operational disruption to multiple threat groups conducting financial fraud.

A wave of fraudulent websites mimicking Calendly booking pages for Meta job interviews has been identified, targeting job seekers to steal credentials. Victims select interview time slots, provide personal information, and complete fake CAPTCHA verifications before being prompted to log into Facebook and Google accounts. The sophisticated phishing kit captures login credentials and bypasses two-factor authentication by relaying authentication codes in real-time to attackers. The pages use convincing replicas of legitimate login screens with fake address bars displaying authentic URLs. Eleven domains following similar naming patterns have been identified, utilizing generic recruiting-related terms. The collection infrastructure operates through Amazon API Gateway in Singapore, with code comments in Vietnamese suggesting the operation's possible origins.

Ivanti has released emergency security updates after attackers exploited a chain of three zero-day vulnerabilities in Connect Secure VPN appliances to gain root-level access without authentication. The attack began on October 3, targeting an appliance running version 22.8R2.4. Two vulnerabilities are tracked as CVE-2026-104935 with a CVSS score of 8.6, involving an authentication bypass and remote code execution through manipulated CGI requests and malicious file uploads. A third unpatched vulnerability allows privilege escalation to root by manipulating a privileged service through memory modification. While patches address the authentication bypass and RCE, the privilege escalation flaw remains unresolved. CISA added the vulnerability to its KEV catalog with an October 16 remediation deadline for federal agencies.

A new Android banking remote access trojan named Hirudo has been identified, combining credential theft with live remote control. It is delivered through shopping and entertainment apps that act as droppers, installing the trojan as a separate package behind fake update prompts. The malware replaces legitimate banking applications with patched versions that disable security checks from within the app itself. Eight Indonesian banking apps covering seven banks have been targeted with purpose-built replacements embedding a hooking engine. The campaign uses real advertising infrastructure including Amazon CloudFront for distribution, with targeting extending beyond Indonesia to China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records.

A phishing campaign has been observed distributing AgentTesla infostealer through emails masquerading as business proposal requests. Recipients are asked to review an attached product list, but the ZIP file contains an executable file instead of a document. The malicious EXE disguises itself as a café management program using Chinese-language descriptions and UI elements. Through multiple stages of obfuscation, the malware extracts encrypted data from bitmap resources, performs XOR decryption, and loads successive .NET payloads into memory. The final payload is AgentTesla, which steals credentials, cookies, and contact information from browsers, email clients, FTP and VPN applications. Stolen data is exfiltrated via FTP to a compromised server. The attack demonstrates sophisticated multi-stage loading techniques and social engineering tactics targeting business users.

An evolving Linux malware campaign deploys ClingSTUN, a back-connect proxy backdoor exploiting known vulnerabilities in Internet-facing IoT and network devices. The malware establishes persistent access and converts compromised systems into remotely controlled proxy nodes. Supporting multiple Linux architectures, ClingSTUN combines boot persistence, process termination, watchdog manipulation, process concealment, remote command execution, and self-propagation. It abuses legitimate public STUN infrastructure for NAT traversal. The campaign has expanded the number of vulnerabilities and device vendors it targets over time, affecting products from D-Link, EnGenius, Realtek, TP-Link, AVTECH, Ivanti, Tenda, Lantronix, and others, highlighting the continued risk posed by unpatched, unsupported, and unnecessarily exposed Internet-facing devices.

During Q3 2026, honeypot monitoring revealed attacks targeting poorly managed Linux SSH servers through brute force and dictionary attacks. Primary malware families included ShellBot (also known as PerlBot), a Perl-based DDoS bot with C&C infrastructure at specific IPs, and Fisieredoor, a backdoor capable of executing commands and deploying SSH dictionary attack tools. Attackers downloaded malware using wget or curl, then installed user-mode rootkits, XHide process masking tools, and XMRig cryptocurrency miners. The launcher malware utilized ld.so.preload to inject rootkits and disguised mining processes as legitimate bash sessions. Fisieredoor deployed additional tools including goauto and tsm for credential harvesting and lateral movement, transmitting successful authentication results to command servers.

During the third quarter of 2026, attackers targeted MS-SQL and MySQL servers on Windows systems through multiple attack vectors including brute-force attacks, dictionary attacks, and vulnerability exploitation. Threat actors deployed XMRig cryptocurrency miners, GotoHTTP backdoors, and SoftEther VPN infrastructure along with various web shells including Sharp4WebCmd, Suo5, and PowerShell-based shells for persistence. Additional tools used included VShell for remote command execution, HackBrowserData for credential theft, Fscan for network reconnaissance, and Cloudflared for port exposure. Attackers created backdoor accounts for RDP access and operated SoftEther VPN servers in Cascade Connection mode as command and control infrastructure. The attacks primarily resulted from weak passwords, improper account management, and inadequate security measures on externally exposed database servers.

This analysis examines attacks against Windows web servers during Q3 2026, focusing on Internet Information Services (IIS) and Apache Tomcat environments. Attackers exploited unpatched vulnerabilities, misconfigurations, and weak management practices to gain control through webshell uploads, remote code execution, proxy tools, and privilege escalation utilities. Two prominent attack cases involving CVE-2019-18935 in Telerik UI for ASP.NET AJAX are detailed. The first case deployed reverse shells connecting to 206.82.6.22, utilized Potato-family privilege escalation tools like SweetPotato and PrintSpoofer to obtain SYSTEM privileges, and installed Godzilla-style memory webshells. The second case leveraged the same vulnerability to deploy a Rust-based scanner that identified WordPress installations and reported findings via Telegram. Attackers subsequently conducted coin mining, established VPN servers, and maintained persistent remote access. Recommendations include applying current patches, minimizing exte...

During the third quarter of 2026, multiple attack campaigns targeted poorly managed Linux SSH servers using brute force, dictionary attacks, and vulnerability exploits. Threat actors deployed ShellBot, a Perl-based DDoS bot, utilizing C&C servers at specific IP addresses with capabilities including port scanning and UDP flooding. A sophisticated attack chain involved launcher malware that executed user-mode rootkit libSSL2.3.0.So via /etc/ld.so.preload, subsequently deploying XMRig cryptocurrency miner disguised as -bash using XHide process concealment tool. Additionally, Fisieredoor backdoor was deployed, capable of command execution and installing SSH brute-force tools including goauto and tsm-family, which systematically targeted systems using credential lists. Organizations must implement strong password policies, regular patching schedules, and access controls for externally exposed SSH infrastructure.

In early October, a sophisticated credential phishing campaign targeted WatchGuard Mobile VPN users through a fake download site at watchguard-vpn[.]net. The attack used SEO poisoning to appear in search results and deployed a unique technique: after collecting victim credentials twice through browser pop-ups, it downloaded the genuine, validly signed WatchGuard installer directly from WatchGuard's official CDN. This eliminated malicious files that security tools could detect. The first credential submission was deliberately rejected as incorrect to collect multiple passwords. The credential collection endpoint at watchguard-ssl[.]online received server addresses, usernames, and passwords, providing attackers network access. This domain was previously reported in January with no backend functionality but was re-registered in August with full phishing capabilities implemented by September.

Cybercriminals are exploiting digital event invitations to distribute remote access trojans. Victims receive legitimate-looking emails with generic subject lines about special gatherings and celebrations. The messages contain download buttons that redirect users through fake CAPTCHA verification pages hosted on recently created domains. After verification, users encounter another generic invitation page prompting them to download an eInvite file. This delivers a zipped folder containing ScreenConnect.exe, a legitimate ConnectWise Screen Connect installer weaponized as a RAT. Once executed, attackers gain full remote access to compromised devices through an unassuming taskbar icon that reveals an active connection. The campaign leverages user curiosity rather than sophisticated techniques, making it particularly effective during holiday seasons when event invitations are common.

The Kimsuky threat group has launched spear phishing campaigns targeting Ukrainian experts in diplomacy, security, and international policy through fraudulent international conference invitations and collaboration requests. This operation, dubbed GitPower, leverages legitimate development platforms like GitHub for malware distribution and data exfiltration. Attack vectors include malicious LNK files and fake Zoom installers, demonstrating links to previous CHM-based attack methodologies. The campaign appears to be state-sponsored cyber espionage focused on monitoring cooperation developments between South Korea and Ukraine. Organizations are advised to enhance EDR detection capabilities and implement threat hunting for suspicious LNK file execution, PowerShell abuse, and unauthorized GitHub communications.

A sophisticated multi-stage intrusion chain begins with a WhatsApp-delivered financial document lure carrying Statement.exe. The malware employs NRV2E compression to conceal its true payload, which performs extensive host screening before attempting privilege elevation via COM-based techniques. Using PoolParty Variant 7 injection, the loader transfers execution into the Windows Task Scheduler process under LocalSystem authority. A downloader shellcode retrieves a compound bundle from a remote server, which deploys through a reflective loader. The deployment stage utilizes a signed GoFly driver to terminate Baidu security processes, establishes persistence via DLL side-loading with a legitimate Intel-signed VulkanInfo executable, and launches a WebSocket-based remote access trojan. The final VulcanRAT207.A payload provides extensive surveillance capabilities including shell access, keystroke capture, desktop control, network filtering, and process injection, while maintaining persistence through SYSTEM-leve...

A North Korean threat actor distributed Funhouse ransomware through malicious Korean-language documents disguised as resumes. Funhouse is a variant of the previously observed Endpoint ransomware. The attack chain involves multi-stage scripts including Batch, VBS, and PowerShell, leading to Quasar RAT installation before deploying the final ransomware payload. The campaign shares significant similarities with earlier Kimsuky Endpoint ransomware operations from early 2026, including identical mutex values, similar batch file structures, and comparable Quasar RAT configurations. The ransomware maintains key characteristics of the Endpoint family while updating encryption extensions, contact information, and C2 infrastructure. A notable shift involves using HWP documents instead of LNK files as initial infection vectors.

A sophisticated malware campaign targets low-cost Android devices built on MediaTek platforms, with malicious code preinstalled in device firmware before users receive them. The platform-signed system application operates with elevated privileges, enabling operators to silently install applications, grant permissions, and load remote code. The scheme primarily generates revenue through ad fraud, click fraud, device information collection, and converting infected devices into residential-proxy botnet nodes. The malicious system application ships under various system-sounding names including com.android.system.lite, com.android.sys.prot, and com.android.sys.gmsprot. Operators deploy at least 32 disguised applications including fake weather, app-lock, and OCR tools. The malware disables Google Play Store during payload installation to evade detection, then re-enables it afterward. Thirteen related applications were also discovered on Google Play, communicating with identical command-and-control infrastructure...

A sophisticated phishing campaign targets YouTube content creators through personalized sponsorship emails impersonating legitimate brands like Hollyland, Nike, and Spotify. Attackers send customized collaboration offers referencing specific videos from targets' channels, then direct them to fraudulent platforms that appear legitimate with campaign metrics and income calculators. The scheme culminates in a Google sign-in request that either captures credentials directly or requests excessive account permissions. Once compromised, attackers lock victims out by changing recovery methods and can misuse the account to spread scams to followers. The modular campaign operates globally, targeting creators in Peru, Japan, and English-speaking regions, using multiple domains while maintaining similar functionality and design patterns across variants.

Two critical zero-day vulnerabilities in NetScaler ADC and Gateway systems are being actively exploited in the wild. CVE-2026-88771 is a remote code execution vulnerability allowing unauthenticated command injection, while CVE-2026-88772 is a DTLS memory overflow flaw enabling RCE or DoS attacks. Threat actors deployed webshells through these vulnerabilities to establish initial access and persistence. The CVE-2026-88771 exploitation involves a three-stage command injection chain poisoning log files, while CVE-2026-88772 exploitation drops .deb webshell files. Attackers used PHP webshells with RC4 encryption for command and control communications, targeting custom directories within NetScaler Gateway interfaces. Cortex Xpanse identified over 50,000 potentially vulnerable exposed instances.

A cryptocurrency wallet-drainer kit called Noir uses DNS TXT records and DNS-over-HTTPS (DoH) as a dynamic command-and-control mechanism. The loader queries public DoH services to discover active infrastructure hosted on Cloudflare Pages, allowing operators to redirect deployed lures by changing a single DNS record. The drainer does not require victims to enter seed phrases or private keys; instead, it requests wallet connection permissions and obtains spending approvals that appear less suspicious than direct transfers. The architecture separates long-lived phishing lures from short-lived operational infrastructure, with 60-second DNS caching and self-healing retry logic. Extensive plain-English code comments suggest AI-assisted development, documenting bugs, fixes, and design decisions. The kit serves as a shared service across multiple cryptocurrency-themed phishing campaigns.

During a live Security Operations Center shift at .conf26 in Denver, analysts investigated Incident ES_00244 involving an exploit link detected by Cisco Secure Firewall. The challenge arose when 15 devices were found communicating with a single IP address (13.226.251.40) flagged for hosting malicious domains moonlighthathel[.]org and ukankingwithea[.]com. Investigation revealed the IP was an Amazon CloudFront CDN node simultaneously serving legitimate services including Samsung Health, Mindtickle learning platform, and Amazon Video. Using AI-assisted analysis, firewall logs, and packet forensics through Endace, analysts isolated one unmanaged Intel laptop generating malicious traffic among 14 benign connections. Instead of blocking the shared IP and disrupting legitimate services, analysts implemented precise DNS object blocks targeting only the malicious domains at the Cisco Firepower Threat Defense perimeter, successfully neutralizing the threat while maintaining normal operations for all other attendees.

In late September 2026, an actor deployed seven malicious npm packages masquerading as a NebulaAI software development kit to deliver a Windows remote-access trojan. The operation, tracked as NEBULA, spans four sequential burner accounts (nebulallms through nebulallms4), with api-nebula and llm-nebula remaining downloadable. Each package presents a convincing AI client facade while hiding an obfuscated installation hook executing malicious logic. The underlying RAT operates exclusively through direct NT and win32k syscalls, bypassing standard DLL imports with an empty Import Address Table. Features include hidden-desktop remote control (HVNC), Kernel Streaming for camera and microphone monitoring, and Winlogon Shell persistence. The payload is a customized KNTRAT variant communicating with 65.87.7.132 using user-agent kntrat/0xB15B00B6. The implant masquerades as conhost.exe and suppressed beaconing during analysis, consistent with embedded anti-analysis provisions.

An unidentified threat actor, likely Chinese-speaking and financially motivated, conducted targeted attacks against South Korean financial institutions between late September and early October 2026, successfully exfiltrating data. The adversary utilized ARTEX, a Chinese-developed open-source agentic penetration testing tool, combined with large language models including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6. Analysis of exposed directories revealed Claude Code session histories, ARTEX configuration files, and operational details showing a two-server architecture involving Hong Kong-based infrastructure. The threat actor demonstrated sophisticated tradecraft by leveraging AI tooling to enhance operational tempo, enabling multiple intrusions within a compressed timeframe. Evidence suggests the attacker also researched Korean data breach marketplaces and Telegram channels for selling stolen information.

Warden Stealer is an emerging Rust-based infostealer-as-a-service that has rapidly become one of the most prevalent threats, distributed via malware-as-a-service model since August 2026. Unlike most competitors, it includes a dedicated loader and built-in cryptocurrency clipper. The malware targets over 200 cryptocurrency wallet extensions, 360+ applications across 13 categories, and is notably one of the first infostealers specifically collecting AI assistant and agentic coding tool data, including tokens, credentials, and prompt histories from Claude, Codex, Grok, and Cursor. Operating through tiered subscriptions ranging from $149 for three days to $1,500 monthly, Warden Stealer employs sophisticated obfuscation techniques, morphing capabilities, and bypasses Application-Bound Encryption to steal browser data. The malware avoids CIS and Baltic countries and is distributed through cracked software, game cheats, malvertising, and ClickFix campaigns.

ESET researchers documented the evolution of MATCHBOIL, a custom C# downloader used by Russia-aligned APT group UAC-0099. The malware downloads payloads from command-and-control servers, installs them, and establishes persistence on victim machines. Development traces back to April 2024, with continuous improvements through April 2026. Early versions used Unicode symbol obfuscation and custom string encryption, while later iterations employed the Eziriz .NET Reactor obfuscator. UAC-0099 progressively added sandbox detection methods, modified persistence mechanisms from registry keys to scheduled tasks, and introduced deceptive graphical interfaces. All observed victims were Ukrainian organizations across transportation, manufacturing, and energy sectors. The group typically distributes MATCHBOIL through spearphishing emails containing malicious links that download VBScript files. MATCHBOIL often delivers MATCHWOK backdoor as its final payload.

Beginning October 7, 2026, threat actors exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to achieve unauthenticated remote code execution on exposed systems. The attackers chained these vulnerabilities together, first bypassing authentication and then executing code with SYSTEM privileges. Post-exploitation activities included deploying JSP webshells, installing XMRig cryptocurrency miners disguised as Microsoft Edge processes, and dropping an AI-assisted PowerShell script that monitors and terminates Task Manager to hide mining operations. The attackers established persistence through a fake Windows service named MicrosoftEdgeUpdateSvc and utilized a vulnerable WinRing0x64.sys kernel driver to enable kernel-level hardware access for optimized mining performance. All AhsayCBS versions through 10.3.4 are affected, with managed service providers being the primary targets.

The FBI seized seven web domains linked to Integrity Technology Group, a Chinese security firm allegedly providing hacking tools to Beijing-backed operatives. These tools enabled attacks on critical infrastructure, including a South Carolina power company and universities in Taiwan. The Flax Typhoon group utilized a Mirai-based botnet from 2021 to infect internet-connected devices, scan networks, and launch cyberattacks while concealing Chinese government hackers' locations. The malicious activity involved vulnerability scanning via Microscan tool, cross-site scripting, password spraying on Microsoft Exchange servers, and data exfiltration using FishHub malware. A joint advisory from US, UK, Australia, Canada, Japan, New Zealand, and Spain warned that Chinese state-sponsored actors continue targeting organizations worldwide to steal sensitive information from critical infrastructure networks.

In July 2026, Zscaler ThreatLabz uncovered a sophisticated campaign utilizing a trojanized Terraform provider to deliver cross-platform malware targeting cryptocurrency and Web3 developers. The attack begins with a malicious Terraform provider that downloads a Bash loader from a HashiCorp-themed lookalike domain, which then selects and deploys payloads tailored to the victim's operating system (macOS, Linux, or Windows). Encrypted executables are concealed within fake font files and extracted using marker-based techniques and AES-256-CBC decryption. The campaign delivers FLATROOF, a Rust-based backdoor with platform-specific persistence mechanisms and multiple C2 channels including Telegram Bot API and GitHub. Python-based information stealers target browser credentials, cookies, cryptocurrency wallet extensions, and system information. The attack culminates with ROOFDECK backdoor deployment, featuring resilient C2 discovery through cryptographically signed Pastebin dead drops and Nostr profile metadata, p...

Threat actors are conducting email campaigns targeting the accommodation industry using fake guest complaints, reviews, and inquiries. These emails deliver malicious LNK shortcut files disguised as images, which ultimately deploy blockchain-abusing malware families known as EtherRAT and TONResolver. Both malware types resolve command and control infrastructure by querying public blockchain APIs (Ethereum and TON respectively) instead of using hardcoded domains. This technique allows operators to rotate infrastructure cheaply through small blockchain transactions while making traditional takedown efforts ineffective. The campaigns represent an evolution from earlier Booking.com-spoofing operations that used ClickFix fake CAPTCHAs to deliver remote access trojans. The threat actors likely employ generative AI to create unique email variants, making detection more challenging.

Since April 2026, PoeLLM malware has been actively targeting exposed AI/LLM and open-source services including LiteLLM, Ollama, Gotenberg, and Gitea, with possible Ivanti Sentry targeting. The campaign employs an unusual command-and-control mechanism where infected systems derive C2 server addresses from keywords embedded in a poem hosted on GitHub. This financially-motivated operation deploys XMRig and Iron cryptocurrency miners, connecting victims to Kryptex mining infrastructure. Compromised hosts are repurposed as scanners and exploit servers to expand the botnet, which has impacted over 3,400 victim servers with peak activity exceeding 800 active servers daily. The campaign appears linked to an Italian-speaking threat actor and predominantly affects victims in the United States and Western Europe. Vulnerable routers are exploited to serve as C2 infrastructure.

Malware authors are developing techniques to obstruct automated AI analysis by embedding natural-language instructions within their code. This 'AI-analysis evasion' targets the pipeline that extracts text from samples and submits it to language models for triage or classification. Analysis of 84 samples across four malware families (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE) from January 2025 through July 2026 reveals progression from simple comments claiming benign functionality to template spraying across multiple LLM formats and intimidation tactics invoking copyright, government contracts, and security certifications. The cheapest technique—direct instructions to ignore samples—proved most effective, steering outcomes favorably for attackers in approximately 35% of test runs. However, these techniques must remain in plaintext, making them consistently detectable. The fundamental defense requires treating extracted text as evidence rather than instruction, ensuring analysis pipelines maintain exp...

A coordinated campaign of 16 malicious Firefox extensions has been identified targeting cryptocurrency wallet users. The extensions masquerade as wallet portals, desktop utilities, and browser tools while intercepting recovery phrases and private keys during wallet import flows. Four large extensions clone Rabby Wallet (misspelled as Raabby WaIIet), while twelve smaller extensions impersonate OKX Wallet. All variants capture 12- or 24-word mnemonics and private keys, transmitting stolen credentials to attacker-controlled Cloudflare Workers endpoints. Fifteen extensions communicate with icy-star-f45c.workers.dev infrastructure. The campaign reuses code markers, network infrastructure, and credential-handling logic, indicating connection to crypto-theft operations identified in August 2026. Mozilla has unpublished these extensions. Users who entered credentials should immediately create new wallets and transfer assets.

Multiple Remote Monitoring and Management (RMM) tools are being distributed through phishing campaigns involving video files and email attachments. Threat actors exploit legitimate RMM solutions like ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able to gain remote access to compromised systems while evading security detection. These tools, typically used for legitimate IT administration purposes, are weaponized through various delivery methods including LNK files, BAT scripts, VBS files, and PDF documents disguised as business documents. The campaigns leverage social engineering tactics, presenting fake Adobe Acrobat updates, DocuSign viewers, and document access prompts to trick victims into installing these remote access tools. Each RMM tool contains configuration data linking back to attacker infrastructure, including deployment IDs, account identifiers, and command-and-control server addresses embedded within installation files.

The Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop/Shai-Hulud supply chain attack, affecting a package with approximately 12,000 weekly downloads. The malicious release contains obfuscated code that harvests credentials from multiple sources including npm tokens, GitHub tokens, AWS credentials, HashiCorp Vault, Kubernetes configurations, SSH keys, and AI development tools. A preinstall hook executes the payload during installation, establishing persistence through scheduled tasks and supporting remote code execution. The attack uses an Ethereum contract to resolve command-and-control endpoints and implements a dead-man switch that monitors stolen GitHub tokens, triggering destructive actions if revoked. The malicious code can self-propagate by republishing compromised versions to other packages associated with the victim's publishing identity, extending the worm's reach across the npm ecosystem.

Five hosts exposed the complete DarkSword/Coruna iOS exploitation platform through open directories, revealing an active commercial exploitation-as-a-service operation. The platform targets cryptocurrency wallets across 18 different applications, extracting BIP39 recovery phrases and conducting automated theft. Analysis of the production server recovered 11 victim recovery phrases, 179 device loot directories, and a 75-account control-plane roster indicating an agent/reseller model. A separate China-based operator is deploying identical tooling through independent infrastructure at 66ds[.]lol, representing a distinct threat actor from previously documented DarkSword users. The infrastructure was operationally active during analysis, with beacon telemetry showing Chinese iOS devices polling every three seconds for hours. Development work targeting iOS 26 via CVE-2026-31001 was discovered but remains undeployed.

LevelBlue observed a ClickFix campaign delivering Remus Stealer through compromised websites using PhantomPolia, a JavaScript loader that retrieves encrypted configurations from Ethereum Sepolia smart contracts via public RPC endpoints. The loader decrypts configurations locally using PBKDF2 and AES-GCM to obtain C2 domains. Victims are tricked into executing PowerShell commands that retrieve and decrypt additional configurations using AES-CBC before downloading bundled installers containing AutoIt executables. The AutoIt script decrypts embedded Donut-packed shellcode and executes it from allocated memory, ultimately loading Remus Stealer. This information-stealing malware collects system data, credentials, browser information, password managers, and cryptocurrency wallets. Stolen data is compressed using custom methods and encrypted with ChaCha20 before exfiltration to attacker-controlled servers.

FortiBleed is an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, with over 86,644 compromised devices verified across 194 countries. The campaign exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication data at scale using distributed GPU clusters. Attackers scan for exposed FortiGate SSL VPN portals, collect credentials through stuffing and password spraying, and crack stolen password hashes offline. Once access is gained, they create new administrative accounts for persistence and conduct Active Directory enumeration to expand access. Affected organizations may experience lockouts as threat actors delete or modify existing accounts. The operation functions as an initial-access broker, with connections observed to INC/Lynx and Payload ransomware affiliates, representing a significant threat requiring immediate defensive action.

In September, a phishing campaign exploited legitimate Microsoft Power BI domains to distribute rogue ScreenConnect remote monitoring tools. Attackers sent phishing emails with embedded links redirecting victims to fake reference documents hosted on Power BI infrastructure. Clicking 'Download Reference' opened attacker-controlled websites that fingerprinted victims' systems and browsers before triggering malicious ScreenConnect installer downloads. The attack deployed multiple ScreenConnect instances for persistent remote access, with the second client connected to attacker infrastructure. Following deployment, threat actors executed defense evasion tools and created scheduled tasks running persistence scripts every two minutes. The campaign used browser fingerprinting and Telegram bots to filter victims and track infections, while abusing trusted Microsoft domains to bypass email security controls and increase attack credibility.

Security researchers uncovered a sophisticated human-operated phishing platform disguising itself as AI advertising products for major platforms including Muse, Gemini, Claude, ChatGPT, and Perplexity. The campaign uses a Browser-in-the-Browser technique, creating fake authentication windows that appear legitimate while remaining on phishing domains. When victims click 'Connect' buttons, operators intercept credentials and MFA challenges in real-time through a state machine that can retry passwords and adapt to different authentication methods. The platform targets advertising account managers and recruiters, with infrastructure built on Next.js and Socket.IO, reusing the same codebase across multiple brand impersonations. The operation extends beyond AI products to include refund scams and fake recruitment sites, all connected through shared backend infrastructure on Railway and Render hosting services.

An Iranian state-aligned threat actor designated as CL-STA-1178 has been impersonating the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. The Blinder Tunnel campaign, active since November 2025 with attacks intensifying in March 2026, primarily targeted Iraqi critical infrastructure. The operation employs a three-step attack chain exploiting legitimate Windows developer files, AppDomainManager hijacking, and DLL sideloading to deploy ShelbyLoader V2 malware. Attackers abuse GitHub API infrastructure for command-and-control communications, utilizing repositories for decryption keys, payload downloads, and GitHub issues as fallback mechanisms. The campaign incorporates Peaky Blinders television show themes in its infrastructure naming and embeds the show's theme song in malware. Operational security failures exposed connections to a separate credential harvesting operation targeting Israeli entities using conflict-themed Google Drive lures during May-June 2026.

In September, an organization experienced an Akira ransomware attack, with investigation revealing the threat actor's tactics and tools. The attacker gained access through Remote Desktop Protocol, subsequently disabling antivirus protections on the compromised endpoint. The adversary deployed Rclone for data exfiltration purposes and utilized a GOST tunneling tool to maintain persistence within the network. Following these preparatory activities, the ransomware payload was executed. Forensic analysis of the impacted endpoints enabled investigators to identify key indicators of compromise, including command and control infrastructure and malicious executables. The investigation uncovered specific file paths and SHA256 hashes associated with the ransomware binary and GOST tunnel executable, along with the C2 server IP address used for tunnel communications.

In September 2026, F5 Labs detected 405 exploitation attempts targeting CVE-2026-0768, an unauthenticated remote code execution vulnerability in Langflow AI application-building platform, originating from 55 distinct IP addresses. This marks the first observation of an AI/ML development platform RCE in opportunistic internet-wide scanning. Captured payloads included capability probing with unique markers, timing-based execution checks, and environment harvesting attempts aimed at extracting cloud credentials, model API keys, and database secrets. Activity came primarily from two infrastructure clusters: Google Cloud hosts using environment-harvesting payloads with forged AI-crawler User-Agents, and European scanning subnets employing marker-based capability probing with spoofed localhost headers. The vulnerability, disclosed in January 2026, allows Python code injection through decorator and default-argument evaluation on the validation endpoint without authentication, enabling arbitrary code execution wit...

Attackers who gain access to AWS credentials perform validation to determine their usefulness, particularly for Amazon Bedrock access. Multiple credential harvesting platforms, including KMON_NOC, have been identified that specifically test stolen AWS keys for LLM capabilities. These platforms validate credentials using GetCallerIdentity, then test Bedrock access through ListFoundationModels and Converse API calls. The validation process helps attackers assess credential value for resale in token-jacking markets, where stolen AI model access is sold below retail price. Scripts analyzed on VirusTotal demonstrate systematic testing across multiple regions, targeting Anthropic Claude models specifically, and enumerating promotional credits to assess financial value. This represents an evolution in credential validation similar to historical patterns observed with AWS SES/SNS services.

The Lunex Malware-as-a-Service platform targets Ukrainian users through fake CAPTCHA lures, deploying a sophisticated loader that exploits AMD's vulnerable PDFWKRNL.sys driver (CVE-2023-20598) to disable endpoint security products. The loader retrieves Windows kernel debugging symbols from Microsoft's Symbol Server to dynamically identify and zero security-related kernel callbacks, making the technique version-agnostic. After manipulating security controls, LunexStealer is deployed to harvest credentials from seven Chromium-based browsers and multiple cryptocurrency wallets while establishing persistent C2 access through registry keys, scheduled tasks, and Native Messaging Host registrations. This mechanism survives deletion of the primary executable and provides continued filesystem access and remote execution capabilities, demonstrating advanced evasion techniques that leave security products running while disrupting their operational visibility.

A Linux malware strain named ClingSTUN exploits unpatched vulnerabilities in Internet-facing devices to establish persistent footholds and functions as a back-connect proxy backdoor. The campaign targets IoT devices through multiple CVEs including command injection and code execution flaws in various vendors' products. ClingSTUN abuses legitimate public STUN infrastructure to discover externally mapped IP addresses, maintain NAT bindings, and improve connectivity between compromised hosts and operators. The malware employs sophisticated persistence mechanisms, terminates watchdog timers, kills competitor processes, and disguises itself as the init process. It maintains remote command execution capabilities and includes self-propagation exploits for seven additional vulnerabilities. The threat actor evolved their approach across three distinct periods, adjusting initial access strategies and expanding the list of targeted vulnerabilities from single-vendor exploits to multi-vendor command injection attacks ...

A Russian-speaking affiliate of the Gentlemen ransomware group, identifying as Azazel, compromised over two dozen organizations across six countries while simultaneously betraying the RaaS operator. The threat actor deployed independent leak site LEAKNED, keeping all extortion proceeds. Attack chains primarily exploited CI/CD secrets from GitLab instances, with one deep compromise involving an AI platform through SSRF, credential decryption, and continuous object storage exfiltration. Azazel operationalized MCP (Model Context Protocol) as a command-and-control channel, marking the first documented criminal use of AI assistant tooling for attack execution. Infrastructure consisted of three nodes totaling over 50TB storage capacity, with approximately 6TB of actively transferring victim data discovered during investigation. Victims spanned logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent sectors.

A sophisticated IoT botnet dubbed Cling has been discovered exploiting vulnerable internet-exposed devices through CVE-2021-35394 and other command-injection flaws. The malware distinguishes itself by abusing STUN protocol traffic and public STUN infrastructure for command-and-control communications, making malicious activity appear as legitimate NAT-traversal behavior. Cling propagates through multiple CVE exploits targeting routers, DVRs and embedded appliances, establishes persistence via init scripts and wget binary replacement, then communicates with operators through STUN-like exchanges with public servers. The botnet operator uses IP spoofing to make commands appear as if originating from Google's STUN infrastructure. Capabilities include propagation scanning, DDoS flooding, TCP tunneling and proxy relay functions. The malware supports various attack commands hidden within STUN transaction ID fields while maintaining a low detection profile by blending into legitimate application traffic from collab...

XWorm is a versatile modular malware that poses a multifaceted threat through remote access, data theft, ransomware delivery, and botnet creation. Associated with the DDGroup cybercrime group, it rapidly gained notoriety for using advanced techniques. The malware employs diverse delivery methods including phishing emails with malicious attachments, drive-by downloads, exploit kits targeting browser vulnerabilities, USB drives, and Remote Desktop Protocol exploitation. Once established, XWorm steals sensitive data like passwords and credit card information, deploys additional malware strains including ransomware and spyware, and causes system crashes and denial-of-service attacks. Its modular nature and varied attack vectors make it a persistent threat requiring robust cybersecurity measures and continuous vigilance.

Threat actors exploited ChatGPT's Custom GPT feature to impersonate legitimate ChatGPT models, directing victims through sponsored Google ads to malicious Custom GPTs titled 'Plus 5.6'. These instances served fake service availability notices, redirecting users to Google Sites pages hosting ClickFix lures disguised as CloudFlare CAPTCHA checks. Victims were tricked into executing PowerShell commands that downloaded malicious MSI installers. The attack chain employed DLL sideloading through legitimate Canon-signed and later Stardock-signed executables, establishing dual persistence mechanisms via registry Run keys and scheduled tasks. The multi-stage infection involved obfuscated scripts, encrypted payloads hidden in WAV files and NuGet packages, and ultimately deployed a feature-rich remote access trojan with capabilities including remote desktop, browser hijacking, credential theft, and follow-on payload delivery. Huntress investigated approximately 40 incidents linked to this campaign, with confirmed Cus...

Socket identified a malicious cluster of Visual Studio Code extensions spanning both VS Code Marketplace and Open VSX registries. Two confirmed malicious themes were discovered: Aurora Nocturne Night Theme, which downloaded and executed threat actor-controlled batch files, and Cosmic Nebula Themes, containing a staged loader that decrypts embedded JavaScript, performs Russian-language gating, and uses Solana blockchain transaction memos to dynamically resolve payload infrastructure. The cluster includes at least ten extensions across both platforms, with over 8,000 Visual Studio Marketplace installs and tens of thousands of Open VSX downloads. Git history, Russian-language source code comments, and distinctive execution patterns connect these extensions to the broader GlassWorm supply chain campaign. Several extensions remain unweaponized but retain executable capabilities that pose significant risk. The operation employs brandjacking tactics and demonstrates sophisticated infrastructure rotation technique...

Between September 9 and September 14, 2026, an unattributed Russian-speaking operator compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page. The ClickFix chain convinced victims to manually execute msiexec.exe commands via the Windows Run dialog, achieving a 14 percent completion rate (79 infections from 426 clicks). The payload, internally named Psychedelic, combines credential theft with persistent agent capabilities, installing browser extensions with native-messaging bridges, establishing scheduled tasks, and polling a REST API for arbitrary executable tasking. Targeting focused overwhelmingly on Ukraine with clear financial motivation, collecting browser credentials, session tokens, and cryptocurrency wallet data from MetaMask, Trust Wallet, Exodus, Atomic Wallet, and others. The technique deliberately avoids encoded PowerShell, using signed Microsoft binaries to bypass common ClickFix detections.

A sophisticated multi-component campaign targeting telecommunications and network-edge appliances has been discovered, featuring BPFDoor variants and a newly identified implant designated AVERAT. The operation leverages SMTP traffic on port 25 to blend command-and-control communications with legitimate mail relay activity, exploiting the trust environments of targeted systems. Attackers deploy a dropper that stages payloads into memory-only execution, leaving no on-disk artifacts for forensic analysis. BPFDoor variants impersonate legitimate processes such as SpamSniper components on South Korean systems, while AVERAT samples target Taiwanese appliances using regionalized disguises. The infrastructure relies on compromised consumer devices including NAS units, CCTV systems, and DVRs as operational relays, consistent with China-nexus covert network patterns. Each component demonstrates advanced operational security through process spoofing, encrypted configurations, and deliberate evasion of network monitor...

BraZetsu is a sophisticated Python-based Windows malware framework attributed to the Brazilian threat actor Exilware. Unlike standard infostealers, it functions as a comprehensive toolkit for Initial Access Brokers, converting compromised systems into high-value commercial assets. The framework employs modular architecture, advanced evasion techniques, and AI-enhanced reconnaissance capabilities to target corporate, financial, industrial, and law enforcement environments across Iberia and Latin America. It specifically harvests financial transaction files in Brazilian CNAB format, detailed browsing histories, and digital certificates. BraZetsu powers the 'Infected Marketplace' where Exilware commercializes initial access to compromised systems, enabling criminal clients to remotely execute additional malicious payloads. The malware demonstrates rapid technical evolution since February 2026, progressing from basic remote access to an AI-enhanced intelligence collection platform.

A threat actor compromised three web servers hosting recreation management software for municipalities and parks organizations by exploiting a file upload vulnerability. After multiple failed exploitation attempts, the attacker registered legitimate accounts and abused the member file upload function to deploy webshells. The attacker enumerated systems, extracted database credentials, and targeted payment card data from Fortis webhook logs. User-agent strings indicate Chinese origin, with suspected AI-generated scripts throughout the operation. The adversary adapted tactics across compromises, employing timestomping and file masquerading for defense evasion. When one server returned to production prematurely, the attacker injected a trojanized jQuery file into authentication pages, establishing WebRTC and WebSocket channels for credential harvesting via Cloudflare Workers infrastructure.

During August 2026, multiple APT campaigns targeted South Korean entities primarily through spear phishing attacks utilizing LNK files. Six distinct attack types were identified, employing various techniques including PowerShell scripts, AutoIt programs, and DLL side-loading. Type A used HEX data extraction with PubNub command and control, while Type B leveraged curl.exe to download HTA files from GitHub and Google Drive, deploying infostealers and keyloggers. Type C distributed XenoRAT malware via GitHub repositories. Type D used resume-themed lures with VBS, BAT, and PowerShell scripts for backdoor injection. Type E employed Python-based backdoors through disguised pythonw.exe executables. Type F exploited Hangul documents with embedded OLE objects for malicious DLL loading. Attacks focused on information theft, system control hijacking, and additional malware deployment.

A cryptocurrency-stealing operation utilizing an Aotera/Tedy loader injects a Vidar-class stealer into Windows processes, launching Chrome or Edge to inject malicious scripts into victim sessions. The malware builder, dubbed Underground, has been active since October 2023. The operation employs seven gate domains and has drained approximately $100,000 across 80+ destination addresses on 23 blockchain networks from 350-430 victims. The infection begins with lure archives containing trojanized files, deploying a loader that implements anti-analysis checks against 67 monitoring tools. Once injected, the stealer automatically drains cryptocurrency exchange accounts through fake security overlays, converts holdings to Bitcoin, and modifies withdrawal confirmation emails. A clipboard clipper targeting two dozen cryptocurrencies replaces copied wallet addresses with operator-controlled addresses. The operation rotates Cloudflare-fronted domains faster than reputation-based detection can respond.

RemusStealer is a malware-as-a-service program exhibiting multiple similarities to LummaStealer, including anti-virtual machine checks, credential theft tactics, and Application-Bound Encryption bypass methods. A key distinction is RemusStealer's use of Ethereum smart contracts for C2 communications instead of Steam or Telegram dead drop resolvers. Written in Go, the stealer performs extensive system discovery, gathering information about antivirus products, hardware specifications, and operating systems. It employs hidden desktop environments to evade detection while launching Microsoft Edge and Brave browser processes on non-primary window stations to steal credential files. The malware establishes connections to suspicious domains ending in .shop or .biz and communicates with Ethereum-related infrastructure. This evolution demonstrates attackers' increasing sophistication in leveraging blockchain technology to masquerade malicious communications through smart contracts.

A critical path traversal vulnerability combined with improper NULL byte neutralization in FortiMail versions 7.2 through 8.0 allows unauthenticated attackers to write arbitrary files on the underlying system through crafted HTTP or HTTPS requests. This vulnerability is actively exploited in the wild. Affected versions include FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and 7.2.0-7.2.9. Indicators of compromise include modified system binaries, added malicious libraries, and suspicious archive configurations communicating with external IPs. Organizations should immediately disable the IBE feature or restrict management interface access until patches become available.

TIKTOUK is a multi-component toolkit designed to collect credentials from WordPress sites. It consists of three components: a Python probing module that identifies WordPress installations and scans for exposed secrets, a Python collection module that extracts configuration files and database credentials, and a Go-based JavaScript crawler that harvests secrets from client-side code. The toolkit exploits exposed configuration files, decrypts email credentials from popular SMTP plugins using recovered encryption keys, and scans for cloud service credentials. All collected data is sent to a centralized HTTP controller. Real-world incidents revealed approximately 50,000 compromised server credentials across 37,000 domains, including hundreds of validated AWS keys with potential for service abuse.

A large-scale phishing operation has deployed 70 fraudulent websites impersonating legitimate cryptocurrency projects including xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, and Firelight. The fake sites closely replicate authentic platforms and lure visitors with offers to vote on rewards distribution dates in exchange for a 1.25x boost. Upon clicking the vote button, users encounter a wallet connection prompt that ultimately leads to malicious authorization requests designed to drain cryptocurrency tokens. The targeted projects were strategically selected based on recent token launches, airdrops, or active rewards programs, making the phishing attempts appear credible to community members. All malicious domains follow the pattern 'sitemu' followed by random characters on the .xyz domain, suggesting a coordinated campaign using shared infrastructure and phishing kits.

The China-nexus threat group Longlegs continues to deploy Warlock ransomware by exploiting Microsoft SharePoint vulnerabilities, particularly the ToolShell exploit chain. Over the past two months, the group targeted at least four organizations including water utilities, telecommunications providers, government bodies, and universities in Portuguese and Spanish-speaking countries across Europe, Africa, and Latin America. The attackers exploit SharePoint flaws for initial access, use DLL sideloading techniques, abuse vulnerable signed drivers like K7RKScan to disable security software, and leverage Visual Studio Code tunneling for covert remote access. They deploy ransomware at scale by staging payloads in domain SYSVOL shares for rapid network-wide distribution, successfully compromising over 40 hosts in some incidents.

In July 2026, China-aligned threat actor TA419 conducted credential phishing campaigns impersonating prominent economists and AI policymakers, targeting AI experts at US think tanks, universities, and legal organizations. The group sent benign conversation starter emails themed around AI policy topics, such as invitations to join an AI Policy Advisory Committee. Upon receiving responses, TA419 deployed multi-stage URL redirection chains leading to Adversary-in-the-Middle credential phishing pages using a customized Frameless Browser-in-the-Browser tool. Active since April 2025, TA419 consistently targets individuals at US and Japan-based think tanks, defense contractors, universities, and law firms. This activity likely supports Chinese intelligence objectives to monitor US AI policy and regulatory developments amid strategic competition involving AI technologies, model distillation concerns, and export controls between the US and China.

CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. LevelBlue's Threat Hunt Operations & Research (THOR) team identified active exploitation across multiple customer environments featuring malicious authentication events with attacker-controlled usernames containing pitboss and NSPPE strings. Observed activities included command-execution testing, payload retrieval using curl and wget, configuration collection and staging, reverse-shell deployment, persistence mechanisms, web-shell installation, and attempted exfiltration of NetScaler configuration data. Analysis revealed two second-stage payloads: main.py establishing reverse shells to command-and-control infrastructure, and update_c08937.pl creating privileged accounts, deploying PHP web shells, and attempting configuration exfiltration. Post-exploitation artifacts included creation of sec_monitor superuser accounts, modification of system binaries, deployment of .local_jou...

On August 31, 2026, threat actors exploited two zero-day vulnerabilities in PaperCut MF affecting a customer in the Education sector. The attackers targeted an internet-facing print server running vulnerable PaperCut MF version 24.0.2, deploying an in-memory Java loader that established a web shell. Through this web shell, they delivered a trojanized Microsoft Copilot binary containing an AdaptixC2 implant. The implant connected to command-and-control infrastructure hosted on Alibaba servers. After remaining dormant for approximately one day, attackers returned to perform reconnaissance and Active Directory enumeration. They then stole a token from a domain-privileged service account and moved laterally to a domain controller. On the compromised domain controller, they dumped credentials from memory and registry, enabled Windows Restricted Admin mode for pass-the-hash attacks, and extracted the NTDS.dit database containing password hashes for all domain accounts, achieving complete domain compromise.

A malicious cyber actor exploited a Citrix NetScaler Gateway zero-day vulnerability on September 24, 2026, three days before public disclosure. The attacker, using IP address 149.104.78.141, attempted exploitation that was detected through behavioral analysis despite no CVE-specific signatures existing at the time. The exploitation chain aimed to establish persistence through a password-protected webshell, attempting to set setuid and setgid bits on /bin/sh for root access. The attacker tried to configure the web server to execute a hidden PHP webshell disguised as a CSS file, using aliases to route requests. Though unsuccessful in compromising the targeted sensor, the post-exploitation playbook revealed sophisticated techniques for maintaining access and evading detection through web server manipulation.

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that Microsoft tracks as “RedFlick”. These changes represent a notable shift in the actor’s operational tradecraft and support ongoing cyberespionage activity targeting Ukrainian individuals and institutions as well as international non-government organizations (NGOs), Western think tanks, governments, and other organizations associated with international policy—particularly those with a nexus in supporting Ukraine.

In August 2026, a new loader designated 2CLoader was identified being used to distribute information stealers including Vidar and Remus, along with XWorm RAT. The loader implements extensive anti-analysis capabilities including anti-VM, anti-debug, and user activity checks. It employs sophisticated evasion techniques such as indirect system calls using Hell's Gate technique and inline trampoline hooks to bypass endpoint security detection. The loader stores its configuration and encrypted payload as a PE resource, using rolling XOR and AES-GCM encryption for payload protection. It supports multiple payload execution methods including RunPE, LoadPE, and CLR hosting for .NET assemblies. Network communication with command-and-control servers uses HTTP POST requests with JSON formatted messages encrypted via XOR. Multiple persistence mechanisms are available through registry keys, scheduled tasks, and startup folders.

Microsoft Threat Intelligence identified active exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite's SNMP notification path. Exploitation occurred between patch availability on July 20, 2026 and public disclosure on August 13, 2026. Attackers delivered JSP webshells and reverse shells without requiring authentication, achieving privilege escalation through PAM configuration abuse and establishing persistent access via systemd services. Post-exploitation activity included cluster-wide lateral movement using Zimbra SSH keys, collection of authentication secrets and mailbox data, and attempted exfiltration using cloud-storage tools. Multiple organizations across different regions and industries were affected through both automated payload delivery and hands-on-keyboard operations targeting internet-facing Zimbra mail servers.

A China-nexus threat cluster designated UAT-11587 has been targeting government and policy organizations across eight Asian countries since September 2025, delivering a previously undocumented Rust-compiled backdoor called Antino. The campaign primarily affected Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria through sophisticated spear-phishing operations using tailored political and diplomatic lures. The multi-stage infection chain leverages Cloudflare infrastructure for delivery and deploys Antino, which uniquely uses Microsoft 365 services—specifically Outlook and OneDrive—as dead-drop command-and-control channels rather than traditional C2 servers. The backdoor supports reconnaissance, command execution, file transfer, shellcode loading, and persistence establishment. Attribution to Chinese nexus is based on metadata containing Simplified Chinese artifacts, UTC+8 timestamps, use of China-focused Rust package mirrors, and targeting patterns consistent with Chinese intellige...

In July 2026, phishing campaigns targeted organizations across multiple industries by distributing a masqueraded MSP360 Remote Monitoring and Management installer through meeting invitations, PDF-themed lures, and software update prompts. Once executed, the legitimate MSP360 installer established remote management access on affected devices, providing threat actors with an initial foothold using trusted administrative software. The MSP360 deployment was then used to download and install a ConnectWise ScreenConnect client, creating a secondary remote-access channel for redundant access to compromised systems. Following access establishment, threat actors deployed additional tools and conducted post-compromise activity, including information collection and credential-access operations. The campaigns utilized multiple delivery mechanisms including actor-controlled domains, compromised websites, and legitimate cloud services such as Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.

Scammers have weaponized fake iPhone Duo preorder pages to deploy the DarkSword exploit chain against vulnerable iPhones. The fraudulent pages mimic Apple's design and offer a $500 voucher to lure victims, but simply opening the page in Safari triggers an exploitation attempt without requiring user interaction. The attack targets iPhones running unpatched iOS versions, attempting to bypass security protections and deploy a payload designed to steal saved credentials, cryptocurrency wallet data, notes, messages, contacts, and other sensitive information. The exploit leverages vulnerabilities previously disclosed by Google in March 2026 and patched by Apple. If successful, the payload establishes communication with command-and-control servers and can execute additional commands remotely while attempting to cover its tracks by deleting diagnostic reports.

ASEC identified a phishing campaign targeting organizations in Korea through emails impersonating company employees. The emails contain malicious XLS files disguised as project material purchase request forms. When opened, the documents exploit CVE-2017-0199, an OLE2Link vulnerability in Microsoft Office, to download HTA files from a C2 server. The HTA file executes an obfuscated PowerShell script that downloads a steganographic PNG file containing a Base64-encoded .NET loader. This loader subsequently deploys Remcos RAT, which performs keylogging, screen capture, file manipulation, and exfiltrates system information to command and control infrastructure. The attack chain demonstrates sophisticated social engineering combined with multiple layers of obfuscation and encoding techniques.

A cluster of 31 Russian-language Chrome extensions masquerading as VPN services for blocked platforms like RuTracker, YouTube, Telegram, Instagram, ChatGPT, and Netflix shares a single malicious codebase. Published from three linked Google accounts, these extensions collectively affect approximately 356,000 users, with the flagship RuTracker VPN extension holding 200,000 installations. The extensions request extensive proxy permissions and dynamically fetch proxy server configurations from remote sources including GitHub Pages, Blogspot, Google Docs, and Telegram channels after installation. This architecture allows operators to modify traffic routing without pushing updates. The configuration uses obfuscated server lists with shared credentials and offers a paid VIP tier for 299 roubles. Some proxy hostnames match those used by Browsec VPN premium servers, suggesting a potential operational connection.

Threat actors are exploiting ChatGPT Custom GPTs and Google Sites to deliver remote access trojans through a sophisticated multi-stage attack chain. The campaign uses sponsored Google search results to direct victims to attacker-created Custom GPTs that impersonate legitimate ChatGPT models. Victims are then redirected to a malicious Google Sites page presenting a fake CloudFlare CAPTCHA that deploys a ClickFix lure, tricking users into executing PowerShell commands. This initiates an eight-stage infection chain involving obfuscated scripts, malicious MSI installers, and DLL sideloading through legitimately signed Canon or Stardock executables. The payload establishes dual persistence mechanisms and deploys a full-featured RAT with capabilities including remote desktop access, credential harvesting from seventeen browsers, file management, and payload deployment. Huntress investigators responded to at least 40 related incidents with two confirmed Custom GPT-driven infections.

RATHat is an Android banking trojan characterized by its unique architecture where the malicious application serves merely as an entry point. After obtaining Accessibility Service permissions, it enables wireless debugging, pairs with the device's ADB daemon, and deploys a native Go service that operates outside Android's permission model. The operation's primary investment lies in its infrastructure, with three successive Command-and-Control panel generations emerging between April and September 2026: BlackCat, followed by Panda Workshop V5 and V6. These panels function as complete malware factories, building, signing, and publishing samples automatically while implementing scheduled rebuilds to evade hash-based detection. Nearly 100 separate deployments across Europe, LATAM, and South-Eastern Asia suggest a Malware-as-a-Service model. Notably, the operation integrates AI on both sides: the malware uses Gemini models to locate on-screen controls when automation fails, while the panel employs LLMs to estim...

NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.

Following the launch of TypeSafe AI's Jev API, numerous fraudulent storefronts emerged selling access to the legitimate API at inflated prices ranging from 3 to 11.5 times the official cost. Within three days of launch, lookalike domains were registered and ranked higher than the official site in search results. At least six sites operated identical code, with operators quickly reskinning platforms for trending AI models. Certificate transparency logs revealed approximately 670 new domains containing "jev" registered within eight days of launch. These storefronts route customer prompts through third-party servers before reaching TypeSafe's API, creating security and privacy risks. While not illegal, these operations exploit brand confusion and charge excessive markups for direct API access.

A sophisticated cybercrime operation compromised enterprise networks across multiple countries by exploiting a GlobalProtect authentication bypass vulnerability (CVE-2026-0257), executed advanced web application attacks, and deployed the AdaptixC2 framework. The operation scanned 277.5 million addresses to curate 81 high-value targets, stole databases from 9+ instances via SQL injection with xp_cmdshell escalation, and exfiltrated Active Directory credentials. Monetization occurred through dual strategies: initially selling corporate and energy sector databases on underground forums under the persona "masterblack", then weaponizing the same data to power a multi-tenant automated invoice fraud platform generating 2.4 million phishing messages and 622,666 personalized fraudulent links. The infrastructure utilized domainless phishing tactics including M365 OAuth device-code phishing and voice-based credential harvesting, collecting payments via PIX through serverless proxies. The operation was exposed in mid-...

A Python-based Malware-as-a-Service builder enables operators to generate customized Windows infostealer executables. The system comprises a builder component and an embedded payload, using Nuitka or PyInstaller compilation to evade detection. The builder features automatic dependency installation, webhook configuration with XOR and Base64 encoding, and multiple compilation backends. The payload targets Chromium and Firefox browsers, extracting credentials, cookies, and credit card data. It harvests Wi-Fi passwords, Discord tokens, and Roblox session cookies while employing anti-analysis techniques including debugger detection, VM process blacklisting, disk size checks, and timing evasion. Persistence is established through registry Run keys and scheduled tasks. All stolen data is packaged into in-memory ZIP archives and exfiltrated via attacker-controlled webhooks, following a scalable affiliate model.

Multiple attack campaigns exploiting CVE-2019-18935, a remote code execution vulnerability in unpatched Telerik UI for ASP.NET AJAX servers, have been identified. The first case involved exploiting the vulnerability to execute a reverse shell connecting to 206.82.6.22, attempting privilege escalation using Potato-family tools like SweetPotato, and installing a Godzilla-style memory-based web shell that operates within the w3wp.exe process without requiring separate ASPX files. The second case deployed a Rust-based scanner tool that searches for exposed WordPress installation pages across target systems and reports findings via Telegram. Both attacks targeted Windows IIS servers, enabling attackers to maintain persistent access, collect system information, and identify additional targets for future campaigns.

A sophisticated four-stage attack chain delivers the Lunex information stealer to Ukrainian-speaking users through fake CAPTCHA pages. The malware employs Bring Your Own Vulnerable Driver (BYOVD) techniques using AMD's PDFWKRNL.sys to disable kernel-level security monitoring before deploying the final payload. The stealer targets seven Chromium-based browsers, extracts credentials using custom SQLite parsers, exfiltrates cryptocurrency wallets, and establishes persistent access through PowerShell-based Chrome Native Messaging Hosts that survive binary deletion. The Lunex platform operates 28 command-and-control panels across 13 countries, features Russian-language operator interfaces, and demonstrates advanced engineering including PDB-guided kernel callback zeroing, custom encryption implementations, and direct syscall invocation. The financially-motivated threat actor originates from the CIS region and operates a Malware-as-a-Service platform serving multiple independent criminal operators.

An investigation reveals that placeholder domains commonly used in documentation are serving malicious content through advertising chains. Two domains, yoursite[.]com and your-domain[.]com, present in hundreds of thousands of GitHub files and agent skills, use cloaking techniques to display scams specifically to macOS visitors while showing legitimate parking pages to others. The scams include fake MacOS Security Center warnings and counterfeit news articles promoting investment schemes. These attacks leverage affiliate fraud models, funneling victims through multiple redirectors to genuine services like McAfee subscriptions to earn commissions. Static security checks fail to detect these threats because malicious redirects occur after JavaScript execution. This follows an earlier disclosure about third-party[.]com serving ClickFix lures. The widespread citation of unregistered placeholder domains in documentation creates significant exposure, particularly for AI agents that fetch and act on this content.

An undocumented remote-access Trojan named Kothamine Agent has been discovered with support for over 30 commands, enabling attackers to control infected Windows systems through command execution, file manipulation, and capability extension. Some variants include browser data theft and camera/microphone recording functionality. The malware has been distributed through malicious npm packages and utilizes tailcat, an open-source Tailscale tool, to establish encrypted command-and-control communications that evade conventional network inspection and blocking. Earlier versions employed Tailscale VPN before transitioning to tailcat. Active since July based on VirusTotal and GitHub evidence, Kothamine features a plugin system for loading additional DLLs, UAC bypass capabilities in certain builds, and employs AES-GCM encryption for C2 communications. The malware achieves persistence through scheduled tasks and adds Windows Defender exclusions during installation.

UNC6240, also known as ShinyHunters, has resumed mass exploitation of CVE-2026-35273 targeting Oracle PeopleSoft systems globally across multiple sectors including education, technology, healthcare, agriculture, transportation, and government. The threat actor bypassed web application firewall rules by URL-encoding a single character in the request path, accessing the vulnerable Environment Management Hub endpoint on systems where operators believed WAF rules had mitigated exposure. Following initial exploitation, UNC6240 deployed multiple web shells including x.jsp and u.jsp, a trojanized backdoor called SIDEEYE delivered via Ple64.exe, Neo-reGeorg tunneling tools, and MeshAgent for persistent access. The actor conducted reconnaissance, credential theft, and prepared for data exfiltration with established patterns indicating potential extortion activities.

Between July and August 2026, a sophisticated campaign targeted organizations across East and Southeast Asia using Japanese and Korean-language phishing emails disguised as product damage complaints. Recipients were directed to fake document-sharing websites that delivered ZIP files containing malware. The archives contained executables with double extensions and DLLs implementing various loader techniques including customized Donut loaders, Python interpreters, AMSI/ETW bypasses, process hollowing, and BYOVD attacks using vulnerable Lenovo drivers. Despite varying loader implementations, the final payloads consistently delivered PureRAT or PureLogs malware families. The campaign demonstrated advanced evasion techniques by frequently changing loader structures while maintaining the same core payloads, effectively bypassing hash-based detection methods. Infrastructure analysis revealed common sending patterns through PHP Swift Mailer and shared Feedback-ID values across campaigns.

Arctic Wolf Labs is tracking an ongoing campaign that compromises legitimate Ukrainian business websites and uses injected iframes to display a Ukrainian-language fake Cloudflare verification page. When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the Windows Run dialog. The command retrieves an MSI package that ultimately delivers a previously unidentified infostealer containing the embedded tag “Psychedelic.”

SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands. These include collecting sensitive data from the victim’s device, capturing screens, remotely managing processes and files, controlling bots, and other forms of remote device management.

Australian security firm Elttam discovered a critical pre-authentication remote code execution vulnerability in TACACS+, a 33-year-old protocol handling authentication on networking equipment. The protocol, released by Cisco in 1993 and now baked into almost all modern networking devices, is widely used at large enterprises, ISPs, data centers, and cloud providers. Attackers can exploit the vulnerability over the internet or local networks with only two packets, leveraging weak encryption. The bug affects both major versions of the protocol, maintained by Shrubbery Networks and a Facebook fork. Patches are available for the Shrubbery version, though no CVE has been assigned. Chinese cyber-espionage groups Salt Typhoon and Fire Ant have exploited TACACS+ in operations targeting telecommunications companies worldwide over the past two years, using it for persistence and lateral movement.

A social engineering campaign targeting security professionals uses fake consultancy offers and job opportunities to exploit trust. Attackers create sparse social media profiles claiming to be consultants, offering $300 for simple consultations on topics like digital transformation. The initial phone call serves as screening to identify targets with valuable access or knowledge. If successful, targets are asked to provide increasingly sensitive information through written reports, requiring them to abuse trusted access, probe internal systems, or leverage professional relationships. Similar variants include fake recruiters offering prestigious positions while requiring installation of trojanised software. These attacks exploit professional flattery and overconfidence, manipulating security practitioners into compromising their most valuable asset: professional integrity and trusted relationships within the industry.

Two previously undocumented .NET malware components were delivered through a ClickFix infection chain. RemotePanel establishes persistent remote access by masquerading as the Windows Time service, providing operators with PowerShell control, file and process management, screen access, modular HVNC, and fleet management capabilities. It uses a BNB Smart Chain contract to dynamically resolve its active Command and Control server, enabling infrastructure rotation without rebuilding the RAT. BoundSiphon runs primarily from memory, targeting browser credentials and sessions, cryptocurrency wallets, password manager data, and documents, including secrets protected by Chromium App-Bound Encryption. Strong code overlap exists between BoundSiphon and a stealer previously documented by Socket, linking the sample to an earlier stealer codebase. The modular design separates persistent access from data theft, allowing operators to replace infrastructure and individual components while maintaining operational capabilities.

A threat actor exploited a Samsung MagicINFO vulnerability (CVE-2025-4632) to gain initial access to victim endpoints. After three attempts, they successfully deployed a rogue AnyDesk instance using various download methods including certutil and PowerShell. The actor created a new local administrator account named 'oldadministrator' and disabled Microsoft Defender protections. Uniquely, instead of dropping a pre-compiled cryptominer, the threat actor compiled one directly on the compromised endpoint using Silent XMR Miner Builder.exe, executing multiple .NET Framework utilities and C compilers including donut.exe, tcc.exe, and MinGW64 tools. The resulting Monero cryptominer connected to the C3Pool mining service and ran under explorer.exe with suspicious command-line arguments. This compilation approach generated significant EDR telemetry, making the activity ironically conspicuous despite using tools associated with silent deployment.

The domain third-party[.]com, historically used as a documentation placeholder similar to example.com, has been compromised and now serves ClickFix lures to Windows users while displaying harmless content to other operating systems. Since at least June 2026, Windows visitors receive a fake Cloudflare verification page that poisons the clipboard with a malicious PowerShell command, instructing users to press Win+R and paste the payload. The domain appears in over 1,500 files across 1,700+ repositories from trusted sources including Chromium, Sanity, and Vercel. Unlike example.com, third-party[.]com is not IANA-reserved, allowing adversaries to register and weaponize it. The attack leverages social engineering to bypass security tools by using signed Windows binaries, making detection difficult through traditional scanning methods.

Threat actors are recompiling open source software, specifically the 7zip self-extracting archive stub, to embed a reflective loader that evades detection. The malicious code is inserted into the ExtractArchive function of the 7zip SFX module, making it difficult for analysts to identify since they typically focus on configuration files and embedded executables rather than the decompression stub itself. Samples are validly signed by Animated Productions, LLC and contain legitimate installers like foobar2000. The loader beacons to C2 servers, downloads DLLs, and reflectively loads encrypted payloads. Variants also abuse other open source libraries like the NSIS plugin EmbedHtml. Files feature bloated certificates and suspicious characteristics including installers wrapped within installers, requiring persistent analysis to uncover the hidden malicious functionality.

RemControl is an Android banking trojan first observed in July 2026 that targets financial institutions across Western Europe, the Middle East, and Canada. The malware is distributed through fake Google Play Store pages advertising TVTap, an IPTV application, using malvertising campaigns with geo-targeted delivery. Once installed, the dropper creates a local VPN to block Play Protect checks and generates unique signing certificates per installation. RemControl exploits Android Accessibility Service permissions to display phishing overlays for over 30 banking applications, capturing PINs, mobile banking codes, and card details. The malware includes remote control capabilities, screen streaming, keylogging, and lock-screen pattern capture. It operates as Malware-as-a-Service with infrastructure showing evidence of AI-assisted development in phishing page creation and documentation.

A sophisticated PowerShell-based backdoor named TASK#STOMP has been discovered that specifically targets business documents while maintaining persistent remote access to compromised systems. The infection begins with VBScript execution, establishing persistence through scheduled tasks and startup folder entries. The malware deploys two primary PowerShell payloads that scan fixed drives for Word, PDF, PowerPoint, Excel, and archive files modified within the past year, excluding files larger than 500MB. It employs filesystem watchers for continuous collection of new documents. Additional capabilities include screenshot capture, Wi-Fi password theft, clipboard monitoring, and arbitrary command execution. The backdoor communicates with two command-and-control domains and uses compiled C helpers to bypass TLS certificate validation, enabling connections to servers with invalid certificates.

North Korea-linked threat actors are conducting Operation Conflict Compass, targeting individuals and organizations focused on Ukraine using spear-phishing emails with malicious ZIP attachments. These contain LNK files disguised as PDFs with themes related to Russia-Ukraine peace plans, Ukrainian research, and geopolitical issues. When executed, the shortcuts retrieve malicious files from GitHub, deploying VBScript to establish persistence via scheduled tasks and delivering VelvetCake, a lightweight PowerShell-based task runner. VelvetCake contacts command-and-control infrastructure to download and execute additional scripts that perform reconnaissance, collect system information, enumerate security software, and capture screenshots. The campaign also utilized trojanized Zoom installers and leveraged infrastructure in South Korea and Ukraine, with activity observed since early August 2026 targeting diplomatic entities, think tanks, and NGOs.

Galago is a newly identified ransomware operation that emerged in September 2026, claiming operational partnership with the Panzer ransomware group. The connection is suggested through shared infrastructure, specifically matching prefixes in their Tor leak-site addresses (pnzr4del for Galago and pnzruro for Panzer). Galago was first detected following an alleged attack on an Icelandic healthcare organization on 9 September 2026, though this claim remains unverified as their dark leak site showed no published victims. Panzer, described as a ransomware-as-a-service operation, has published 32 victims between August and September 2026 and employs double extortion tactics. While the naming pattern and self-reported claims suggest a relationship, no independent evidence confirms shared operators, malware, or infrastructure control between the two groups.

A detailed technical analysis examines the evolution of MacSync, a macOS stealer-as-a-service initially known as Mac.c, which targets cryptocurrency enthusiasts and developers. The malware has undergone significant changes, replacing AppleScript-based droppers with binary executable files written in Objective-C and Swift. The infection chain utilizes malicious DMG images and employs iCloud infrastructure for payload delivery. MacSync collects extensive data including browser credentials, cryptocurrency wallets, Telegram data, SSH configurations, and keychain files. The stealer incorporates novel techniques like PAM API for password verification and features a backdoor module for persistent access. Distribution occurs through social engineering, fake applications, and cracked software disguised as legitimate crypto wallets like the nonexistent Toria wallet, promoted through dedicated websites and social media channels.

ThreatDown researchers discovered CARBONATO, a Docker botnet that exploits exposed Docker daemons on port 2375. The operation was uncovered through an unauthenticated Docker registry exposed since May 2026, revealing two parallel activities: distribution of trojanized cryptocurrency wallet applications and a botnet infrastructure. The botnet leverages Hermes Agent, an MIT-licensed open-source AI framework, modified with a custom prompt directing it to execute commands via Telegram, maintain persistence, and harvest credentials. The campaign infrastructure spans multiple hosting providers including Linode, Hetzner, and Contabo, with activity documented from October 2024 through August 2026.

A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is.

AvisLoader is a newly discovered Windows malware loader that uses the Tox encrypted peer-to-peer messaging network for command-and-control communications, making traditional domain-based takedowns ineffective. The infection begins with a ClickFix social engineering technique, where victims are tricked into copying and executing malicious commands disguised as document verification steps. The loader is delivered through Cloudflare infrastructure and includes various stealth capabilities such as shortcut modification for persistence, UAC bypass attempts via UACME method 41, and process-hiding functionality through API hooking. Operators manage infected systems through a web-based Command Center that enables client management, task configuration, and payload distribution over the Tox network. The malware's architecture allows operators to maintain control by simply copying their Tox save file when relocating infrastructure, with clients automatically following without requiring domain updates.

VeloCloud Orchestrator (VCO) on-premises deployments contain a critical vulnerability allowing remote attackers to access privileged internal functionality and compromise the VCO host. The flaw, tracked as CVE-2026-93952 with a CVSS score of 10.0, enables attackers with network access to the VCO web interface and access to the public portion of VeloCloud Edge authentication certificates to exploit the system. This vulnerability is actively being exploited in the wild and affects VCO versions 5.2.3.15 and below, 6.1.3.7 and below, 6.4.2.7 and below, and 7.0.0.2 and below. Successful exploitation compromises confidentiality, integrity, and availability of the orchestrator and managed data. Hosted VCO versions were already patched. Specific indicators of compromise include malicious files, suspicious HTTP headers, and connections from known malicious IP addresses.

Group-IB researchers discovered RemControl, a previously undocumented Android banking trojan operating as Malware-as-a-Service since May 2026. The malware targets over 30 financial institutions across Western Europe, the Middle East, and Canada through fake TVTap IPTV download pages distributed via malvertising. RemControl abuses Android Accessibility Service to inject phishing overlays, stream device screens in real-time, log keystrokes, and provide full remote control. The investigation revealed that the criminal infrastructure was inadvertently built using AI assistance, with complete AI-generated responses found verbatim in production phishing pages. The C2 panel documentation describes credential theft as quiz completion, suggesting developers deceived AI assistants into building fraud infrastructure under false pretenses. The threat actor UNKK operates the campaigns, with possible links to the Medusa UNKN affiliate botnet based on overlapping infrastructure patterns and naming conventions.

In early September 2026, Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows through sophisticated phishing campaigns. The actor registered fake domains impersonating legitimate organizations including China Digital Times and the Center for American Progress, sending targeted phishing emails to Asian government entities. Victims were directed to spoofed websites hosting an exploit chain leveraging CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attacks delivered CLEANGULP, a previously undocumented malware family with backdoor capabilities including command execution, file operations, and beacon object file execution. The malware communicated with command-and-control infrastructure via encrypted HTTP traffic using custom encoding. Multiple Chinese APT groups demonstrated coordinated access to this exploit kit, suggesting widespread sharing within the Chinese cyber espionage community during the vulnerability window.

Over five months, four distinct malicious chains operated through the same bulletproof hosting provider, AS202412 registered to OMEGATECH LTD in Seychelles. All chains began with fake CAPTCHA pages (ClickFix technique) that instructed victims to paste commands into Windows Run dialogs. The campaigns used disposable domains with similar naming patterns, compromised legitimate websites, and varied infrastructure including cloud storage, blockchain-resolved C2 addresses, and trojanized installers. Despite different payloads and staging methods, every chain initiated contact through AS202412. The provider expanded from initial allocations to announcing twenty-four /24 prefixes during the observation period. Most browser contacts ended at the lure page without execution, but successful compromises deployed stealers and remote access tools with persistence mechanisms surviving system reboots.

DarkMe, a Visual Basic 6 spy-RAT previously linked to financially-motivated APT group Water Hydra, was observed in two separate incidents affecting organizations in August 2026. Previously notable for weaponizing zero-day exploits including CVE-2023-38831 and CVE-2024-21412, this campaign abandoned sophisticated exploits in favor of basic social engineering tactics. Victims received phishing emails containing links disguised as images that delivered PIF executables. The attack chain utilized MSI installers, VB6 loaders, COM objects, and process hollowing into legitimate signed Microsoft binaries. Novel tradecraft includes using PIF files as initial payloads and implementing custom protocol handlers for persistence. The malware targets cryptocurrency wallets, password managers, trading platforms, and gaming applications, employing an inverted sandbox check against 329 applications to identify genuine user environments rather than analysis systems. This shift from targeted, exploit-driven operations to high-...

A third variant of PamStealer has been identified, distributed through a fake Wavel cryptocurrency wallet application. The malware employs a sophisticated server-side decryption chain using a purpose-built utility called pkgunpack that performs live ECIES key exchange with command-and-control infrastructure, making offline payload decryption impossible. The second stage has been rewritten from Rust to Swift while maintaining PAM-based credential validation. The infostealer targets seventeen browsers including Arc, Zen, Waterfox, and LibreWolf, extracts keychain credentials, collects system fingerprints, and harvests user files including shell history and account photos via Open Directory. Persistence is maintained through four redundant repair mechanisms including LaunchAgent installation, shell hooks, Git hooks, and a local backup tarball, with notification suppression achieved by killing background task management processes.

This analysis covers infostealer distribution trends during August 2026, focusing on distribution channels, detection rates, and disguise techniques. Primary infostealers identified include Remus, Vidar, LummaC2, and ACRStealer, distributed through crack software disguises, SEO poisoning, and file-hosting platforms like Mega and Mediafire. Malware disguised itself as legitimate companies, with Microsoft Corporation being the most frequently impersonated. Distribution methods included DLL side-loading using python37.dll and python36.dll, and exploitation of Renpy game development tool. Email campaigns delivered Formbook disguised as Turkish bank statements and AgentTesla as business quote requests from Indian companies. EXE files constituted 97.3% of execution types. The stolen information poses risks for dark web trading and secondary attacks, emphasizing the need for cautious handling of untrusted links, avoiding illegal software, enabling two-factor authentication, and maintaining updated security soluti...

A suspected Chinese-speaking threat actor, operating from UTC+8 timezone and linked to Red Heron, conducted extensive exploitation campaigns from May through September 2026. The adversary maintained persistent use of a single IP address to target multiple technologies including WordPress, ZyXEL switches, and various enterprise platforms. In the most severe incident, the attacker exploited WordPress vulnerabilities CVE-2026-63030 and CVE-2026-60137 to breach a western government organization, stealing over 18,000 sensitive records containing credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The attacker demonstrated sophisticated capabilities including custom tool development possibly leveraging large language models, privilege escalation attempts, and systematic data exfiltration using PowerShell-based collection and staging techniques.

CLOSEDQUORUM is a Windows malware binary representing the first documented implant utilizing autonomous AI-driven command and control. Discovered through Cisco Talos' CAIRN project, it delegates tactical decisions to a panel of commercial large language models including DeepSeek, Qwen, Mistral, and Google Gemini. The system operates through plurality voting among AI models to select actions for credential harvesting and crypto wallet theft, eliminating the need for continuous human operator involvement. The 16.4MB Go-compiled executable employs structured JSON schema to constrain LLM responses to executable attack choices. While containing placeholder credentials in public distribution, development builds demonstrate compile-time injection of operator-specific API keys and Discord webhooks. This architecture represents a significant shift toward effort displacement in cyber operations, where entire attack phases execute autonomously without human bottlenecks, though introducing new dependencies on commerci...

A sophisticated six-month campaign targeting quantitative and DeFi developers through malicious npm packages disguised as legitimate mathematics libraries. The operation employs encrypted loaders that trigger only when specific cryptographic operations are performed, specifically when solving linear equations with predetermined matrices. Command and control infrastructure uses Ethereum Sepolia testnet smart contracts as dead drops, alongside a secondary Slack channel, enabling encrypted tasking of compromised systems. The threat actors manufactured millions of fake downloads using GitHub Actions workers to establish false credibility. Fourteen smart contracts were deployed across five operator wallets, managing over 1,000 encrypted taskings to enrolled victims. The campaign demonstrates advanced operational security with disposable accounts, encrypted payloads sealed under ephemeral keys, and infection markers hidden in license files.

This document analyzes multiple cybersecurity incidents involving various threat actors and malicious campaigns. The analysis covers sophisticated attack methodologies including exploitation of vulnerabilities, deployment of specialized malware tools, and targeting of critical infrastructure across multiple sectors. The campaigns demonstrate advanced persistent threat capabilities with focus on data exfiltration, system compromise, and lateral movement within targeted networks. Key observations include the use of social engineering tactics, exploitation of remote access vulnerabilities, and deployment of custom malware frameworks. The threat landscape encompasses government, technology, financial, and defense sectors with significant emphasis on supply chain attacks and credential harvesting operations.

Vidar is an information stealer first observed in 2018 that has continuously evolved its string obfuscation techniques to evade detection and analysis. Between May and September 2026, the malware progressed from basic XOR encryption to ChaCha20-based algorithms, and most recently implemented a custom virtual machine executed via a lightweight bytecode interpreter combined with custom stream ciphers that change per build. The VM uses 14 opcode handlers with simple primitives including XOR, addition, rotation, and substitution. Version 2.0 introduced this VM approach, while versions 2.2 and later added ARX-based custom stream ciphers using FNV-1a hashing and golden ratio constants. These per-build variations in opcodes, constants, and substitution tables significantly hinder static and automated analysis capabilities.

A deep technical analysis reveals updates to Hangro, North Korea's state VPN and mail product, operating on servers in Pyongyang and the Russian Far East. A new certificate hierarchy deployed in July 2026 differs significantly from the 2024 version, with both containing cryptographic anomalies where signatures fail verification. Investigation uncovered six network assignments in Chinese address space linked to a single registry contact associated with Silibank, plus infrastructure in Russian Far East networks designated KPOST. The service evolved from a commercial email gateway in 2001 to a certificate-bound VPN deployment issued to trade representatives through consulates. Technical evidence indicates structured infrastructure spanning North Korean, Russian, and Chinese address space, with mail systems configured for bulk transfers over intermittent connections using ten gigabyte message limits and ETRN capabilities.

In late August, an organization was compromised by INC ransomware across at least 175 endpoints. The attack timeline spanned from early to late August with a 17-day gap, suggesting involvement of an initial access broker and a separate ransomware affiliate. Early August activity included scheduled tasks with randomized names and lateral movement via RDP using a compromised account. After the lull, attackers deployed AnyDesk for remote access, used Bring Your Own Vulnerable Driver tactics to disable security controls, and executed ransomware via Impacket tools. Uniquely, two ransom notes were discovered: the standard INC-README.txt and a subsequent DATALEAK_PRESS_RELEASE.txt containing detailed stolen file listings, threatening to contact media, employees, and partners within 48 hours to increase pressure on victims.

A sophisticated multi-stage infection chain was discovered through analysis of a system exhibiting frequent PowerShell execution alerts. The attack leveraged multiple layers of obfuscation and concealment techniques, including Registry-based payload storage, DNS TXT record exploitation, and data hidden within image and WAV audio files. The threat actors employed various evasion methods such as security control tampering and in-memory execution to avoid detection. Rather than writing payloads directly to disk, attackers reconstructed malicious code from distributed sources including Registry entries and steganographically encoded data in media files. The ultimate objective of this elaborate infection chain was to deploy cryptocurrency mining operations covertly on compromised systems while maintaining persistent access through multiple redundant mechanisms.

In April 2026, a manufacturing organization in the Middle East suffered a ransomware attack where threat actors with domain admin privileges weaponized Active Directory Group Policy Objects to achieve domain-wide impact without deploying ransomware binaries on Windows endpoints. The attackers created malicious GPOs linked at the domain root, delivering ransom notes, hijacking wallpapers and lock screens, enforcing logon banners, and disabling local administrator accounts across all domain-joined workstations. No file encryption occurred on Windows systems; instead, the operation focused on encryptionless extortion through operational disruption and data exfiltration. Initial access was gained via compromised VPN credentials. The attack remained dormant for one day between GPO creation and detonation, evading file-based detection entirely by abusing trusted AD infrastructure.

In 2026, the DPRK-sponsored Lazarus subgroup TraderTraitor continued campaigns targeting cryptocurrency entities, including a high-profile attack on LayerZero resulting in $292 million theft from KelpDAO. Following this disclosure, an additional victim was identified: a smaller IT services provider in India with no cryptocurrency connections. The compromise involved a DevOps engineer targeted through fake job interview lures containing weaponized Terraform coding projects. Malicious GitHub repositories used typosquatted provider domains to deliver macOS backdoors FLATROOF and ROOFDECK when victims executed terraform init. The backdoors enabled reconnaissance, credential theft, and cloud environment escalation. One day after LayerZero's public disclosure, attackers deployed an updated stripped version of ROOFDECK and removed earlier implants. Activity continued until June 2026, suggesting the threat actor ultimately abandoned the intrusion after determining insufficient value from the smaller target.

Blackpoint's Adversary Pursuit Group identified ChainScript, a previously unnamed Node.js remote access trojan discovered during ClickFix investigation. The malware disguises itself as legitimate software including Spotify, Zoom Workplace, and Microsoft Teams through malicious Windows Installer packages. ChainScript employs an EtherHiding-style C2 discovery technique utilizing a Polygon smart contract to dynamically locate active WebSocket infrastructure, enabling operators to rotate backend services without rebuilding agents. The RAT provides comprehensive remote access capabilities including interactive shell sessions, file operations, screenshots, payload deployment, cryptocurrency wallet discovery, remote JavaScript execution, self-update mechanisms, and cleanup functions. Multiple builds appeared under different names (ComponentTask33, UpdateDigital, HostShared, OrchidViolet66) while maintaining consistent core agent architecture. Analysis revealed automated contract deployment integrated into the mal...

ESET researchers uncovered a Lazarus attack against a Spanish aerospace company where attackers masqueraded as Meta recruiters on LinkedIn, sending trojanized coding challenges to employees. The campaign deployed multiple tools including LightlessCan, a previously undocumented backdoor that mimics native Windows commands to evade detection. Initial access was achieved through spearphishing via LinkedIn Messaging, delivering malicious executables disguised as C++ programming tests. The attack chain involved DLL side-loading techniques delivering payloads including NickelLoader downloader, miniBlindingCan variant, and the sophisticated LightlessCan RAT supporting 68 commands. LightlessCan represents a significant advancement over its predecessor BlindingCan, implementing execution guardrails and enhanced stealth capabilities. The campaign targeted aerospace technology and know-how for cyberespionage purposes, consistent with North Korean strategic objectives in missile development.

A new JavaScript infostealer dubbed WeaselBiscuit has been discovered hidden in 11 malicious npm packages. This lean malware shares operational similarities with DPRK-linked BeaverTail and OtterCookie families but features a stripped-down architecture. WeaselBiscuit deploys through npm imports, executes a detached Node process, retrieves its payload from Npoint URLs, and communicates with a C2 server at 103.170.217.184:8787. The malware profiles infected hosts, steals Chrome extension storage containing wallet signing states, captures clipboard contents, and logs Windows keystrokes when commanded. Unlike its predecessors, it lacks wallet-draining code, browser password decryption, Python second stages, screenshots, and remote shell capabilities. The operation uses numeric campaign identifiers embedded in package names for tracking. While technical overlap suggests DPRK attribution, particularly through Npoint dead-drop patterns and nested IP geolocation lookups, definitive attribution requires additional c...

Fraudulent organizations in Korea are exploiting private Home Trading System (HTS) software to distribute ransomware to victims. The unauthorized HTS program called 'UBP Asset' impersonates the legitimate Swiss financial institution Union Bancaire Privee (UBP) and has been used in investment scams since at least September 2025. Attackers lure victims through social media platforms like Telegram and KakaoTalk, convincing them to install the fraudulent HTS and deposit funds. The latest campaign involves distributing KRSID ransomware through the HTS update mechanism, which encrypts files using AES-256 and RSA-2048 algorithms. Previous campaigns used similar private HTS programs to distribute Quasar RAT. Victims not only lose their investment funds but also have their systems compromised and files encrypted for ransom demands.

A sophisticated malware campaign active since November 2025 exploits blockchain technology to maintain persistent command-and-control infrastructure. Attackers store C2 addresses in Polygon blockchain smart contracts rather than hardcoding them, enabling rapid infrastructure rotation for pennies. The operation compromised at least 31 legitimate websites across multiple countries, deploying FakeCaptcha lures through compromised sites accessed via Bing or Google searches. When victims follow the lure, malware establishes persistence through scheduled tasks and registry keys, queries Polygon smart contracts for current C2 domains, and deploys versatile payloads including banking trojans targeting 479 financial and cryptocurrency domains. Investigators identified 15 smart contracts across six operational waves, three active C2 domains, and two operator wallets controlling the infrastructure. The campaign demonstrates significant operational security with multiple fallback mechanisms, though investigators succe...

LabubaRAT is a custom, unsigned 64-bit Rust-based remote access trojan identified by Blackpoint, designed to masquerade as legitimate NVIDIA software. It provides comprehensive remote access capabilities including command execution, file operations, screen capture, and SOCKS5 proxying. The malware features configurable enrollment fields and an internal ZM_ configuration namespace, suggesting it is built on a reusable, multi-tenant framework consistent with a malware-as-a-service offering. LabubaRAT is managed through an associated backend infrastructure called LabubaPanel, hosted on German providers. The delivery mechanism utilized the RAT's own JavaScript execution capability. First observed in July 2026, it targets Windows platforms and employs various evasion techniques including masquerading as NVIDIA components and abusing legitimate Microsoft build utilities.

PolinRider operators compromised a GitHub account to insert malicious code into development versions of visanduma/nova-two-factor, a Packagist package with over 700,000 downloads. The campaign spreads through compromised developer accounts and Git repositories across multiple ecosystems including npm, PyPI, Go modules, Packagist, and Chrome extensions. The operators use Git history rewriting, payload concealment in configuration files and font files, automatic execution through IDE tasks, and staged payload delivery via dead-drop mechanisms like EtherHiding and NullReceiver. Primary infection occurs through Git-based collaboration rather than direct package registry compromise, with PHP projects targeted using obfuscated JavaScript executed through shell_exec. The campaign appears linked to North Korean operators focused on cryptocurrency theft.

An Israeli influence-for-hire company called BlackCore has been identified conducting digital manipulation campaigns across multiple countries. The company operates through a sophisticated infrastructure offering services including discourse dominance, organic engagement manipulation, and counter-operations. Researchers identified a specific campaign involving a 14-week training program delivered to Angolan government employees in early 2026, which included the creation and deployment of fake social media personas and coordinated inauthentic behavior. The operation utilized AI-generated profile pictures, fake news outlets like 'Agita News', and coordinated amplification tactics across Facebook, Instagram, and TikTok. BlackCore's promotional materials openly advertised their capabilities to conduct deceptive influence operations on behalf of government clients, demonstrating how influence-for-hire services have become accessible to state actors seeking to manipulate online discourse.

Analysis reveals HEAVYGRAM, a multi-stage Windows backdoor attributed to Iran-linked threat actor Handala Hack, deployed since Fall 2023 targeting Iranian dissidents, journalists, and government opponents. The surveillance tool uses Telegram bot API for command-and-control operations, enabling remote command execution, screen capture, data exfiltration, and persistent access. Victims receive social-engineered files masquerading as legitimate applications like Telegram, KeePass, or Pictory. The implant supports DLL side-loading, registry persistence, and system reconnaissance. Infrastructure analysis identified 29 samples utilizing networks of Telegram bots and groups for operations. The malware aligns with activity disclosed by U.S. Department of Justice regarding Iran's Ministry of Intelligence and Security infrastructure seizures, with tradecraft including Vultr Object Storage and Persian-language decoys targeting specific victim profiles including academics and media personnel.

A significant supply chain attack compromised Brevo's infrastructure on September 14, 2026, affecting over 100,000 customer websites. Attackers injected malicious code into Brevo's JavaScript assets and widgets, delivering two distinct payloads: a WordPress plugin backdoor automatically installed when site administrators visited their own sites while logged in, and ClickFix overlays targeting regular visitors. The attack vector involved modification of Brevo's CDN-hosted files and creation of malicious subdomains under sendibt1.com. Evidence suggests attackers gained access to Brevo's Cloudflare account, allowing them to modify DNS records and rewrite content dynamically. The malicious activity lasted approximately four hours, from 16:05 to 20:12 UTC. Brevo's prominent clients include eBay, Louis Vuitton, Michelin, and Amnesty International, amplifying the attack's potential impact significantly.

Since early May 2026, a large-scale phishing campaign has targeted individuals with fraudulent text messages claiming their T-Mobile rewards points are about to expire. The messages create urgency by stating that point balances, typically cited as 18,400 points, will expire imminently if not redeemed. Recipients are directed to click on phishing links using rotating domains designed to mimic legitimate T-Mobile websites. The campaign has generated over 1,000 closely related message templates with only superficial variations in salutations, dates, and point balances. The operation experienced two major spikes in activity before declining. The criminals employed at least 81 domains over four months, all following a recognizable pattern. These messages use generic greetings and formal language to appear legitimate, exploiting social engineering tactics to trick recipients into divulging login credentials, personal information, or payment details.

A previously unknown modular multi-stage framework named MovieReaper has been discovered targeting users through compromised torrent files. Attackers compromised the public torrent repository itorrents[.]org, enabling them to distribute malicious loaders disguised as popular movies, including "The Odyssey." The campaign began in mid-August 2026 and affected hundreds of victims across multiple countries. The malware employs a sophisticated infection chain with fileless execution, utilizing blockchain network Solana for C2 infrastructure resilience. The framework includes multiple stages: an initial loader with anti-sandbox checks, shellcode that retrieves C2 addresses from Solana blockchain, UAC bypass with persistence mechanisms, and a final file manager module providing comprehensive file system access. The campaign demonstrates advanced evasion techniques including manual API resolution, vectored exception handling, and in-memory execution.

Settra is a ransomware variant first observed in June 2026 that targets organizations through VPNs or compromised credentials. Two incidents were investigated in July and September 2026, affecting the consumer services, retail, and manufacturing sectors. Attackers deployed MeshAgent RMM for persistence, naming ransomware executables after victim domain names. The malicious activity included file encryption with .locked or .locked_wip extensions, deployment of RESTORE_FILES.txt ransom notes, clearing Windows event logs, and disabling Windows recovery options using reagentc and diskpart utilities. One incident featured Bring Your Own Vulnerable Driver (BYOVD) tactics using gdrv.sys. A notable operational security failure occurred when attackers misspelled the Windows Defender Event Log path, preventing its deletion. Both attacks followed remarkably similar operational patterns, with MeshAgent installations pointing to different C2 IP addresses (45.13.122[.]7 and 193.5.65[.]114), and malicious workstation WIN...

ESET researchers have documented SparroWocky, a sophisticated C++ backdoor deployed by the FamousSparrow APT group since August 2025. This China-aligned threat actor has shifted focus to extensively targeting governmental organizations across Latin America, likely in response to increased US interest in the region. SparroWocky replaced the group's previous SparrowDoor backdoor and demonstrates advanced capabilities including reflective loading, anti-analysis techniques like SilentMoonwalk for call stack spoofing, and the ability to execute Beacon Object Files. The modular backdoor incorporates open-source projects directly into its codebase, uses TLS-encrypted communications with RC4 encryption for data exfiltration, and employs sophisticated evasion methods including MinHook API hooking and custom PE loading with host process camouflage. The targeting pattern reflects China's strategic interest in monitoring Latin American governmental responses to current US pressures regarding investments and infrastruc...

A French-speaking cybercrime crew operating as BlackHatSect0r && DXQRTXX left an operation server exposed, revealing a custom Go command-and-control platform that harvested 16,834 credentials from 726,989 hosts across 2.7 million queued domains. The operator deliberately removed safety controls from a Nous Research Hermes AI agent, deleting the line "discernment retained" from its memory and replacing it with "I am a weapon." This enabled automated campaigns targeting French government institutions, including the Equestrian Federation and National Mountain Observation System, alongside extortion operations against four New York public bodies, cryptocurrency exchange breaches, and vishing campaigns against elderly French banking customers. Despite branding itself as a zero-day operation, all confirmed breaches resulted from exposed cloud storage, readable .env files, and default signing secrets rather than novel exploits. The crew operates openly on Telegram with 13 declared members and maintains public all...

Infrastructure analysis reveals a cluster of SpiceRAT command and control servers active from late 2025 through August 2026, linked through shared TLS certificates, domain registrations, and a cloned RTX Corporation webpage. The infrastructure connects to multiple threat families including SpiceRAT, NodeEdgeRAT, NomadRAT, and BloodAlchemy, suggesting either a single operator managing multiple toolsets or shared support infrastructure. A TLS certificate impersonating Uzbekistan's railway authority was issued by TLC, a Chinese state-affiliated certificate authority. Domains spoof Central Asian government entities including Türkmengaz, the Galkynysh gas field, Tojiktelecom, and Turkmenistan's Ministry of Foreign Affairs. Passive DNS analysis reveals subdomain infrastructure dating to mid-2022, indicating at least four years of ongoing operations. The infrastructure shares characteristics with previously documented China-nexus actors FamousSparrow and IndigoZebra, both known for targeting Central Asian governm...

VectraRAT is a previously undocumented Malware-as-a-Service platform combining a Go-based control server (VectraHub) with a native C++ Windows implant, renting from $250 monthly. The developer, operating under the handle 'Vectra' (formerly 'Nyxel'), has been active since August 2022 without prior public documentation. The platform offers hidden desktop control, keylogging, clipboard hijacking with cryptocurrency address replacement, browser credential theft, and a UAC bypass achieving elevation without user prompts. Delivered through Amadey loader and ClickFix campaigns targeting tax-themed lures, 48% of observed victims run corporate Windows editions including Windows Server 2025. Infrastructure analysis revealed exposed directories and operational panels across multiple hosting providers, with victims spanning the United States, Russia, Germany, and other nations.

Noodle RAT, also known as ANGRYREBEL or Nood RAT, is a modular remote access trojan with dual versions for Windows and Linux, actively used by Chinese-speaking threat actors since at least mid-2016. Previously misclassified as variants of Gh0st RAT or Rekoobe, it is now recognized as a distinct backdoor family. The malware has been deployed in espionage and cybercrime campaigns targeting entities across the Asia-Pacific region, including Thailand, India, Japan, Malaysia, and Taiwan. Multiple threat groups including Iron Tiger, Calypso APT, Rocke, and Cloud Snooper have utilized this tool. Both variants feature shared command-and-control architecture, similar configuration structures, and modular capabilities. The Windows version operates as an in-memory backdoor with file management and proxy capabilities, while the Linux variant provides reverse shell, SOCKS tunneling, and task scheduling functionalities. Evidence suggests an actively maintained, possibly commercial malware toolkit.

In August 2026, the Pakistan-nexus threat actor APT36 launched Operation RapidRust, targeting government and defense organizations in India and Afghanistan with an updated arsenal of custom tools. The campaign introduced RUSTYSHADE, a Rust-based backdoor leveraging private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools included RUSTYMOVE for USB-based lateral movement to air-gapped networks, PSNATCH and BASHNATCH for file exfiltration from Windows and Linux systems respectively. The attackers registered typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities revealed systematic network reconnaissance, credential harvesting, and lateral movement attempts, with operations conducted exclusively on weekdays between 4:00-11:00 UTC, demonstrating disciplined operational security and sustained targeting of South Asian government infrastructure.

In late August 2026, a sophisticated device code phishing campaign was identified, distributed through web contact forms. Threat actors impersonated procurement officers from legitimate businesses, specifically BJ's Wholesale Club, using lookalike domains registered with Zoho Mail. The campaign, tracked as GhostCode, abused Microsoft's OAuth 2.0 device authorization grant flow to obtain authentication tokens. Victims received WeTransfer links to password-protected HTML files containing three layers of obfuscation: junk padding, character-level HTML comment injection, and AES-256-GCM encrypted redirect URLs. After passing multiple security checks including Cloudflare Turnstile, victims were directed to legitimate Microsoft sign-in pages where they unwittingly authorized attacker-controlled devices. Within 78 seconds of successful authentication, threat actors registered three devices, obtained Primary Refresh Tokens, and harvested emails using residential proxy rotation to evade detection.

An analysis of Atomic macOS (AMOS) stealer infections from early August 2026 reveals this information stealer targeting macOS systems has been advertised since April 2024. AMOS exfiltrates system information, login credentials, and sensitive data from web browsers and cryptocurrency wallets. Distribution methods include ClickFix campaigns, malicious advertisements, and fake cracked software sites offering macOS toolkits. The examined infection chain begins with malicious instructions on getmacouscloud[.]com, leading to execution of a Zsh script that retrieves and installs Mach-O binaries establishing persistence in system directories. The malware collects data from various applications including Binance, TonKeeper, Telegram, AWS, Docker, and FileZilla, compressing it into an out.zip file before exfiltrating to command and control servers. Post-infection traffic consists of HTTP POST requests with specific stage parameters indicating collected data types. The malware demonstrates active development with con...

The NightEagle APT group (APT-Q-95), active since 2023 and initially targeting Asian organizations, has expanded operations to Russian enterprises. Attackers gain initial access through compromised VPN credentials originating from Cloudflare WARP tunnels and European infrastructure providers. They deploy the GhostContainer backdoor on Microsoft Exchange servers, exploiting CVE-2020-0688 and incorporating components from Neo-reGeorg and ysoserial. For traffic tunneling, the group uses Microsoft Dev Tunnels combined with rdp2tcp, masking malicious tools as legitimate software hosted on GitHub repositories. They exploit vulnerabilities including CVE-2019-0708 (BlueKeep) for lateral movement and perform DCSync attacks against Active Directory to compromise domain controllers. The group employs sophisticated techniques for persistence and privilege escalation across corporate networks.

Illegal online gambling infrastructure spans three distinct cybercrime categories that defenders often overlook. First, over 1.7 million Chinese-language casino domains facilitate illegal gambling and transnational money laundering, primarily operated by triad-aligned syndicates. Second, thousands of "scambling" websites target global audiences with rigged games and withdrawal fraud, using deposit bonuses to lure victims. Third, China-aligned APT groups deploy the PeckBirdy malware framework within fake casino and adult websites as command-and-control infrastructure, targeting education, government, finance and technology sectors across Asia. These operations exploit U.S. and European hosting providers through infrastructure laundering while maintaining bulletproof Asian hosting. The campaigns have escalated sharply since 2023, with PeckBirdy domains achieving zero detection rates on VirusTotal. All three types appear visually identical, creating detection challenges for security teams.

Brazilian banking malware operation REF9334 has been deploying KREMLIN toolkit since May 2025, targeting Brazilian financial institutions through malicious browser extensions. The operation uses multi-stage JavaScript loaders, custom C++ installers, and exploits Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs. Infrastructure leverages Ethereum smart contracts as dead-drop resolvers for dynamic C2 configuration. Seven distinct campaigns over 15 months show evolution from PULSAR RAT to REMCOS RAT delivery. Attackers impersonate twelve Brazilian banks through Portuguese-language lures, with transaction patterns clustering during São Paulo working hours. The malicious extensions intercept credentials, session tokens, and sensitive banking data through keylogging and request interception capabilities. Over 1,500 infections have been temporarily disrupted through network canary registration, with 98.75% of victims located in Brazil.

BambooToken is an emerging multiplatform malware family active since at least February 2023, utilizing the Message Queueing and Telemetry Transport (MQTT) protocol for covert command and control operations. The campaign targets Windows and Linux systems across Asia and South America, with infections observed on backend servers for mobile applications, legal and financial services, software companies, hotels, and GitLab instances. The malware leverages sideloading techniques through Tendyron's OnKey authentication software, commonly used in Chinese banking and government networks. Analysis reveals extensive host enumeration capabilities, plugins for antivirus detection, and potential keylogging and clipboard theft functions. Infrastructure analysis shows C2 domains ranking in Cloudflare's top 500,000, indicating widespread infections. The actor demonstrates sophisticated operational security, using MQTT's publish-subscribe architecture to hide infrastructure and employing Cloudflare proxies for additional o...

In July 2026, IIJ discovered and analyzed an unknown .NET-based malicious tool hosted on a public directory. This tool, named PIVOTPIPE, exhibits functionality similar to Cobalt Strike Beacon, communicating with C2 servers using configurations close to default profiles and supporting numerous C2 commands. However, PIVOTPIPE differs from official Cobalt Strike Beacon through unique implementations including detection evasion code, custom loaders, and obfuscated strings. The tool consists of two components: a loader and RAT module. The loader implements AMSI bypass, indirect syscalls, and sleep masking for EDR evasion. PIVOTPIPE supports TCP Beacon and SMB Beacon functionality for peer-to-peer communication through compromised hosts. Debug artifacts suggest the tool was still under development at the time of discovery, indicating potential future enhancements.

Mythic is an open-source collaborative command-and-control framework with plugin-based architecture supporting multiple agent types and transport profiles. It features a web-based operator interface used by red teams for authorized engagements, though threat actors have also deployed it in unauthorized intrusions. Analysis identifies 131 unique hosts exposing Mythic on the public Internet, with 115 carrying default certificate configurations. The infrastructure spans predominantly DigitalOcean, AWS, and Azure environments, concentrated in the United States, Hong Kong, and China. Default deployment artifacts including TLS certificates with O=Mythic subjects, port 7443 responses, and internal PKI chains enable detection. Multi-framework clusters suggest training environments, while isolated deployments with custom domains and staged payloads indicate operational use with Discord-based transports and steganographic techniques.

A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seven countries, successfully compromising organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Activities included source code theft, credential collection, SSH persistence, and lateral movement, with one case escalating from a vulnerable Gitea server to root access across a three-node Proxmox cluster. An exposed staging server revealed targeting taxonomies using Simplified Chinese labels covering defense, elections, energy, aerospace, telecommunications, and government sectors. The campaign deployed JITTERLY, a C++ Linux implant with 30+ post-exploitation commands, embedding SIXZUT, a previously undocumented LD_PRELOAD rootkit capable of hiding files, processes, and network connections while protecting the implant from termination.

Cybercriminals have created numerous fake websites mimicking Bitrefill, a legitimate cryptocurrency-based gift card and eSIM retailer. These fraudulent sites appear in search engine results and use lookalike domains incorporating the Bitrefill brand name with added words or character substitutions, including internationalized domain names using Punycode. Victims are guided through convincing checkout processes that replicate Bitrefill's legitimate payment flow, complete with cryptocurrency options, QR codes, and countdown timers. However, payments are sent directly to attacker-controlled cryptocurrency addresses rather than Bitrefill, with virtually no chance of recovery. The operation demonstrates sophisticated measurement using commercial analytics software to optimize conversion rates, indicating organized criminal activity rather than opportunistic fraud.

A cybercriminal group dubbed GrelosGTM has been exploiting Google Tag Manager's legitimate functionality to compromise e-commerce websites. First detected in early April 2020, the group evolved their tactics by February 2021 to inject malicious Google Tag Manager scripts into targeted sites. The campaign affected at least seven websites running Magento CMS across Belgium, Italy, the United Kingdom, and the United States. Attackers inject custom Google Tag Manager scripts that load multi-stage JavaScript payloads through WebSocket connections. The final payload deploys a heavily obfuscated JavaScript sniffer designed to steal customers' payment card information during checkout using fake payment forms, with stolen data exfiltrated to attacker-controlled servers.

An exposed directory on a Thai server revealed an active intrusion campaign targeting 3BB (Triple T Broadband), one of Thailand's largest broadband providers. The attacker exploited CVE-2024-21762 in a FortiGate 60F SSL-VPN appliance to gain initial access, then deployed MeshCentral remote management software for persistent command-and-control. The operation involved extensive reconnaissance, credential harvesting targeting RADIUS authentication databases, privilege escalation using PwnKit and Dirty COW exploits, lateral movement via SSH brute-forcing across 55+ internal hosts, and anti-forensic cleanup procedures. Multiple devices were already enrolled under attacker control at discovery, with additional targeting of Jasmine International infrastructure. The attacker's toolkit included web application exploitation scripts, database credential extraction tools, and persistence mechanisms designed to maintain long-term access to subscriber authentication systems.

A malicious browser extension called 'Twitch Enhanced Viewer | JeetBot' distributed on Chrome Web Store and Firefox Add-ons captures and forwards users' live Twitch OAuth session tokens to Russian-controlled proxy servers. The extension, with approximately 30,000 Chrome users and 552 Firefox users, markets itself as a quality-of-life tool for blocking ads and unlocking streams. While delivering these features, it secretly extracts users' account-scoped OAuth tokens and forwards them as query parameters to operator-controlled infrastructure. Current versions append tokens inline during video playlist redirects, while earlier builds explicitly POSTed tokens to dedicated collection endpoints. The operator is identified as a commercial Russian bot service called JeetBot, with infrastructure hosted across German and cloud providers.

KATARU is an IoT malware variant discovered in August 2026 through Telnet credential brute-forcing against a honeypot from Vietnam. While maintaining traditional Mirai-style botnet capabilities, it distinguishes itself through an extensive feature set including multiple Linux local privilege escalation exploits, comprehensive persistence mechanisms across Linux and embedded platforms, encrypted C2 communications using X25519 and ChaCha20-Poly1305, anti-analysis techniques, and decoy traffic generation. Implementation artifacts strongly suggest AI-assisted development, evidenced by architecture-mismatched x86 shellcode in ARM binaries, RFC test vectors as configuration values, and untested cross-platform persistence logic. The malware attempts various privilege escalation paths through system misconfigurations and public exploits, establishes persistence across numerous startup mechanisms, and supports multiple DDoS attack vectors alongside SSH brute-forcing capabilities.

LegionLoader malware is being distributed through ClickFix tactics using fake Cloudflare CAPTCHA pages. Two primary distribution methods have been identified: one exploits Korea's Newlywed Hope Town Namu Wiki page with malicious URLs, while the other uses spear phishing emails targeting specific companies disguised as internal business system account issuance instructions. When users access these malicious URLs, they are redirected to fake CAPTCHA pages that trick them into executing PowerShell commands, which download and execute LegionLoader. The malware sequentially decrypts encrypted shellcode and PE files, evaluates the infection environment through display device checks and ASN verification, then executes backdoor malware capable of running various payloads including PE files, shellcode, PowerShell scripts, and MSI files. It also steals Chrome browser credentials and profile information based on C2 server commands.

Gen Threat Labs identified CVE-2026-51990, a critical remote code execution vulnerability in Sogou Input Method, a widely-used Chinese-language input editor with hundreds of millions of installations. The exploit chains three weaknesses: unvalidated command-line argument injection in the sgbiz: custom protocol handler, unrestricted URL navigation in a CEF-based webview, and a severely outdated unsandboxed Chromium browser engine from 2020. UNC3569 actively exploited this vulnerability in the wild, using a crafted link to deploy the GRAYRABBIT backdoor. The attack required only a single click, with the exploit leveraging CVE-2021-38003 to achieve code execution. The backdoor included anti-sandbox techniques, self-deletion capabilities, and command-and-control functionality. Tencent patched the vulnerability within twelve days of disclosure, though underlying browser components remain outdated and unsandboxed.

Active exploitation of three critical vulnerabilities in JFrog Artifactory has been identified, with attackers chaining CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 to bypass authentication and gain administrative control. CVE-2026-42018 exposes internal anonymous-user tokens, CVE-2026-42016 enables privilege escalation through insufficient token validation, and CVE-2026-82329 allows unauthenticated access to administrative privileges. Post-exploitation activities include creating persistent administrator accounts, deploying malicious Groovy plugins for code execution, and installing Rust-based backdoors. Exploitation was observed between August 15 and September 8, 2026, affecting multiple organizations. Data indicates 67-69% of organizations running Artifactory had vulnerable instances at initial publication, with slow patching velocity for lower-severity CVEs despite active exploitation across environments.

Threat actors exploited trusted brands and cloud services in a sophisticated web campaign combining fraudulent DocuSign workflows, Florida healthcare screening lures, and deceptive cloud infrastructure to deploy ConnectWise ScreenConnect Access clients. The attack utilized Cloudflare Pages hosting with fake Cloudflare verification workflows to establish legitimacy. Victims were socially engineered to download a ZIP archive containing a malicious HTA file that employed Base64-encoded VBScript, fake Adobe interfaces, UAC privilege escalation, and Microsoft Defender SmartScreen registry modifications. The attack leveraged living-off-the-land techniques using native Windows tools like mshta.exe, curl.exe, and msiexec.exe for silent ScreenConnect installation, ultimately providing unauthorized remote access. The campaign was classified as Zero Hour Fraudulent and blocked at the web entry point before payload delivery could occur.

Threat actors are leveraging generative AI to enhance financial fraud campaigns targeting enterprise organizations. Between August 3-5, over one million phishing emails were distributed through third-party infrastructure, primarily targeting US-based organizations (87.7%). The attacks employed sophisticated executive impersonation, specifically CEOs and CFOs, combined with fabricated ServiceNow invoices requesting ACH transfers of approximately $50,000. The campaign demonstrated multiple AI-assisted indicators including extensive HTML comments, structured section labeling, and uniform template construction. Attackers registered lookalike domains and created elaborate forwarded email threads between spoofed executives to establish legitimacy. The fraudulent invoices contained detailed branding, personalized recipient information, and specific payment instructions to attacker-controlled bank accounts. Multiple layered social engineering techniques were deployed to reduce recipient skepticism and convince acc...

Three years after its initial discovery, the Melofee Linux implant has evolved with sophisticated new capabilities. The malware now features modularized architecture with hot-loadable components for shell functionality, file management, and command execution. New versions incorporate remote C2 infrastructure reconfiguration and enhanced stealth through a kernel rootkit based on the Reptile project. The implant uses RC4 encryption and supports multiple communication protocols including TCP, HTTP, HTTPS, and TLS. Analysis reveals two infrastructure clusters utilizing fake certificates impersonating Symantec and other entities. Code similarities establish links with Windows-targeting implants including CrowDoor, Hemigate, and RatelS, suggesting tool sharing among multiple Chinese state-linked threat groups. The modular design allows dynamic loading of up to eleven specialized modules via a common plugin interface.

In June 2026, a new malware family named SloppyRAT was identified, likely used by ransomware-related threat actors to establish footholds for lateral movement. Delivered through multi-stage ClickFix infection chains, the malware features encrypted code blocks, EtherHiding for command-and-control resolution via Polygon JSON-RPC protocol, and multiple anti-analysis techniques including junk code and indirect system calls. SloppyRAT implements certificate pinning to prevent TLS traffic inspection and includes 47 built-in PowerShell-like commands for remote access. The infection chain uses finger.exe, IronPython, and deploys CastleLoader and CastleRAT components before installing SloppyRAT. Despite sophisticated capabilities, the codebase contains numerous software bugs affecting persistence mechanisms and other features, suggesting active development.

In August 2026, a Casbaneiro campaign targeted Latin American users through phishing emails and PDFs themed as fake invoices and legal notices. The multi-stage infection chain includes HTA downloaders and AutoIt loaders, employing geofencing to filter victims by IP address location. The malware exhibits sophisticated evasion techniques, including distributed data-receiving servers, deliberate HTTP 403 responses, and activation only when victims access targeted banking websites. Casbaneiro steals email data, performs clipboard injection, and creates fake windows for fraudulent activities. The campaign specifically targets Argentina, Peru, Colombia, and Mexico while avoiding German, French, and English language systems. The malware splits stolen data across multiple servers and uses malformed HTTP packets to complicate detection and analysis efforts.

A widespread IT impersonation and voice-phishing campaign designated PREY-0058 is actively targeting Microsoft 365 and SaaS platforms. Threat actors impersonate IT helpdesk staff via phone or text to trick executives and senior personnel into divulging credentials through adversary-in-the-middle phishing portals. After bypassing multi-factor authentication, attackers conduct rapid automated data exfiltration across email, file storage, and cloud repositories without deploying ransomware. The operation relies heavily on NodeMaven residential proxy infrastructure to blend with legitimate traffic. Extortion demands are delivered via TOX messaging within hours of compromise, typically with 72-hour deadlines and threats of public data exposure. The campaign exhibits tradecraft overlapping with UNC6671 and involves multiple extortionware brands including BlackFile, Redact, Pink, and Helix.

Djinn Stealer is a cross-platform information stealer delivered as a second-stage payload by the TaskWeaver Node.js loader. It employs a rules-based collection engine to harvest credentials and configuration data from cloud platforms, source control systems, package registries, infrastructure tooling, AI development assistants, browsers, SSH, and cryptocurrency wallets. The stolen data is archived, encrypted, and exfiltrated to attacker-controlled infrastructure. This threat has been observed following exploitation of the SimpleHelp vulnerability CVE-2026-48558. The stealer executes within a Node.js runtime context and communicates with command-and-control servers using encrypted channels for data exfiltration.

In September 2026, two Chinese threat actors, UTA0560 and JungleBamboo, were observed exploiting an identical Chrome zero-day vulnerability chain targeting NGOs and other organizations. The exploitation leveraged CVE-2026-85046 and CVE-2026-87491 in Chrome alongside CVE-2026-85880 in Windows kernel. These vulnerabilities had been patched in Chromium source code but not yet released to Chrome users, creating a patch-gap exploitation window. UTA0560 conducted spear-phishing campaigns using financial lures to deliver GRIMWEDGE JScript backdoor for reconnaissance and command execution. JungleBamboo employed generic phishing themes to deploy SUPERSTOMP loader, which installed the LONGTALE Chrome extension designed for credential theft, keylogging, and surveillance. Both actors used byte-for-byte identical shellcode, suggesting a shared exploit supply chain while deploying distinct post-exploitation tools tailored to their operational objectives.

Six Chrome and Firefox extensions linked through shared code, C2 infrastructure, and publishing history have been identified targeting cryptocurrency traders. Four malicious extensions steal authenticated session tokens and wallet data from Axiom Trade and Padre users, while two earlier extensions reveal a pattern of repackaging crypto trading tools. The extensions J7Tracker, VREO, and Orbit Tracker automatically retrieve user information, wallet bundles, Firebase tokens, and application state, then exfiltrate data to threat actor-controlled Vercel deployments. The campaign targets an active trading community with Axiom processing over $15 billion in volume across 650,000 wallets. The malicious code runs inside authenticated sessions, collecting localStorage, IndexedDB data, and API responses containing authentication tokens and wallet keys. Data is Base64-encoded and transmitted via browser navigation to avoid CORS restrictions, enabling account compromise and cryptocurrency theft.

The Adversary Pursuit Group identified a sophisticated exploitation campaign targeting internet-facing PaperCut servers using CVE-2026-81578 and CVE-2026-82078. Analysis uncovered exposed operator infrastructure revealing an AI-assisted workflow spanning vulnerability research, proof-of-concept development, target sourcing, and campaign execution. Timestamped state files documented an iterative process where AI agents preserved project context, managed failures, and refined exploitation across hundreds of systems. The campaign processed over 500 targets using 200 concurrent threads across 100 retry rounds, implementing geographic filtering, reachability checks, and stage validation. The operation demonstrated how AI reduces human effort in research, debugging, classification, tracking, and continuous improvement rather than inventing novel techniques. Post-exploitation activities included administrator creation, credential collection, Active Directory discovery, and proxy deployment.

A sophisticated mobile threat linked to Indonesian actors combines ransomware and spyware capabilities in a single attack vector. The malware is distributed via third-party file-sharing platforms through social engineering, targeting Android devices. It requests extensive permissions including device administrator, SMS, contacts, and accessibility access. The threat encrypts files using AES on Android 9 and earlier, appending .enc extensions, while stealing sensitive data including screen recordings, browser history, PINs, contacts, call logs, SMS messages, WhatsApp and Telegram chats. It establishes C2 communication via HTTPS and WebSockets using dynamic domain resolution through GitHub. Version 2 introduces UI hijacking, screen blocking, touch input interception, harassment features, and remote text-to-speech capabilities. The malware exfiltrates data through Firebase and Catbox services, enabling double-extortion through an interactive chat portal for ransom demands.

Multiple cloud accounts have been compromised through passkey-themed social engineering campaigns since May 2026. Attackers impersonate IT helpdesk staff via phone calls or SMS, directing victims to phishing sites that mimic Microsoft sign-in pages. After obtaining credentials through adversary-in-the-middle or device code authentication flows, attackers establish persistence by adding unauthorized MFA methods. They then conduct extensive reconnaissance using Microsoft Graph API to map users, groups, permissions, and resources. The intrusion culminates in high-volume data collection from SharePoint, OneDrive, and Exchange using automated tools, with exfiltration occurring over hours or days at controlled rates to avoid detection.

Cisco Talos is tracking active exploitation of two vulnerabilities in Secure Firewall Management Center (FMC) Software. CVE-2026-20079 is a critical authentication bypass vulnerability allowing remote attackers to execute scripts and obtain root access. CVE-2026-20316 enables remote login using low-privileged accounts and can be chained with other vulnerabilities for privilege escalation. Three distinct threat actor clusters have been identified conducting post-compromise activities: UAT-12197 deployed web shells and credential theft tools; UAT-11823, overlapping with Russian APT Sandworm, deployed Cyclops Blink malware and established reverse shells; UAT-11988, a Qilin ransomware operator, conducted extensive reconnaissance, credential harvesting, and deployed ransomware after establishing persistent network access through tunneling tools. Customers are strongly advised to apply available hotfixes immediately.

Gigabud is an Android remote access banking trojan active since 2022, attributed to GoldFactory group, targeting victims across Southeast Asia, South Asia, Middle East, Africa and Latin America. The malware now utilizes Vwork, a weaponized fork of the open-source app cloning application Shelter, to evade detection by creating isolated work profiles. After initial Gigabud infection, Vwork is installed to clone banking applications into the work profile, hiding malicious activity from signature-based detection in application security SDKs. Between February and July 2026, approximately 1,469 compromised devices and 1,281 potentially compromised logins were observed in Indonesia alone, with estimated losses of roughly $960,939. The infection chain involves social engineering through phishing sites delivering fake apps disguised as legitimate services, followed by credential theft through overlays and remote-controlled fraudulent transactions executed within cloned banking apps.

Threat actors are exploiting anticipation for Grand Theft Auto VI by distributing malicious ISO files disguised as leaked game versions. These fake installers are spread through SEO poisoning, gaming forums, social media, and torrenting sites. The analyzed ISO contains multiple malicious components including several RAT variants (NJRAT and DCRAT), Mercurial Grabber infostealer, Chaos ransomware functioning as a wiper, and Yandex Browser. When executed, the fake installer displays Russian-language messages and deploys malware to %TEMP% folders. The package includes data exfiltration capabilities, credential theft, system control features, and destructive file encryption. Based on Russian language usage throughout the infection chain, the campaign appears to target Russian-speaking gamers. The malware components date back to 2023, suggesting repurposed tools for this opportunistic attack.

Two sophisticated phishing campaigns employed browser-in-the-browser (BiTB) techniques to deceive victims into installing rogue ScreenConnect remote management tools. Attackers sent phishing messages with malicious links redirecting targets to fake Adobe Reader update pages. The BiTB technique created convincing fake browser windows within webpages, displaying legitimate-looking Adobe URLs to bypass user awareness training. Victims were tricked into downloading ScreenConnect installers disguised as Adobe software updates. Each incident resulted in deployment of multiple rogue ScreenConnect instances for redundant persistence, followed by execution of defense-evasion binaries (HideCursor.exe and HideUL.exe) designed to hide attacker activities. The attacks established service-based persistence through Windows services, enabling continued remote access. Both campaigns were intercepted before further damage occurred, demonstrating how threat actors combine social engineering throughout the entire attack chain...

A likely Russian-speaking malicious cyber actor leveraged artificial intelligence to orchestrate a global campaign exploiting PaperCut NG/MF print management software via CVE-2026-81578 and CVE-2026-82078. Using AI agents powered by DeepSeek models and OpenAI's Codex, the adversary moved from empty workspace to first remote code execution in under four hours, compromising at least 440 PaperCut instances across 395 organizations in 48 countries. The campaign originated from IP 45.142.193.132, which had been tracked since July 2026 for attacks against various technologies. The adversary developed and tested exploits in a self-hosted lab environment before launching coordinated attacks using AI agents to achieve rapid compromise, with the fastest domain admin access achieved in just five minutes. Domain administrator access was confirmed in 12 organizations, primarily affecting educational institutions in the United States.

Four espionage-motivated threat actors have been observed deploying the BlueMoon exploit kit, which chains Chrome browser and Microsoft Windows vulnerabilities. The initial adopter was China-aligned TA412 on 28 August 2026, followed by several other suspected China-nexus groups within days. The exploit chain targets CVE-2026-85046 (Chromium V8 type-confusion), a V8 sandbox escape, and CVE-2026-85880 (Windows kernel LPE affecting older builds). Both V8 vulnerabilities were patch-gap zero-days, with fixes available in upstream Chromium but not yet deployed in stable releases. The rapid adoption by multiple actors and low operational security suggest rushed deployment ahead of anticipated patches. Evidence including extensive logging, verbose comments, and markdown references indicate potential AI-assisted development. BlueMoon's ease of adoption suggests further proliferation among espionage and financially motivated actors is likely.

A massive cybercrime campaign tracked as CL-CRI-1171 has operated undetected for at least two years, utilizing a pay-per-install marketplace to distribute multiple malware families. The operation targeted primarily young gamers through YouTube channels with hundreds of thousands of followers, while simultaneously using SEO poisoning to compromise corporate endpoints including critical infrastructure and government entities. The campaign employed OfferLoader, a custom loader capable of delivering unique payload combinations through sophisticated gating mechanisms. Three distinct malware families were identified: Insomnia RAT, a cross-platform backdoor targeting Windows and macOS; ARKTunnel, a WebSocket tunneling tool hidden via steganography; and Docro Hijacker, a Chrome browser hijacker. Over 10,000 distinct loader samples were discovered, indicating a much larger deployment campaign affecting numerous organizations globally.

This analysis examines a sophisticated Vidar infostealer variant that employs a custom virtual machine to obfuscate its malicious code through proprietary bytecode interpretation. The malware implements extensive anti-analysis measures including debugger detection via NtQueryInformationProcess and RDTSC timing checks, sandbox evasion by identifying antivirus processes and checking system resources, and environment fingerprinting. Vidar targets credentials from web browsers including Chromium and Gecko-based extensions, Azure authentication tokens, FileZilla FTP credentials, and captures screenshots. It utilizes SeDebugPrivilege for elevated access, creates hidden desktops for browser automation, and exfiltrates stolen data through Telegram channels. The malware performs cleanup operations to remove execution artifacts and proxies DLL execution through rundll32.exe to blend with legitimate Windows processes.

An exposed directory at 188.245.99.156 revealed a comprehensive cryptomining toolkit containing 147 files including Python exploit source code, campaign logs, and Windows registry hives. Analysis confirms 3,562 Redis servers were compromised across two campaign runs targeting 12,966 hosts. The operation exploited unauthenticated Redis instances using rogue replication techniques to inject cron jobs that deployed XMRig miners. Victims spanned Redis versions 2.8.17 through 7.2.0 across outdated and current Linux distributions, indicating misconfiguration rather than version-specific vulnerabilities. The toolkit also targeted WordPress, MongoDB, and SSH but achieved zero confirmed compromises through those vectors. A separate February 2026 open directory linked by wallet reuse revealed Meterpreter deployment capabilities, extending the operator's known activity timeline by five months. The operation mined Monero through pool.moneroocean.stream with the same wallet used on the operator's own Windows-based work...

Hagaseca is an Android malware cluster linked to exposed Android Debug Bridge (ADB) services, focusing on the THost9 RAT loader variant. The malware conceals executable code within an APK that loads tc9.dex, a stage providing shell access, file transfer, and ADB propagation capabilities. Public incidents connect THost4 and THost9 to exposed Android and Redroid systems from October 2024 through 2026. The loader uses XOR and gzip packing, establishes persistence through foreground services, exploits accessibility features for device control, and downloads additional stages from test.hagaseca.com. The tc9.dex stage implements remote administration, discovers ADB endpoints via mDNS, scans entire /16 networks, authenticates with prepared keys, and installs itself on vulnerable systems. The malware exhibits worm-like behavior, spreading opportunistically through unsecured ADB services exposed to the internet, particularly affecting Redroid container deployments and devices with public ADB over Wi-Fi.

MacSync Stealer is a macOS information stealer and remote-access stager delivered through ClickFix social engineering and malvertising campaigns. Operating under a malware-as-a-service model, it employs sophisticated evasion techniques including process daemonization, single-byte XOR obfuscation, and in-memory AppleScript execution to bypass Apple Gatekeeper, XProtect, and EDR solutions. The malware exfiltrates credentials, browser data, cryptocurrency wallets, and SSH keys through fault-tolerant 10MB chunked uploads to command-and-control infrastructure. MacSync targets professionals in software engineering, cryptocurrency, fintech, and corporate environments across North America, Europe, and Asia-Pacific regions, with campaigns impersonating legitimate services like Google Meet, Claude AI, Docker, and TradingView to trick victims into executing malicious Terminal commands.

An investigation revealed a sophisticated cryptocurrency and credential-stealing operation using Amatera stealer as the primary payload. The attack chain leverages Cloudflare Workers to inject JavaScript stored on BNB Smart Chain, presenting fake Google CAPTCHA prompts that lead to WebDAV-based DLL execution. Two parallel infection chains were identified, one loading through a DLL named 'pf.ch' and another through 'verification.google', both delivering Amatera stealer with different secondary payloads. The 'pf.ch' variant deployed ZigCryptoStealer via NativeAOT loader and a Go-based reverse proxy, while the 'verification.google' variant installed NetSupport Manager with C2 infrastructure in Russia. The operation affects numerous countries with primary focus on stealing cryptocurrency wallets, credentials from password managers, and various authentication data through extensive collection rules targeting over 400 applications.

Cybercriminals are exploiting legitimate Google infrastructure in a sophisticated phishing operation that bypasses email security gateways and enterprise firewalls. The attack chains together six distinct Google properties including Meet, Search, DoubleClick, Custom Search, Tag Manager and Analytics to proxy malicious traffic through trusted domains. Victims' email addresses are encoded in URL fragments and stripped before server-side logging. Landing pages dynamically impersonate target organizations by pulling live logos from Clearbit, capturing real-time website screenshots, and validating domains via Google's DNS API. The operation includes multilingual support for 16 languages and dual execution tracks: credential harvesting with immediate Telegram exfiltration, or silent ScreenConnect remote access tool installation. Lures span document reviews, credential expiry notices, package delivery, payment notifications, government benefits and voicemail themes targeting manufacturing, government, finance and...

An unpatched zero-day vulnerability dubbed StyleSmuggler affects all current versions of Magento and Adobe Commerce, including 2.4.9, enabling unauthenticated remote code execution. Active exploitation began on September 4th, 2026. The attack operates in two stages: injecting malicious PHP code into Magento's template system using styles properties to evade safeguards, then executing the poisoned code via failed payment emails. Upon successful compromise, attackers deploy a Rust-based backdoor disguised as legitimate system processes (kworker, fc-cache, or chronyd) that connects to command and control servers. The backdoor uses NTP-shaped UDP traffic for C2 communication to evade detection. A second unrelated attacker has also been observed exploiting the same vulnerability to deploy PHP web shells. Affected merchants should deploy immediate mitigation measures, scan for compromise, and temporarily disable GraphQL until an official patch is released.

In June 2026, researchers uncovered BigBear 2.0, a rebranded Evilginx2-based phishing-as-a-service framework targeting Microsoft 365 credentials globally. The operation, managed by operator 'General Boss', deployed 42 VPS nodes primarily hosted on Vultr infrastructure, utilizing the 'offy' phishlet configuration. The platform employed adversary-in-the-middle techniques with geo-matched residential proxy pools across 69 countries, real-time Telegram exfiltration, and automated cookie replay to bypass MFA. The campaign exfiltrated 5,137 credential records including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies, affecting 3,331 unique victim IPs across 40+ countries. The multi-user PhaaS panel was leased to at least five identified affiliate operators. Custom JavaScript injections disabled FIDO2/WebAuthn MFA while residential proxies bypassed anti-bot detection, enabling persistent access to compromised Microsoft 365 environments.

PEEP is a Chromium-based post-exploitation toolkit disguised as 'Smart Bookmarks' that transforms Chrome and Edge browsers into persistent backdoors. Requiring prior administrative access, it bypasses Web Store security by forging Chromium integrity values and uses native-messaging to extend beyond browser telemetry to full host-level command execution. The malware beacons every 30 seconds over unencrypted HTTP, exfiltrating browsing history, cookies, credentials, and session data. Built on the open-source RedExt framework with significant enhancements, PEEP combines browser surveillance with filesystem manipulation, shell command execution, and process discovery. The infrastructure exposed development artifacts including source code, signing keys, and Traditional Chinese testing logs, indicating a Chinese-speaking operator using AI-assisted development. The toolkit demonstrates sophisticated persistence through HMAC forgery, enterprise policies, and ScriptCache manipulation.

The Kimsuky threat group continues Operation GitPower campaigns utilizing malicious LNK files disguised as financial and business documents. Thirteen LNK variants collected between August 11-19, 2026, employ GitHub Personal Access Tokens (PAT) for command-and-control communications, delivering obfuscated PowerShell loaders through custom decoders. Notable evolution includes anti-analysis routines detecting virtualization tools, Pastebin as alternative C2 infrastructure, and diversified decoy formats (PDF, XLSX, PNG). Metadata analysis reveals AI-generated content using the 'opencode' AI coding agent and HeadlessChrome PDF conversion, with placeholder text remaining unreviewed. The group maintains persistence through hidden scheduled tasks masquerading as legitimate software (BitLocker, MATLAB), while hardcoded GitHub PATs enable raw content retrieval. Despite increased sophistication in evasion techniques and decoy production automation, endpoint behaviors remain detectable through behavioral correlation a...

An emerging infostealer tracked as REVSTEALER under REF2859 has gained significant momentum with approximately 4,700 samples identified over the past year. The malware features comprehensive credential harvesting capabilities targeting browsers, VPN applications, password managers, cryptocurrency wallets, and gaming platforms. It incorporates sophisticated anti-analysis mechanisms including a weighted sandbox scoring system and uses Polygon blockchain-based dead drops for resilient infrastructure management. Distribution occurs primarily through social engineering campaigns targeting gamers via compromised YouTube channels advertising fake game cheats, though samples also impersonate legitimate software like Slack and qBittorrent. The malware delivers four additional modules extending capabilities to include wallet theft, clipboard manipulation, reverse proxy functionality, and cryptocurrency mining deployment. Most samples employ VMProtect packing and feature an App-Bound Encryption bypass using debugger-...

In March 2026, a sophisticated SEO poisoning campaign was identified leading to malware distribution and tech support scams. Operating since at least 2015, this operation is attributed to individuals and IT service providers in Rajasthan, India, collectively tracked as BengalSEO. Two primary entities were identified: WeConnect Solutions LLC operates tech support call centers, while Garage2Global develops malicious web infrastructure. The group leverages extensive black hat SEO techniques including backlink generation, DOM injection, and keyword stuffing to promote lure pages mimicking legitimate technical support portals. A custom Traffic Distribution System routes victims through rotating redirector domains, utilizing Matomo analytics for tracking and fingerprinting. The operation deploys custom malware named MayaBot to further enable scam activities. Infrastructure analysis revealed hundreds of domains registered primarily through Spaceship and Namecheap, hosted via Cloudflare and Hostmaza, with GitHub e...

StyleSmuggler is an unpatched zero-day vulnerability affecting all current versions of Magento and Adobe Commerce, including version 2.4.9, enabling unauthenticated remote code execution. Active exploitation began on September 4th, 2026. The attack operates in two stages: injecting malicious PHP code through the styles properties to evade safeguards, then executing it via failed payment email templates. The vulnerability exploits Magento's GraphQL endpoint and template system. Attackers deploy backdoors disguised as legitimate system processes, establish command and control through multiple domains using WebSocket over TLS and custom NTP-shaped traffic. Affected merchants should deploy protective measures, scan for compromise indicators including suspicious background processes, and consider temporarily disabling GraphQL until an official patch is released.

A previously undocumented Linux toolkit has been targeting South Korean automotive and media organizations with minimal detection since early 2025. The campaign employs a HAProxy instance called ted backdoor, compiled within the victim's existing HAProxy version 2.8.12, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This sophisticated framework enables remote command execution, malicious script injection into web traffic, credential harvesting, and long-term surveillance. The ted backdoor uses HAProxy's native filter API and internal structures to intercept SSL-decrypted HTTP traffic while maintaining legitimate load balancing operations. Operating alongside are an SSH keylogger, a curl-based RAT with HAProxy health monitoring capabilities, and a deployment stager. The toolkit is attributed with medium confidence to DPRK APTs based on targeting patterns, simple XOR-based encryption schemes, custom substitution ciphers, and C2 infrastructure associated with APT37.

Toy Ghouls, a financially motivated group targeting Russian organizations since 2025, has deployed custom backdoors for the first time. Two versions were identified: mqtt-bird-agent using HiveMQ MQTT broker and matrix-bird-agent using Element messenger as command and control infrastructure. The backdoors are delivered via Windows Remote Management (WinRM) using tools like Evil-WinRM and WinRM-fs. They establish persistence as Windows services, encrypt configuration files using ChaCha20-Poly1305 algorithm, and execute commands via PowerShell or command line. The backdoors collect system metrics including CPU load, memory, and disk usage, and communicate with attackers through unconventional channels. This represents a significant evolution from their previous reliance on public GitHub tools and leaked ransomware builders to custom-developed malware.

Attack campaigns targeting Korean users have been observed deploying remote control tools including Radmin and UltraVNC to compromise systems. The initial intrusion vector remains unidentified, but attackers download compressed files containing batch scripts and remote administration software. Following Radmin installation, threat actors leverage access to deploy UltraVNC alongside proxy tools such as Netch-gateway and CCProxy, ultimately utilizing compromised systems as proxy nodes. Recent variants include SoftEther VPN deployment to establish VPN servers on infected infrastructure. PowerShell scripts containing Chinese language comments, combined with tools familiar to Chinese-speaking actors, suggest attribution to Chinese threat operators. The campaigns enable both remote system control and abuse of compromised infrastructure for proxy services.

Jamf Threat Labs discovered a cluster of 14 trojanized macOS applications distributed as DMG and PKG files impersonating legitimate software like The Unarchiver, Sketch, and Bartender. These samples are linked to the Contagious Interview campaign, a DPRK-attributed operation using fake job interviews as a pretext. The malware chain begins with unsigned, modified applications containing hidden executables that download staging scripts from infrastructure at 162.0.239[.]85. The attack progresses through multiple stages, ultimately deploying OtterCookie malware, which provides remote access capabilities, credential stealing from browsers and crypto wallets, filesystem scanning, and clipboard monitoring. The delivery method represents an evolution from previous Git hook and VS Code task-based attacks to standalone installer packages requiring manual quarantine attribute removal to execute.

Microsoft researchers identified a high-volume phishing campaign utilizing invisible Unicode tag characters (U+E0000 to U+E007F), a technique originally associated with AI prompt injection research known as ASCII Smuggling. The attackers inserted these invisible characters into financial keywords like 'funding' to evade email filters rather than hiding instructions from users. The campaign began February 9, 2026, generating millions of daily messages for approximately three months with a distinctive weekday-only pattern. Finance-themed disposable domains were used to send business loan and credit-line phishing through a legitimate email marketing platform. The technique, while designed for AI security contexts, proved effective at bypassing traditional keyword-based detection by splitting words with invisible characters that appear normal to recipients but break signature matches and alter ML tokenization.

A Chinese-speaking threat operator deployed an AI orchestration framework called SecFlow to conduct intrusions across Taiwan, Indonesia, China, Vietnam, and Afghanistan. The campaign utilized commercial AI models (Claude, Qwen, DeepSeek) as operational components for reconnaissance, exploitation, and data collection. The most significant compromise affected a Fengtai District government environment, achieving command execution, credential theft, and deployment of SecBox implants. Additional confirmed breaches included a Chinese education AI platform and university campus systems. The operator exploited eight CVEs including Shellshock, Log4Shell, and Spring4Shell, deploying steganographic GLUTTON webshells concealed in PNG images. Infrastructure was linked through the handle 'Nie' and associated domains under niestools.com, with operations routed through authenticated SOCKS proxies. Targets included government offices, political organizations, educational institutions, and telecommunications infrastructure.

A resurgence in Node.js abuse has been observed since February 2026, targeting government departments, technology companies, and hotels. Attackers leverage the legitimate, signed node.exe binary to execute malicious JavaScript payloads, evading signature-based detection. In one intrusion at an Asian technology company, attackers downloaded the official Node.js installer after repeated payload blocks and used it to run an implant communicating with Ethereum blockchain gateways via EtherHiding techniques. The same threat actors compromised a U.S. fintech firm, deploying the Rust-based C2Looper backdoor linked to ransomware operations. Multiple attacks involved ModeloRAT, associated with initial access broker Woodgnat, connected to ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo. Attackers employ ClickFix techniques for initial access and combine living-off-the-land tools with commodity malware.

Two distinct multi-stage network intrusion campaigns are actively targeting Latin American organizations, with attackers leveraging artificial intelligence tools to enhance their capabilities. The Mexican transportation campaign (CL-CRI-1131) impacted transportation organizations and government entities in Mexico and Ecuador, utilizing living-off-the-land techniques and self-hosted NextChat instances. The Brazilian financial campaign (CL-CRI-1163) employed custom RATs and tunneling tools including a Go-based SOCKS5 proxy. Both operations demonstrate technical overlaps including shared SOCKS5 infrastructure and reliance on commercial large language models like Claude and GPT-4.1 for operational orchestration. Attackers used AI to generate scripts and troubleshoot execution failures, evidenced by iterative file naming patterns and exposed NextChat interfaces. However, fundamental operational security failures, including exposed staging directories and unsecured interfaces, provided defenders clear visibility...

Multiple organizations experienced attacks beginning with social engineering that led to rogue ScreenConnect installations executing suspicious VBScript files. The attack chain involved four sequential VBScript payloads (1.vbs through 4.vbs) used to profile systems, check for security products, establish persistence, and deploy additional tools. Modified ScreenConnect clients enabled worm-like propagation by automatically transferring and executing these scripts on newly connected endpoints. The attacks included deployment of additional RMM tools like UltraViewer, cryptocurrency miners, and tunneling utilities. Systems were profiled based on installed security products, RAM capacity, and existing ScreenConnect installations. Persistence was achieved through Windows Registry Run Keys and concealed services. The campaign demonstrated sophisticated evasion techniques including AMSI bypass attempts, Windows Defender exclusions, and UAC bypass mechanisms.

An active malware campaign utilizes fraudulent software-download websites impersonating trusted vendors to distribute malicious installers. The operation primarily targets China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. The malicious installers deploy malware capable of establishing persistence, disabling Windows Update services, configuring Microsoft Defender exclusions, deleting volume shadow copies, and establishing command-and-control communications. Microsoft attributes this activity with moderate confidence to the Chinese threat cluster Silver Fox, known for using spoofed vendor download pages to distribute remote access trojans. The campaign leverages high-fidelity clones of legitimate vendor websites hosted on Chinese domains, delivering server-side generated payloads through ZIP archives.

Microsoft Threat Intelligence observed a sophisticated human-operated campaign exploiting Microsoft Teams external collaboration features to impersonate IT helpdesk personnel. Attackers socially engineer users into granting remote access via legitimate remote monitoring tools. Once established, they deploy malicious MSI packages through PowerShell, staging a portable Node.js runtime and obfuscated JavaScript implant for persistent command execution. The campaign progresses through extensive Active Directory reconnaissance, periodic screenshot captures, and lateral movement via Windows Remote Management toward high-value infrastructure including domain controllers. Unlike commodity phishing operations, this hands-on-keyboard intrusion leverages legitimate tooling throughout, blending malicious activity into normal enterprise operations. The reconnaissance patterns and targeting of identity systems indicate precursor activity consistent with data theft, extortion, or ransomware deployment objectives.

Analysis of server infrastructure revealed a complete TukTuk C2 framework (version 2.0) with cross-platform capabilities, including Windows and Linux agents, backend infrastructure, and management panel. The server contained eb.sys matching GentleKiller, along with comprehensive EDR neutralization training materials organized in four progressive lessons covering BYOVD techniques, vulnerable driver hunting, and kernel-level research. DLL sideloading configurations targeting Greenshot, ProcMon, Slack, and Postman were identified. Exfiltrated data included 224 Jira tickets from a global technology company containing information related to U.S. defense organizations and defense contractors, plus credentials from a global healthcare company's Infrastructure-as-Code platform exposing AWS keys, production databases, Azure AD, and Bitbucket access.

A Chinese-speaking cybercrime group dubbed Gambling Goblin has conducted a sustained campaign against Brazilian organizations since mid-2025, primarily targeting government and educational institutions. The attackers compromise web servers and install malicious Apache modules that silently reverse-proxy visitors to phishing pages while appearing to originate from legitimate domains. These phishing pages impersonate trusted app stores like Google Play and Microsoft Store but actually promote online gambling and sports betting. The operation manipulates search engine rankings by chaining together compromised high-reputation domains, particularly Brazilian government sites. The group deploys an extensive Linux toolkit including custom downloaders, backdoors, credential stealers, and reconnaissance tools, most heavily obfuscated to evade detection. Evidence shows the operation extends beyond Brazil with parallel infrastructure targeting Vietnamese, Spanish, and English-speaking victims.

ThreatFabric researchers discovered StreamRat, a sophisticated Android banking trojan distributed through Meta and TikTok advertisements disguised as a free TV-streaming service targeting Spanish-speaking users. The campaign reached approximately 570,000 potential victims, primarily in Spain. StreamRat employs a two-stage installation process, utilizing a dropper that implements internet-blocking mechanisms via non-functional VPN connections. Once installed, the trojan abuses Accessibility Services and MediaProjection API to provide operators with near-complete device control, featuring VNC and hidden-screen control, UI-tree collection, keylogging, credential-stealing overlays, and screen-blocking capabilities. The malware appears designed as a Malware-as-a-Service offering, with a sophisticated control panel supporting multiple user roles and WebSocket-based C2 communications.

Huntress researchers discovered Knight Office, a phishing kit utilizing Adversary-in-the-Middle techniques to steal Microsoft 365 session tokens. The attack chain begins with DocuSign-themed phishing emails containing redirects through Monday.com and compromised Joomla websites. Victims are directed to credential capture pages where session tokens are harvested and fed into the Knight Office console. These stolen tokens enable attackers to bypass multi-factor authentication entirely by using already-authenticated sessions. In one incident, attackers registered rogue devices in Microsoft Entra ID and bound Windows Hello for Business credentials for persistence. Analysis revealed nine phishing attacks linked to this kit over two weeks, with hundreds of related emails reported since April. The console, hosted at IP 104.37.188.94, manages at least 25 phishing domains using .vu top-level domains.

On August 31, 2026, U.S., Bulgarian, Hungarian, and Romanian authorities, collaborating with CrowdStrike and Shadowserver Foundation, successfully disrupted the Sality botnet through a peer-to-peer sinkhole operation. Active since 2003, Sality infects Windows executables and spreads malware for credential theft, spam distribution, and DDoS attacks. The botnet delivered EggJagger clipper malware, stealing at least $150,000 through cryptocurrency wallet substitution. The takedown exploited Sality's P2P architecture weakness by manipulating peer lists, isolating over 15,000 infected machines from threat actor control. This peer list manipulation technique prevented payload distribution by inserting sinkhole entries and removing legitimate peers. Associated domains were seized across U.S. and Europe. While the disruption stops new payloads, existing infections remain active requiring remediation. The operation demonstrates that resilient P2P criminal infrastructure can be dismantled through coordinated law enf...

A malware campaign uses counterfeit software-download websites impersonating trusted vendors to distribute malicious installers. The activity primarily targets China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. Malicious installers deploy payloads that establish persistence, disable security protections, and communicate with attacker-controlled infrastructure. The campaign employs dynamically generated installers with rotating hashes, spoofed vendor pages on .com.cn and .hl.cn domains, and randomized payload staging paths. Follow-on activity includes disabling Windows Defender, deleting shadow copies, neutralizing Windows Update, creating scheduled tasks for persistence, and establishing command-and-control over non-standard ports. Microsoft assesses this activity aligns with publicly reported Silver Fox operations but has not attributed it to a nation-state actor.

A compilation artifact, specifically a developer's home directory path (/home/tcherber/.cargo/), linked multiple malware families including a Rust-based infostealer named Zer0day Stealer, an HVNC remote-control tool, and ENIGMA Locker ransomware to a single developer. The infostealer exfiltrates cryptocurrency wallets, browser credentials, Office documents, and VPN configurations. The HVNC tool enables hidden remote desktop sessions and implements AMSI and ETW evasion techniques. Analysis revealed an actively developed, cross-platform malware operation spanning Windows, Linux, and macOS. Multiple droppers written in C, Rust, and PowerShell were discovered delivering the malicious payloads. Build timestamps indicated development occurred within weeks, and infrastructure leaked evidence of additional tools including FUD-Crypter, Botnet, and C2 Agent components, demonstrating how overlooked compilation artifacts enable comprehensive attribution and threat mapping.

Between late July and mid-August 2026, multiple organizations were compromised by a sophisticated modular RAT disguised as a legitimate Exodus cryptocurrency wallet. Victims were tricked through fake PDFs or software updates delivered via JavaScript files that downloaded a tampered Windows Installer package. The installer deploys genuine Exodus wallet version 24.33.4 with three modified files that prevent the user interface from displaying while establishing persistent access. The payload includes six modules providing hidden VNC, SOCKS proxy, browser credential theft, file management, remote shell, and script execution capabilities. Communication occurs via Azure Table Storage as a dead drop mechanism, avoiding traditional command and control domains. The RAT maintains persistence through scheduled tasks executing hourly and includes mechanisms to bypass corporate proxy configurations.

Mirage Kitten, an APT group historically focused on the Middle East and Africa, has deployed two previously undocumented cross-platform remote access trojans: NodeRabbit (Node.js-based) and PollCat (JavaScript-based). Both malware families mark the group's first departure from native malware toward scripting languages compatible with Windows, Linux, and macOS. Operators deliver these tools through sophisticated social engineering campaigns involving fake recruiters on LinkedIn who distribute trojanized coding challenges via Amazon S3 buckets. The malicious projects contain backdoored npm packages that silently install persistent implants. NodeRabbit implements comprehensive command-and-control capabilities including file operations, process management, and proxy-aware C2 communications through Azure and Cloudflare infrastructure. PollCat provides similar RAT functionality with specialized developer persistence mechanisms targeting VS Code extensions and Git hooks. Targeted sectors include aviation, aerospa...

Beginning in 2024, a financially motivated threat actor designated BREEZE COMET has conducted sophisticated operations targeting Brazilian financial services, retail, and eCommerce organizations. The group specializes in manipulating payment systems including Pix, STR, and Boleto to conduct fraudulent transfers worth tens of thousands of USD. Their evolved tactics leverage customized malware suites written in multiple languages including Rust, Nim, Golang, and Java, alongside compromised government websites for initial access and command and control. The threat actor demonstrates advanced capabilities by targeting banking software, payment APIs, and mTLS credentials while maintaining persistent access through multiple backdoors. Evidence indicates BREEZE COMET uses generative AI to accelerate malware development and script creation, suggesting potential expansion to other Latin American and African countries based on infrastructure replication observed in Nigeria, Paraguay, Ghana, and Venezuela.

Thirteen malicious Composer theme packages published on Packagist across five vendor namespaces inject JavaScript into Vietnamese movie and comic streaming sites. The injected code executes two operations: a mobile ad-fraud and gambling redirect chain, and on iPhones, a WebKit-to-kernel exploit chain installing spyware. The iOS chain weaponizes CVE-2025-31277 and CVE-2025-43529, targeting devices running iOS 18.4 through 18.6.x on iPhone XS through iPhone 16. The exploit chain progresses from WebKit renderer through GPU process to kernel escape via AppleM2ScalerCSCDriver, ultimately deploying spyware that exfiltrates keychain databases, cryptocurrency wallet seeds from seven wallet applications, Wi-Fi passwords, SMS, photos, contacts, and location data. Infrastructure resolves to FUNNULL, a sanctioned provider operated by Chinese national Liu Lizhi. The theme operators are Vietnamese-based, publishing trojanized forks of OphimCMS and KKPhim projects, affecting site operators who unknowingly serve malicious...

BraZetsu is a sophisticated Python-based Windows malware framework attributed to the Brazilian threat actor Exilware, functioning as a comprehensive toolkit for Initial Access Brokers. Unlike standard infostealers, BraZetsu transforms compromised systems into commercial assets through deep reconnaissance capabilities targeting Iberian and Latin American corporate, financial, industrial, and law enforcement environments. The framework scans for standardized financial remittance files in Brazilian CNAB format, extracts detailed browser histories, and employs AI-enhanced data triage for target prioritization. Operating through a modular architecture with stealth techniques, BraZetsu powers the Infected Marketplace where Exilware commercializes initial access to compromised hosts. The platform allows criminal customers to remotely execute secondary malicious payloads on purchased access, creating a persistent threat-multiplier effect. Tracked since February 2026, BraZetsu demonstrates rapid technical progressi...

A threat actor developed the Gryxa toolkit with substantial assistance from an AI coding agent, demonstrating how artificial intelligence lowers the skill barrier for creating sophisticated attack infrastructure. The actor operated across several hundred hosts despite lacking development experience, deceiving the AI agent by falsely claiming authorized testing purposes. Gryxa employs multiple persistence mechanisms including seven scheduled tasks, Windows event subscriptions, and redundant file copies, making it resilient to removal attempts. The toolkit includes monitoring capabilities that collect Windows logs and host artifacts after remediation attempts, potentially exposing defender tools and accounts. The actor iteratively improved the toolkit through 35 documented failed installations, working with the AI agent to enhance resilience. Organizations face challenges remediating devices outside centralized management, where Gryxa can rebuild faster than manual response efforts.

A new Mini Shai-Hulud worm variant named Trinitite was detected on August 28, 2026, targeting the npm package @7nohe/openapi-react-query-codegen, a TanStack Query codegen tool with over 150K weekly downloads. The attacker exploited a workflow vulnerability that allowed any GitHub user to trigger npm publish via pull-request comments, publishing ten malicious versions in twenty minutes. The worm uses XOR-wrapped loaders and obfuscated binding.gyp files to execute even when scripts are disabled. It steals credentials from GitHub, npm, PyPI, RubyGems, cloud services, Vault, and Kubernetes, exfiltrating data via GitHub commits. The malware establishes persistence through systemd services and includes a token revoke trap that can wipe user directories. This campaign appeared shortly after TeamPCP suspects were arrested in Australia, using the same toolkit but with new RSA keys and graffiti.

Check Point Research developed a fully static deobfuscation pipeline to analyze JSCeal, a sophisticated cryptocurrency-focused stealer delivered as compiled V8 bytecode. The malware uses javascript-obfuscator with multiple protection layers including RC4-encrypted strings, control-flow flattening, and proxy functions. The toolkit transforms View8 pseudocode without executing samples, enabling detailed analysis of capabilities including keylogging, browser credential theft, cryptocurrency collection, HTTPS traffic interception through a local MITM proxy, and active session replay using stolen cookies. Recent JSCeal variants have evolved to target macOS, use newer V8 versions, and add AES-256-CBC encryption layers around payloads, demonstrating active development.

Attackers are distributing the ValleyRAT backdoor disguised as legitimate Chinese adware called QN Wallpaper. The malicious installer deploys a modified version of the wallpaper management tool and uses DLL sideloading techniques to execute malicious code under a signed process. ValleyRAT is a sophisticated backdoor capable of keylogging, clipboard monitoring, screenshot capture, and delivering additional modules. The campaign has affected over 1,500 unique users, primarily in China and India, with more than 100,000 detections throughout 2026. Attribution points to the Silver Fox threat group, known for operating ValleyRAT. The attackers disabled Windows Defender, established persistence mechanisms, and implemented process protection techniques including marking processes as critical to trigger system crashes if terminated.

Between January and April 2026, a coordinated social engineering operation named Spring Ring leveraged external Microsoft Teams accounts to impersonate IT help desk personnel, targeting over 150 employees across at least 10 companies. Adversaries initiated voice phishing calls to coerce victims into executing remote monitoring and management tools or custom malware. In advanced variants, attackers transitioned from vishing to NTLM relay attacks targeting domain controllers. Two distinct campaigns were observed: Campaign A utilized RMM tools and obfuscated PowerShell-based RATs, while Campaign B employed tailored cloud infrastructure with PetitPotam exploitation for domain-level compromise. The operation demonstrates the weaponization of trusted collaboration platforms as primary attack vectors, exploiting the trust gap in SaaS applications.

On August 28, 2026, an attacker published 10 malicious versions of the npm package @7nohe/openapi-react-query-codegen by exploiting a flawed GitHub Actions workflow. The release pipeline contained an issue_comment trigger without author-association gates, allowing any GitHub user to trigger npm publishing from a forked repository. The attacker opened pull requests from a fork and used an npm publish comment to execute their code with OIDC token minting permissions. The payload employed dual execution triggers: a binding.gyp file exploiting node-gyp's Python evaluation to execute commands, and a preinstall hook. The main payload, 3FWCvzduYZg.js, was a multi-megabyte obfuscated script with three decryption layers leading to a bootstrapper that downloaded Bun v1.4.0. This attack pattern matches the Mini Shai-Hulud toolkit previously used in SAP and AntV compromises. All malicious versions were removed from npm.

A sophisticated TerminalFix campaign, a variant of ClickFix, targets organizations by leveraging compromised websites displaying fake Cloudflare CAPTCHA overlays. Users are tricked into copying and executing malicious PowerShell commands in Windows Terminal. The attack deploys a complex multi-stage chain combining DLL sideloading via LockScreenContentServer.exe, steganographic payload extraction from PNG images, dual persistence mechanisms through Registry Run keys and scheduled tasks, extensive Active Directory reconnaissance including domain trust enumeration and admin discovery, and ultimately a custom Python-based reverse-tunnel implant. This implant establishes encrypted WebSocket communication to attacker infrastructure, providing SOCKS-style TCP proxy access through the compromised host. The combination transforms victims into network pivot points, enabling attackers to access internal systems, escalate privileges, and potentially deploy ransomware across enterprise environments through hands-on-key...

An investigation into malware delivery infrastructure reveals an operator using GitHub repositories to stage malicious loaders and RAT payloads. Starting from commit metadata, researchers traced an email address to a compromised machine via stealer log databases. The infected workstation exposed a complete operational pipeline including multiple RAT families (AsyncRAT, DcRat, Remcos, XWorm), phishing templates impersonating Colombian government institutions, bulk email software, and commercial crypter services. The operator maintains delivery infrastructure across GitHub, Bitbucket, AWS S3, and DuckDNS for command-and-control. Phishing campaigns target Colombian organizations using judicial notification and traffic violation lures with password-protected archives. The investigation demonstrates how infrastructure analysis and operational security failures can expose entire malware production workflows beyond individual samples.

A sophisticated infection chain leverages PowerShell loaders to deliver encrypted NetSupport client payloads concealed within fake MP4 files. The malicious MP4 containers appear valid to basic file-type checks but contain 6.5 MB of encrypted data in ISO Base Media File Format uuid extension boxes rather than playable video content. The attack begins with PowerShell delivered via Cloudflare-fronted infrastructure, performing environment checks before retrieving the carrier file. A secondary script parses the MP4 structure, extracts and decrypts an embedded 16.8 MB PowerShell payload, then deploys NetSupport Manager with silent operation configured. Infrastructure spans 40 live endpoints across six autonomous systems, primarily in Frankfurt and Los Angeles, with command-and-control gateways registered 77 seconds apart. The toolkit employs Russian-language business site decoys and rotates carriers frequently without backward compatibility.

A Chinese-language executable disguised as a resume claiming to be from a Beijing Institute of Technology graduate student delivers SNOWLIGHT and VShell RAT. The infection chain uses a custom Go loader with sandbox detection, CPU checks, and sleep-timer evasion before downloading a legitimate DOCX decoy. It then executes a 1,454-byte SNOWLIGHT stager that connects to infrastructure, downloads 4.65 MB of data, XOR-decodes it with key 0x99, and launches a fileless VShell RAT. The lure targets mainland Chinese academics in electrical engineering, power systems, or AI research, providing operators with command execution, file access, screen capture, and lateral movement capabilities. The delivery uses panel-generated SNOWLIGHT components now widely available in cracked VShell releases, making actor-level attribution unreliable beyond identifying an unattributed operator using commodity tooling with China-oriented academic targeting.

During July 2026, multiple APT campaigns targeted entities in South Korea primarily through spear phishing attacks utilizing LNK files. Seven distinct attack types (A through G) were identified, each employing different techniques including PowerShell scripts, AutoIt programs, curl.exe downloads, and DLL side-loading. Attackers distributed malware through platforms like GitHub, Google Drive, and Dropbox, often disguised as legitimate documents or resumes. These campaigns deployed backdoors, infostealers, keyloggers, and XenoRAT malware to exfiltrate system information, credentials, virtual asset data, and maintain persistent access through Task Scheduler entries. Communications occurred via PubNub channels with data encoded in Base64. The attacks primarily began with phishing emails containing work-related content designed to deceive specific victims into executing malicious files.

A misconfigured open directory on IP address 86.53.111[.]212:8080 exposed critical details of an active cybercrime operation, including Moobot botnet source code, denial of service tools with attack records, and a fraudulent Chinese identity verification service. The exposed directory also contained StresD Pro+, a multi-user DDoS panel with 16 registered accounts and 32 recorded attacks on the collection date. The recovered Moobot source code revealed a previously unknown dormant download-and-execute functionality that represents the most plausible mechanism behind APT28's repurposing of Moobot for deploying malware to compromised devices. Despite a 2024 court-authorized disruption by the U.S. Department of Justice, Moobot remains active as of August 2026, with one active C2 server observed conducting over 500 short-duration attacks throughout the month, consistent with DDoS-as-a-service operations.

Socket Threat Research team identified 19 malicious browser extensions (18 Chrome, 1 Edge) published in the last six months, delivering an extendable malware framework. These extensions establish WebSocket communication with command and control servers, strip Content Security Policy headers, and use XSS injection to execute malicious payloads. The primary focus is cryptocurrency wallet secret stealing and crypto draining. The threat actor employs two publishing approaches: creating malicious extensions from scratch or acquiring legitimate extensions with established user bases and weaponizing them. The most impactful case involves the 'Enable Right Click & Copy' extension, which had approximately 70,000 Chrome users and 10,000 Edge users when compromised. The campaign, tracked as 'Superior', has been active since February 2024, demonstrating sophisticated operational capabilities and persistent evolution of malicious modules targeting multiple cryptocurrency platforms, exchanges, and credential harvesting.

Wiz Threat Research deployed honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, and Ollama, observing sustained attack activity over 90 days. Three distinct attack patterns emerged: exploitation of Internet-facing MCP servers for remote code execution through authentication bypass and command injection vulnerabilities; blind prompt injection attacks against AI agent frameworks using out-of-band DNS callbacks to confirm execution; and AI-native post-exploitation techniques adapted to AI infrastructure internals, including extracting master keys from Python module state and staging cryptominers in framework-specific directories. Attackers demonstrated deep knowledge of AI tooling internals, targeting credential concentration points where proxies hold multiple provider keys, and exploiting agent reachability to execute instructions embedded in requests. The campaigns primarily deployed XMRig cryptominers, leveraging framework-specific paths and processes for camoufl...

Three distinct implants—SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS—have been discovered embedded in ZBT router firmware distributed through a global supply chain reaching the United States, Canada, Australia, Philippines, Germany, and Russia. DARKLANTERN is an unauthenticated UDP backdoor listening on port 9992, offering root shell access from the internet with trivial MAC address bypass. SPEAKINGSTONE is a phone-home surveillance implant that beacons to ZBT's cloud infrastructure, capable of DNS hijacking, ISP credential theft, and remote command execution. A sinkholed backup domain revealed 392 devices, 390 located in China, primarily on China Mobile's network. Internet scans identified 203 DARKLANTERN instances across 22 countries. These implants use plaintext protocols without authentication, making them hijackable by any network adversary. The affected hardware appears in white-labeled consumer products sold through mainstream retailers, representing embedded surveillance capabilities in commerciall...

In July 2026, Microsoft Threat Intelligence uncovered a supply chain attack targeting the official AsyncAPI NPM organization. Attackers published malicious versions of multiple packages under the trusted AsyncAPI namespace, exploiting developer dependencies to distribute malware. The compromised packages deployed a multi-stage Remote Access Trojan through obfuscated lifecycle hooks that executed during routine build workflows. Upon installation, the malware retrieved second-stage payloads from IPFS gateways, established persistence on infected systems, and initiated command-and-control communications with external infrastructure. The attack leveraged trusted build automation and dynamic package retrieval via npx to bypass traditional security controls, affecting developers executing version-pinned tasks in their CI/CD pipelines.

This analysis examines how poorly-designed AI guardrails in security operations can inadvertently assist threat actors by hindering defensive capabilities. The piece argues that while guardrails are necessary, their implementation and control by third-party AI providers can create safety penalties that slow or halt security investigations. When agentic Security Operations Centers experience refusals from overly restrictive filters, attackers gain valuable time to complete their missions. The author advocates for operational sovereignty, where security teams maintain control over their own guardrails and can customize them according to their specific threat models. Organizations need flexibility to temporarily adjust safeguards under authorized circumstances, something impossible with inflexible frontier provider controls. The piece emphasizes that defenders' traditional advantage requires engaging with threat landscape realities while ensuring adversaries cannot derail investigation and response processes.

Between late September 2025 and early April 2026, BlueDelta conducted espionage campaigns against government and diplomatic organizations in Romania, Spain, and Türkiye. The threat group deployed HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents using diplomatic-themed lures, including material impersonating Spain's Ministry of the Presidency created after a September 2025 meeting between Spanish and Moldovan officials. HOOKEDGE shares significant code and tradecraft overlap with the previously documented HEADLACE backdoor, abusing legitimate webhook services for command-and-control, payload staging, and data exfiltration. The implant underwent continuous refinement to evade sandbox environments and adapt to webhook service limitations. BlueDelta employed a tiered operational model, deploying second-stage payloads with shorter beaconing intervals for high-value targets while preserving initial-access infrastructure.

The Gentlemen is a financially motivated ransomware group operating since July 2025 using a Ransomware-as-a-Service model with dual-extortion tactics. They exfiltrate sensitive data before encrypting systems, targeting Windows, Linux, and ESXi environments. The group focuses heavily on preparation before encryption, using legitimate administrative tools like PowerRun.exe for privilege escalation, and establishing persistence through multiple mechanisms including registry modifications, scheduled tasks, and autostart configurations. They disable security tools, delete logs, terminate database and backup services, and use XChaCha20 and Curve25519 encryption. Primarily targeting medium-to-large organizations in the Asia-Pacific region, their activity has increased by 2,100% compared to typical levels. Victims receive ransom notes with approximately 10-day deadlines threatening to publish stolen data on leak sites if demands are not met.

AnonyMousKIT is an AI-powered Phishing-as-a-Service platform engineered to disable Apple's Activation Lock on stolen devices. Operating as a credit-metered system, it automates credential harvesting through email, SMS, WhatsApp, and AI-driven voice phishing calls. The investigation exposed a reseller supply chain spanning 506 domains and 168 storefront brands active since early 2024. The platform targets owners of stolen Apple devices using device-specific lures with internal model identifiers and real-time Find My statuses. Conversational AI agents impersonating Apple Support conduct vishing operations, with over 200 calls placed primarily to Brazil at minimal cost. Coding vulnerabilities exposed 120,242 lines of operational logs, revealing 689 distinct WhatsApp operator accounts and detailed attack infrastructure. The ecosystem operates through a decentralized enterprise structure with developers, resellers, and hundreds of subscriber-operators monetizing stolen iPhone hardware through industrialized soc...

An exposed directory revealed extensive Aurora ransomware operations by a Russian-speaking affiliate active against over twenty organisations between April and July 2026. The misconfigured server exposed the operator's complete toolkit, shell history, AI-assisted attack planning via Cursor, and the Aurora encryptor written in Zig. CloudSEK recovered keys enabling visibility into ransom negotiations and traced payments on-chain in partnership with TRM Labs, identifying connections between multiple victims through shared laundering infrastructure. The operator demonstrated sophisticated capabilities including Active Directory compromise, ADCS exploitation, and ESXi targeting, while consistently excluding CIS ranges and domains. Four victims have appeared on Aurora's leak site, though financial analysis suggests broader impact with varied affiliate payment splits.

A China-nexus infrastructure provider operates as a 'quartermaster' offering reconnaissance, proxy orchestration, and traffic routing services to Chinese cyber espionage actors. The operation consists of four interconnected components: QScan for target reconnaissance, Fast Labyrinth providing encrypted relay networks through co-opted commercial proxy infrastructure, QTRouter managing access to proxy systems, and QTProxy controlling operational nodes. The infrastructure targets research universities, defense networks, government agencies, and critical infrastructure globally, particularly in the U.S., U.K., and Asia-Pacific regions. By exploiting commercial 'Airport' proxy services designed to bypass China's Great Firewall, specifically fastlink.ws, the quartermaster enables multiple threat actors to conduct operations while maintaining anonymity through shared infrastructure, representing a significant evolution in state-sponsored cyber operations.

This analysis examines infrastructure used by multiple Russian cyber espionage clusters targeting individuals in academia, think tanks, and organizations across Europe and the United States. The investigation expands on three threat clusters (UNC6293, UNC7005, and UNC5976) that employed OAuth phishing, Microsoft device code phishing, and WhatsApp targeting. UNC6293 utilized lure domains impersonating the Council on Foreign Relations and government portals, with possible Evilginx configurations. UNC7005 demonstrated lower sophistication with poor operational security, using domains like my-invite[.]org for phishing campaigns. UNC5976 employed Google Drive impersonation domains for OAuth phishing. The analysis leverages historical DNS data, CSS hash similarities, favicon analysis, registration patterns, and certificate information to identify additional infrastructure and tracking methods for discovering related malicious domains and IP addresses.

A suspected Chinese-speaking threat actor conducted targeted intrusions against Philippine nuclear research and defense organizations. On August 13, 2026, an open directory on a VPS exposed custom Python scripts exploiting CVE-2023-49105 in ownCloud and CVE-2024-28000 in WordPress LiteSpeed Cache. The operator exfiltrated approximately 9 GB from a nuclear agency, including reactor core databases, radiation safety documentation, employee PII, BitLocker keys, and strategic planning materials. A second victim, a marine engineering firm serving the Philippine Navy, had its complete WordPress installation compromised. Simplified Chinese language usage throughout scripts, logs, and folder structures indicates operator origin. The methodical targeting of nuclear and naval defense sectors aligns with South China Sea tensions and broader Chinese espionage activities against Philippine government infrastructure.

During a targeted intrusion investigation in June 2026, investigators uncovered GoCaracal, a previously undocumented modular framework written in Go. This sophisticated toolkit exists in two operational profiles: a lightweight implant for establishing access and delivering payloads, and an extended build for sustained intelligence collection with capabilities including keylogging, browser credential theft, WebRTC remote desktop, and SOCKS5 proxying. Analysis of 249 samples traced the framework's evolution from January to July 2026, revealing active development and maturation. A notable innovation includes an Ethereum smart-contract fallback mechanism enabling operators to update C2 infrastructure without redeploying malware. The activity targeted a Venezuelan communications organization using Spanish-language financial lures, weaponized SVG files, and delivery methods consistent with established tradecraft. GoCaracal was deployed alongside an updated Bandook variant, suggesting the new framework currently ...

An Iranian-linked cyber-espionage group known as Tortoiseshell has enhanced its malware arsenal with newly identified tools, including a reverse SSH tunneling utility and a C++ backdoor. The SSH tunnel, disguised as wtsapi32.dll, leverages Windows OpenSSH client to establish connections with command-and-control infrastructure. The backdoor, showing similarities to TWOSTROKE malware, supports file execution, shell commands, in-memory DLL execution, and file manipulation capabilities. Infrastructure analysis revealed domains with subdomains referencing UAE, Saudi Arabia, UK, Belgium, Canada, Australia, and Japan, suggesting expanded targeting beyond the group's traditional focus on defense, aerospace, IT service providers, and military organizations in the Middle East and United States. Active since 2018, the group continues operations with persistent infrastructure despite domain suspensions.

A sophisticated phishing operation initially appearing to target Canadians with fake Canada Revenue Agency T4 tax documents has evolved into a global campaign spanning 46 countries, with 45% of activity concentrated in the United States. Attackers impersonate trusted organizations including the Social Security Administration, Adobe, and various tax authorities to deliver legitimate Remote Management and Monitoring software that is then abused for unauthorized remote access. The campaign employs a reusable delivery kit featuring password-protected archives, browser fingerprinting, and Telegram-based victim filtering. Infrastructure rotates rapidly across 240 hosts, predominantly using Vercel deployments that provide legitimate TLS certificates and domain reputation. The operation leverages signed commercial RMM tools including GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian, making signature-based detection ineffective. Activity has remained steady from January 2026 onwards, targeting ...

In May 2026, threat actors exploited CVE-2026-35616, an improper access control vulnerability in Fortinet EMS versions 7.4.5 through 7.4.6, to deploy EKZ Stealer within an energy sector organization. The malware was disguised as FortiEndpoint_Patch.exe and harvested browser credentials from Chromium-based browsers and Firefox before exfiltrating data via PowerShell to a command-and-control server. EKZ Stealer employs sophisticated compiler-based obfuscation techniques including indirect jumps, control-flow flattening, and XOR-based string encryption to evade analysis. The technical analysis demonstrates how Binary Ninja Workflows can be leveraged to defeat these obfuscation methods by matching repeatable Intermediate Language patterns and rewriting LLIL/MLIL expressions to restore readable control flow, significantly accelerating malware reverse engineering efforts.

OX Security identified a campaign distributing fake Cloudflare Captcha pages through 24 malicious npm packages. The threat actors exploit npm mirrors like unpkg, yarn, and npmmirror as free hosting infrastructure for phishing content. Each package contains an HTML page that displays a fraudulent Cloudflare verification interface. When accessed through mirror sites, these pages appear on trusted domains, increasing their credibility. The initial versions redirected victims to a typosquatted Microsoft domain, while later iterations used legitimate key-value storage services to dynamically retrieve redirection targets. Although downloading the packages is harmless, accessing the HTML files through mirror URLs can lead to ClickFix delivery or other phishing attacks. The campaign demonstrates infrastructure abuse where npm registries serve as persistent, validated storage for malicious payloads.

ERMAC and HookBot are two branches of one Android banking trojan sold as a service, forking from shared code originating with Cerberus. A copy of the builder, Laravel backend, and React panel leaked in August 2025, enabling unrelated operators to deploy panels with default credentials and keys still in place. The lineage runs Cerberus to ERMAC to Hook, confirmed through source code analysis showing identical database migrations and network protocol structures. HookBot added VNC remote control and 38 new commands while maintaining ERMAC's core. The leaked source includes a Docker stack, Obfuscapk builder, and IP-whitelist firewall that hides panels but leaves the builder port exposed. Operators target 484 apps across 40+ countries including Japanese banks, Brazilian financial institutions, Turkish banks, and cryptocurrency wallets. Detection artifacts survive in builder obfuscator flags and favicons, while panel titles remain easily changed.

Analysis of over 400 AI-integrated malware samples reveals that approximately 97% exist only in research repositories and sandboxes, never reaching production environments. Of 405 samples examined, only 12 appeared on protected endpoints across three countries, spanning five malware families including FunkSec ransomware, trojanized AI applications, Oyster backdoor, Rhadamanthys stealer, and COM hijacking DLLs. All samples were successfully detected and blocked by existing behavioral detection, cloud-based sandboxing and endpoint analytics. The AI component influences code authorship rather than execution patterns, enabling faster development cycles as evidenced by FunkSec's seven variants compiled within six days. Findings indicate AI lowers barriers to malware creation but has not yet enabled evasion of established defensive mechanisms, with opportunistic rather than targeted distribution patterns observed.

A sophisticated multi-stage loader dubbed PavinLoader has been identified across multiple distribution campaigns including ClickFix attacks, fake software downloads, and malicious RenPy games. The loader employs heavily obfuscated .NET DLLs, abuses legitimate Windows tools like MSBuild, and utilizes EtherHiding technique to retrieve command-and-control domains via blockchain. The infection chain consists of four main stages: a Loader DLL performing anti-forensics, an EtherHiding Loader obtaining C2 infrastructure, an Anti-Analysis DLL checking for virtualized environments, and a PE Loader delivering final payloads including Amatera Stealer. Evidence suggests PavinLoader may be offered as a Loader-as-a-Service, with common artifacts found across over 200 related files. The campaigns demonstrate sophisticated evasion techniques including custom obfuscation, API hashing, and extensive anti-analysis checks targeting virtualized environments and specific geographic regions.

Cybercriminals are exploiting the hype surrounding Grand Theft Auto VI by creating fake Rockstar Games websites that appear in search results offering a GTA 6 demo. These sites impersonate legitimate promotional material for Rockstar's official Extended Look scheduled for August 27 on Netflix. Visitors who click 'Play Now' buttons download gta6_installer.exe, a Vidar infostealer. The malware steals browser-saved passwords, cookies, authenticated sessions, autofill data, and FTP credentials from 19 different browsers including Chrome, Edge, and Firefox. The executable uses legitimate browser binaries in headless mode to access protected data, making credential theft more effective. Stolen session tokens can be reused without triggering two-factor authentication, allowing attackers persistent access even after password changes. The campaign exploited recent GTA 6 leaks that began circulating August 18.

A network of fraudulent websites branded as SysScan with Microsoft logos are conducting fake security scans to deceive victims into uninstalling legitimate antivirus software. Eleven sites hosted on a single server run convincing but fabricated security checks using basic browser data, deliberately constraining security scores between 13 and 30 out of 100 to guarantee failure. The scam falsely claims Windows no longer supports third-party antivirus and tricks victims into providing personal information, banking details, and remote-access credentials through a detailed form that transmits data directly to Telegram. After form submission, victims receive calls from supposed refund managers who exploit the removed security protections. The operation shows indicators of AI-generated code and targets both consumer and enterprise security software users.

Threat actors are conducting sophisticated recruitment-themed phishing campaigns by impersonating HR personnel from prominent companies. The attacks leverage Browser-in-the-Browser techniques on desktop, while mobile devices display full-screen counterfeit login pages without visible URL indicators. The malicious infrastructure actively screens victims, rejecting personal emails to specifically target corporate credentials and enterprise access. Analysis reveals persistent hosting patterns primarily using Amazon and SEDO networks, with attackers impersonating brands including Amazon, Louis Vuitton, Apple, FIFA, Emirates, Boeing, Heineken, Deloitte, and Lego. Traditional threat feeds show significant delays in detecting these domains, with detection gaps ranging from 7 days to over 6 years. The campaign enables credential harvesting, OAuth token theft, and lateral movement within organizations.

Multiple ClickFix campaigns were identified employing three distinct delivery mechanisms while sharing common characteristics including DLL sideloading, consistent file-naming conventions, and command-and-control dead drops. The first campaign used remotely hosted MSI packages containing legitimate software to sideload malicious DLLs. The second leveraged NodeJS to execute JavaScript files, while the third utilized Python 3.5 to conceal and execute payloads. All campaigns originated from ClickFix lures and employed aggressive social engineering tactics, including direct phone contact directing victims to compromised WordPress sites. Post-compromise activity included extensive discovery commands and Active Directory enumeration. Infrastructure overlap and tactics indicate connections to the Lorem Ipsum malware family and Vanilla Tempest operations, with potential ransomware deployment as the final objective.

A masqueraded scheduled task alert triggered an aggressive threat hunt that uncovered a complete FakeAgent intrusion campaign within ten minutes using an automated threat hunting agent. The campaign leveraged malvertising on Bing to distribute trojanized Claude Desktop installers hosted on legitimate Anthropic infrastructure. The attack chain featured DLL sideloading via Java Chromium Embedded Framework, Microsoft Defender tampering, scheduled task persistence masquerading as Microsoft Edge updates, and blockchain-based command-and-control infrastructure using EtherHiding techniques. The hunting agent executed correlated queries across multiple kill chain phases simultaneously, providing confidence-scored findings that enabled rapid validation and remediation. The intrusion delivered SectopRAT malware with infostealing and remote desktop capabilities, requiring full endpoint reimaging and credential resets.

A sophisticated macOS campaign exploits ClickFix social engineering, deceiving victims into executing malicious AppleScript commands via fake CAPTCHA verification pages. The attack chain deploys a persistent backdoor agent that utilizes EtherHiding, storing C2 addresses in Polygon blockchain smart contracts, making infrastructure detection challenging. The infection establishes persistence through LaunchAgents and deploys multiple payloads including the AMOS stealer targeting cryptocurrency wallets, browser credentials, and macOS Keychain data, alongside XMRig cryptominer for sustained revenue generation. The operation demonstrates advanced evasion through character-ID obfuscation, blockchain-based infrastructure, and abuse of legitimate macOS utilities. Analysis of blockchain transactions reveals complete C2 rotation history and funding trails, providing defenders with infrastructure-level pivots despite the campaign's memory-resident execution model.

The Head Mare APT group exploited two vulnerabilities in TrueConf video conferencing servers to deliver PhantomCore malware to conference participants. Attackers used these vulnerabilities to execute arbitrary code, replace legitimate client installers with malicious versions, and deploy web shells. When participants downloaded the TrueConf client from compromised servers, they received infected installers that deployed PhantomCore backdoor, granting attackers full control over infected systems. On Linux servers, additional backdoors were installed using GitHub as a command and control channel. The vulnerabilities affected TrueConf server versions released since 2022 and were patched in versions 5.3.9, 5.4.9, and 5.5.5 released in June 2026. Organizations whose employees participated in video conferences using TrueConf may have been affected, even if they don't operate their own TrueConf servers.

A sophisticated modular loader utilizing multiple programming languages to evade detection has been discovered. The attack begins with Microsoft Teams phishing where attackers impersonate IT helpdesk personnel, convincing targets to install a fake PowerShell cleaner via MSI installer. The malware deploys memory-resident components bridging Python, C#, C++, and PowerShell to profile systems, establish persistence via scheduled tasks, and deploy a fake Windows lock screen to phish user credentials. Additional modules include a reverse proxy for network tunneling, enabling threat actors to access internal corporate systems using compromised credentials, plus remote shell and VNC capabilities for hands-on-keyboard attacks. The elaborate multi-stage infection chain suggests potential ransomware operations or initial access brokering.

A coordinated supply chain attack compromised three legitimate Rust crates maintained by David Roundy: arrayref, internment, and append-only-vec. The threat actor injected a malicious dependency called proc-macro1, a typosquat of the legitimate proc-macro2 crate. This malicious package executed cross-platform malware automatically during Cargo builds through its build.rs script. The attack delivered platform-specific stage-2 backdoors for Linux, macOS, and Windows that profiled victims, collected browser data, established persistence, and provided remote command execution capabilities. The malware communicated with command-and-control infrastructure at 23.254.165.112 and included a domain generation algorithm for fallback. Developer workstations, CI/CD runners, and release infrastructure were particularly at risk, as the compromise occurred during normal compilation processes. The Rust Security Response Team removed the malicious releases and locked the maintainer account, believing the legitimate maintain...

On August 20, 2026, malicious versions of three Rust crates were published to crates.io: arrayref@0.3.10, internment@0.8.7, and append-only-vec@0.1.9. The malicious crates added a typosquatted dependency (proc-macro1) whose build script downloads and executes a remote binary at compile time. The payload is a featureful backdoor that beacons to C2 via HTTPS, exfiltrates host information, enumerates installed applications, reads browser profiles for saved logins, and persists via Registry Run key, LaunchAgent, or systemd user service. The campaign's infrastructure substantially overlaps with operations attributed to North Korean actors, including shared C2 endpoint patterns with the Mastra campaign and IP addresses used in the axios npm attack.

Three distinct suspected Russian cyber espionage threat clusters—UNC6293, UNC7005, and UNC5976—are abusing legitimate authentication flows to target individuals in academia, aerospace, defense, governments, and think tanks across Europe and the United States. These groups conduct sophisticated phishing campaigns using app password phishing, OAuth phishing, device code phishing, and malware deployment. UNC6293 and UNC7005 are assessed with moderate confidence to be initial access clusters linked to ICE RELIC (formerly APT29), while UNC5976 appears distinct. Operations leverage social engineering through fake diplomatic invitations, conference registrations, and file sharing pages. UNC7005 was tied to hospitality captive portal redirects and deployed MaaS infostealers including VIDAR and ATOMIC. These actors abuse legitimate authentication mechanisms including Google OAuth, Microsoft device codes, and WhatsApp device linking to compromise personal accounts, making detection challenging for organizations.

Investigation into residential proxy networks reveals that bandwidth-sharing applications like PEER2PROFIT recruit users to share internet connections for payment, then monetize this bandwidth through commercial proxy service ASTROPROXY at up to 27 times the original cost. Over 72 hours, researchers identified 117,224 unique IPs across residential, mobile, and datacenter pools, with residential pools adding over 1,000 new IPs hourly. These applications install through official channels with user consent, making them invisible to traditional security tools. Reverse engineering of the Windows SDK revealed the communications protocol and backconnect infrastructure coordinating proxy sessions. Testing demonstrated that proxy networks could access internal network resources through simple DNS entries resolving to internal IPs, potentially exposing corporate assets. The scale, legitimacy, and internal network access capabilities present significant risks to organizations where employees may unknowingly expose co...

N4D Mesh Controller is an active Linux malware campaign exploiting exposed Model Context Protocol (MCP) servers and various internet-facing services for credential theft, lateral movement, and command and control. First documented in June 2026, recent analysis reveals evolved tactics including a new loader-to-agent chain, rotated infrastructure using IP 209.99.186.235, and an agent labeled "33.8-go-titan" that enumerates MCP tools and executes commands. The campaign automates discovery and abuse of dangerous MCP capabilities, particularly command execution tools, without requiring traditional vulnerabilities. The agent establishes persistence through multiple mechanisms including cron entries, systemd units, SSH keys, and watchdog scripts, while scanning for additional targets across databases, container platforms, AI infrastructure including Ray Dashboard and LightLLM, and cloud services. Secondary access is maintained through Cloudflare Quick Tunnels.

Kimsuky conducted spear phishing campaigns against South Korean and Japanese targets during the first half of 2026, distributing LNK malware through OneDrive share links. The malicious files established scheduled tasks that periodically fetched PowerShell scripts from command-and-control servers to profile systems, exfiltrate Thunderbird and Outlook email data, and log keystrokes. The threat actor installed legitimate remote control software including Chrome Remote Desktop and AnyDesk to evade antivirus detection and maintain multiple access channels. A malicious Chrome extension designed to steal Gmail data exhibited characteristics of AI-generated code, featuring Korean comments, debug strings, and Unicode emoji throughout. The operation employed rotating infrastructure and compromised legitimate Korean servers as command-and-control nodes to impede tracking efforts.

In August 2026, an operator published forty typosquatted npm packages mimicking popular libraries like chalk, axios, commander, lodash, react, and typescript. Each package contained an install script that profiles the host and, when detecting Windows or WSL environments, downloads a 22MB Rust-based executable from GitHub. This payload runs entirely in memory without dropping files to disk, targeting cryptocurrency wallets, browser credentials, cookies, and Telegram sessions. The malware uses legitimate services for reconnaissance and exfiltration, making detection and takedown difficult. While npm packages were removed within 84 minutes, the GitHub-hosted payload remained active for an additional 39 hours, and the command-and-control server continued operating. The campaign specifically targets developers using WSL by crossing the boundary between Linux environments and underlying Windows systems.

A Chinese-speaking cybercrime group designated UAT-10147 has been identified targeting Windows and Linux web servers worldwide, affecting organizations across government, education, media, technology, and gaming sectors. The adversary exploits publicly disclosed vulnerabilities to achieve initial access at scale, then deploys AI-driven tooling throughout exploitation, reconnaissance, payload generation, validation, and persistence workflows. The operation leverages open-source offensive frameworks including Metasploit, ysoserial, PentestGPT, and DeepAudit to automate intrusion operations. UAT-10147 demonstrates an emerging capability of integrating semi-autonomous AI systems for iterative exploit refinement, adaptive troubleshooting, and operational documentation generation. Targeting includes approximately 170,000 URLs across multiple countries, with post-compromise activities involving deployment of various implants, BadIIS installations, and SEO fraud operations.

Educational institutions continue to be the most targeted sector globally, experiencing an average of 4,696 weekly cyberattacks per organization between January and July 2026, representing an 8% increase year-over-year and more than double the cross-industry average. The back-to-school period sees intensified malicious activity, with July 2026 recording 4,848 weekly attacks. Threat actors are registering thousands of education-themed domains, with one in every 226 newly registered domains being malicious. APAC leads with 7,452 weekly attacks, while Europe and Latin America show the fastest growth at 18% and 42% respectively. Attackers deploy phishing campaigns impersonating retailers, schools, and Microsoft 365 to steal credentials and financial information from students, educators, and families during peak enrollment periods.

A newly identified Android malware family named Manic combines banking malware and mobile spyware capabilities, targeting Ukrainian banks, government services, messaging applications, Russian and European financial institutions, and global fintech and cryptocurrency services. Active since February 2026, Manic enables extensive Device Takeover operations through sophisticated surveillance and remote-control features. It employs advanced PIN stealing techniques without requiring traditional overlay attacks, utilizing Accessibility services as a UI keylogger to capture lock-screen inputs, recovery phrases, and authentication codes. A distinctive feature is its Wi-Fi mesh egress technique, allowing compromised devices to relay stolen data through other infected phones via Wi-Fi Direct, Bluetooth, or BLE when direct C2 access is unavailable. The malware monitors 169 applications including banks, cryptocurrency wallets, government eID services, and military-focused messengers across multiple countries.

A network of 41 fraudulent websites has been identified impersonating popular games and Windows software to redirect users toward Download Studio installer. These sites advertise legitimate products including Counter-Strike, Half-Life, Fallout, Roblox, VLC, 7-Zip, and VMware using authentic product information and real download links. The deception employs JavaScript to display legitimate URLs when hovering over download buttons, but redirects users elsewhere upon clicking. Sites target users seeking everyday software and security tools, pushing them through affiliate redirects to Download Studio installation. The campaign is particularly concerning as Download Studio's automatic updater was previously compromised in 2020 to distribute FakeMBAM backdoor and cryptocurrency miners, though no current malicious activity is confirmed.

SilkParasite is a cyberespionage operation assessed with medium confidence as China-nexus that targeted government bodies across Central Asia. Seven remote access tool families were deployed, five of which were previously undocumented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The toolset is small, modular, and professionally engineered with traces of AI-assisted development. Initial access occurred through malicious Microsoft Office documents delivered via spear-phishing, using regionally tailored lures impersonating government ministries. The operation leveraged DLL sideloading as the primary delivery mechanism and used Google Drive for command-and-control communications to hide within trusted services. Infrastructure analysis identified connections to China Unicom's backbone network, and operational patterns suggest a functioning software organization with maintained build pipelines and careful operational security.

Socket identified a coordinated campaign involving 77 Firefox extensions designed to steal cryptocurrency wallet secrets and credentials. The operation, tracked as 'Offside Wallet Theft Factory', includes 40 confirmed malicious extensions that exfiltrate recovery phrases, private keys, and credentials through Supabase-controlled remote switches, Cloudflare Workers, and hardcoded command-and-control infrastructure. An additional 37 deceptive sports-score shells share publishing artifacts and version histories showing transitions from benign utilities into wallet-stealing malware. The campaign operated from at least March 2026 through August 2026, targeting Web3 users through impersonations of OKX, Rabby Wallet, TronLink, and other cryptocurrency products. Extensions capture secrets through phishing interfaces, modified wallet code, and direct credential theft, enabling immediate cryptocurrency theft and financial harm.

Grandoreiro, a notorious banking trojan active since 2016 across Latin America, continues operations despite major law enforcement disruption in 2024. Recent campaigns leverage DLL sideloading techniques, abusing the legitimate Duplicate Files Finder application to execute malicious code. The loader incorporates extensive anti-analysis mechanisms including sandbox detection, virtual machine artifact checks, process blacklisting, and environment profiling to evade automated analysis systems. These defensive checks occur before C2 contact, indicating high priority on avoiding detection. Telemetry from June 2026 shows activity concentrated in Latin America, primarily Mexico, with limited presence in Europe and North America. The malware uses custom string obfuscation combining proprietary decryption with Base64 encoding, and communicates with C2 infrastructure over TCP port 6432 using encrypted requests containing host-specific information.

A sophisticated backdoor disguised as a legitimate Malwarebytes installer was distributed to over 100,000 machines through compromised automatic updates of one torrent client (Download Studio) and three adblockers (NetShield Kit, My AdBlock, and Net AdBlock). The backdoor creates a fake Malwarebytes installation directory containing legitimate signed files alongside malicious DLL files. Once executed, it establishes persistence through a Windows service and communicates with command-and-control servers to receive configuration updates and additional payloads. The primary observed payloads were cryptocurrency miners, though the infrastructure supports delivery of multiple persistent threats. The attack demonstrates abuse of software update mechanisms and affects primarily users in Russia, Ukraine, and Kazakhstan.

Following Black Hat and DEF CON conferences, a threat actor targeted attendees through X direct messages, posing as CoinDesk's VP and Head of Marketing to establish trust under the pretext of conference planning. The campaign employed a malicious Google Apps Script embedded in a Google Doc that presented ClickFix-style instructions and manual download options. The attack delivered different payloads based on the victim's operating system: macOS users received AMOS infostealer, while Windows users were infected with NetSupport RAT, a Ledger wallet implant, and a TLS-intercepting proxy. A secondary lure masqueraded as a DocSend installer to deliver additional payloads. The operation demonstrated sophisticated social engineering by leveraging trusted platforms and post-conference networking expectations.

Cybercriminals are deploying fraudulent cryptocurrency wallet-checking websites that impersonate legitimate anti-money laundering (AML) services to steal digital assets. These fake sites, often mimicking AMLBot or using names like 'AML Check,' replicate the appearance and branding of authentic wallet-screening platforms. Instead of simply requesting a wallet's public address for legitimate screening, these malicious sites prompt users to connect their wallets and approve transactions. The scam exploits users' security consciousness by displaying fake progress bars, compliance verification messages, and fraudulent error notifications requesting small fees. Once victims approve transactions or grant token permissions, attackers can drain their cryptocurrency holdings. The scam's effectiveness lies in its professional appearance and exploitation of legitimate security practices, making fraudulent requests appear routine.

A sophisticated Phishing-as-a-Service platform called Balonx Sistema, operated from Mexico, targets over 20 financial institutions through tiered subscriptions. The platform employs real-time WebSocket session hijacking to defeat multi-factor authentication, distributing a Spyroid-based Android RAT via fake security alerts. Since October 2025, over 1,100 victims' credentials have been harvested. The operation includes CallFlow, an AI-driven vishing module using GPT-4o-mini, ElevenLabs synthetic voice, and OpenAI Whisper for automated telephone fraud, eliminating human operators. The platform uses continuous domain rotation across 350+ domains since 2019, maintains centralized PostgreSQL infrastructure, and is openly promoted through Facebook groups. The operator, identified as 'balonx', manages a sophisticated criminal enterprise generating approximately $99,000 USD through subscription-based access priced between 3,000-6,000 MXN weekly.

A new ClickFix campaign targets Windows users with a NodeJS-based infostealer delivered via malicious MSI installers. This highly adaptable remote access Trojan minimizes forensic footprints through dynamic capability loading, with core stealing modules and communication protocols delivered in-memory only after C2 connection. The malware routes gRPC streaming traffic over Tor network for persistent, masked bidirectional channels. An operational security failure exposed server-side admin panel protocol definitions, revealing a malware-as-a-service backend designed to manage multiple operators and automate cryptocurrency asset tracking. The modular architecture delivers malicious logic dynamically as strings executed in-memory, bypassing static signature detection while supporting full RAT functionality including shell command execution and wallet tracking.

A phishing campaign has been identified where attackers impersonate sales staff from specific overseas companies, requesting quotation modifications and product version confirmations. The email contains a malicious GZ compressed file that, when extracted, delivers an injector-type executable. This injector employs multiple UAC bypass techniques including SSPI-based authentication and CMSTPLUA COM exploitation to gain elevated privileges. It then performs BYOVD attacks using the vulnerable DCRCVDrv.sys driver to terminate security products through kernel-level access. Following security product neutralization, the injector uses process hollowing to inject PhantomStealer into the legitimate AddInProcess32.exe process. PhantomStealer then executes comprehensive information theft including keylogging, screen capture, browser credentials, cryptocurrency wallet data, and clipboard manipulation to replace wallet addresses with attacker-controlled ones.

The Clop threat group has returned to mass exploitation tactics by leveraging CVE-2026-12569 in PTC Windchill, deploying a sophisticated custom web shell designed specifically for data theft and extortion. This purpose-built implant provides immediate full data-theft capability without requiring additional tooling, featuring built-in credential harvesting, database enumeration, and a custom Java class loader for executing arbitrary code in memory. The web shell decrypts credentials from Windchill's keystore, including LDAP manager passwords that could enable enterprise-wide compromise. Its application-specific design allows malicious activity to blend seamlessly with legitimate traffic, making detection significantly more challenging. The implant targets sensitive intellectual property and engineering data stored in Windchill installations across manufacturing enterprises globally.

The Russian influence network CopyCop conducted a coordinated disinformation campaign targeting the US-Armenian joint Firebird AI data center in Hrazdan between June and July 2026. Through three escalating operations, CopyCop fabricated narratives about earthquake risks, power grid instability, and Iranian military threats against the facility. The campaign employed media impersonations of TechCrunch and Gizmodo, with the final operation achieving over 1.6 million views. These operations aim to undermine Armenia's westward geopolitical realignment and Western investment projects. Additional high-profile targets likely include the TRIPP corridor, Metsamor nuclear power plant modernization, and critical minerals development initiatives, all representing significant US-Armenian cooperation that threatens Russia's regional influence.

Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle attacks. Analysis shows 63.7% of identified victims are in the US, with Technology, Manufacturing, and Education among the most targeted industries. The operation generated thousands of compromise events between 2024 and 2026, including stolen session cookies, passwords, and SSO access. Once a Microsoft 365 session is hijacked, attackers gain access to corporate email, sensitive data, and trusted business accounts. The toolkit uses browser-based delivery through .htm, .xhtml, and .svg stagers, QR codes, JavaScript obfuscation, and WebSocket-based AiTM activity. Of 9,426 unique targeted email addresses, 4,532 were potentially compromised, representing approximately 48% success rate.

On 5 May 2026, a Jamf Protect deployment blocked a download attempt from jacksonvillemma[.]com, four days after the operator's previous MacSync C2 was publicly disclosed. The new C2's TLS certificate was issued within 24 hours of that disclosure. Analysis revealed a Stage 2 zsh loader containing a static api-key value observed across four distinct C2 domains spanning December 2025 to May 2026. URI-pattern pivoting through any.run identified eleven additional candidate C2 domains dating back to February 2026, suggesting parallel infrastructure operation rather than sequential rotation. The loader exfiltrates macOS credentials, browser data, and cryptocurrency wallets, and transmits the victim's account password in cleartext via URL query strings, making it visible in web proxy logs.

A phishing campaign targets Indian organizations by impersonating the Indian Income Tax Department. Victims receive emails containing links to spoofed notice pages that download ZIP archives. These archives include a legitimately signed Overwolf executable and two hidden files: a malicious DLL and an encrypted binary. When executed, the signed binary side-loads the malicious DLL through DLL hijacking. The DLL is UPX-packed and modified with Astral-PE, and decrypts the binary file containing ValleyRAT. The payload uses modified RC4 encryption with a 115-byte key and deploys entirely in memory. Once active, ValleyRAT establishes persistence through scheduled tasks masquerading as OneDrive entries, marks dropped files as hidden and system files, and performs process hollowing into svchost.exe to evade detection before connecting to command and control infrastructure.

Multiple clusters of North Korean IT workers, designated as PurpleDelta, have been identified applying to over 1,100 companies between late 2024 and early 2025, primarily targeting software, technology, staffing, consulting, and healthcare sectors. The operators maintained at least 22 fabricated personas supported by AI-generated profile photos, custom ChatGPT assistants, and fraudulent identity documents. They demonstrated sophisticated tradecraft, applying to up to 60 positions daily using multi-account management browsers and detailed tracking spreadsheets. During interviews, operators employed screen recording software and AI transcription tools to generate real-time answers, often repeating ChatGPT responses verbatim. Once employed at ten or more organizations, they recorded internal meetings, used personal devices and bank accounts, and coordinated via Telegram and Slack with facilitators who maintained company-issued hardware. This activity represents an ongoing insider threat to organizations hirin...

In June 2026, a previously undocumented Android fraud bot called Octagon was identified, sold as malware-as-a-service by Russian-speaking actor AndroidKitKat for $1,400 monthly. The malware employs accessibility overlays, hidden VNC, SMS interception, unlock-pattern capture, and balance reading capabilities to target cryptocurrency wallets, exchanges, and banking applications. Distributed through sideloaded APKs with Restricted Settings bypass, Octagon connects infected devices to a Windows command-and-control panel where operators monitor applications, read screens, and control devices remotely. The malware maintains persistence through multiple mechanisms while appearing benign to security scans. Three APK samples were recovered, including deployments using Lifted Dreams game and Bahrain government lures. The malware captures credentials through HTML WebView overlays targeting Trust Wallet, Binance, MEXC, MetaMask, and messaging apps like Telegram and WhatsApp, enabling cryptocurrency theft and account t...

A sophisticated phishing campaign has been identified where attackers impersonate employees of a US company, sending emails that claim to contain transaction receipts. Recipients are urged to verify fund deposits by opening an attached PDF file. The malicious PDF displays a fake Adobe Flash Player update prompt, which when clicked, downloads a VBS script. This script executes with administrator privileges, displays a decoy payment receipt document, and silently installs ScreenConnect remote management software via an MSI package. The installation establishes persistent remote access to the compromised system, enabling attackers to execute commands, transfer files, and deploy additional payloads using legitimate administrative tools in a Living-off-the-Land attack technique.

Researchers identified an exposed web directory on infrastructure supporting a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and fake wallet applications for Ledger, Trezor, and Exodus. The operator validated approximately 885,000 phone numbers against cryptocurrency exchange accounts, achieving a 13.6% hit rate on German numbers. Victims received coordinated phishing emails and vishing calls referencing fake support cases before being directed to counterfeit wallet applications designed to steal recovery phrases via Telegram exfiltration. Notable findings include extensive use of AI coding assistants throughout development, including GitHub Copilot and Claude Code. When one AI model resisted malicious requests, the operator switched providers and attempted to bypass safety controls using a structured jailbreak prompt targeting the model's reasoning patterns and safety mechanisms.

Projextor is a malware campaign that leverages Electron-based productivity applications to deliver malicious payloads. The threat disguises itself as legitimate document converters, meal planners, and PDF management tools with working user interfaces. Distribution occurs through impersonating websites that mimic genuine services, using high-ranking search results to lure victims. Applications like Kitchen Canvas, Food Formula, DocConvertWizard, and PDFGrip contain insecure Electron configurations that enable dynamic JavaScript execution and desktop capture capabilities. The infection chain begins with NSIS, Squirrel, or Inno Setup installers that download the main Electron application. Preload scripts abuse privileged Node.js APIs with intentionally disabled security features, allowing arbitrary code execution and screen monitoring. This enables threat actors to capture sensitive information, monitor user activity, and execute remote commands while maintaining the appearance of functional productivity soft...

In July 2026, a new Rust-based malware family called C2Looper was identified, likely used by ransomware-related threat actors. The malware is assessed with low to medium confidence to be delivered through multi-stage ClickFix infection chains. C2Looper provides backdoor capabilities including remote shell execution, reconnaissance, and deploying additional payloads. It dynamically resolves Windows APIs and encrypts strings using XOR operations. The malware communicates via plaintext HTTP initially, but an evolved version uses GitHub repositories for command-and-control operations, storing commands and exfiltrated data in JSON files. Version 2 introduces additional commands such as reconnaissance collection, drive enumeration, shellcode injection, and file listing. The malware demonstrates active development with refined capabilities, likely serving initial access brokers for data theft and ransomware deployment.

A China-nexus threat actor is targeting Myanmar government personnel and diplomats through Operation QUICSILVER, delivering malware via Virtual Hard Disk files disguised as JPEG images. The campaign uses Burmese-language lures impersonating Myanmar's Information Technology and Cyber Security Department, including graduation ceremony invitations. The multi-stage infection chain begins with a malicious LNK file that abuses ftp.exe to execute scripts, reconstructs payloads from split files, and deploys QUICAgent, a custom Go-based backdoor. The implant retrieves C2 infrastructure through Cloudflare Workers, communicates over HTTP/3 using QUIC protocol, and employs RC4 encryption. Deleted documents recovered from the VHD reveal interest in ASEAN affairs, BIMSTEC, and Myanmar diplomatic activities. Three related campaigns were identified between April and July 2026, sharing similar TTPs and infrastructure.