VERY IMPORTANT

Acronis Threat Research Unit identified a single operator utilizing a mesh of 12 AI agents called BOSSAI to conduct persistent campaigns across 11 countries. The attacker deployed both abliterated and commercial AI models working in specialized roles - infrastructure builders, vulnerability scanners, and active exploitation agents. Primary targets included emergency services, universities, financial institutions, and government systems in Taiwan, Thailand, and Mexico. Confirmed breaches involved exfiltration of medical records from Taipei emergency services, student data from Thai universities, and collection of over 200,000 Mexican residential phone records. Commercial AI models repeatedly refused malicious instructions despite jailbreak attempts, forcing the operator to rely on less effective abliterated local models. The investigation exposed complete operational infrastructure including command histories, agent conversations, and victim data, revealing both the power and limitations of AI-augmented off...

A Russia-aligned threat actor named Gorbag has been operating since February 2025, conducting highly targeted cyberespionage operations against Ukrainian organizations. The group primarily focuses on law enforcement, justice entities, local administrations near the front line, and the defense sector. Rather than establishing long-term access, Gorbag employs simple infostealers for rapid intelligence collection, harvesting browser credentials, VPN configurations, and selected documents in single-pass operations. The group's toolset includes Prime ReverseShell (a PowerShell reverse shell) and BeautyStealer (a C++ browser-data and file stealer). Initial compromise occurs through spearphishing emails with malicious attachments. In early 2026, Gorbag updated its attack chain to exploit CVE-2025-8088, a WinRAR path traversal vulnerability. The operational focus on quick data collection suggests Gorbag may function as an initial access broker, sharing collected credentials with other Russia-aligned threat actors ...

Microsoft Threat Intelligence identified an evolving campaign targeting users searching for cracked commercial software, free games, activators, and unofficial utilities. The operation uses trojanized Inno Setup-style installers to distribute multiple monetized software payloads through a per-offer callback and status-tracking system. Three downstream monetization branches transform affected devices into monetized assets: routing third-party internet traffic through the device via WorldProxyPool, enrolling devices in distributed-computing platforms through CharityEngine and BOINC, or installing utility-style software such as Advanced Windows Manager. These components are silently installed through deceptive software bundles without informed user consent, introducing security and privacy risks. The campaign employs a four-stage attack chain progressing from deceptive lures through Inno-based staging, offer-controlled payload delivery, and installation of monetization branches using scheduled tasks for persi...

Check Point Research discovered the Haiou jailbreak bundle, a prompt package targeting OpenAI Codex designed to weaken model guardrails for security-related tasks including hacking and software cracking. The bundle functions as prompt adware by modifying Codex configuration files to inject advertisements for the author's LLM gateway service into agent responses. The jailbreak employs various techniques including role-playing, context-reframing into CTF scenarios, and refusal suppression. Researchers found this bundle on a misconfigured webserver alongside Cobalt Strike, VulnClaw agent, and Ladon framework, indicating active use by cybercrime actors. The freely distributed jailbreak serves as an acquisition channel for a paid gateway service. The bundle installs security-focused skills for penetration testing, reverse engineering, and game security, while persistently injecting promotional content through encrypted payload files distributed via GitHub and Chinese platforms.

Between September 9 and September 13, 2026, a coordinated campaign exploited Magento and Adobe Commerce stores across Western Europe, North America, and Asia-Pacific using CVE-2026-75650 (StyleSmuggler). The attack chain delivered a shell-script dropper, PSK Agent RAT, and PHP webshell through the /paypal/transparent/response/ endpoint. The dropper achieved 0% detection on VirusTotal at time of analysis. The campaign deployed chi_down, a 10.5 MB obfuscated Go binary with remote access capabilities including command execution, SOCKS5 proxying, and encrypted communications. DNS exfiltration was used to track successful compromises. Chinese-language comments in the dropper and infrastructure naming suggest a likely Chinese-speaking operator, though attribution to a specific threat group is not supported. Multiple operators are exploiting the same vulnerability with distinct toolkits.

A sophisticated campaign tracked as Yoba distributes cryptocurrency mining malware through fraudulent GitHub repositories impersonating ChatGPT and Claude AI applications. Attackers leverage legitimate, digitally signed executables from OpenAI and Anthropic alongside malicious DLLs to achieve DLL sideloading, evading detection through trusted software signatures. The multistage infection chain employs YobaDropper and YobaLoader components with anti-analysis techniques including process verification, execution delays, and regional language exclusions. C2 communication leverages Telegram profile imagery combined with domain generation algorithms, DNS over HTTPS via Google, and public hosting services like Catbox to retrieve encrypted payloads. While XMRig cryptocurrency miner deployment was observed, the loader architecture supports additional Windows executables and PowerShell payloads, suggesting potential expansion beyond cryptojacking operations.

On October 30, 2026, exploitation activity was detected targeting CVE-2026-58115, an unauthenticated Node-RED admin API vulnerability. Attackers deployed malicious flows that automatically download and execute Linux bots through three layers of encoding. The exploit originated from IP 4.201.105.116 in Microsoft's network and utilized Node-RED's inject and exec nodes to execute commands without authentication. The dropper retrieved binaries from 85.215.73.250:8080, saving them to RAM-backed storage at /dev/shm/.b to avoid disk forensics. Multiple payload variants were observed, including staged shell scripts and persistent webshells. The activity demonstrates opportunistic mass scanning across multiple CVEs rather than targeted operations. Node-RED is embedded in critical infrastructure products including Siemens SIMATIC IoT2050 devices, making this vulnerability particularly significant for industrial control systems environments.

A sophisticated cyberespionage operation targeting Israel and the Kurdistan Region of Iraq was conducted by DarkBlinders, the threat actor behind the Blinder Tunnel campaign. Active between August and October 2026, the campaign compromised a high-profile Israeli individual associated with the security sector and a government cloud environment in the Kurdistan Region. The operation employed government webmail, cloud-drive, and meeting-service lures, including phishing infrastructure impersonating the Gulf Cooperation Council Secretariat General and Kuwait's Ministry of Foreign Affairs. GitHub repositories under the PeakyBlindersTeam account served as command-and-control infrastructure. The attackers used selective activation, reviewing metadata from infected hosts before deploying a second-stage backdoor enabling PowerShell command execution. Post-compromise activity included credential theft and exfiltration of at least 1 GB of data from the government cloud environment. The activity demonstrates connectio...

Investigation reveals a massive supply chain compromise involving MECOOL Android set-top boxes manufactured by Videostrong Technology Co., Ltd. Over 1.3 million devices were pre-infected with the x.cpe backdoor, granting operators system-level access through MQTT infrastructure. The backdoor deploys multiple payloads including residential proxy SDKs and ad fraud modules like AdMoyu, Appsalt, APSolo, LinkFog, and Gaganode. Approximately 500,000 devices remain actively online, predominantly affecting Malaysia, Mexico, and Brazil. The operation functions as a pay-per-install campaign fueling ad fraud and proxy ecosystems. Google has permanently banned Videostrong from the Android ecosystem following these findings. Investigation conducted in partnership with Motion Picture Association, Google, Plume, Trend Micro, Lumen, and HUMAN Security.

A cyberespionage group known as BITTER has been conducting campaigns targeting South Asian organizations using PowerShell scripts and a custom remote access trojan called PapRAT. Three distinct infection chains have been identified: one exploiting Windows ftp.exe with malicious LNK files, another using VHDX disk images containing MSI installers, and a third combining URL shortcuts with WebDAV to deploy PapRAT. The malware exists in both C++ and Rust implementations, with capabilities including command execution, file manipulation, directory enumeration, screenshot capture, and secondary payload delivery. PapRAT maintains persistent access through scheduled tasks and communicates with command-and-control servers over HTTP. The Rust variant introduces enhanced functionality including PowerShell execution and sleep commands. Targets are concentrated in South Asian government, energy, and engineering sectors.

Threat actors are hijacking enterprise access to Large Language Models through a tactic called LLMJacking, impacting organizations across North America, South America, and Asia Pacific in financial services, retail, technology, and transportation sectors. Unlike cryptojacking's gradual consumption, LLMJacking generates massive spikes in fraudulent cloud charges, with incidents exceeding $100,000 USD daily and reaching $1 million USD cumulatively. Actors establish initial access through exposed cloud identity tokens, IAM credentials, Service Account keys, and stolen API keys. They escalate privileges, conduct reconnaissance, and monetize compromised resources through LLM Mixers—illicit routing gateways that proxy and resell unauthorized LLM access. The ecosystem shows sophisticated specialization with distinct operational clusters coordinating compromises and downstream monetization infrastructure.

Google and industry partners dismantled the XCPE backdoor that enrolled over 1.3 million set-top boxes into a botnet. The backdoor was intentionally developed and operated by Videostrong Technology Co., an Android OEM/ODM, who monetized it by selling access to criminal affiliates. These affiliates loaded malware modules conducting ad-fraud, enrolling devices into residential proxy networks, and installing additional malware. The disruption also severed access to at least 10 million additional compromised devices by taking down affiliate C2 domains. The malicious software was built directly into various device models over multiple years with dedicated infrastructure. Google has banned Videostrong from making certified Android devices and implemented improvements to firmware integrity reviews on Android TV devices.

A sophisticated phishing campaign impersonates OpenAI by sending fraudulent ChatGPT Plus billing emails claiming failed subscription payments. Victims are directed to fake payment pages hosted on compromised WordPress instances under Nexcess's nxcli.io infrastructure. The operation features live attacker involvement, where operators monitor submitted credit card information and dynamically decide whether to request one-time passwords through a real-time polling mechanism. After victims submit payment details including card numbers, expiry dates, CVV codes, and cardholder names, the page maintains a loading animation while the browser polls a backend system approximately every 500 milliseconds. The attackers can then redirect victims to verification-code collection pages to complete fraudulent transactions. The campaign uses distinctive redirect domains and identical client-side code across multiple instances.

An open-source framework called CyberStrikeAI was used in real-world attacks against educational institutions across Africa and Latin America. The framework combines LLM-based orchestration with a traditional C2 server, where an AI model on the server plans actions and generates commands while an implant executes them on compromised hosts. Attackers initially gained access through compromised SQL Server infrastructure, then deployed the CyberStrikeAI agent which performed reconnaissance, privilege escalation, credential dumping, lateral movement, and data exfiltration. The AI orchestrator automated post-exploitation activities that traditionally require manual operator intervention, reducing the skill barrier for attackers. While the AI component operates server-side, the actual malicious activities on victim systems use standard techniques like Kerberoasting, AS-REP Roasting, LSASS dumps, DCSync, and Golden Ticket attacks, making them detectable through conventional security controls. Chinese-language art...

VAPOR PANDA conducted a sophisticated espionage campaign beginning October 17, 2026, using the ARTEX AI-driven framework alongside DeepSeek and commercial LLMs to orchestrate parallel intrusions against over 200 organizations worldwide. Targets included foreign ministries across Latin America, Europe, Asia, and the Middle East, plus U.S.-based semiconductor, defense, pharmaceutical, nuclear, and telecommunications entities. The adversary deployed BLOODALCHEMY backdoor, conducted credential spraying, and explicitly instructed AI agents to identify systems without endpoint security sensors. This represents an escalation from single intrusions to multiple simultaneous engagements, with agents autonomously pursuing attack paths while human operators provided strategic direction in Chinese. The campaign demonstrated how threat actors combine open-source AI frameworks with commercial LLMs to dramatically scale intrusion operations beyond manual capabilities.

VOLTA is a sophisticated Windows infostealer that incorporates AI-powered victim profiling to prioritize targets based on monetization potential. After harvesting credentials, browser data, cryptocurrency wallets, sessions from various platforms, and personal information, it compiles a structured evidence bundle and submits it to OpenRouter using LLM models like Claude Opus, with fallback options to Kimi-K2 and Gemini. The LLM acts as a forensic intelligence analyst, ranking stolen assets by value and assessing victim security posture. VOLTA performs live enrichment by accessing victim Gmail, Uber Eats, DoorDash, Discord, and Roblox accounts using stolen tokens. The malware self-deletes and operates through third-party infrastructure without actor-owned servers, suggesting a builder-based distribution model where customers can deploy customized versions.

Attackers impersonated IT help desk personnel on Microsoft Teams to gain unauthorized access to Active Directory environments through social engineering and misconfigured certificate services. Two distinct intrusion campaigns leveraged Quick Assist remote support sessions after convincing users to share connection codes. Adversaries deployed portable Python, Bun, and Java runtimes to enumerate domain infrastructure and exploit vulnerable Active Directory Certificate Services configurations through ESC1 and ESC8 attack paths. In one incident, attackers obtained certificates for multiple privileged accounts and performed DCSync operations to harvest credentials. Data exfiltration was conducted using Rclone transferred to external SFTP destinations. The second intrusion used PetitPotam to coerce domain controller authentication and relay NTLM credentials to obtain unauthorized certificates. Neither attack exploited Teams vulnerabilities, but rather combined impersonation tactics, legitimate remote access tool...

North Korean operators execute cryptocurrency thefts by initially compromising developers through social engineering on the open internet before moving operations on-chain. The Bybit theft in February 2025 began when operators tricked a Safe{Wallet} engineer into running a malicious stock-trading project via getstockprice[.]com, later planting code in Bybit's wallet interface. Binance experienced similar compromise through a DevOps engineer's laptop. These operations rely on registering domains before targeting victims, with bybit-assessment[.]com registered hours before the Bybit theft. An investigation revealed three US-registered front companies (BlockNovas, Angeloper Agency, and SoftGlide) used to deliver malware through fake job interviews. Preemptive defense mechanisms identified 206 Binance-named domains with maximum risk scores, with 64 showing live activity, enabling defenders to block malicious infrastructure before deployment.

On October 29, 2026, Cursor's VS Code extension marketplace served malicious Claude Code extensions (versions 2.1.312 and 2.1.313) designed to plant SSH backdoors on developer machines. The fake extensions, not developed by Anthropic, operated for approximately 11 hours before removal. They installed attacker SSH keys, established reverse SSH tunnels to 134.209.82[.]225, and created persistence mechanisms disguised as legitimate system components. Expel investigated four incidents involving Mac computers, discovering that malicious activity occurred up to 8 hours after Cursor's stated exposure window closed. The backdoor survives extension uninstallation and requires separate removal. The attack collected system information including hostname, username, Git email, and environment variable names. Organizations relying solely on the 11-hour exposure window for scoping may miss compromised machines.

A compromised version of the Claude Code extension (anthropic.claude-code, versions 2.1.313 and 2.1.312) was distributed through the Cursor extension marketplace from October 29, 2026, between 2:27 AM and 1:35 PM PDT. The malicious extension contained injected JavaScript that executed during module loading to establish persistent backdoor access. The loader collected host reconnaissance data, installed an attacker-controlled SSH key, enabled local SSH services, established reverse SSH tunneling to infrastructure at 134.209.82.225, and configured platform-specific persistence mechanisms including macOS LaunchAgents, Linux cron jobs, and Windows scheduled tasks. The attack leveraged built-in system tools to avoid detection while maintaining access. Microsoft confirmed the malicious packages were never distributed through Visual Studio Marketplace or npm, and Anthropic's systems were not compromised. The incident appears limited to Cursor marketplace.

Throughout October 2026, at least nine AI Developer Platforms experienced security breaches involving credential theft and subsequent abuse of AI model access. The attacks targeted platforms including Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank. Attackers exploited various vulnerabilities to access stored environment variables containing AI credentials, then monetized stolen access through LLM broker infrastructure. Follow-on activity included validation sweeps, quota enumeration, and large-scale token abuse resembling resold coding-agent traffic. Two documented cases show approximately 800,000 and 1.7 million unauthorized Bedrock calls respectively, generating over $100,000 in fraudulent usage. Multiple reseller operations were identified, including actors using infrastructure at llm-routing.com and xingjiabiapi.org, selling discounted access to frontier models using stolen credentials.

PHP2Shell emerged from two critical PHP memory-safety vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 and patched on October 21, 2026. Investigation of open directories uncovered 616 PHP2Shell-related files revealing widespread exploit development across multiple operators. While exploitation succeeded only on honeypots operated by watchTowr, 0x4D31, and GreyNoise for the open internet, the vulnerability has been successfully weaponized against Palo Alto PAN-OS firewalls. Attackers chained PHP2Shell with the Fragnesia Linux kernel privilege-escalation vulnerability (CVE-2026-46300) to obtain root access on 25 PAN-OS firewalls. The campaign utilized AI-driven reconnaissance frameworks to automate target selection, narrowing approximately 19,000 internet-facing firewalls to 240 high-value targets. Multiple operator clusters were identified sharing exploit toolkits, custom heap exploits, and staging infrastructure targeting government ministries, national banks, telecommunications, and cr...

Two human-operated intrusions leveraged Microsoft Teams messages and calls to impersonate IT personnel, socially engineering users into granting remote access through Quick Assist. Threat actors staged portable Python, Bun, or Java runtimes, performed network discovery, and assessed Active Directory Certificate Services for authentication paths. The incidents diverged at the certificate layer: one exploited an ESC1-vulnerable certificate template to obtain authentication certificates for privileged accounts and performed DCSync operations, while the other used PetitPotam to coerce domain-controller authentication and relayed it to AD CS Web Enrollment through ESC8, obtaining a domain-controller certificate for Kerberos authentication. Automated attack disruption limited progression in the first case except for an excluded privileged identity that enabled data exfiltration, while customer-led device isolation stopped progression in the second case following Defender alerts.

Belarus-aligned threat actors deployed a VBScript wiper against a Ukrainian manufacturing company involved in the transportation sector in late May 2026. The group, tracked as FrostyNeighbor (also known as UNC1151, PUSHCHA, Storm-0257, and TA445), utilized Chisel, UltraVNC, and Cobalt Strike before delivering the destructive payload through Group Policy. This incident marks the first documented destructive cyberattack by a Belarus-aligned actor, representing a shift from traditional espionage operations. The targeted company's role in Ukraine's transportation sector suggests potential wartime operational value. Researchers assessed that Belarus-aligned groups are becoming increasingly aggressive and selecting targets aligned with Russian intelligence priorities, potentially acting as a proxy, though direct cooperation remains unconfirmed.

During September 2026, multiple APT attack campaigns targeting South Korean entities were identified, primarily delivered through spear phishing emails. The attacks utilized various techniques including LNK files with embedded PowerShell scripts, HTA files downloaded via curl.exe, and malicious DLL files. Five distinct attack types were classified (Type A through D, plus Unknown). These campaigns deployed AutoIt scripts, Infostealers, keyloggers, backdoors including XenoRAT, and established persistence through Task Scheduler entries. Attackers leveraged legitimate services like GitHub, Google Drive, and PubNub for command and control operations. The malicious files were disguised as legitimate documents to deceive users, ultimately exfiltrating system information, credentials, and virtual asset data while maintaining persistent access to compromised systems.

Kairos is a newly documented DDoS botnet for Linux written in Go, designed to transform compromised machines into attack nodes. The bot establishes hundreds to thousands of TCP connections to operator-specified targets, maintaining them with minimal keepalive bytes every few seconds to exhaust victim services. Initial access occurs via Telnet using default root credentials with empty passwords. The payload is delivered through multi-fallback shell commands via HTTP from the same server used for command and control. The bot operates with a simple three-command protocol including hold, kill all, and kill unpause commands. It masquerades as a kernel worker thread and employs a build-per-C2 distribution model, with samples identified across multiple CPU architectures including x86_64, ARM, MIPS, and 386.

Version 2.1.313 of the Claude Code extension in the Cursor Marketplace was compromised on October 29th, 2026. A malicious 66-line loader was inserted before legitimate extension code in the extension.js file. Upon activation, it adds an attacker-controlled SSH key labeled 'svc-telemetry' to the victim's authorized_keys, attempts to enable local SSH services, and establishes a reverse SSH tunnel to 134.209.82.225. The implant collects reconnaissance data including hostname, user information, Git configuration, and environment variables containing credentials. It installs platform-specific persistence mechanisms using LaunchAgents on macOS, crontab on Linux, and scheduled tasks on Windows. Beacon data is transmitted unencrypted to the command-and-control infrastructure, providing persistent remote access through the established SSH tunnel.

A malicious JavaScript file was discovered in a third-party performance monitoring integration on Polymarket. The script, hosted on a DebugBear CDN URL, contained sophisticated code designed to access authenticated trading sessions, inspect user portfolios, and transfer cryptocurrency assets to attacker-controlled addresses. The payload searches for active trading clients and signers within the user's browser session, then attempts to sell positions or transfer tokens directly. Analysis revealed code that reads authentication context from local storage, traverses React component structures to locate trading functionality, and constructs EIP-712 signed messages to move assets. A fallback recipient address embedded in the script showed holdings exceeding $2.1 million. Production build metadata from Polymarket confirms removal of the DebugBear integration. While the script's malicious capabilities are established through static analysis, the total number of victims and aggregate losses remain unverified.

Seven months after initial disclosure, the Coruna iOS exploit framework continues to evolve, now deploying two distinct chains based on device operating system version. Targets running iOS 17.2.1 or earlier receive the legacy Coruna framework, while later builds receive DarkSword-derived chains. Analysis identified 608 domains delivering Coruna-family code, with 93 sites mapping to 21 distinct tracking collectors. Distribution spans dating portals, AI-companion platforms, cryptocurrency promotions, media streaming services, and compromised legitimate sites. The attack requires no user interaction beyond loading a webpage, operating through hidden iframes that deploy browser exploits leading to native code execution. Recovered modules include kernel memory manipulation, code-signing enforcement changes, process memory access, encrypted command-and-control communication, and cleanup routines. One delivery vector involves compromised npm packages, enabling legitimate websites to serve exploits through their o...

Cryptocurrency transactions face unique threats from specialized malware known as Clipbankers, designed to redirect payments by replacing copied wallet addresses with attacker-controlled ones. These attacks exploit user trust in clipboard functions, the difficulty of memorizing long cryptographic strings, and the irreversible nature of blockchain transactions. Two prominent families, AnimateClipper and Efimer, demonstrate sophisticated capabilities including pattern matching and digit-matching techniques to minimize detection. AnimateClipper emerged in January 2026 and monitors clipboards for cryptocurrency patterns across multiple networks. Efimer employs advanced evasion techniques including Pyarmor protection, XOR encryption, and TOR-based command and control communications, while matching leading or trailing digits of addresses. Both families are distributed through social engineering methods including ClickFix campaigns, phishing emails, and fake software installations. The malware families became lar...

A sophisticated SEO poisoning campaign targets users searching for DeepSeek AI tools through malicious lookalike domains positioned on first-page search results. The attack employs a multi-stage infection chain beginning with weaponized MSI files disguised as legitimate DeepSeek software. The execution flow progresses through multiple stages involving shellcode, DLL side-loading via legitimate Cyglaunch software, and ultimately deploys Kong RAT. The threat actor registered domains mimicking DeepSeek and distributed ZIP archives containing code-signed fake installers to add legitimacy. Attribution points to a potential Chinese threat actor based on PDB paths referencing '52pojie', a Chinese cybersecurity forum. This campaign appears to be a continuation of previous operations from April 2026 targeting users of Chinese developer tools including FinalShell SSH client, Xshell, and Clash proxy. The final payload includes keylogger functionality and establishes persistence through registry modifications.

Seven months after initial disclosure, the Coruna iOS exploit framework continues evolving with two distinct exploit chains conditioned on device operating system versions. Targets running iOS 17.2.1 or earlier receive the legacy Coruna framework, while later builds receive DarkSword-derived execution chains. Through October 2026, 608 domains were identified delivering Coruna-family code across dating portals, AI-companion platforms, cryptocurrency promotions, and compromised legitimate sites. The attack operates entirely through web pages via hidden iframes, requiring no application installation or user consent. Recovered native modules demonstrate sophisticated capabilities including kernel memory manipulation, Apple Mobile File Integrity state changes, process memory reads, encrypted command-and-control communication, and artifact deletion. A supply-chain compromise through the npm package art-template enables delivery through legitimate application infrastructure, bypassing traditional domain-based def...

A critical out-of-bounds write vulnerability in Google's Brotli decompression library allows specially crafted compressed data to corrupt application memory, potentially enabling remote code execution. The flaw, scoring 9.2 CVSS v4.0, affects Google Brotli versions 1.0.3 through 1.2.0 and impacts multiple platforms including Node.js, Bun, Python implementations, and .NET frameworks. Exploitation attempts were observed within days of patch availability, with working proof-of-concept code demonstrating remote code execution against Node.js environments through malicious HTTP requests and responses. CISA added the vulnerability to its KEV catalog on October 27, 2026. The vulnerability can be triggered through various attack vectors including incoming HTTP requests with Brotli-compressed bodies, malicious server responses, and file processing workflows. Enterprise products from Palo Alto Networks and VMware are also affected, expanding the attack surface beyond typical Node.js deployments.

Investigation into a tech-support scam led to discovering connections between the remote-access application UltraViewer and bulk-mailing software UltraMailer. DNS and email analysis revealed a long-running QuickBooks phishing campaign utilizing over 350 lookalike domains and tracking domain chanret[.]com. The campaign directs victims to call scammers attempting to steal QuickBooks credentials while exposing recipient information through UltraMailer tracking pixels. UltraMailer is openly promoted on criminal forums as a spamming tool with no abuse-reporting mechanism. The investigation also uncovered trojanized installers containing authentic copies of both applications, including one UltraMailer installer carrying njRAT. When the QuickBooks actor briefly switched to Mail250, the account was suspended after reporting, but the campaign resumed using UltraMailer infrastructure. While no evidence suggests developers participated in these activities, the findings demonstrate widespread criminal abuse of legitim...

Multiple Russian-language traffer teams have rapidly adapted affiliate-fraud models to exploit growing interest in prediction markets like PolyMarket and Kalshi since spring 2026. Three teams—AtlasCore, PolyFucked, and Magnetic Team—provide comprehensive fraud infrastructure including websites, administrative panels, cryptocurrency payment systems, and technical support. These services enable affiliates to deploy convincing prediction-market interfaces combined with established fraud mechanisms such as controlled trading outcomes, fabricated market activity, artificial withdrawal restrictions, and collection of sensitive identity information. Artificial intelligence accelerates these operations by reducing time and expertise required for platform development, content creation, social engineering, and victim engagement. The rapid adoption demonstrates how mature fraud ecosystems can pivot toward emerging technologies and financial products without developing entirely new criminal capabilities. Prediction ma...

Aurora ransomware group has been active since approximately April 2026, targeting organizations across multiple countries and operating a data leak site. The investigation revealed the group deploys a Linux ransomware variant specifically designed for ESXi environments, using ChaCha20 encryption with RSA-4096 key wrapping. A distinctive characteristic includes the abuse of Cursor Agent with Claude Sonnet AI to assist with hands-on exploitation activities across ten target organizations between April and May 2026. The AI agent performed tasks including privilege enumeration, network scanning, NTLM relay attacks, and certificate attacks. Operators imposed specific restrictions prohibiting DCSync, account lockouts, and adding new computer objects to domains. A second cluster of activity attributed to Aurora used different tactics including SQL Server lateral movement, GodPotato escalation, and S3-based exfiltration affecting eight organizations across multiple countries.

The provided document does not contain an intelligence report. Instead, it appears to be a loading or verification page that displays a placeholder message indicating that a request is being processed or verified. There is no substantive content available for analysis, no threat intelligence information, no discussion of malicious activities, threat actors, malware campaigns, or security incidents. Without actual report content, it is impossible to extract meaningful intelligence data or perform the requested analysis.

A previously undocumented Microsoft Device Code phishing kit named MadApe has been uncovered, operating through a multi-stage campaign that combines business-themed PDF lures, configurable redirect chains, and fake document-sharing pages. The kit abuses Microsoft's legitimate Device Code authentication flow to gain access to victim accounts without collecting credentials on phishing pages. The campaign demonstrates sophisticated infrastructure comprising 155 root domains registered between June and August 2026, primarily through Dynadot. Multiple phishing templates impersonate SharePoint, OneDrive, Teams, Adobe Acrobat, and DocuSign while sharing identical backend functionality. The infrastructure includes custom human-verification challenges, decoy websites using shared templates, and operator panels exposed on the same hosts serving phishing pages. The activity shows broad localization across at least nine languages and targets business-related communications.

A sophisticated AI-integrated command-and-control framework named NIK C2 has been discovered, featuring a Windows implant capable of credential dumping, keystroke streaming, and real-time AI-powered data analysis through the OpenAI Chat Completions API. The Go-based implant employs dual-channel C2 architecture with TLS-secured WebSockets and HTTP fallback, utilizing AES-256-GCM encryption. It includes surveillance capabilities, lateral movement tools, screen-locking ransomware deployment demanding Bitcoin or USDT payment, and bootkit preparation features. The framework demonstrates advanced defense evasion through AMSI patching, process hollowing, and anti-debugging measures. Development spans at least three versions compiled with Go 1.23.4, indicating active evolution by a technically proficient team. Active C2 infrastructure was observed at IP 87.120.196[.]120 hosting domain total-sitevv[.]lol, confirming operational deployment beyond proof-of-concept status.

An unauthorized relay service has been installing genuine OpenAI Codex and Anthropic Claude Code command-line interfaces on enterprise systems, then reconfiguring them to route all requests through third-party infrastructure. Active since early 2026, the service has impacted organizations primarily in mainland China, with additional cases in South Korea, Taiwan, and Malaysia. Affected sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, and petrochemicals. The delivery mechanism uses fileless PowerShell or bash scripts fetched from lookalike domains. The reconfiguration disables execution sandboxes entirely, enables network access, replaces legitimate API credentials with relay-issued tokens, and disables telemetry. While no evidence of abuse exists, the configuration grants operators access to read every prompt, file, and secret, with commands executing under full user privileges.

Researchers uncovered fake Adobe Acrobat and "View & Sign" pages distributing legitimate, digitally signed ConnectWise ScreenConnect installers configured for unauthorized remote access. The campaign uses Telegram bots to track visitors, profile devices and networks, and automatically download remote-access clients when specific criteria are met. Five distinct page variants share near-identical JavaScript and common background images, applying operating-system and ISP-based checks before delivery. The installers connect to separate ScreenConnect Cloud tenants including omydze, vvvzou, luminahealthturkey2, tfcconnection, and alunos1. If executed, these clients establish persistent remote access running as LocalSystem. The threat weaponizes trusted software with valid digital signatures to bypass traditional security controls, requiring defenders to focus on identifying unauthorized tenant configurations rather than relying solely on file hashes.

A sophisticated supply-chain attack has been discovered targeting a custom Windows 10 build used exclusively by government entities in Asia. The attack employs a complex multi-stage infection chain called NetamLoader, leveraging XAML markup and .NET assemblies. The malicious framework begins with a CAB archive placed in Windows update directories, exploiting AppDomainManager injection and BinaryFormatter deserialization vulnerabilities. The attack chain progresses through multiple stages involving XAML loaders, bypasses AMSI protection, and deploys a plugin that communicates with command-and-control infrastructure. The framework uses AES encryption for network traffic, implements anti-analysis techniques including 22-28 hour polling intervals, and removes forensic evidence. The malware operates covertly by migrating to dllhost.exe and uses isolated AppDomains for payload execution. Commercial hosting infrastructure including Cloudflare CDN was utilized.

Star Blizzard, attributed to the Russian Federal Security Service Centre 18, is a persistent espionage group targeting government officials, defence personnel, think tanks, NGOs, and academia primarily in the UK, US, Ukraine, and NATO countries. The group conducts credential theft and hack-and-leak operations through sophisticated spear-phishing, impersonation, and relationship building. Since 2024, operations expanded from credential harvesting to deploying endpoint malware including SPICA, YESROBOT, MAYBEROBOT, and CosmicPulse backdoors. Notable shifts include moving from targeted to bulk phishing campaigns, incorporating fake CAPTCHA lures, exploiting iOS devices with leaked DarkSword exploit kit, and using compromised WordPress sites as infrastructure. The group rapidly adapts tooling after exposure, with new malware variants appearing within days of public disclosure. Recent campaigns targeted over 100 organizations using the RedFlick delivery chain, demonstrating increased scale and sophistication.

An out-of-bounds write vulnerability in Google's Brotli decoder, tracked as CVE-2026-111497 and known as Node2Shell or HTTP2Shell, affects Node.js and various other software packages. The critical flaw (CVSS 9.2) can be triggered when vulnerable processes decompress attacker-controlled Brotli data, potentially leading to crashes, memory disclosure, or remote code execution. The vulnerability impacts multiple runtimes including Node.js, Bun, Python, .NET, Envoy Proxy, and Java brotli4j. Exploitation can occur through both inbound malicious requests and outbound responses from compromised servers. Within 24 hours of disclosure, reconnaissance and exploitation attempts were observed from 20 source IP addresses across 402 events, with 40% involving reconnaissance and 60% exploitation attempts. Organizations should immediately patch vulnerable components and monitor for suspicious activity.

In September 2026, an exposed staging server revealed the complete operational workspace of a n0n ransomware operator, including breach tools, encryptor source code, extortion infrastructure, and an AI coding agent environment with over $7,000 in paid LLM API usage. The investigation identified at least 23 victim organizations across 14 countries spanning multiple sectors. Every documented compromise relied exclusively on weak or stolen credentials, with no vulnerability exploitation observed. The operation combines data exfiltration with either encryption or complete data destruction, including backup deletion. The operator leveraged an AI coding agent configured with 154 models to generate hundreds of attack scripts, demonstrating human-directed operations augmented by artificial intelligence. By October 2026, n0n had listed 93 victims with combined ransom demands totaling $283.7 million, using credential stuffing against FortiGate SSL-VPN devices, exposed cloud keys, and compromised management portals a...

An exposed staging server at 96.126.130.81 revealed an operator's extortion campaign targeting Japanese real estate websites between October 9-11, 2026, followed by PHP2Shell exploitation tooling. The operator, using the handle kkkkevin777, compromised one Japanese real estate services company and pivoted to nearly 20 related sites through shared hosting credentials. Stolen data included 16,061 customer records with plaintext passwords, income details, and addresses. The operator deployed ransom pages with an October 11 deadline and pressured victims by threatening to expose customer data. PHP2Shell tooling arrived on October 21, ten days after the extortion wave, indicating the operator was preparing new capabilities. Additionally, databases and emails from a Taiwanese company were exfiltrated. The server contained weaponized PHP2Shell reproducers, web shells, beacon logs, and scripts for lateral movement, though no confirmed PHP2Shell exploitation against live targets was documented.

An unidentified operator exfiltrated 68.837 GiB of database backups from a Philippine government agency managing overseas employment and migrant workers on 6 September 2026. The theft involved 27 SQL Server backups containing case-management systems including POEA and OFW variants. The operator inadvertently exposed their staging infrastructure via an open HTTP directory on a UpCloud VPS in Singapore, revealing a rebranded GodPotato privilege escalation tool (renamed Wrqsnx), PowerShell stagers, Impacket toolkit, and transfer logs. The payload leverages DCOM and RPC mechanisms to achieve SYSTEM-level access without exploiting vulnerabilities. Certificate analysis linked the compromised infrastructure to the Philippine Overseas Employment Administration portal farm. Initial access vectors and command-and-control channels remain unidentified, though tooling was delivered to agency portal hosts.

Group-IB's Threat Intelligence team uncovered a sophisticated Android malware campaign systematically targeting India's financial services sector since July 2025, orchestrated by the financially-motivated threat cluster CyberDakait. The operation distributes seven distinct malware families through coordinated smishing and vishing campaigns, impersonating bank representatives to trick victims into installing malicious APKs. These trojans harvest sensitive banking credentials, credit card details, and outstanding balances through overlay attacks while simultaneously conducting cryptojacking using XMRig. The malicious applications are hosted on GitHub repositories to maintain legitimacy, with the initial APK functioning as a dropper for the main payload and cryptocurrency mining module. Analysis revealed at least 17,960 compromised devices with 7.6 million intercepted SMS messages, including OTPs and transaction notifications. Attackers primarily target victims through fraudulent Credit Card Protection Plan s...

Threat actors are weaponizing legitimate mobile device management platforms, including Hexnode and Rippling, through social engineering techniques to establish unauthorized remote access to victim systems. Attackers use phishing emails with business-themed lures, such as proposals and meeting invitations, to trick users into enrolling devices or installing management agents. Once MDM access is established, adversaries leverage this trusted, privileged path to deploy unauthorized remote monitoring and management tools like ScreenConnect, which connect to attacker-controlled relays. The deployment chain typically follows a pattern: social engineering leading to MDM enrollment, followed by RMM installation and external relay connections. This technique demonstrates the challenge of distinguishing legitimate administrative tools from malicious use, as the MDM platforms themselves are not compromised but rather misused through deception.

A sophisticated Android Malware-as-a-Service operation called MR ROBOT is actively targeting Indian bank customers through a subscription-based model. The platform enables cybercriminals to rent customized banking trojans distributed via fake Play Store pages and messaging apps. The operation uses a multi-stage dropper that decrypts encrypted payloads to deploy banking trojans capable of intercepting SMS and OTPs, silently enabling call forwarding using the *21# carrier code to bypass phone-based two-factor authentication, and overlaying phishing screens to harvest card details, CVV, ATM PINs, UPI credentials, and identity documents. One tracked affiliate compromised 153 devices and intercepted 5,407 SMS messages across multiple Indian banks. The operation features a Telegram bot storefront offering approximately 36 fake applications impersonating banks, utility providers, and government services, with stolen data exfiltrated to Firebase Realtime Database and Telegram channels.

Three malicious Firefox extensions impersonating popular cryptocurrency wallets—Phantom, Jupiter, and Bitget—were discovered stealing recovery phrases and private keys from users. The extensions use Unicode homoglyphs to mimic legitimate wallet names and route stolen credentials to brand-named subdomains of bonto[.]io. The Phantom impersonator employs a two-stage approach: a loader fetches additional payloads from a remote server at runtime, allowing operators to modify malicious code post-review. All three extensions bundle complete stealers in signed packages that capture seed phrases, private keys, and clipboard data. The campaign uses separate throwaway developer accounts for each listing and provisions infrastructure for additional targets including Coinbase and Exodus wallets. Captured secrets grant attackers complete control over victims' cryptocurrency wallets and assets.

During September 2026, infostealers were primarily distributed through SEO poisoning, disguised as illegal software such as cracks and keygens. Major distribution platforms included Mediafire, AWS S3, Mega, and Cloudflare Storage. EXE files comprised 90.8% of samples, while DLL side-loading accounted for 9.2%, utilizing legitimate files like python37.dll and POWRPROF.dll. A new infostealer named Lzveil, built with Rust, downloads configuration data from C2 servers and uses modified Base64 decryption, XOR encryption, and LZNT1 compression. Email campaigns distributed DarkCloud and AgentTesla infostealers, impersonating construction and logistics companies respectively. Both steal credentials, browser data, cryptocurrency wallets, and system information. The stolen data is often traded on dark web markets or used for secondary attacks.

Infrastructure tracking related to ValleyRAT led to the discovery of multiple fraudulent websites impersonating legitimate Korean companies including Doosan Robotics and Cheonjeong. These sites used authentic corporate logos, videos, and descriptions to appear legitimate while offering features like invitation-code registration, VIP memberships, and cryptocurrency deposit/withdrawal functions. Online chat support provided instructions for USDT payments via TRON wallet addresses, requiring users to submit transaction screenshots. Analysis revealed TRON wallet addresses with significant transaction volumes, including one wallet that received approximately 13 million USDT cumulatively. Infrastructure analysis starting from ValleyRAT C2 IP address 14.128.53[.]155 identified 12 potentially associated domains. However, no direct operational connection has been confirmed between ValleyRAT malware operations and these fraudulent websites or cryptocurrency wallets.

Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 that became one of the most prolific groups by 2025 with over 1,000 claimed victims. The operation employs a flexible platform allowing affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure. Affiliates typically gain initial access through phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools. The group follows a double-extortion model, encrypting systems while threatening to publish stolen data via their blog and WikiLeaksV2 platform. Notable incidents include the 2024 Synnovis attack affecting UK healthcare services. Qilin has been linked to Moonstone Sleet and Scattered Spider, with some operators creating derivative operations including The Gentlemen and Securotrop, the latter maintaining affiliate status while operating an independent leak site.

The FBI seized virtualine[.]net on October 27, 2026, under Operation Omegaline, targeting Virtualine Technologies, which operated as Omegatech (AS202412). This bulletproof hosting provider emerged in February 2026 after infrastructure shifted from Railnet LLC (AS214943). Bulletproof hosting providers rent servers to cybercriminals while ignoring abuse complaints, enabling phishing, malware, and ransomware operations. Over the past year, 50 such providers lost their autonomous system numbers due to law enforcement action, sanctions, or strategic abandonment. Despite seizures, operators quickly rebrand and acquire new ASNs within days, moving malicious IP ranges to continue operations. Recent enforcement actions include Dutch seizure of THE.Hosting servers, US charges against Russian nationals, and EU sanctions against Media Land. The investigation involved FBI Washington Field Office, Germany's Polizei Hessen, Netherlands' Politie Midden-Nederland, UK's National Crime Agency, and private partners.

SkyW4lker is an active device-code phishing kit exploiting Microsoft 365 authentication processes across the United States, Europe, and other regions. Operating since June 2026, it bypasses MFA by abusing legitimate OAuth 2.0 device-code flows, granting attackers access to corporate accounts without stealing passwords. The kit uses phishing emails with password-protected attachments containing links that lead victims through CAPTCHA pages to malicious sites requesting Microsoft device codes. Analysis revealed 618 sandbox submissions between June and October 2026, with 46% originating from US organizations. Monthly activity surged from 20 cases in June to 200 in September. Technical investigation uncovered shared infrastructure and code similarities with the Gabagool credential phishing kit, suggesting common development. The kit employs obfuscated JavaScript, IP-based geolocation, and PHP backends to track victim authentication status, primarily targeting technology, manufacturing, and government sectors.

A sophisticated credential phishing campaign leverages fake business bid invitations to target professionals. The attack begins with an email titled 'Project Bid Invitation' containing a password-protected PDF attachment that evades automated security scanning. Once opened, the PDF displays a fake OneDrive button redirecting victims to a fraudulent shared document drive. Recipients are prompted to select files for download, then asked to enter their email address, mimicking legitimate document-sharing platforms. This leads to a counterfeit Microsoft login page where entered credentials are harvested and transmitted to attacker-controlled servers. The campaign exploits trusted business processes, password protection mechanisms, and familiar brand interfaces to bypass both technical defenses and human vigilance, making it particularly effective against employees conditioned to respond urgently to legitimate business opportunities.

Unprotected Cairn AI intrusion harnesses are being systematically compromised by unknown actors through automated campaigns that began around October 20, 2026. Attackers insert malicious tasks that manipulate agents to compromise the host systems, involving profiling installations, stealing secrets including AI model API keys, downloading Poseidon malware, and installing unauthorized SSH keys. Two distinct threat clusters, designated AIA0009 and AIA0010, conduct synchronized waves of attacks across multiple panels. AIA0009 focuses on persistence and malware deployment, while AIA0010 emphasizes exploration and credential extraction. The campaigns appear highly automated and possibly agentic, utilizing AI to attack AI operations. Activities include container escape attempts, reconnaissance of host environments, and deployment of Poseidon RAT configured with Bunny.net CDN command and control infrastructure.

A Brazilian Magecart group, active since 2024, conducted a supply chain attack by injecting a card skimmer into the Plausible analytics script of Brazilian ecommerce platform Convertr. Starting October 24, 2026, all Convertr checkouts loaded the malicious tracker from analytics.convertr.app.br, stealing card details, CVV, expiry dates, cardholder names, and CPF taxpayer numbers from shoppers. The stolen data was exfiltrated to 1x0.is. The attackers exploited CVE-2026-8467, a critical vulnerability in Plausible Community Edition versions 3.0.0 through 3.2.0, which allowed command execution through an exposed component. Convertr removed the skimmer and patched Plausible on October 27. This group has targeted dozens of Brazilian stores running Magento, OpenCart, and WooCommerce since 2024, using distinctive techniques including pipe-delimited data exfiltration and Portuguese-named endpoints.

Attackers compromised camera management software (CMS.exe) to gain initial access to multiple organizational environments. Following compromise, adversaries deployed rs.win32.exe into user AppData directories and leveraged DLL sideloading by placing the legitimate Windows binary WpcMon.exe alongside malicious DLLs (IPHLPAPI.DLL and samcli.dll) in non-standard locations. These modified DLLs, based on zlib compression libraries, incorporated beaconing functionality to communicate with a command-and-control server at 144.172.116.37. Persistence was established through Run Key registry modifications. The camera management software, potentially linked to 3R Global and kvision.ai, lacked adequate security controls and logging capabilities. Organizations should treat camera systems and their management platforms as critical components of the enterprise attack surface, implementing proper access controls, monitoring unusual process chains, and restricting executable execution in user-writable paths.

Check Point Research discovered a campaign tracked as Yoba that exploits the popularity of AI tools like ChatGPT and Claude. Attackers created fake GitHub projects mimicking desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects host malicious installers alongside legitimate, signed executables from OpenAI and Anthropic, employing DLL sideloading techniques to bypass security protections. The campaign demonstrates strong operational security by avoiding dedicated command-and-control infrastructure, instead relying on Telegram, Tor, Catbox, and DNS over HTTPS. The malware chain includes YobaDropper and YobaLoader components that ultimately deliver unwanted software, including XMRig cryptocurrency miners, to infected systems. The threat actor exhibits indicators suggesting Russian origins and operates primarily in the UTC-4 timezone, excluding CIS countries from infection.

Wiz Research has been monitoring exploitation attempts targeting two critical PHP vulnerabilities since their public disclosure on October 21, 2026. While no successful attacks have been observed in their telemetry, some private exploits have been shared that work against various targets. Telemetry shows a 67% decrease in exposed vulnerable machines and a 47.9% reduction in significantly affected organizations within one week. Observed exploitation attempts include tools using the PHP2Shell mechanism matching public proof-of-concepts, though none completed the full exploit chain. Challenges preventing successful exploitation include request-size limits, memory exhaustion failures, and difficulties with worker pinning across different PHP configurations. Additionally, some tools branded as PHP2Shell exploits actually relied on unrelated session poisoning techniques requiring separate local file inclusion vulnerabilities. Despite limited success to date, PHP2Shell remains a significant risk requiring immedia...

ICMacOS (Icarus macOS) is a newly identified macOS Malware-as-a-Service stealer actively marketed since September 2026 by the Russian-speaking actor GlowComa on underground forums. The malware targets macOS systems running Sierra through current versions on both Intel and Apple Silicon architectures. Initially designed as a credential stealer, it rapidly evolved into a persistent remote access trojan with WebSocket-based command-and-control capabilities. The infection chain uses ClickFix social engineering to deliver dropper scripts that harvest administrator passwords through fake system dialogs before deploying the primary payload. Version 1 focuses on stealing browser credentials, cryptocurrency wallets, developer secrets, messaging data, and password managers. Version 2 introduces full RAT functionality with LaunchAgent persistence and interactive shell access while expanding data collection to include Steam accounts, Outlook data, and additional password managers.

Two unrelated operations exploited domain shadowing techniques to place illegal gambling content beneath legitimate educational and government domains in Bangladesh, India, and Mexico. Unauthorized parties gained access to DNS administration, creating records beneath established institutional namespaces to leverage their reputation for search engine optimization. Hidden Hawk added individual CNAME records mapping institutional hostnames to gambling pages hosted primarily on Cloudflare Pages, affecting over 850 entry points across eight domains. A separate campaign targeting Maharashtra government domains delegated entire subzones to third-party nameservers using wildcards, enabling external management of numerous hostnames. Both operations served Indonesian and Indian illegal gambling content worth an estimated $6 trillion globally in unregulated markets, exploiting institutional trust to boost search rankings and acquire traffic while leaving primary websites intact and potentially unnoticed by domain own...

Two critical use-after-free vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2, affect the session.upload_progress feature. These flaws trigger during multipart request parsing before application code executes, bypassing WAFs and enabling unauthenticated remote code execution. Within 48 hours of the October 21, 2026 patch release, exploit code spread rapidly across GitHub. Diverse UNC actors deployed automated scanning and exploitation tools targeting over 70% of internet-facing PHP infrastructure running unpatched versions (prior to 8.5.12, 8.4.27, 8.3.36, 8.2.35). Observed campaigns include mass exploitation scripts, Mirai botnet C2 infrastructure, session poisoning chains via WordPress LFI vulnerabilities, and automated reconnaissance using proxy pools. Honeynet telemetry captured active exploitation from multiple IP addresses, demonstrating weaponization across public, educational, and business sectors globally.

Security researchers uncovered DarkCore, a remote access trojan distributed through cybercrime networks with advanced credential theft and session hijacking capabilities. The threat features a dedicated browser that reuses stolen session cookies to access Gmail, WhatsApp, MediaFire and other services while routing traffic through victims' IP addresses to masquerade as legitimate activity. DarkCore also includes hidden virtual network computing (HVNC) for concealed desktop access, credential managers displaying usernames and passwords, and reverse proxy functionality. Distribution occurs via PDF-themed shortcuts that download decoy documents alongside malicious executables. The native C++ tool communicates with command-and-control infrastructure via direct TCP connections and can load additional modules either in-memory or as temporary DLL files for extended functionality.

Three malware campaigns using VBScript have been identified targeting victims primarily in Brazil and Portugal through phishing attacks. The campaigns deliver Overlord RAT, Lampion trojan, and an unknown RAT using fake legal notices, financial documents, and invoice pages. Attackers employ multi-stage execution chains involving obfuscated VBScript, batch files, and DLL side-loading with legitimate Windows components like VMware network libraries and VLC player. The malware establishes persistence through scheduled tasks and registry modifications while attempting to evade detection by adding Defender exclusions and checking for virtualized environments. Infrastructure analysis reveals Brazilian-based command and control servers, with payloads delivered through cloud services including Dropbox, Google Cloud Storage, and AWS S3. The campaigns demonstrate sophisticated techniques combining social engineering, trusted application abuse, and encrypted payloads to compromise systems and maintain remote access ca...

Security researchers identified a sophisticated supply chain attack campaign involving 42 compromised GitHub repositories across 11 legitimate owners connected to the testmetest npm operation. The campaign evolved to use compiled native addons that decrypt hidden payloads at runtime, evading detection in CI environments through extensive anti-analysis checks. Attackers deployed polymorphic wrappers ranging from 12.9 to 13.7 MB that decode to identical publisher payloads, embedding execution hooks for AI coding assistants and IDEs. The operation included credential theft, repository hijacking, forged commit timelines, and automated malicious package publishing through GitHub Actions using npm trusted publishing. The infrastructure also links to shellpanel exploitation activities targeting cPanel systems. The campaign demonstrates advanced evasion techniques including environment detection for CI systems, containers, sandboxes, debuggers, and security tools before executing malicious code on developer workst...

Adversaries are exploiting Microsoft Teams' default external chat functionality to conduct social engineering attacks and deliver malicious payloads. Analysis of over 400 incidents reveals threat actors consistently impersonate IT support personnel using throwaway Microsoft 365 tenants with IT-themed display names marked as "(Internal)" to bypass external-user warnings. Attacks frequently begin with email bombing followed by Teams contact offering assistance. Adversaries leverage legitimate remote monitoring tools like Quick Assist, AnyDesk, and ScreenConnect to gain hands-on-keyboard access, progressing from initial contact to payload execution in under 15 minutes. Infrastructure patterns show a shift from default onmicrosoft domains toward paid top-level domains, particularly .top domains comprising 50 percent of observed cases. The technique exploits legitimate collaboration features rather than software vulnerabilities, requiring organizations to implement allow-list policies and user training to disru...

Since September 15, 2026, an automated campaign named Gheist has been performing mass abuse of compromised GitHub tokens. The attack commits a workflow named sync-check to every accessible repository, designed to print repository secrets into workflow logs. These secrets are then exfiltrated through GitHub's API and the logs deleted seconds later. Over 13,500 planted branches from more than 850 compromised accounts have been recovered, affecting personal projects and enterprise private repositories. While GitHub's approval controls have blocked exploitation in public repositories, private repositories and GitHub Enterprise environments remain vulnerable. The campaign uses no command-and-control server, carries the user agent 'gheist', and has been actively evolving with multiple variants. Approximately two-thirds of implicated accounts have been removed from GitHub, likely due to response activities.

A criminal group has compromised 953 online stores, predominantly Magento shops, since July 2025 by injecting malicious JavaScript loaders into CMS blocks. The latest domain, deepveindrilling.com, was registered in October 2026 and employs sophisticated bot detection using browser fingerprinting to evade security scanners. The loader stores malicious code in visitors' localStorage for persistent execution. The campaign utilizes five different domains over 15 months, previously leveraging Keitaro traffic distribution system. Attackers exploited known Magento vulnerabilities, particularly PolyShell and SessionReaper file upload flaws, to gain initial access. The final payload targets cryptocurrency users with fake Ledger wallet pages. Most compromised stores were previously infected victims that were reinfected through persistent database access and backdoors, demonstrating the attackers maintain long-term access even after initial cleanup attempts.

A Korean-speaking threat actor, tracked as the June 2026 Minjun campaign and linked with moderate confidence to North Korea's Lazarus Group, is actively planning targeted exploitation of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that enable unauthenticated remote code execution. The campaign prioritizes government agencies, financial institutions, manufacturing, logistics, aviation, and trading platforms across the US, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, and the EU. Operators are using AI-assisted reconnaissance to rank public exploit code and plan sector-specific attacks. Exploitation attempts have been observed globally since 17 October 2026, with 17 suspected source IPs identified conducting web shell deployment and session poisoning. The vulnerabilities affect all internet-facing PHP installations below version 8.5.12, 8.4.27, 8.3.36, or 8.2.35, with Apache mod_php at highest risk.

On October 21, 2026, LiteLLM version 1.107.0 was compromised and distributed through PyPI and official container images. The malicious package leveraged Python startup mechanisms to execute credential-stealing payloads automatically, without requiring applications to actively import LiteLLM. Attackers utilized stolen developer GitHub credentials to redirect the release workflow to a lookalike repository. The payload targeted authentication material across developer tools, AI applications, cloud environments, browsers, and infrastructure. Two execution paths were identified: a credential collector launched through path extensions and a Unix-oriented loader persisted through site-specific configuration. Collected credentials were encrypted using AES-256-CBC with RSA-wrapped keys and exfiltrated to attacker-controlled infrastructure. The compromise affected not only LiteLLM gateway deployments but also developer workstations, CI/CD agents, test systems, and containers where Python was executed in affected env...

Aokigahara is a newly identified infostealer with traditional data theft capabilities targeting browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications. Its distinguishing feature is dedicated targeting of AI applications and development tools, including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI. The malware collects authentication files, session data, and configuration files from these AI services, alongside developer credentials such as Git files, SSH private keys, and AWS, Azure, and Google Cloud credentials. Stolen AI credentials could enable unauthorized access to paid services, account resale, or data extortion. The stealer employs anti-analysis techniques including language checks, virtual machine detection, and control-flow flattening, and uses AES-256 encryption with X25519 key exchange for command-and-control communications.

VeloCloud Orchestrator (VCO) on-premises versions contain a critical SQL injection vulnerability that allows authenticated users with minimal privileges to escalate to superuser operator access. Any user with Enterprise Read Only role can exploit this flaw to access privileged internal functionality, potentially compromising the confidentiality, integrity, and availability of the orchestrator and managed data. The vulnerability is actively exploited, with specific malicious IP addresses identified. Affected versions include VCO 5.2.x prior to 5.2.3.18, 6.1.x prior to 6.1.3.10, and 6.4.x prior to 6.4.2.12. Hosted and dedicated VCO instances were already patched. Immediate upgrade to fixed releases is recommended, along with restricting web interface access and monitoring for suspicious activity.

In September 2026, an SEO poisoning campaign distributed Armorsteal malware through fake websites impersonating Chocolatey package manager and Microsoft Activation Scripts (MAS) tool. Victims searching for software installation commands were presented with malicious PowerShell scripts that deployed Python-based malware protected by Pyarmor. The malware consists of three main components: a remote access module that communicates with command-and-control servers and verifies RSA-2048 signatures on received tasks; a surveillance module that logs keystrokes, monitors clipboard activity, hijacks cryptocurrency wallet addresses, and captures screenshots; and an information stealer targeting browser data, Discord tokens, cryptocurrency wallets, seed phrases, passwords, and SSH keys. The campaign employed anti-analysis techniques including cloud provider detection and code obfuscation, with infrastructure changes observed throughout the monitoring period.

Advanced Android threats increasingly operate beyond the standard application sandbox, requiring multi-layered detection strategies that combine on-device behavioral analysis with OS-level telemetry. Android's Delegated Scope enables enterprises to grant security applications access to security and network logs on managed devices without full MDM authority. The new Intrusion Logging feature extends similar forensic visibility to BYOD users through Advanced Protection on supported devices running Android 16 or later. This privacy-preserving capability allows users to collect and share encrypted security, DNS, and connection logs for analysis. The technical analysis demonstrates how these logs expose the complete RatHat attack chain, including Wireless Debugging self-pairing, ADB shell command execution, daemon staging, and command-and-control communications, providing actionable indicators of compromise across process execution, privileged operations, and network activity.

As organizations approach year-end and fiscal close periods, employees face increased administrative activity in finance, HR, and IT departments. This heightened legitimate communication creates ideal cover for phishing campaigns. Attackers exploit year-end business processes by impersonating compensation adjustments, Q4 financial documents, access reviews, invoice follow-ups, and benefits statements. Multiple campaigns have been observed targeting organizations across sectors including aviation, telecommunications, manufacturing, real estate, technology, and financial services, with concentration in the Middle East. Attackers leverage SharePoint, Docusign, and Microsoft 365 themes, employing credential harvesting pages disguised as document-sharing portals. Generic protected-message lures prove effective by requiring minimal customization while appearing legitimate during busy periods when employees expect increased document requests and administrative deadlines.

TRUST#GRAFT is a sophisticated attack chain that exploits authenticated WordPress administrator browser sessions to deploy persistent PHP backdoors. The attack begins with JavaScript loaders that present fake Cloudflare-style verification screens while performing browser fingerprinting, credential harvesting from browser storage, and environment profiling. The critical pivot occurs when the script detects an active WordPress administrator session, automatically extracting CSRF tokens and uploading a malicious plugin disguised as 'Web Media Optimizer.' The PHP backdoor establishes persistence by copying itself to the must-use plugins directory, injects remote JavaScript into public pages, provides token-gated administrator access, and conceals itself from standard plugin management interfaces. The chain demonstrates coordinated infrastructure across multiple domains and requires no authentication bypass, instead leveraging existing trusted browser sessions to convert legitimate administrator workflows into ...

On July 16th, 2025, UAC-0099 conducted a spearphishing attack against a Ukrainian grain logistics company, deploying the MATCHWOK backdoor. The following day, attackers introduced MythicRatatoskr, a previously undocumented Go-based backdoor utilizing the Yggdrasil mesh network for command and control communications. This decentralized network enables end-to-end encrypted IPv6 traffic between nodes, complicating detection efforts. Approximately two months later, on September 17th, 2025, Sandworm executed a destructive data-wiping attack using the SDelete utility deployed via Active Directory Group Policy. This incident represents documented cooperation between UAC-0099, acting as an initial access broker, and Sandworm, responsible for the destructive phase. The MythicRatatoskr backdoor supports standard backdoor functionality including command execution, file transfer, screenshot capture, and SOCKS5 proxying capabilities, marking the first documented case of state-aligned actors exploiting Yggdrasil infrast...

Throughout October 2026, an actor utilizing ARTEX, an autonomous AI penetration-testing agent, targeted multiple IT and software vendors with attacks focused on identity providers including Okta, Entra, and Cognito. The activity overlaps with Storm-0940, a Chinese-state aligned actor involved in supply-chain attacks. Observed methodologies included mapping applications through JavaScript bundles and source maps, probing authentication mechanisms, manipulating OAuth callbacks, password-spraying corporate environments, abusing account recovery endpoints, and testing tenant isolation. Sessions lasted 24-30 hours with automatic IP rotation when blocked. The agent demonstrated agentic behavior through automated step chaining, output-based adaptation, and relentless iteration. Attacks featured coordinated bursts with unique user agents, one-second intervals between attempts, and targeting of software engineers across hundreds of users.

Four months after Operation Endgame dismantled StealC in June, its seller returned in October with Stadia, a full-featured remote access trojan that incorporates StealC's code verbatim. Unlike its predecessor, Stadia offers comprehensive remote administration capabilities including hidden desktop control, live command shell, file explorer, process manager, and in-memory loader, with the original StealC stealer functioning as one of six modules. The operator targets former StealC customers by offering a free month on the top-tier subscription priced at $900 monthly. Analysis reveals the binary shares byte-for-byte code with StealC version 3.5, particularly the Chromium App-Bound Encryption helper. The agent communicates via plain HTTP to three hardcoded IP addresses, uses RC4 encryption with Base64 encoding, and establishes persistence through hidden scheduled tasks under C:\ProgramData\ with randomized directory names impersonating legitimate updaters. The transformation from simple infostealer to full RAT...

Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, leaked before their scheduled patch on October 21, 2026. The flaws involve out-of-memory corruption in PHP core through multipart/form-data parsing, exploitable via session.upload_progress without authentication. Scanning began approximately 20 minutes after the patch release, with activity traced to a Mirai-style IoT botnet. Analysis of attacker infrastructure revealed approximately ten workspaces staging php2shell tooling, targeting WooCommerce, WHMCS, and Magento platforms. Despite widespread exposure affecting over 683,000 IPs running vulnerable PHP versions, no successful in-the-wild exploitation was confirmed as of October 21, 2026. The technical difficulty of achieving reliable code execution on systems with address-space randomization limited successful compromises.

Between July and September 2026, a sophisticated campaign targeted Microsoft 365 accounts through adversary-in-the-middle attacks and token replay techniques. The operation captured sign-in sessions via AiTM relays and replayed stolen tokens from IP addresses controlled by German hosting provider 1337 Services GmbH. Over ten weeks, 79 organizations were compromised with 497 successful sign-ins against over 200,000 failed attempts. Attackers registered 48 rogue Entra devices, replaced victim MFA methods, and created hidden inbox rules to conceal malicious communications. The campaign evolved through four distinct phases, rotating through different IP addresses and employing both scripted token replay and browser session replay techniques. In one case, compromised accounts were used to send payroll-related emails to external contacts, demonstrating business email compromise objectives.

SiriusQT is a Windows Remote Access Trojan advertised on dark web forums since April 2026, offering capabilities beyond remote administration including HVNC, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, and persistence mechanisms. Distributed via Malware-as-a-Service by a reseller named GhostKernel, at least 30 users purchased licenses ranging from monthly to lifetime access. The malware was observed targeting victims in the United Kingdom, Germany, France, Spain, Italy, and the Netherlands. SiriusQT employs custom encrypted command-and-control traffic, multiple process injection techniques, and features both native C++ and .NET loader variants. The threat actor Amonus is referenced as the alleged developer, though GhostKernel appears to be the primary distributor through underground forums and Telegram channels.

Amazon Threat Intelligence discovered PHP2Shell exploitation attempts in MadPot honeypot telemetry on October 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The initial exploit originated from a commercial anonymization network, suggesting threat actor involvement during the embargo period. Multiple proof-of-concept exploits emerged on the disclosure date, with varied payloads and infrastructure indicating multiple actors. Following the embargo lift on October 21, 2026, exploitation became widespread within hours. This incident highlights two critical lessons: coordinated disclosure cannot guarantee zero-day protection, and AI-assisted analysis has dramatically shortened the time from patch release to working exploits, requiring organizations to measure patch timelines in hours rather than days.

In early 2026, a sophisticated APT campaign targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan deployed BlackX, a UEFI bootkit similar to the notorious BlackLotus. The bootkit exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot and install malicious drivers into the Windows kernel. Despite patches being available since 2023, victims remained vulnerable because the mitigation requires manual activation by administrators. The campaign deploys cyberespionage payloads including a RAT using cloud storage for command and control, and OxiDLLRunner, a Rust-based payload. The attack demonstrates APT actors borrowing techniques from cybercrime operations, as BlackX appears to be reverse-engineered from BlackLotus code. Attribution points to APT41 based on code similarities and tactics matching previous campaigns.

On October 21, 2026, attackers compromised litellm version 1.107.0, a popular Python proxy library for LLM providers with approximately 23 million weekly downloads. The malicious release was available on PyPI and official Docker images for about two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to launch a private release workflow against a malicious fork. The payload installed a credential stealer targeting cloud, developer, AI-tool, browser and LiteLLM proxy credentials, plus a second-stage remote access trojan backdoor. The malware executes automatically whenever Python starts through dropped files in the site-packages directory. This represents the second supply chain compromise of LiteLLM in 2026, with no established connection to the previous incident linked to TeamPCP activity.

In October 2026, a Chinese-speaking threat actor conducted widespread AI-assisted cyberattacks combining the ARTEX penetration testing framework with multiple AI coding assistants including Claude Code, Codex, and Grok. The attacks, initially reported as targeting South Korean financial institutions, affected organizations globally across multiple industries including finance, retail, education, cryptocurrency, and telecommunications. Custom synchronization scripts maintained investigation context across AI sessions, while specialized agents divided reconnaissance and exploitation tasks. Prompts revealed requests for bulk personal data, transaction records, and mobile phone numbers, alongside questions about selling stolen information on underground markets. The workflow incorporated peer review between AI models, with GLM instructed to audit DeepSeek findings. Targeting spanned over 20 countries across Asia, Africa, Europe, and North America, indicating financially-motivated opportunistic attacks.

Two critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell, were disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory handling corruption that can interrupt PHP while internal request data is partially initialized, leading to invalid data treatment. CVE-2026-109619 exploits stale global state where request-owned internal state survives after memory is freed. Both vulnerabilities can be exploited successfully on ARM64 systems and x86 systems without ASLR. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Over 2.6 million internet-facing hosts running PHP were identified as vulnerable, with 42% on end-of-life branches receiving no official patches. Early exploitation attempts were observed from multiple sources, including scanning activity and webshell deployment attempts targeting the upload-progress vulnerability path.

LiteLLM version 1.107.0 was compromised through a supply chain attack affecting both PyPI packages and Docker images. The malicious release contains Python startup files that automatically execute upon Python initialization, stealing cloud credentials, private keys, browser data, and AI development tool authentication. Socket's AI scanner detected the compromise seven minutes after publication. Container build provenance reveals the attack used a lookalike repository (Berri-AI/litellm instead of BerriAI/litellm) in the release workflow. The payload targets AWS, Azure, Google Cloud credentials, GitHub CLI, SSH keys, npm/PyPI configuration, and AI tool credentials including Claude, Gemini, and Cursor. Stolen data is encrypted and exfiltrated to a command-and-control server. A separate loader mechanism enables remote Python code execution. The package receives approximately 23 million weekly downloads, making the impact significant.

Threat researchers discovered an AI-driven intrusion ecosystem operated by affiliates of INC Ransomware and The Gentlemen Ransomware groups through seven exposed command-and-control servers. The operators integrated commercial AI models via OpenCode and OpenRouter, logging over 8,000 messages across 133 sessions with recorded spending exceeding $23,000. They exploited edge devices at scale including FortiClient EMS, SimpleHelp, and cPanel systems, compromising thousands of targets. The infrastructure contained 46 custom INC encryptor builds staged for October 1, 2026 deployment, evidence of live victim encryption, and a custom arsenal including the Phantom autonomous framework, Ghost C2, and various exploitation tools. The campaign targeted 62 named organizations, predominantly in the United States, with focus on industrial manufacturing and healthcare sectors. OPSEC failures in late September 2026 exposed source code, credentials, AI session logs, and complete victim knowledge bases.

Group-IB and NyxLab uncovered a large-scale campaign by threat actor k0t exploiting FortiGate, FortiWeb, and Palo Alto GlobalProtect edge devices to harvest credentials and establish persistent access. The operation involves exploiting CVE-2025-64446 in FortiWeb and CVE-2026-0257 in GlobalProtect, alongside brute-forcing attacks using custom tools. Over 70,000 exposed credentials were discovered, with victims spanning multiple industries globally. Post-compromise activities include credential theft, Active Directory enumeration, and data exfiltration via Rclone to cloud storage. Persistence is maintained through MeshCentral, AdaptixC2, and various RMM tools including Atera and AnyDesk. The campaign shows overlaps with Qilin and The Gentlemen ransomware groups, suggesting k0t may operate as an Initial Access Broker, though direct affiliation remains unconfirmed.

BlueHammer (CVE-2026-33825) is an eight-stage local privilege-escalation chain targeting Windows Defender Antimalware Platform before version 4.18.26030.3011. It requires initial code execution as a standard user and chains CloudFilter callbacks, batch oplocks, object-manager symlinks, Defender's update RPC, offline SAM parsing, and SAMR operations to achieve NT AUTHORITY\SYSTEM access. The exploit leverages legitimate Windows mechanisms rather than memory corruption, freezing MsMpEng.exe through CloudFilter manipulation while staging malicious update files. In laboratory testing, it successfully escalated privileges, recovered domain-admin credentials from LSASS, and enabled lateral movement via pass-the-hash to compromise domain controllers. Runtime factors including pending signature updates, WinDefend state, filter drivers, VSS, and CloudFilter reachability determine actual exploitability beyond version-based detection.

A financially motivated threat actor operating under the handle BUGSTER leveraged jailbroken AI assistants, specifically the Hermes Agent framework with DeepSeek V4, to conduct multiple cybercrime operations across India. The actor, demonstrating limited technical skills but relying heavily on AI-generated scripts and reconnaissance, successfully exfiltrated over 5,200 personal records from a university database, conducted WordPress brute force attacks, and planned VoIP telecommunications fraud. Additional activities included Wi-Fi password cracking requiring physical proximity to targets, cryptocurrency whale reconnaissance, and development of credential scanning toolkits. The actor configured specialized AI bot profiles providing step-by-step criminal guidance, including fraud traffic ratios and carrier evasion techniques, demonstrating how AI lowers the skill barrier for cybercrime operations.

Attackers leveraged a sponsored Google search result for 'amazon business' to redirect victims to a spoofed Amazon login page hosted on Google Sites. The page presented a fake CAPTCHA (ClickFix) that tricked users into executing a malicious command using Windows' finger utility, an obsolete network tool repurposed as a living-off-the-land binary. This initiated a complex infection chain downloading IronPython, executing obfuscated Python scripts, and deploying multiple payloads including Doina malware, Lumma Stealer via a Node.js package, and a pirated NetSupport Client RMM tool. The attack infrastructure predominantly used barbecue-themed domains for command and control. The campaign affected multiple organizations and demonstrates cross-platform capabilities, with alternate payloads prepared for macOS users. Attackers employed sophisticated obfuscation techniques including Base64 encoding with Cyrillic character substitution, XOR encryption, and RC4 decryption throughout the infection stages.

In October 2026, multiple organizations in Japan experienced unauthorized access incidents resulting in personal information leakage. Investigations revealed that attackers leveraged artificial intelligence to scan for known vulnerabilities and execute attacks through APIs. The threat actors analyzed Android application packages to identify and exploit APIs, testing for vulnerabilities including server-side request forgery. Multiple attack servers were identified containing tools for reverse engineering Flutter applications, analyzing Android apps, and targeting web applications, MySQL databases, Jenkins servers, and email gateways. Evidence suggests attempts to evade endpoint detection and response systems and deploy web shells for internal network access. The attacks also targeted web services beyond Japan, demonstrating a broader scope of malicious activity.

Attackers have developed an autonomous offensive agent that scans the internet for exposed large language model endpoints and hijacks them to execute attacks. The agent is equipped with 74 offensive tools covering reconnaissance, exploitation of web frameworks including VS Code, Django, Jupyter, Laravel, Supabase, Next.js, Flask/Werkzeug, database theft through Prisma, credential harvesting, and cryptocurrency mining. Once connected to an unprotected model, it operates unattended for up to 100,000 steps without human approval. The operators use jailbreak techniques to bypass safety controls, redefining credential theft as routine development work. Victims include model owners who pay for computing power and compromised servers stripped of data and used for Monero mining. The activity was captured through an AI honeypot that recorded the complete instruction set, revealing a self-directed cybercrime operation targeting internet-facing AI services without authentication.

The Gentlemen is a Russian-speaking ransomware-as-a-service group that emerged in mid-2025 after operating as an affiliate of LockBit and Qilin. The group offers affiliates up to 90% of ransom revenue and has claimed over 800 victims across multiple regions and sectors. The ransomware targets Windows, Linux, NAS, and BSD systems using a double-extortion model that encrypts files and exfiltrates data. Written in Go, the ransomware employs ChaCha20 encryption with multiple speed modes, terminates security processes using vulnerable drivers, and spreads laterally through networks via PsExec. A May 2026 infrastructure breach exposed internal communications, affiliate information, and connections to the Qilin ecosystem. Organizations in the United States and Europe are most frequently targeted, particularly in manufacturing, technology, healthcare, professional services, and retail sectors.

In January, Lazarus Group launched Operation FlashHole against South Korea, exploiting mandatory security software CrossWeb EX through watering hole strategies and targeted spear-phishing emails with fake portfolio and resume sites. The campaign began in July the previous year, targeting software, construction, and cable equipment manufacturing sectors. The attack chain combines old and new malware families including TechHub, Cubridge, TouchShift, TouchHub, ClientHub, and LPEClient. Notable techniques include in-memory execution, GitHub and Dropbox for command-and-control infrastructure, DLL side-loading, and the incorporation of post-quantum cryptography (ML-KEM-1024) and GOST encryption. The sophisticated modular framework demonstrates Lazarus's continuous evolution of tools and tactics specifically designed for South Korean targets.

Threat actors are conducting sophisticated campaigns targeting Google Cloud Platform environments through phishing attacks via sponsored search ads. Attackers compromise privileged user credentials using fake login pages, then manipulate organizational policies to disable security guardrails. They create service accounts with Gemini API access, invite external attacker-controlled accounts, and assign administrative billing roles. The attackers link their external GCP projects to victim billing accounts, enabling them to execute large-scale AI workloads while hiding activity from victim monitoring. This results in unauthorized charges reaching tens to hundreds of thousands of dollars within 24-48 hours. The campaigns employ evasion techniques including geographic IP blending and demoting legitimate administrators to prevent detection and remediation.

A newly observed multi-stage phishing kit named Wazza has been actively targeting Microsoft 365 accounts since early July 2026. The campaign delivers phishing emails from compromised accounts containing PDF lures with business themes like invoices and contracts. These PDFs redirect victims through a complex infrastructure leveraging Google Sites, CloudFlare Workers, and various domains. Wazza features dynamic capabilities including 19 different phishing themes impersonating services like Adobe, DocuSign, and OneDrive, along with six corporate decoy websites. The kit employs sophisticated browser interrogation, anti-automation checks, and client-side protection mechanisms. The final stage abuses Microsoft OAuth device authorization, displaying a verification code and instructing victims to complete authentication on a separate page. Throughout the process, a backend session continuously monitors the authentication attempt, ultimately granting attackers access to victim accounts and cloud resources.

Midnight Mimosa is a widespread Android malware campaign involving malicious applications preinstalled in firmware of low-cost MediaTek-based devices, with infections observed across more than 150 countries. The campaign leverages platform-signed system applications to silently deploy payloads, evade mobile security protections, execute remotely supplied code, and monetize compromised devices through advertising fraud and residential-proxy services. The malicious firmware components provide persistent system-level access before device activation, bypass conventional Android security controls by temporarily disabling Google Play Store protections, and maintain privileged positions while operators rotate payloads remotely. Affected devices include low-cost Android handsets, counterfeit flagship models, and devices associated with Doogee and Cubot products, with highest concentrations reported in Mexico, France, and Italy.

Between May and September 2026, a Russian-speaking operator systematically targeted Ukraine's state data-exchange infrastructure by exploiting Log4Shell vulnerabilities in Graylog servers. The attacker swept 9.1 million Ukrainian IP addresses, filtering 7,576 live hosts to identify systems running UXP Verifier, a component of the national data-exchange platform. Using a two-stage CommonsBeanutils2 deserialization chain delivered through Graylog's sessions API, the operator gained access to at least two organizations, including a logging server containing 6.8 million documents from Ukraine's state data-exchange system. The operation was exposed when the attacker accidentally served their working directory over HTTP for 17 hours, revealing reconnaissance tools, shell history, exploit code, and access logs. While the operator queried transaction indices and demonstrated prior knowledge of the system's schema, no data exfiltration was directly observed. The campaign also included failed exploitation attempts a...

Active exploitation of PAN-OS vulnerability CVE-2026-0257 has been observed, targeting GlobalProtect portal and gateway components. The authentication bypass flaw allows unauthorized attackers to circumvent security controls and establish VPN connections. Ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), along with Settra ransomware actors, are exploiting this vulnerability to gain initial network access. Following successful exploitation, threat actors bypass multi-factor authentication, conduct internal reconnaissance using remote monitoring tools, move laterally via RDP and SMB, and stage additional tooling for credential harvesting and ransomware deployment. A sophisticated tactic observed involves pivoting directly to the virtualization layer, accessing vCenter management appliances, disabling security controls on ESXi hypervisors, and performing offline credential dumping against domain controller virtual disks. Multiple industries have been impacted including educa...

A DLL side-loading vulnerability in Software Center version 3.5.8.7 is being actively exploited by attackers. The threat actors distribute a genuine, digitally signed copy of the application alongside malicious DLL files through unofficial channels. When executed, the vulnerable version loads the attacker-supplied DLLs without validation, enabling malicious code execution. The attack vector involves ClickFix social engineering tactics, tricking users into executing commands. The campaign uses specific infrastructure for payload hosting and command-and-control operations. Version 4.0.9.8 patches this vulnerability, with automatic updates applied upon application restart. No official systems or distribution channels were compromised during this campaign.

Russian espionage group Swallowtail targeted organizations across two NATO member states, including a law enforcement agency, naval shipbuilder, and military aircraft engine manufacturer. During a two-month intrusion at the naval shipbuilder, attackers deployed the Hookedge backdoor delivered through malicious Word documents. They conducted hands-on-keyboard operations, stealing credentials through two distinct techniques: deploying an SSH private key to establish a persistent tunnel into the internal network, and using a PowerShell script to capture NTLM handshakes. The attackers also deployed a previously undocumented reflective loader (ld.exe) that decrypts payloads in memory using runtime-supplied keys. All targets hold information of direct interest to foreign intelligence, consistent with a broad collection effort against European government and defense sectors.

A critical authentication bypass vulnerability in BeyondTrust Remote Support platform allows unauthenticated remote attackers to perform file operations without user interaction. Versions 26.2.3 and earlier are affected. BeyondTrust confirmed exploitation in the wild with two compromises dating to August 29, 2026, affecting one hosted instance and one self-hosted appliance. Mandiant investigation revealed arbitrary file uploads, deployment of SAWFLY web shell and BARECLAW tunneler, root escalation, credential-vault extraction attempts, persistence mechanisms, and log deletion. The activity is attributed to ARMORY CASTLE, a suspected PRC-nexus espionage actor. CISA added this vulnerability to the Known Exploited Vulnerabilities list on October 16, 2026. Organizations must apply emergency patches and investigate for compromise, as patching does not remove persistence.

In early October 2026, analysts investigated a compromise of a Citrix NetScaler ADC appliance running an affected 14.1 build. Attackers chained two vulnerabilities: CVE-2026-88771 (pre-authentication log-poisoning/RCE) and CVE-2026-88779 (SAML-parsing crash) to achieve root code execution. The intrusion deployed multiple persistence mechanisms including PHP web shells with cookie-based command channels, setuid shell modifications, cron entries, and boot hooks. Attackers installed TCP session managers, HTTP tunnels, and outbound reverse agents for command-and-control. A dedicated Go reconnaissance tool mapped internal infrastructure including DNS, LDAP/Active Directory, management services, and VMware vCenter systems. HA-aware persistence logic synchronized implants across appliance pairs and forced failovers. The campaign exfiltrated NetScaler configurations, historical data, and key material, demonstrating evolution from initial foothold to persistent platform for internal reconnaissance.

Between April and July 2026, attackers compromised AOMEI Technology's update and notification infrastructure to distribute malware to users of AOMEI Backupper, backup software used by over 100 million people worldwide. During three confirmed tampering windows lasting ten, six, and five minutes, attackers modified download instructions to deliver a malicious ZIP archive containing an initial downloader that installed a persistent remote-access backdoor. The compromised infrastructure also serves AnyViewer customers. The brief tampering periods made detection difficult while limiting infection opportunities. The backdoor enables attackers to execute commands and install additional malware, leaving infected systems vulnerable to further compromise. Users can check for infection by scanning with security software, examining Task Scheduler for RadminComponentRuntime tasks, searching for unsigned upgrade-now.exe files, or monitoring suspicious network traffic to specific domains and IP addresses.

A Microsoft 365 API credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was compromised and used to gain unauthorized access to customer M365 environments. The threat actor authenticated from IP address 144.172.64.128 on October 15, obtaining Microsoft Graph access tokens across hundreds of tenants. The attacker moved through tenants in sorted GUID order, suggesting automated targeting. In one instance, the ConnectWise Cloud Management MS Teams application elevated itself to Global Administrator and added credentials to other applications, including security tools. The activity began with password spraying against law firms on October 13-14, followed by role assignments in approximately 50 tenants, and culminated in widespread credential abuse. Nearly 1,000 Entra tenants showed sign-in activity from the malicious IP, with over 300 successful authentications. A second targeted wave focused on 16 tenants in policy, national security, trade, and critical mineral sectors.

Multiple Plex Media Server vulnerabilities announced in September 2026 are being actively exploited to deploy cryptominers and proxy software. The exploitation chains together four CVEs to achieve remote code execution on vulnerable Plex servers. A honeypot deployment captured exploitation attempts from multiple IP addresses starting October 17, 2026. Attackers deployed XMRig cryptominer and myawesomeproxy software on compromised systems. The proxy tool potentially enables threat actors to utilize residential IPs for accessing corporate VPNs and email systems. Exploitation was observed from IP addresses 45.194.92.222, 91.92.40.202, and 176.65.139.228, with malicious payloads downloaded from 217.60.194.116. The vulnerabilities affect Plex Media Server version 1.43.2 and earlier, with proof-of-concept code publicly available through the plex2shell project.

On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution vulnerability affecting NetScaler Application Delivery Controller and NetScaler Gateway with a CVSS score of 9.8. The vulnerability enables unauthenticated attackers to execute arbitrary commands without requiring optional features. CISA added it to the Known Exploited Vulnerabilities catalog following confirmed worldwide exploitation. Attackers employ a staged exploitation chain involving access-log poisoning, where malicious Base64-encoded payloads are staged in HTTP User-Agent headers, followed by authentication log poisoning using forged PPE failure messages containing shell commands. A vulnerable Perl diagnostic script then executes the poisoned commands with elevated privileges. Observed activities include web shell deployment, PHP enablement, and delivery of FreeBSD implants from infrastructure overlapping with CVE-2026-75650 exploitation targeting Adobe Commerce systems.

YuanKong is a multi-tenant Android remote access trojan whose dropper stores decryption keys in cleartext configuration files. The malware uses a two-key XOR scheme to unpack payloads signed with a shared certificate across all operator builds. Each build embeds operator account identifiers as hardcoded string constants, including account IDs, operator handles, and enrollment codes that are transmitted to command-and-control servers. Analysis of 110 dropper samples revealed 57 distinct payloads belonging to 42 different operator accounts. The RAT steals credentials through screen capture, accessibility service abuse, and overlay attacks while escalating privileges by self-pairing with the device's own ADB daemon to obtain shell access. It communicates via Socket.IO over WebSocket with a shared set of C2 domains.

QuartzLine, also tracked as CLOUDHAZE by Mandiant, is malicious software disguised as a functional Windows PDF viewer that conceals a backdoor enabling attackers to execute commands and deploy additional malware. The malware has appeared as paperline.exe and fielddesk.exe, signed with a legitimate but now-revoked EV code-signing certificate. Distribution occurs through malicious advertising, where users searching for unrelated content click ads and download the viewer from AWS S3 buckets. Once installed, QuartzLine establishes persistence through scheduled tasks and communicates with command-and-control infrastructure. Observed attack chains include Chrome data theft within one week of installation, followed by deployment of second-stage RATs like Caira and IronBark. The backdoor operates with user-level privileges and can execute arbitrary Windows commands.

This analysis examines exploitation of Suo5, an HTTP/HTTPS-based tunneling tool, for pivoting attacks through compromised web servers to access internal networks. Suo5 relays TCP traffic and enables SOCKS5 proxy access to internal systems, supporting multiple transmission modes and environments including Java, PHP, IIS/.NET, and Nginx. Two deployment methods were observed: file upload exploitation on IIS servers through renamed ASPX files, and memory injection via Jenkins Script Console using Groovy scripts to register Suo5 as Servlet and Filter components. Key indicators include repeated POST requests in web logs, DLL files in Temporary ASP.NET Files directories, and PluginServletFilter chains in Java logs. Detection strategies recommend monitoring web request patterns, server-side behaviors, abnormal User-Agent headers, unauthorized URI access, and file modifications in web application paths, alongside restricting script execution capabilities and implementing network segmentation controls.

Since April 2017, a Russian-language affiliate program called Hotejka, believed to be a rebrand of ROI777, has operated the Help Traffic Distribution System (TDS), delivering tech support scams to victims. The operation uses browser fingerprinting and geolocation to redirect users through compromised websites, malvertising, social media, and spam to fake Microsoft security alerts that lock browsers and display fraudulent phone numbers. When victims call, operators from call centers guide them to install remote desktop tools like UltraViewer, granting complete system access for ongoing exploitation. Since April 2026, Hotejka has created over 20,000 disposable domains on free Cloudflare Pages infrastructure, generating approximately 300 new domains daily. Affiliates including Balada Injector, Detour Dog, and DollyWay drive traffic to the TDS. Infoblox developed predictive detection algorithms that identify malicious domains approximately seven days before deployment, reducing customer exposure from 4% to 0.5...

Silent Lynx, a persistent cyber espionage threat actor, has conducted targeted intrusion campaigns against government ministries, diplomatic missions, and civil society organizations across Central Asia since 2024. The group focuses on high-value public sector organizations in Commonwealth of Independent States countries, leveraging spear-phishing campaigns through compromised government email accounts and malware staging via GitHub. Operations from late 2024 through 2026 reveal extensive infrastructure including exposed open directories, newly registered domains, and GitHub repositories. The actor employs lightweight reverse shells, PowerShell scripts, proprietary tools, and commodity utilities. Recent activity shows adoption of exploit-assisted delivery via CVE-2025-8088, expanding focus on Linux systems, and interest in FortiWeb vulnerability CVE-2025-25257. Attribution indicators point to Russian-speaking operators likely based in Kazakhstan, with targeting concentrated on water resources, environmenta...

On October 15, BeyondTrust disclosed CVE-2026-102764, a vulnerability affecting BeyondTrust Remote Support appliances that enables arbitrary file upload. Mandiant identified ARMORY CASTLE, a suspected PRC-nexus espionage actor, exploiting this as a zero-day in late August 2026. Following exploitation, the actor deployed SAWFLY webshell and BARECLAW tunneler, escalated privileges using SUID bit manipulation, harvested credentials from the BeyondTrust vault, and established persistent access by modifying sudoers templates and HAProxy configurations. The actor demonstrated deep knowledge of BeyondTrust internals, abusing proprietary CLI utilities and reverse-proxy routing. They systematically deleted logs to evade detection and leveraged compromised administrator credentials to pivot laterally and exfiltrate sensitive documents. Organizations face potential widespread exploitation as ARMORY CASTLE historically conducts opportunistic campaigns following vulnerability disclosure. Immediate patching and comprehe...

Blackpoint's Adversary Pursuit Group traced a ClickFix intrusion to a previously unclassified modular Windows implant designated Variola. The malware establishes persistent host identity through encrypted storage, maintains configuration and controller information across executions, and employs authenticated command-and-control with controller rotation capabilities. Variola's modular architecture enables operators to dynamically load additional components for credential theft, browser manipulation, and session hijacking. The framework demonstrates capabilities typical of banking trojans, including Chromium browser process injection, live cookie database access, and VNC-style remote access. Multiple related builds discovered in the same GitHub repository suggest active development and experimentation. The implant uses XSalsa20 encryption, secp256k1 key exchange, and Ed25519 signatures for secure communications. Its ability to preserve context, migrate between processes, and expand capabilities on demand tra...

An espionage campaign tracked as CL-UNK-1211 targeted government entities and state-affiliated infrastructure between October 2025 and April 2026, utilizing AI-generated payloads containing conversational annotations suggesting LLM or automated AI agent involvement. Attackers focused on Linux environments deploying web shells, custom cross-platform backdoors including SysGoRAT malware, and open-source tools to maintain persistent access. Operations included extensive reconnaissance, database dumping, mailbox enumeration targeting social media accounts linked to government emails, and sophisticated defense evasion techniques such as disabling endpoint protections, erasing system logs, and planting deceptive red-team markers to disguise malicious activity as legitimate security assessments.

KGB RAT is a Windows Remote Access Trojan actively promoted on underground forums since late 2025, marketed deceptively as a legitimate administration tool. Sold through a Malware-as-a-Service model with pricing from $150 to $800, it features credential theft, keylogging, hidden desktop takeover, ransomware capabilities, and psychological harassment functions including screamers and forced blue screens. The tool ships with a built-in FUD crypter updated daily to evade Windows Defender, requires no port forwarding for C2 connectivity, and delivers Telegram-based notifications. Evidence suggests development began in early 2022. Based on NjRAT foundation, it targets multiple operators sharing a common builder, with at least one deployment featuring an active CryptoClipper module for cryptocurrency wallet address swapping.

Three exposed directories on infrastructure at 45.142.193[.]132 revealed an AI-orchestrated campaign targeting PaperCut NG/MF print management software. The exposed workbench contained AI-agent instructions, exploit code, operational logs, and post-exploitation tooling. Attackers exploited CVE-2026-81578 and CVE-2026-82078 through a Tapestry vulnerability chain, and developed a second RCE path via XML-RPC API abuse. The campaign deployed automated exploitation at scale using hundreds of AI agents running through OpenAI Codex and DeepSeek models. Post-exploitation activity included Windows credential harvesting, LSA secret extraction, reverse SOCKS5 pivoting using chisel, Metasploit automation, and Active Directory domain compromise. The actor's files documented 1,005 hosts across 45 countries in their reconnaissance pool, with 46 confirmed Active Directory domain compromises and 45 targets maintaining live internal access pivots at time of discovery.

A malicious cyber actor conducted a proxyjacking campaign, compromising at least 143 network edge devices across 34 countries to force them into residential proxy networks. The attacker exploited vulnerabilities in D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVR systems, and SAP NetWeaver Visual Composer, also targeting DVR/NVR devices from Hikvision and Dahua. The compromised devices were installed with Pawns.app software without owners' consent, monetizing victim bandwidth through IPRoyal's residential proxy network. The attacker configured SSH key authentication as a persistent access method. This activity was discovered when an organization identified suspicious authentication patterns showing multiple users logging in from the same residential proxy IP address, leading to confirmation of a serious intrusion.

DragonForce is a financially motivated ransomware operation that emerged in August 2023, initially using leaked LockBit 3.0 code and later transitioning to Conti v3-based variants. Operating as a Ransomware-as-a-Service model, they offer affiliates an 80% revenue share and comprehensive management tools. By March 2025, they evolved into a 'cartel' structure, providing white-label services. Their attacks primarily target organizations in the US and UK, spanning multiple sectors including manufacturing, professional services, retail, healthcare, and technology. The group actively recruits developers and reverse engineers while offering specialized data analysis services to help affiliates maximize extortion pressure. Notable incidents include a major MSP breach in May 2025 exploiting SimpleHelp vulnerabilities, cascading compromise across multiple client networks.

This investigation reveals the first public confirmation of zero-click mercenary spyware delivered via targeted advertisements, termed AdFection. Devices at Al Jazeera were infected with Candiru spyware through malicious ads purchased by Israeli company Discover-Tech, which operates as a facilitator for mercenary spyware partners. Discover-Tech's Controlium platform enables partners to de-anonymize, fingerprint, and automatically infect devices when advertisements render. Analysis of four billion bidding records shows ads were displayed across nearly 200,000 websites and apps in dozens of countries. The company appeared on Google and IAB Europe vendor lists from 2020-2026, serving ads via major networks. Discover-Tech is linked to multiple mercenary surveillance actors including Candiru, Intelos, and Bindecy, and supports mass-deanonymization through mobile carrier vulnerability exploitation. The infrastructure also covertly directed millions of devices to contact Candiru servers for tracking and reconnais...

The Aoki infostealer has evolved to target credentials from AI coding assistants including Claude, OpenAI's Codex, Cursor, Codeium and Gemini. This capability represents a recent addition, as earlier versions did not target AI-related files. The malware steals API keys, tokens and session files that could enable attackers to conduct activities under legitimate user identities, access connected repositories, cloud services and CI/CD pipelines. Beyond AI credentials, Aoki harvests data from dozens of browsers, cryptocurrency wallets, password managers, messaging applications, gaming platforms, VPN and FTP clients. The malware collects available data and transmits it to command-and-control servers. This development suggests AI credentials are becoming as valuable as traditional targets like payment card data and cryptocurrency wallets for cybercriminals.

Resecurity identified and mapped infrastructure supporting a commercial Phishing-as-a-Service operation marketed as 'Iron Man System.' The kit is sold to criminal buyers as a self-hosted package deploying pre-built lure pages impersonating postal services, banks, government agencies, and other trusted entities. Through infiltration of Chinese threat actor communities and acquisition of a license, Resecurity traced the back-end infrastructure and found 2,360 phishing templates targeting 130 countries. The operation features a self-hosted build registry with 911 published versions, bilingual Chinese-English interface, and subscription-based licensing tied to vendor-controlled authorization servers. Working with Microsoft's Digital Crimes Unit and industry partners, the cybercriminal infrastructure was mapped and disrupted. The kit captured approximately 17.4GB of telemetry data targeting 75,000 organizations through an estimated 1 billion phishing emails.

An investigation revealed the first confirmed incident where large language model-driven AI agents executed substantial portions of an attack. Within 24 hours, attackers exploited an exposed job-submission feature on an Apache Tomcat server running Spring Batch, requiring no authentication, zero-days, or new malware. The attacker used Cairn, an open-source AI agent orchestration platform, identified on the attacking infrastructure. Commands were executed through JavaScript via Nashorn engine, with results extracted through error messages in 1,800-byte chunks across hundreds of sequential requests. The attacker recovered plaintext database credentials from configuration files, enabled xp_cmdshell, and escalated privileges using PrintSpoofer and GodPotato tools to achieve SYSTEM access. Registry hives were extracted, administrator accounts created, and artifacts deleted. Machine-driven execution was evidenced by rapid command timing, programmatic job naming, structured output formatting, and automated error ...

A sophisticated multi-stage network intrusion against a telecommunications organization in September 2024 exploited CVE-2024-47575 on a FortiManager appliance, exfiltrating configurations and cryptographic material for over 500 managed FortiGate firewalls. Attackers then exploited CVE-2025-61624 to deploy PEERSTITCH, a novel memory-resident ARM64 malware that leaves no disk artifacts or network traces. The implant operates by patching running processes, creating covert inter-process communication channels between system daemons, and intercepting network traffic. Additional attack vectors included weaponizing Apache mod_md for reverse shell command and control, impersonating the FortiManager platform to compromise downstream devices, and deploying extensive anti-forensic measures. The intrusion demonstrates advanced tradecraft consistent with nation-state actors, highlighting the critical risk of centralized edge management platforms.

A coordinated disruption action targeted Chinese-speaking cybercriminals operating three major phishing kits: CoGUI, CoAceV, and CoFish_Ws, which collectively distributed hundreds of millions of credential phishing messages primarily targeting Japanese organizations. These operations impersonated 66 well-known brands, mainly consumer and finance companies, to steal usernames, passwords, and payment data. The threat actors demonstrated sophisticated capabilities, utilizing approximately 17,000 unique domains with frequent rotation and evasion techniques. The ecosystem enablers YAM Store and Iron Man were also targeted through a civil lawsuit and domain seizures, conducted in collaboration between Microsoft, Health-ISAC, and multiple security partners. This coordinated action is expected to significantly impact the Chinese phishing ecosystem and cause substantial operational disruption to multiple threat groups conducting financial fraud.

A wave of fraudulent websites mimicking Calendly booking pages for Meta job interviews has been identified, targeting job seekers to steal credentials. Victims select interview time slots, provide personal information, and complete fake CAPTCHA verifications before being prompted to log into Facebook and Google accounts. The sophisticated phishing kit captures login credentials and bypasses two-factor authentication by relaying authentication codes in real-time to attackers. The pages use convincing replicas of legitimate login screens with fake address bars displaying authentic URLs. Eleven domains following similar naming patterns have been identified, utilizing generic recruiting-related terms. The collection infrastructure operates through Amazon API Gateway in Singapore, with code comments in Vietnamese suggesting the operation's possible origins.

Ivanti has released emergency security updates after attackers exploited a chain of three zero-day vulnerabilities in Connect Secure VPN appliances to gain root-level access without authentication. The attack began on October 3, targeting an appliance running version 22.8R2.4. Two vulnerabilities are tracked as CVE-2026-104935 with a CVSS score of 8.6, involving an authentication bypass and remote code execution through manipulated CGI requests and malicious file uploads. A third unpatched vulnerability allows privilege escalation to root by manipulating a privileged service through memory modification. While patches address the authentication bypass and RCE, the privilege escalation flaw remains unresolved. CISA added the vulnerability to its KEV catalog with an October 16 remediation deadline for federal agencies.

A new Android banking remote access trojan named Hirudo has been identified, combining credential theft with live remote control. It is delivered through shopping and entertainment apps that act as droppers, installing the trojan as a separate package behind fake update prompts. The malware replaces legitimate banking applications with patched versions that disable security checks from within the app itself. Eight Indonesian banking apps covering seven banks have been targeted with purpose-built replacements embedding a hooking engine. The campaign uses real advertising infrastructure including Amazon CloudFront for distribution, with targeting extending beyond Indonesia to China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records.

A phishing campaign has been observed distributing AgentTesla infostealer through emails masquerading as business proposal requests. Recipients are asked to review an attached product list, but the ZIP file contains an executable file instead of a document. The malicious EXE disguises itself as a café management program using Chinese-language descriptions and UI elements. Through multiple stages of obfuscation, the malware extracts encrypted data from bitmap resources, performs XOR decryption, and loads successive .NET payloads into memory. The final payload is AgentTesla, which steals credentials, cookies, and contact information from browsers, email clients, FTP and VPN applications. Stolen data is exfiltrated via FTP to a compromised server. The attack demonstrates sophisticated multi-stage loading techniques and social engineering tactics targeting business users.

An evolving Linux malware campaign deploys ClingSTUN, a back-connect proxy backdoor exploiting known vulnerabilities in Internet-facing IoT and network devices. The malware establishes persistent access and converts compromised systems into remotely controlled proxy nodes. Supporting multiple Linux architectures, ClingSTUN combines boot persistence, process termination, watchdog manipulation, process concealment, remote command execution, and self-propagation. It abuses legitimate public STUN infrastructure for NAT traversal. The campaign has expanded the number of vulnerabilities and device vendors it targets over time, affecting products from D-Link, EnGenius, Realtek, TP-Link, AVTECH, Ivanti, Tenda, Lantronix, and others, highlighting the continued risk posed by unpatched, unsupported, and unnecessarily exposed Internet-facing devices.

During Q3 2026, honeypot monitoring revealed attacks targeting poorly managed Linux SSH servers through brute force and dictionary attacks. Primary malware families included ShellBot (also known as PerlBot), a Perl-based DDoS bot with C&C infrastructure at specific IPs, and Fisieredoor, a backdoor capable of executing commands and deploying SSH dictionary attack tools. Attackers downloaded malware using wget or curl, then installed user-mode rootkits, XHide process masking tools, and XMRig cryptocurrency miners. The launcher malware utilized ld.so.preload to inject rootkits and disguised mining processes as legitimate bash sessions. Fisieredoor deployed additional tools including goauto and tsm for credential harvesting and lateral movement, transmitting successful authentication results to command servers.

During the third quarter of 2026, attackers targeted MS-SQL and MySQL servers on Windows systems through multiple attack vectors including brute-force attacks, dictionary attacks, and vulnerability exploitation. Threat actors deployed XMRig cryptocurrency miners, GotoHTTP backdoors, and SoftEther VPN infrastructure along with various web shells including Sharp4WebCmd, Suo5, and PowerShell-based shells for persistence. Additional tools used included VShell for remote command execution, HackBrowserData for credential theft, Fscan for network reconnaissance, and Cloudflared for port exposure. Attackers created backdoor accounts for RDP access and operated SoftEther VPN servers in Cascade Connection mode as command and control infrastructure. The attacks primarily resulted from weak passwords, improper account management, and inadequate security measures on externally exposed database servers.

This analysis examines attacks against Windows web servers during Q3 2026, focusing on Internet Information Services (IIS) and Apache Tomcat environments. Attackers exploited unpatched vulnerabilities, misconfigurations, and weak management practices to gain control through webshell uploads, remote code execution, proxy tools, and privilege escalation utilities. Two prominent attack cases involving CVE-2019-18935 in Telerik UI for ASP.NET AJAX are detailed. The first case deployed reverse shells connecting to 206.82.6.22, utilized Potato-family privilege escalation tools like SweetPotato and PrintSpoofer to obtain SYSTEM privileges, and installed Godzilla-style memory webshells. The second case leveraged the same vulnerability to deploy a Rust-based scanner that identified WordPress installations and reported findings via Telegram. Attackers subsequently conducted coin mining, established VPN servers, and maintained persistent remote access. Recommendations include applying current patches, minimizing exte...

During the third quarter of 2026, multiple attack campaigns targeted poorly managed Linux SSH servers using brute force, dictionary attacks, and vulnerability exploits. Threat actors deployed ShellBot, a Perl-based DDoS bot, utilizing C&C servers at specific IP addresses with capabilities including port scanning and UDP flooding. A sophisticated attack chain involved launcher malware that executed user-mode rootkit libSSL2.3.0.So via /etc/ld.so.preload, subsequently deploying XMRig cryptocurrency miner disguised as -bash using XHide process concealment tool. Additionally, Fisieredoor backdoor was deployed, capable of command execution and installing SSH brute-force tools including goauto and tsm-family, which systematically targeted systems using credential lists. Organizations must implement strong password policies, regular patching schedules, and access controls for externally exposed SSH infrastructure.

In early October, a sophisticated credential phishing campaign targeted WatchGuard Mobile VPN users through a fake download site at watchguard-vpn[.]net. The attack used SEO poisoning to appear in search results and deployed a unique technique: after collecting victim credentials twice through browser pop-ups, it downloaded the genuine, validly signed WatchGuard installer directly from WatchGuard's official CDN. This eliminated malicious files that security tools could detect. The first credential submission was deliberately rejected as incorrect to collect multiple passwords. The credential collection endpoint at watchguard-ssl[.]online received server addresses, usernames, and passwords, providing attackers network access. This domain was previously reported in January with no backend functionality but was re-registered in August with full phishing capabilities implemented by September.

Cybercriminals are exploiting digital event invitations to distribute remote access trojans. Victims receive legitimate-looking emails with generic subject lines about special gatherings and celebrations. The messages contain download buttons that redirect users through fake CAPTCHA verification pages hosted on recently created domains. After verification, users encounter another generic invitation page prompting them to download an eInvite file. This delivers a zipped folder containing ScreenConnect.exe, a legitimate ConnectWise Screen Connect installer weaponized as a RAT. Once executed, attackers gain full remote access to compromised devices through an unassuming taskbar icon that reveals an active connection. The campaign leverages user curiosity rather than sophisticated techniques, making it particularly effective during holiday seasons when event invitations are common.

The Kimsuky threat group has launched spear phishing campaigns targeting Ukrainian experts in diplomacy, security, and international policy through fraudulent international conference invitations and collaboration requests. This operation, dubbed GitPower, leverages legitimate development platforms like GitHub for malware distribution and data exfiltration. Attack vectors include malicious LNK files and fake Zoom installers, demonstrating links to previous CHM-based attack methodologies. The campaign appears to be state-sponsored cyber espionage focused on monitoring cooperation developments between South Korea and Ukraine. Organizations are advised to enhance EDR detection capabilities and implement threat hunting for suspicious LNK file execution, PowerShell abuse, and unauthorized GitHub communications.

A sophisticated multi-stage intrusion chain begins with a WhatsApp-delivered financial document lure carrying Statement.exe. The malware employs NRV2E compression to conceal its true payload, which performs extensive host screening before attempting privilege elevation via COM-based techniques. Using PoolParty Variant 7 injection, the loader transfers execution into the Windows Task Scheduler process under LocalSystem authority. A downloader shellcode retrieves a compound bundle from a remote server, which deploys through a reflective loader. The deployment stage utilizes a signed GoFly driver to terminate Baidu security processes, establishes persistence via DLL side-loading with a legitimate Intel-signed VulkanInfo executable, and launches a WebSocket-based remote access trojan. The final VulcanRAT207.A payload provides extensive surveillance capabilities including shell access, keystroke capture, desktop control, network filtering, and process injection, while maintaining persistence through SYSTEM-leve...

A North Korean threat actor distributed Funhouse ransomware through malicious Korean-language documents disguised as resumes. Funhouse is a variant of the previously observed Endpoint ransomware. The attack chain involves multi-stage scripts including Batch, VBS, and PowerShell, leading to Quasar RAT installation before deploying the final ransomware payload. The campaign shares significant similarities with earlier Kimsuky Endpoint ransomware operations from early 2026, including identical mutex values, similar batch file structures, and comparable Quasar RAT configurations. The ransomware maintains key characteristics of the Endpoint family while updating encryption extensions, contact information, and C2 infrastructure. A notable shift involves using HWP documents instead of LNK files as initial infection vectors.

A sophisticated malware campaign targets low-cost Android devices built on MediaTek platforms, with malicious code preinstalled in device firmware before users receive them. The platform-signed system application operates with elevated privileges, enabling operators to silently install applications, grant permissions, and load remote code. The scheme primarily generates revenue through ad fraud, click fraud, device information collection, and converting infected devices into residential-proxy botnet nodes. The malicious system application ships under various system-sounding names including com.android.system.lite, com.android.sys.prot, and com.android.sys.gmsprot. Operators deploy at least 32 disguised applications including fake weather, app-lock, and OCR tools. The malware disables Google Play Store during payload installation to evade detection, then re-enables it afterward. Thirteen related applications were also discovered on Google Play, communicating with identical command-and-control infrastructure...

A sophisticated phishing campaign targets YouTube content creators through personalized sponsorship emails impersonating legitimate brands like Hollyland, Nike, and Spotify. Attackers send customized collaboration offers referencing specific videos from targets' channels, then direct them to fraudulent platforms that appear legitimate with campaign metrics and income calculators. The scheme culminates in a Google sign-in request that either captures credentials directly or requests excessive account permissions. Once compromised, attackers lock victims out by changing recovery methods and can misuse the account to spread scams to followers. The modular campaign operates globally, targeting creators in Peru, Japan, and English-speaking regions, using multiple domains while maintaining similar functionality and design patterns across variants.

Two critical zero-day vulnerabilities in NetScaler ADC and Gateway systems are being actively exploited in the wild. CVE-2026-88771 is a remote code execution vulnerability allowing unauthenticated command injection, while CVE-2026-88772 is a DTLS memory overflow flaw enabling RCE or DoS attacks. Threat actors deployed webshells through these vulnerabilities to establish initial access and persistence. The CVE-2026-88771 exploitation involves a three-stage command injection chain poisoning log files, while CVE-2026-88772 exploitation drops .deb webshell files. Attackers used PHP webshells with RC4 encryption for command and control communications, targeting custom directories within NetScaler Gateway interfaces. Cortex Xpanse identified over 50,000 potentially vulnerable exposed instances.

A cryptocurrency wallet-drainer kit called Noir uses DNS TXT records and DNS-over-HTTPS (DoH) as a dynamic command-and-control mechanism. The loader queries public DoH services to discover active infrastructure hosted on Cloudflare Pages, allowing operators to redirect deployed lures by changing a single DNS record. The drainer does not require victims to enter seed phrases or private keys; instead, it requests wallet connection permissions and obtains spending approvals that appear less suspicious than direct transfers. The architecture separates long-lived phishing lures from short-lived operational infrastructure, with 60-second DNS caching and self-healing retry logic. Extensive plain-English code comments suggest AI-assisted development, documenting bugs, fixes, and design decisions. The kit serves as a shared service across multiple cryptocurrency-themed phishing campaigns.

During a live Security Operations Center shift at .conf26 in Denver, analysts investigated Incident ES_00244 involving an exploit link detected by Cisco Secure Firewall. The challenge arose when 15 devices were found communicating with a single IP address (13.226.251.40) flagged for hosting malicious domains moonlighthathel[.]org and ukankingwithea[.]com. Investigation revealed the IP was an Amazon CloudFront CDN node simultaneously serving legitimate services including Samsung Health, Mindtickle learning platform, and Amazon Video. Using AI-assisted analysis, firewall logs, and packet forensics through Endace, analysts isolated one unmanaged Intel laptop generating malicious traffic among 14 benign connections. Instead of blocking the shared IP and disrupting legitimate services, analysts implemented precise DNS object blocks targeting only the malicious domains at the Cisco Firepower Threat Defense perimeter, successfully neutralizing the threat while maintaining normal operations for all other attendees.

In late September 2026, an actor deployed seven malicious npm packages masquerading as a NebulaAI software development kit to deliver a Windows remote-access trojan. The operation, tracked as NEBULA, spans four sequential burner accounts (nebulallms through nebulallms4), with api-nebula and llm-nebula remaining downloadable. Each package presents a convincing AI client facade while hiding an obfuscated installation hook executing malicious logic. The underlying RAT operates exclusively through direct NT and win32k syscalls, bypassing standard DLL imports with an empty Import Address Table. Features include hidden-desktop remote control (HVNC), Kernel Streaming for camera and microphone monitoring, and Winlogon Shell persistence. The payload is a customized KNTRAT variant communicating with 65.87.7.132 using user-agent kntrat/0xB15B00B6. The implant masquerades as conhost.exe and suppressed beaconing during analysis, consistent with embedded anti-analysis provisions.

An unidentified threat actor, likely Chinese-speaking and financially motivated, conducted targeted attacks against South Korean financial institutions between late September and early October 2026, successfully exfiltrating data. The adversary utilized ARTEX, a Chinese-developed open-source agentic penetration testing tool, combined with large language models including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6. Analysis of exposed directories revealed Claude Code session histories, ARTEX configuration files, and operational details showing a two-server architecture involving Hong Kong-based infrastructure. The threat actor demonstrated sophisticated tradecraft by leveraging AI tooling to enhance operational tempo, enabling multiple intrusions within a compressed timeframe. Evidence suggests the attacker also researched Korean data breach marketplaces and Telegram channels for selling stolen information.

Warden Stealer is an emerging Rust-based infostealer-as-a-service that has rapidly become one of the most prevalent threats, distributed via malware-as-a-service model since August 2026. Unlike most competitors, it includes a dedicated loader and built-in cryptocurrency clipper. The malware targets over 200 cryptocurrency wallet extensions, 360+ applications across 13 categories, and is notably one of the first infostealers specifically collecting AI assistant and agentic coding tool data, including tokens, credentials, and prompt histories from Claude, Codex, Grok, and Cursor. Operating through tiered subscriptions ranging from $149 for three days to $1,500 monthly, Warden Stealer employs sophisticated obfuscation techniques, morphing capabilities, and bypasses Application-Bound Encryption to steal browser data. The malware avoids CIS and Baltic countries and is distributed through cracked software, game cheats, malvertising, and ClickFix campaigns.

ESET researchers documented the evolution of MATCHBOIL, a custom C# downloader used by Russia-aligned APT group UAC-0099. The malware downloads payloads from command-and-control servers, installs them, and establishes persistence on victim machines. Development traces back to April 2024, with continuous improvements through April 2026. Early versions used Unicode symbol obfuscation and custom string encryption, while later iterations employed the Eziriz .NET Reactor obfuscator. UAC-0099 progressively added sandbox detection methods, modified persistence mechanisms from registry keys to scheduled tasks, and introduced deceptive graphical interfaces. All observed victims were Ukrainian organizations across transportation, manufacturing, and energy sectors. The group typically distributes MATCHBOIL through spearphishing emails containing malicious links that download VBScript files. MATCHBOIL often delivers MATCHWOK backdoor as its final payload.

Beginning October 7, 2026, threat actors exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to achieve unauthenticated remote code execution on exposed systems. The attackers chained these vulnerabilities together, first bypassing authentication and then executing code with SYSTEM privileges. Post-exploitation activities included deploying JSP webshells, installing XMRig cryptocurrency miners disguised as Microsoft Edge processes, and dropping an AI-assisted PowerShell script that monitors and terminates Task Manager to hide mining operations. The attackers established persistence through a fake Windows service named MicrosoftEdgeUpdateSvc and utilized a vulnerable WinRing0x64.sys kernel driver to enable kernel-level hardware access for optimized mining performance. All AhsayCBS versions through 10.3.4 are affected, with managed service providers being the primary targets.

The FBI seized seven web domains linked to Integrity Technology Group, a Chinese security firm allegedly providing hacking tools to Beijing-backed operatives. These tools enabled attacks on critical infrastructure, including a South Carolina power company and universities in Taiwan. The Flax Typhoon group utilized a Mirai-based botnet from 2021 to infect internet-connected devices, scan networks, and launch cyberattacks while concealing Chinese government hackers' locations. The malicious activity involved vulnerability scanning via Microscan tool, cross-site scripting, password spraying on Microsoft Exchange servers, and data exfiltration using FishHub malware. A joint advisory from US, UK, Australia, Canada, Japan, New Zealand, and Spain warned that Chinese state-sponsored actors continue targeting organizations worldwide to steal sensitive information from critical infrastructure networks.

In July 2026, Zscaler ThreatLabz uncovered a sophisticated campaign utilizing a trojanized Terraform provider to deliver cross-platform malware targeting cryptocurrency and Web3 developers. The attack begins with a malicious Terraform provider that downloads a Bash loader from a HashiCorp-themed lookalike domain, which then selects and deploys payloads tailored to the victim's operating system (macOS, Linux, or Windows). Encrypted executables are concealed within fake font files and extracted using marker-based techniques and AES-256-CBC decryption. The campaign delivers FLATROOF, a Rust-based backdoor with platform-specific persistence mechanisms and multiple C2 channels including Telegram Bot API and GitHub. Python-based information stealers target browser credentials, cookies, cryptocurrency wallet extensions, and system information. The attack culminates with ROOFDECK backdoor deployment, featuring resilient C2 discovery through cryptographically signed Pastebin dead drops and Nostr profile metadata, p...

Threat actors are conducting email campaigns targeting the accommodation industry using fake guest complaints, reviews, and inquiries. These emails deliver malicious LNK shortcut files disguised as images, which ultimately deploy blockchain-abusing malware families known as EtherRAT and TONResolver. Both malware types resolve command and control infrastructure by querying public blockchain APIs (Ethereum and TON respectively) instead of using hardcoded domains. This technique allows operators to rotate infrastructure cheaply through small blockchain transactions while making traditional takedown efforts ineffective. The campaigns represent an evolution from earlier Booking.com-spoofing operations that used ClickFix fake CAPTCHAs to deliver remote access trojans. The threat actors likely employ generative AI to create unique email variants, making detection more challenging.

Since April 2026, PoeLLM malware has been actively targeting exposed AI/LLM and open-source services including LiteLLM, Ollama, Gotenberg, and Gitea, with possible Ivanti Sentry targeting. The campaign employs an unusual command-and-control mechanism where infected systems derive C2 server addresses from keywords embedded in a poem hosted on GitHub. This financially-motivated operation deploys XMRig and Iron cryptocurrency miners, connecting victims to Kryptex mining infrastructure. Compromised hosts are repurposed as scanners and exploit servers to expand the botnet, which has impacted over 3,400 victim servers with peak activity exceeding 800 active servers daily. The campaign appears linked to an Italian-speaking threat actor and predominantly affects victims in the United States and Western Europe. Vulnerable routers are exploited to serve as C2 infrastructure.

Malware authors are developing techniques to obstruct automated AI analysis by embedding natural-language instructions within their code. This 'AI-analysis evasion' targets the pipeline that extracts text from samples and submits it to language models for triage or classification. Analysis of 84 samples across four malware families (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE) from January 2025 through July 2026 reveals progression from simple comments claiming benign functionality to template spraying across multiple LLM formats and intimidation tactics invoking copyright, government contracts, and security certifications. The cheapest technique—direct instructions to ignore samples—proved most effective, steering outcomes favorably for attackers in approximately 35% of test runs. However, these techniques must remain in plaintext, making them consistently detectable. The fundamental defense requires treating extracted text as evidence rather than instruction, ensuring analysis pipelines maintain exp...

A coordinated campaign of 16 malicious Firefox extensions has been identified targeting cryptocurrency wallet users. The extensions masquerade as wallet portals, desktop utilities, and browser tools while intercepting recovery phrases and private keys during wallet import flows. Four large extensions clone Rabby Wallet (misspelled as Raabby WaIIet), while twelve smaller extensions impersonate OKX Wallet. All variants capture 12- or 24-word mnemonics and private keys, transmitting stolen credentials to attacker-controlled Cloudflare Workers endpoints. Fifteen extensions communicate with icy-star-f45c.workers.dev infrastructure. The campaign reuses code markers, network infrastructure, and credential-handling logic, indicating connection to crypto-theft operations identified in August 2026. Mozilla has unpublished these extensions. Users who entered credentials should immediately create new wallets and transfer assets.

Multiple Remote Monitoring and Management (RMM) tools are being distributed through phishing campaigns involving video files and email attachments. Threat actors exploit legitimate RMM solutions like ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able to gain remote access to compromised systems while evading security detection. These tools, typically used for legitimate IT administration purposes, are weaponized through various delivery methods including LNK files, BAT scripts, VBS files, and PDF documents disguised as business documents. The campaigns leverage social engineering tactics, presenting fake Adobe Acrobat updates, DocuSign viewers, and document access prompts to trick victims into installing these remote access tools. Each RMM tool contains configuration data linking back to attacker infrastructure, including deployment IDs, account identifiers, and command-and-control server addresses embedded within installation files.

The Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop/Shai-Hulud supply chain attack, affecting a package with approximately 12,000 weekly downloads. The malicious release contains obfuscated code that harvests credentials from multiple sources including npm tokens, GitHub tokens, AWS credentials, HashiCorp Vault, Kubernetes configurations, SSH keys, and AI development tools. A preinstall hook executes the payload during installation, establishing persistence through scheduled tasks and supporting remote code execution. The attack uses an Ethereum contract to resolve command-and-control endpoints and implements a dead-man switch that monitors stolen GitHub tokens, triggering destructive actions if revoked. The malicious code can self-propagate by republishing compromised versions to other packages associated with the victim's publishing identity, extending the worm's reach across the npm ecosystem.

Five hosts exposed the complete DarkSword/Coruna iOS exploitation platform through open directories, revealing an active commercial exploitation-as-a-service operation. The platform targets cryptocurrency wallets across 18 different applications, extracting BIP39 recovery phrases and conducting automated theft. Analysis of the production server recovered 11 victim recovery phrases, 179 device loot directories, and a 75-account control-plane roster indicating an agent/reseller model. A separate China-based operator is deploying identical tooling through independent infrastructure at 66ds[.]lol, representing a distinct threat actor from previously documented DarkSword users. The infrastructure was operationally active during analysis, with beacon telemetry showing Chinese iOS devices polling every three seconds for hours. Development work targeting iOS 26 via CVE-2026-31001 was discovered but remains undeployed.

LevelBlue observed a ClickFix campaign delivering Remus Stealer through compromised websites using PhantomPolia, a JavaScript loader that retrieves encrypted configurations from Ethereum Sepolia smart contracts via public RPC endpoints. The loader decrypts configurations locally using PBKDF2 and AES-GCM to obtain C2 domains. Victims are tricked into executing PowerShell commands that retrieve and decrypt additional configurations using AES-CBC before downloading bundled installers containing AutoIt executables. The AutoIt script decrypts embedded Donut-packed shellcode and executes it from allocated memory, ultimately loading Remus Stealer. This information-stealing malware collects system data, credentials, browser information, password managers, and cryptocurrency wallets. Stolen data is compressed using custom methods and encrypted with ChaCha20 before exfiltration to attacker-controlled servers.

FortiBleed is an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, with over 86,644 compromised devices verified across 194 countries. The campaign exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication data at scale using distributed GPU clusters. Attackers scan for exposed FortiGate SSL VPN portals, collect credentials through stuffing and password spraying, and crack stolen password hashes offline. Once access is gained, they create new administrative accounts for persistence and conduct Active Directory enumeration to expand access. Affected organizations may experience lockouts as threat actors delete or modify existing accounts. The operation functions as an initial-access broker, with connections observed to INC/Lynx and Payload ransomware affiliates, representing a significant threat requiring immediate defensive action.

In September, a phishing campaign exploited legitimate Microsoft Power BI domains to distribute rogue ScreenConnect remote monitoring tools. Attackers sent phishing emails with embedded links redirecting victims to fake reference documents hosted on Power BI infrastructure. Clicking 'Download Reference' opened attacker-controlled websites that fingerprinted victims' systems and browsers before triggering malicious ScreenConnect installer downloads. The attack deployed multiple ScreenConnect instances for persistent remote access, with the second client connected to attacker infrastructure. Following deployment, threat actors executed defense evasion tools and created scheduled tasks running persistence scripts every two minutes. The campaign used browser fingerprinting and Telegram bots to filter victims and track infections, while abusing trusted Microsoft domains to bypass email security controls and increase attack credibility.

Security researchers uncovered a sophisticated human-operated phishing platform disguising itself as AI advertising products for major platforms including Muse, Gemini, Claude, ChatGPT, and Perplexity. The campaign uses a Browser-in-the-Browser technique, creating fake authentication windows that appear legitimate while remaining on phishing domains. When victims click 'Connect' buttons, operators intercept credentials and MFA challenges in real-time through a state machine that can retry passwords and adapt to different authentication methods. The platform targets advertising account managers and recruiters, with infrastructure built on Next.js and Socket.IO, reusing the same codebase across multiple brand impersonations. The operation extends beyond AI products to include refund scams and fake recruitment sites, all connected through shared backend infrastructure on Railway and Render hosting services.

An Iranian state-aligned threat actor designated as CL-STA-1178 has been impersonating the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. The Blinder Tunnel campaign, active since November 2025 with attacks intensifying in March 2026, primarily targeted Iraqi critical infrastructure. The operation employs a three-step attack chain exploiting legitimate Windows developer files, AppDomainManager hijacking, and DLL sideloading to deploy ShelbyLoader V2 malware. Attackers abuse GitHub API infrastructure for command-and-control communications, utilizing repositories for decryption keys, payload downloads, and GitHub issues as fallback mechanisms. The campaign incorporates Peaky Blinders television show themes in its infrastructure naming and embeds the show's theme song in malware. Operational security failures exposed connections to a separate credential harvesting operation targeting Israeli entities using conflict-themed Google Drive lures during May-June 2026.

In September, an organization experienced an Akira ransomware attack, with investigation revealing the threat actor's tactics and tools. The attacker gained access through Remote Desktop Protocol, subsequently disabling antivirus protections on the compromised endpoint. The adversary deployed Rclone for data exfiltration purposes and utilized a GOST tunneling tool to maintain persistence within the network. Following these preparatory activities, the ransomware payload was executed. Forensic analysis of the impacted endpoints enabled investigators to identify key indicators of compromise, including command and control infrastructure and malicious executables. The investigation uncovered specific file paths and SHA256 hashes associated with the ransomware binary and GOST tunnel executable, along with the C2 server IP address used for tunnel communications.

In September 2026, F5 Labs detected 405 exploitation attempts targeting CVE-2026-0768, an unauthenticated remote code execution vulnerability in Langflow AI application-building platform, originating from 55 distinct IP addresses. This marks the first observation of an AI/ML development platform RCE in opportunistic internet-wide scanning. Captured payloads included capability probing with unique markers, timing-based execution checks, and environment harvesting attempts aimed at extracting cloud credentials, model API keys, and database secrets. Activity came primarily from two infrastructure clusters: Google Cloud hosts using environment-harvesting payloads with forged AI-crawler User-Agents, and European scanning subnets employing marker-based capability probing with spoofed localhost headers. The vulnerability, disclosed in January 2026, allows Python code injection through decorator and default-argument evaluation on the validation endpoint without authentication, enabling arbitrary code execution wit...

Attackers who gain access to AWS credentials perform validation to determine their usefulness, particularly for Amazon Bedrock access. Multiple credential harvesting platforms, including KMON_NOC, have been identified that specifically test stolen AWS keys for LLM capabilities. These platforms validate credentials using GetCallerIdentity, then test Bedrock access through ListFoundationModels and Converse API calls. The validation process helps attackers assess credential value for resale in token-jacking markets, where stolen AI model access is sold below retail price. Scripts analyzed on VirusTotal demonstrate systematic testing across multiple regions, targeting Anthropic Claude models specifically, and enumerating promotional credits to assess financial value. This represents an evolution in credential validation similar to historical patterns observed with AWS SES/SNS services.

The Lunex Malware-as-a-Service platform targets Ukrainian users through fake CAPTCHA lures, deploying a sophisticated loader that exploits AMD's vulnerable PDFWKRNL.sys driver (CVE-2023-20598) to disable endpoint security products. The loader retrieves Windows kernel debugging symbols from Microsoft's Symbol Server to dynamically identify and zero security-related kernel callbacks, making the technique version-agnostic. After manipulating security controls, LunexStealer is deployed to harvest credentials from seven Chromium-based browsers and multiple cryptocurrency wallets while establishing persistent C2 access through registry keys, scheduled tasks, and Native Messaging Host registrations. This mechanism survives deletion of the primary executable and provides continued filesystem access and remote execution capabilities, demonstrating advanced evasion techniques that leave security products running while disrupting their operational visibility.

A Linux malware strain named ClingSTUN exploits unpatched vulnerabilities in Internet-facing devices to establish persistent footholds and functions as a back-connect proxy backdoor. The campaign targets IoT devices through multiple CVEs including command injection and code execution flaws in various vendors' products. ClingSTUN abuses legitimate public STUN infrastructure to discover externally mapped IP addresses, maintain NAT bindings, and improve connectivity between compromised hosts and operators. The malware employs sophisticated persistence mechanisms, terminates watchdog timers, kills competitor processes, and disguises itself as the init process. It maintains remote command execution capabilities and includes self-propagation exploits for seven additional vulnerabilities. The threat actor evolved their approach across three distinct periods, adjusting initial access strategies and expanding the list of targeted vulnerabilities from single-vendor exploits to multi-vendor command injection attacks ...

A Russian-speaking affiliate of the Gentlemen ransomware group, identifying as Azazel, compromised over two dozen organizations across six countries while simultaneously betraying the RaaS operator. The threat actor deployed independent leak site LEAKNED, keeping all extortion proceeds. Attack chains primarily exploited CI/CD secrets from GitLab instances, with one deep compromise involving an AI platform through SSRF, credential decryption, and continuous object storage exfiltration. Azazel operationalized MCP (Model Context Protocol) as a command-and-control channel, marking the first documented criminal use of AI assistant tooling for attack execution. Infrastructure consisted of three nodes totaling over 50TB storage capacity, with approximately 6TB of actively transferring victim data discovered during investigation. Victims spanned logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent sectors.

A sophisticated IoT botnet dubbed Cling has been discovered exploiting vulnerable internet-exposed devices through CVE-2021-35394 and other command-injection flaws. The malware distinguishes itself by abusing STUN protocol traffic and public STUN infrastructure for command-and-control communications, making malicious activity appear as legitimate NAT-traversal behavior. Cling propagates through multiple CVE exploits targeting routers, DVRs and embedded appliances, establishes persistence via init scripts and wget binary replacement, then communicates with operators through STUN-like exchanges with public servers. The botnet operator uses IP spoofing to make commands appear as if originating from Google's STUN infrastructure. Capabilities include propagation scanning, DDoS flooding, TCP tunneling and proxy relay functions. The malware supports various attack commands hidden within STUN transaction ID fields while maintaining a low detection profile by blending into legitimate application traffic from collab...

XWorm is a versatile modular malware that poses a multifaceted threat through remote access, data theft, ransomware delivery, and botnet creation. Associated with the DDGroup cybercrime group, it rapidly gained notoriety for using advanced techniques. The malware employs diverse delivery methods including phishing emails with malicious attachments, drive-by downloads, exploit kits targeting browser vulnerabilities, USB drives, and Remote Desktop Protocol exploitation. Once established, XWorm steals sensitive data like passwords and credit card information, deploys additional malware strains including ransomware and spyware, and causes system crashes and denial-of-service attacks. Its modular nature and varied attack vectors make it a persistent threat requiring robust cybersecurity measures and continuous vigilance.

Threat actors exploited ChatGPT's Custom GPT feature to impersonate legitimate ChatGPT models, directing victims through sponsored Google ads to malicious Custom GPTs titled 'Plus 5.6'. These instances served fake service availability notices, redirecting users to Google Sites pages hosting ClickFix lures disguised as CloudFlare CAPTCHA checks. Victims were tricked into executing PowerShell commands that downloaded malicious MSI installers. The attack chain employed DLL sideloading through legitimate Canon-signed and later Stardock-signed executables, establishing dual persistence mechanisms via registry Run keys and scheduled tasks. The multi-stage infection involved obfuscated scripts, encrypted payloads hidden in WAV files and NuGet packages, and ultimately deployed a feature-rich remote access trojan with capabilities including remote desktop, browser hijacking, credential theft, and follow-on payload delivery. Huntress investigated approximately 40 incidents linked to this campaign, with confirmed Cus...

Socket identified a malicious cluster of Visual Studio Code extensions spanning both VS Code Marketplace and Open VSX registries. Two confirmed malicious themes were discovered: Aurora Nocturne Night Theme, which downloaded and executed threat actor-controlled batch files, and Cosmic Nebula Themes, containing a staged loader that decrypts embedded JavaScript, performs Russian-language gating, and uses Solana blockchain transaction memos to dynamically resolve payload infrastructure. The cluster includes at least ten extensions across both platforms, with over 8,000 Visual Studio Marketplace installs and tens of thousands of Open VSX downloads. Git history, Russian-language source code comments, and distinctive execution patterns connect these extensions to the broader GlassWorm supply chain campaign. Several extensions remain unweaponized but retain executable capabilities that pose significant risk. The operation employs brandjacking tactics and demonstrates sophisticated infrastructure rotation technique...

Between September 9 and September 14, 2026, an unattributed Russian-speaking operator compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page. The ClickFix chain convinced victims to manually execute msiexec.exe commands via the Windows Run dialog, achieving a 14 percent completion rate (79 infections from 426 clicks). The payload, internally named Psychedelic, combines credential theft with persistent agent capabilities, installing browser extensions with native-messaging bridges, establishing scheduled tasks, and polling a REST API for arbitrary executable tasking. Targeting focused overwhelmingly on Ukraine with clear financial motivation, collecting browser credentials, session tokens, and cryptocurrency wallet data from MetaMask, Trust Wallet, Exodus, Atomic Wallet, and others. The technique deliberately avoids encoded PowerShell, using signed Microsoft binaries to bypass common ClickFix detections.

A sophisticated multi-component campaign targeting telecommunications and network-edge appliances has been discovered, featuring BPFDoor variants and a newly identified implant designated AVERAT. The operation leverages SMTP traffic on port 25 to blend command-and-control communications with legitimate mail relay activity, exploiting the trust environments of targeted systems. Attackers deploy a dropper that stages payloads into memory-only execution, leaving no on-disk artifacts for forensic analysis. BPFDoor variants impersonate legitimate processes such as SpamSniper components on South Korean systems, while AVERAT samples target Taiwanese appliances using regionalized disguises. The infrastructure relies on compromised consumer devices including NAS units, CCTV systems, and DVRs as operational relays, consistent with China-nexus covert network patterns. Each component demonstrates advanced operational security through process spoofing, encrypted configurations, and deliberate evasion of network monitor...

BraZetsu is a sophisticated Python-based Windows malware framework attributed to the Brazilian threat actor Exilware. Unlike standard infostealers, it functions as a comprehensive toolkit for Initial Access Brokers, converting compromised systems into high-value commercial assets. The framework employs modular architecture, advanced evasion techniques, and AI-enhanced reconnaissance capabilities to target corporate, financial, industrial, and law enforcement environments across Iberia and Latin America. It specifically harvests financial transaction files in Brazilian CNAB format, detailed browsing histories, and digital certificates. BraZetsu powers the 'Infected Marketplace' where Exilware commercializes initial access to compromised systems, enabling criminal clients to remotely execute additional malicious payloads. The malware demonstrates rapid technical evolution since February 2026, progressing from basic remote access to an AI-enhanced intelligence collection platform.

A threat actor compromised three web servers hosting recreation management software for municipalities and parks organizations by exploiting a file upload vulnerability. After multiple failed exploitation attempts, the attacker registered legitimate accounts and abused the member file upload function to deploy webshells. The attacker enumerated systems, extracted database credentials, and targeted payment card data from Fortis webhook logs. User-agent strings indicate Chinese origin, with suspected AI-generated scripts throughout the operation. The adversary adapted tactics across compromises, employing timestomping and file masquerading for defense evasion. When one server returned to production prematurely, the attacker injected a trojanized jQuery file into authentication pages, establishing WebRTC and WebSocket channels for credential harvesting via Cloudflare Workers infrastructure.

During August 2026, multiple APT campaigns targeted South Korean entities primarily through spear phishing attacks utilizing LNK files. Six distinct attack types were identified, employing various techniques including PowerShell scripts, AutoIt programs, and DLL side-loading. Type A used HEX data extraction with PubNub command and control, while Type B leveraged curl.exe to download HTA files from GitHub and Google Drive, deploying infostealers and keyloggers. Type C distributed XenoRAT malware via GitHub repositories. Type D used resume-themed lures with VBS, BAT, and PowerShell scripts for backdoor injection. Type E employed Python-based backdoors through disguised pythonw.exe executables. Type F exploited Hangul documents with embedded OLE objects for malicious DLL loading. Attacks focused on information theft, system control hijacking, and additional malware deployment.

A cryptocurrency-stealing operation utilizing an Aotera/Tedy loader injects a Vidar-class stealer into Windows processes, launching Chrome or Edge to inject malicious scripts into victim sessions. The malware builder, dubbed Underground, has been active since October 2023. The operation employs seven gate domains and has drained approximately $100,000 across 80+ destination addresses on 23 blockchain networks from 350-430 victims. The infection begins with lure archives containing trojanized files, deploying a loader that implements anti-analysis checks against 67 monitoring tools. Once injected, the stealer automatically drains cryptocurrency exchange accounts through fake security overlays, converts holdings to Bitcoin, and modifies withdrawal confirmation emails. A clipboard clipper targeting two dozen cryptocurrencies replaces copied wallet addresses with operator-controlled addresses. The operation rotates Cloudflare-fronted domains faster than reputation-based detection can respond.

RemusStealer is a malware-as-a-service program exhibiting multiple similarities to LummaStealer, including anti-virtual machine checks, credential theft tactics, and Application-Bound Encryption bypass methods. A key distinction is RemusStealer's use of Ethereum smart contracts for C2 communications instead of Steam or Telegram dead drop resolvers. Written in Go, the stealer performs extensive system discovery, gathering information about antivirus products, hardware specifications, and operating systems. It employs hidden desktop environments to evade detection while launching Microsoft Edge and Brave browser processes on non-primary window stations to steal credential files. The malware establishes connections to suspicious domains ending in .shop or .biz and communicates with Ethereum-related infrastructure. This evolution demonstrates attackers' increasing sophistication in leveraging blockchain technology to masquerade malicious communications through smart contracts.

A critical path traversal vulnerability combined with improper NULL byte neutralization in FortiMail versions 7.2 through 8.0 allows unauthenticated attackers to write arbitrary files on the underlying system through crafted HTTP or HTTPS requests. This vulnerability is actively exploited in the wild. Affected versions include FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and 7.2.0-7.2.9. Indicators of compromise include modified system binaries, added malicious libraries, and suspicious archive configurations communicating with external IPs. Organizations should immediately disable the IBE feature or restrict management interface access until patches become available.

TIKTOUK is a multi-component toolkit designed to collect credentials from WordPress sites. It consists of three components: a Python probing module that identifies WordPress installations and scans for exposed secrets, a Python collection module that extracts configuration files and database credentials, and a Go-based JavaScript crawler that harvests secrets from client-side code. The toolkit exploits exposed configuration files, decrypts email credentials from popular SMTP plugins using recovered encryption keys, and scans for cloud service credentials. All collected data is sent to a centralized HTTP controller. Real-world incidents revealed approximately 50,000 compromised server credentials across 37,000 domains, including hundreds of validated AWS keys with potential for service abuse.

A large-scale phishing operation has deployed 70 fraudulent websites impersonating legitimate cryptocurrency projects including xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, and Firelight. The fake sites closely replicate authentic platforms and lure visitors with offers to vote on rewards distribution dates in exchange for a 1.25x boost. Upon clicking the vote button, users encounter a wallet connection prompt that ultimately leads to malicious authorization requests designed to drain cryptocurrency tokens. The targeted projects were strategically selected based on recent token launches, airdrops, or active rewards programs, making the phishing attempts appear credible to community members. All malicious domains follow the pattern 'sitemu' followed by random characters on the .xyz domain, suggesting a coordinated campaign using shared infrastructure and phishing kits.

The China-nexus threat group Longlegs continues to deploy Warlock ransomware by exploiting Microsoft SharePoint vulnerabilities, particularly the ToolShell exploit chain. Over the past two months, the group targeted at least four organizations including water utilities, telecommunications providers, government bodies, and universities in Portuguese and Spanish-speaking countries across Europe, Africa, and Latin America. The attackers exploit SharePoint flaws for initial access, use DLL sideloading techniques, abuse vulnerable signed drivers like K7RKScan to disable security software, and leverage Visual Studio Code tunneling for covert remote access. They deploy ransomware at scale by staging payloads in domain SYSVOL shares for rapid network-wide distribution, successfully compromising over 40 hosts in some incidents.

In July 2026, China-aligned threat actor TA419 conducted credential phishing campaigns impersonating prominent economists and AI policymakers, targeting AI experts at US think tanks, universities, and legal organizations. The group sent benign conversation starter emails themed around AI policy topics, such as invitations to join an AI Policy Advisory Committee. Upon receiving responses, TA419 deployed multi-stage URL redirection chains leading to Adversary-in-the-Middle credential phishing pages using a customized Frameless Browser-in-the-Browser tool. Active since April 2025, TA419 consistently targets individuals at US and Japan-based think tanks, defense contractors, universities, and law firms. This activity likely supports Chinese intelligence objectives to monitor US AI policy and regulatory developments amid strategic competition involving AI technologies, model distillation concerns, and export controls between the US and China.

CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. LevelBlue's Threat Hunt Operations & Research (THOR) team identified active exploitation across multiple customer environments featuring malicious authentication events with attacker-controlled usernames containing pitboss and NSPPE strings. Observed activities included command-execution testing, payload retrieval using curl and wget, configuration collection and staging, reverse-shell deployment, persistence mechanisms, web-shell installation, and attempted exfiltration of NetScaler configuration data. Analysis revealed two second-stage payloads: main.py establishing reverse shells to command-and-control infrastructure, and update_c08937.pl creating privileged accounts, deploying PHP web shells, and attempting configuration exfiltration. Post-exploitation artifacts included creation of sec_monitor superuser accounts, modification of system binaries, deployment of .local_jou...

On August 31, 2026, threat actors exploited two zero-day vulnerabilities in PaperCut MF affecting a customer in the Education sector. The attackers targeted an internet-facing print server running vulnerable PaperCut MF version 24.0.2, deploying an in-memory Java loader that established a web shell. Through this web shell, they delivered a trojanized Microsoft Copilot binary containing an AdaptixC2 implant. The implant connected to command-and-control infrastructure hosted on Alibaba servers. After remaining dormant for approximately one day, attackers returned to perform reconnaissance and Active Directory enumeration. They then stole a token from a domain-privileged service account and moved laterally to a domain controller. On the compromised domain controller, they dumped credentials from memory and registry, enabled Windows Restricted Admin mode for pass-the-hash attacks, and extracted the NTDS.dit database containing password hashes for all domain accounts, achieving complete domain compromise.

A malicious cyber actor exploited a Citrix NetScaler Gateway zero-day vulnerability on September 24, 2026, three days before public disclosure. The attacker, using IP address 149.104.78.141, attempted exploitation that was detected through behavioral analysis despite no CVE-specific signatures existing at the time. The exploitation chain aimed to establish persistence through a password-protected webshell, attempting to set setuid and setgid bits on /bin/sh for root access. The attacker tried to configure the web server to execute a hidden PHP webshell disguised as a CSS file, using aliases to route requests. Though unsuccessful in compromising the targeted sensor, the post-exploitation playbook revealed sophisticated techniques for maintaining access and evading detection through web server manipulation.

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that Microsoft tracks as “RedFlick”. These changes represent a notable shift in the actor’s operational tradecraft and support ongoing cyberespionage activity targeting Ukrainian individuals and institutions as well as international non-government organizations (NGOs), Western think tanks, governments, and other organizations associated with international policy—particularly those with a nexus in supporting Ukraine.

In August 2026, a new loader designated 2CLoader was identified being used to distribute information stealers including Vidar and Remus, along with XWorm RAT. The loader implements extensive anti-analysis capabilities including anti-VM, anti-debug, and user activity checks. It employs sophisticated evasion techniques such as indirect system calls using Hell's Gate technique and inline trampoline hooks to bypass endpoint security detection. The loader stores its configuration and encrypted payload as a PE resource, using rolling XOR and AES-GCM encryption for payload protection. It supports multiple payload execution methods including RunPE, LoadPE, and CLR hosting for .NET assemblies. Network communication with command-and-control servers uses HTTP POST requests with JSON formatted messages encrypted via XOR. Multiple persistence mechanisms are available through registry keys, scheduled tasks, and startup folders.

Microsoft Threat Intelligence identified active exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite's SNMP notification path. Exploitation occurred between patch availability on July 20, 2026 and public disclosure on August 13, 2026. Attackers delivered JSP webshells and reverse shells without requiring authentication, achieving privilege escalation through PAM configuration abuse and establishing persistent access via systemd services. Post-exploitation activity included cluster-wide lateral movement using Zimbra SSH keys, collection of authentication secrets and mailbox data, and attempted exfiltration using cloud-storage tools. Multiple organizations across different regions and industries were affected through both automated payload delivery and hands-on-keyboard operations targeting internet-facing Zimbra mail servers.

A China-nexus threat cluster designated UAT-11587 has been targeting government and policy organizations across eight Asian countries since September 2025, delivering a previously undocumented Rust-compiled backdoor called Antino. The campaign primarily affected Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria through sophisticated spear-phishing operations using tailored political and diplomatic lures. The multi-stage infection chain leverages Cloudflare infrastructure for delivery and deploys Antino, which uniquely uses Microsoft 365 services—specifically Outlook and OneDrive—as dead-drop command-and-control channels rather than traditional C2 servers. The backdoor supports reconnaissance, command execution, file transfer, shellcode loading, and persistence establishment. Attribution to Chinese nexus is based on metadata containing Simplified Chinese artifacts, UTC+8 timestamps, use of China-focused Rust package mirrors, and targeting patterns consistent with Chinese intellige...

In July 2026, phishing campaigns targeted organizations across multiple industries by distributing a masqueraded MSP360 Remote Monitoring and Management installer through meeting invitations, PDF-themed lures, and software update prompts. Once executed, the legitimate MSP360 installer established remote management access on affected devices, providing threat actors with an initial foothold using trusted administrative software. The MSP360 deployment was then used to download and install a ConnectWise ScreenConnect client, creating a secondary remote-access channel for redundant access to compromised systems. Following access establishment, threat actors deployed additional tools and conducted post-compromise activity, including information collection and credential-access operations. The campaigns utilized multiple delivery mechanisms including actor-controlled domains, compromised websites, and legitimate cloud services such as Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.

Scammers have weaponized fake iPhone Duo preorder pages to deploy the DarkSword exploit chain against vulnerable iPhones. The fraudulent pages mimic Apple's design and offer a $500 voucher to lure victims, but simply opening the page in Safari triggers an exploitation attempt without requiring user interaction. The attack targets iPhones running unpatched iOS versions, attempting to bypass security protections and deploy a payload designed to steal saved credentials, cryptocurrency wallet data, notes, messages, contacts, and other sensitive information. The exploit leverages vulnerabilities previously disclosed by Google in March 2026 and patched by Apple. If successful, the payload establishes communication with command-and-control servers and can execute additional commands remotely while attempting to cover its tracks by deleting diagnostic reports.

ASEC identified a phishing campaign targeting organizations in Korea through emails impersonating company employees. The emails contain malicious XLS files disguised as project material purchase request forms. When opened, the documents exploit CVE-2017-0199, an OLE2Link vulnerability in Microsoft Office, to download HTA files from a C2 server. The HTA file executes an obfuscated PowerShell script that downloads a steganographic PNG file containing a Base64-encoded .NET loader. This loader subsequently deploys Remcos RAT, which performs keylogging, screen capture, file manipulation, and exfiltrates system information to command and control infrastructure. The attack chain demonstrates sophisticated social engineering combined with multiple layers of obfuscation and encoding techniques.

A cluster of 31 Russian-language Chrome extensions masquerading as VPN services for blocked platforms like RuTracker, YouTube, Telegram, Instagram, ChatGPT, and Netflix shares a single malicious codebase. Published from three linked Google accounts, these extensions collectively affect approximately 356,000 users, with the flagship RuTracker VPN extension holding 200,000 installations. The extensions request extensive proxy permissions and dynamically fetch proxy server configurations from remote sources including GitHub Pages, Blogspot, Google Docs, and Telegram channels after installation. This architecture allows operators to modify traffic routing without pushing updates. The configuration uses obfuscated server lists with shared credentials and offers a paid VIP tier for 299 roubles. Some proxy hostnames match those used by Browsec VPN premium servers, suggesting a potential operational connection.

Threat actors are exploiting ChatGPT Custom GPTs and Google Sites to deliver remote access trojans through a sophisticated multi-stage attack chain. The campaign uses sponsored Google search results to direct victims to attacker-created Custom GPTs that impersonate legitimate ChatGPT models. Victims are then redirected to a malicious Google Sites page presenting a fake CloudFlare CAPTCHA that deploys a ClickFix lure, tricking users into executing PowerShell commands. This initiates an eight-stage infection chain involving obfuscated scripts, malicious MSI installers, and DLL sideloading through legitimately signed Canon or Stardock executables. The payload establishes dual persistence mechanisms and deploys a full-featured RAT with capabilities including remote desktop access, credential harvesting from seventeen browsers, file management, and payload deployment. Huntress investigators responded to at least 40 related incidents with two confirmed Custom GPT-driven infections.

RATHat is an Android banking trojan characterized by its unique architecture where the malicious application serves merely as an entry point. After obtaining Accessibility Service permissions, it enables wireless debugging, pairs with the device's ADB daemon, and deploys a native Go service that operates outside Android's permission model. The operation's primary investment lies in its infrastructure, with three successive Command-and-Control panel generations emerging between April and September 2026: BlackCat, followed by Panda Workshop V5 and V6. These panels function as complete malware factories, building, signing, and publishing samples automatically while implementing scheduled rebuilds to evade hash-based detection. Nearly 100 separate deployments across Europe, LATAM, and South-Eastern Asia suggest a Malware-as-a-Service model. Notably, the operation integrates AI on both sides: the malware uses Gemini models to locate on-screen controls when automation fails, while the panel employs LLMs to estim...

NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.

Following the launch of TypeSafe AI's Jev API, numerous fraudulent storefronts emerged selling access to the legitimate API at inflated prices ranging from 3 to 11.5 times the official cost. Within three days of launch, lookalike domains were registered and ranked higher than the official site in search results. At least six sites operated identical code, with operators quickly reskinning platforms for trending AI models. Certificate transparency logs revealed approximately 670 new domains containing "jev" registered within eight days of launch. These storefronts route customer prompts through third-party servers before reaching TypeSafe's API, creating security and privacy risks. While not illegal, these operations exploit brand confusion and charge excessive markups for direct API access.

A sophisticated cybercrime operation compromised enterprise networks across multiple countries by exploiting a GlobalProtect authentication bypass vulnerability (CVE-2026-0257), executed advanced web application attacks, and deployed the AdaptixC2 framework. The operation scanned 277.5 million addresses to curate 81 high-value targets, stole databases from 9+ instances via SQL injection with xp_cmdshell escalation, and exfiltrated Active Directory credentials. Monetization occurred through dual strategies: initially selling corporate and energy sector databases on underground forums under the persona "masterblack", then weaponizing the same data to power a multi-tenant automated invoice fraud platform generating 2.4 million phishing messages and 622,666 personalized fraudulent links. The infrastructure utilized domainless phishing tactics including M365 OAuth device-code phishing and voice-based credential harvesting, collecting payments via PIX through serverless proxies. The operation was exposed in mid-...

A Python-based Malware-as-a-Service builder enables operators to generate customized Windows infostealer executables. The system comprises a builder component and an embedded payload, using Nuitka or PyInstaller compilation to evade detection. The builder features automatic dependency installation, webhook configuration with XOR and Base64 encoding, and multiple compilation backends. The payload targets Chromium and Firefox browsers, extracting credentials, cookies, and credit card data. It harvests Wi-Fi passwords, Discord tokens, and Roblox session cookies while employing anti-analysis techniques including debugger detection, VM process blacklisting, disk size checks, and timing evasion. Persistence is established through registry Run keys and scheduled tasks. All stolen data is packaged into in-memory ZIP archives and exfiltrated via attacker-controlled webhooks, following a scalable affiliate model.

Multiple attack campaigns exploiting CVE-2019-18935, a remote code execution vulnerability in unpatched Telerik UI for ASP.NET AJAX servers, have been identified. The first case involved exploiting the vulnerability to execute a reverse shell connecting to 206.82.6.22, attempting privilege escalation using Potato-family tools like SweetPotato, and installing a Godzilla-style memory-based web shell that operates within the w3wp.exe process without requiring separate ASPX files. The second case deployed a Rust-based scanner tool that searches for exposed WordPress installation pages across target systems and reports findings via Telegram. Both attacks targeted Windows IIS servers, enabling attackers to maintain persistent access, collect system information, and identify additional targets for future campaigns.

A sophisticated four-stage attack chain delivers the Lunex information stealer to Ukrainian-speaking users through fake CAPTCHA pages. The malware employs Bring Your Own Vulnerable Driver (BYOVD) techniques using AMD's PDFWKRNL.sys to disable kernel-level security monitoring before deploying the final payload. The stealer targets seven Chromium-based browsers, extracts credentials using custom SQLite parsers, exfiltrates cryptocurrency wallets, and establishes persistent access through PowerShell-based Chrome Native Messaging Hosts that survive binary deletion. The Lunex platform operates 28 command-and-control panels across 13 countries, features Russian-language operator interfaces, and demonstrates advanced engineering including PDB-guided kernel callback zeroing, custom encryption implementations, and direct syscall invocation. The financially-motivated threat actor originates from the CIS region and operates a Malware-as-a-Service platform serving multiple independent criminal operators.

An investigation reveals that placeholder domains commonly used in documentation are serving malicious content through advertising chains. Two domains, yoursite[.]com and your-domain[.]com, present in hundreds of thousands of GitHub files and agent skills, use cloaking techniques to display scams specifically to macOS visitors while showing legitimate parking pages to others. The scams include fake MacOS Security Center warnings and counterfeit news articles promoting investment schemes. These attacks leverage affiliate fraud models, funneling victims through multiple redirectors to genuine services like McAfee subscriptions to earn commissions. Static security checks fail to detect these threats because malicious redirects occur after JavaScript execution. This follows an earlier disclosure about third-party[.]com serving ClickFix lures. The widespread citation of unregistered placeholder domains in documentation creates significant exposure, particularly for AI agents that fetch and act on this content.

An undocumented remote-access Trojan named Kothamine Agent has been discovered with support for over 30 commands, enabling attackers to control infected Windows systems through command execution, file manipulation, and capability extension. Some variants include browser data theft and camera/microphone recording functionality. The malware has been distributed through malicious npm packages and utilizes tailcat, an open-source Tailscale tool, to establish encrypted command-and-control communications that evade conventional network inspection and blocking. Earlier versions employed Tailscale VPN before transitioning to tailcat. Active since July based on VirusTotal and GitHub evidence, Kothamine features a plugin system for loading additional DLLs, UAC bypass capabilities in certain builds, and employs AES-GCM encryption for C2 communications. The malware achieves persistence through scheduled tasks and adds Windows Defender exclusions during installation.

UNC6240, also known as ShinyHunters, has resumed mass exploitation of CVE-2026-35273 targeting Oracle PeopleSoft systems globally across multiple sectors including education, technology, healthcare, agriculture, transportation, and government. The threat actor bypassed web application firewall rules by URL-encoding a single character in the request path, accessing the vulnerable Environment Management Hub endpoint on systems where operators believed WAF rules had mitigated exposure. Following initial exploitation, UNC6240 deployed multiple web shells including x.jsp and u.jsp, a trojanized backdoor called SIDEEYE delivered via Ple64.exe, Neo-reGeorg tunneling tools, and MeshAgent for persistent access. The actor conducted reconnaissance, credential theft, and prepared for data exfiltration with established patterns indicating potential extortion activities.

Between July and August 2026, a sophisticated campaign targeted organizations across East and Southeast Asia using Japanese and Korean-language phishing emails disguised as product damage complaints. Recipients were directed to fake document-sharing websites that delivered ZIP files containing malware. The archives contained executables with double extensions and DLLs implementing various loader techniques including customized Donut loaders, Python interpreters, AMSI/ETW bypasses, process hollowing, and BYOVD attacks using vulnerable Lenovo drivers. Despite varying loader implementations, the final payloads consistently delivered PureRAT or PureLogs malware families. The campaign demonstrated advanced evasion techniques by frequently changing loader structures while maintaining the same core payloads, effectively bypassing hash-based detection methods. Infrastructure analysis revealed common sending patterns through PHP Swift Mailer and shared Feedback-ID values across campaigns.

Arctic Wolf Labs is tracking an ongoing campaign that compromises legitimate Ukrainian business websites and uses injected iframes to display a Ukrainian-language fake Cloudflare verification page. When a visitor interacts with the page, the lure copies a Windows Installer command to the clipboard and instructs the visitor to paste it into the Windows Run dialog. The command retrieves an MSI package that ultimately delivers a previously unidentified infostealer containing the embedded tag “Psychedelic.”

SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands. These include collecting sensitive data from the victim’s device, capturing screens, remotely managing processes and files, controlling bots, and other forms of remote device management.

Australian security firm Elttam discovered a critical pre-authentication remote code execution vulnerability in TACACS+, a 33-year-old protocol handling authentication on networking equipment. The protocol, released by Cisco in 1993 and now baked into almost all modern networking devices, is widely used at large enterprises, ISPs, data centers, and cloud providers. Attackers can exploit the vulnerability over the internet or local networks with only two packets, leveraging weak encryption. The bug affects both major versions of the protocol, maintained by Shrubbery Networks and a Facebook fork. Patches are available for the Shrubbery version, though no CVE has been assigned. Chinese cyber-espionage groups Salt Typhoon and Fire Ant have exploited TACACS+ in operations targeting telecommunications companies worldwide over the past two years, using it for persistence and lateral movement.

A social engineering campaign targeting security professionals uses fake consultancy offers and job opportunities to exploit trust. Attackers create sparse social media profiles claiming to be consultants, offering $300 for simple consultations on topics like digital transformation. The initial phone call serves as screening to identify targets with valuable access or knowledge. If successful, targets are asked to provide increasingly sensitive information through written reports, requiring them to abuse trusted access, probe internal systems, or leverage professional relationships. Similar variants include fake recruiters offering prestigious positions while requiring installation of trojanised software. These attacks exploit professional flattery and overconfidence, manipulating security practitioners into compromising their most valuable asset: professional integrity and trusted relationships within the industry.

Two previously undocumented .NET malware components were delivered through a ClickFix infection chain. RemotePanel establishes persistent remote access by masquerading as the Windows Time service, providing operators with PowerShell control, file and process management, screen access, modular HVNC, and fleet management capabilities. It uses a BNB Smart Chain contract to dynamically resolve its active Command and Control server, enabling infrastructure rotation without rebuilding the RAT. BoundSiphon runs primarily from memory, targeting browser credentials and sessions, cryptocurrency wallets, password manager data, and documents, including secrets protected by Chromium App-Bound Encryption. Strong code overlap exists between BoundSiphon and a stealer previously documented by Socket, linking the sample to an earlier stealer codebase. The modular design separates persistent access from data theft, allowing operators to replace infrastructure and individual components while maintaining operational capabilities.

A threat actor exploited a Samsung MagicINFO vulnerability (CVE-2025-4632) to gain initial access to victim endpoints. After three attempts, they successfully deployed a rogue AnyDesk instance using various download methods including certutil and PowerShell. The actor created a new local administrator account named 'oldadministrator' and disabled Microsoft Defender protections. Uniquely, instead of dropping a pre-compiled cryptominer, the threat actor compiled one directly on the compromised endpoint using Silent XMR Miner Builder.exe, executing multiple .NET Framework utilities and C compilers including donut.exe, tcc.exe, and MinGW64 tools. The resulting Monero cryptominer connected to the C3Pool mining service and ran under explorer.exe with suspicious command-line arguments. This compilation approach generated significant EDR telemetry, making the activity ironically conspicuous despite using tools associated with silent deployment.

The domain third-party[.]com, historically used as a documentation placeholder similar to example.com, has been compromised and now serves ClickFix lures to Windows users while displaying harmless content to other operating systems. Since at least June 2026, Windows visitors receive a fake Cloudflare verification page that poisons the clipboard with a malicious PowerShell command, instructing users to press Win+R and paste the payload. The domain appears in over 1,500 files across 1,700+ repositories from trusted sources including Chromium, Sanity, and Vercel. Unlike example.com, third-party[.]com is not IANA-reserved, allowing adversaries to register and weaponize it. The attack leverages social engineering to bypass security tools by using signed Windows binaries, making detection difficult through traditional scanning methods.

Threat actors are recompiling open source software, specifically the 7zip self-extracting archive stub, to embed a reflective loader that evades detection. The malicious code is inserted into the ExtractArchive function of the 7zip SFX module, making it difficult for analysts to identify since they typically focus on configuration files and embedded executables rather than the decompression stub itself. Samples are validly signed by Animated Productions, LLC and contain legitimate installers like foobar2000. The loader beacons to C2 servers, downloads DLLs, and reflectively loads encrypted payloads. Variants also abuse other open source libraries like the NSIS plugin EmbedHtml. Files feature bloated certificates and suspicious characteristics including installers wrapped within installers, requiring persistent analysis to uncover the hidden malicious functionality.

RemControl is an Android banking trojan first observed in July 2026 that targets financial institutions across Western Europe, the Middle East, and Canada. The malware is distributed through fake Google Play Store pages advertising TVTap, an IPTV application, using malvertising campaigns with geo-targeted delivery. Once installed, the dropper creates a local VPN to block Play Protect checks and generates unique signing certificates per installation. RemControl exploits Android Accessibility Service permissions to display phishing overlays for over 30 banking applications, capturing PINs, mobile banking codes, and card details. The malware includes remote control capabilities, screen streaming, keylogging, and lock-screen pattern capture. It operates as Malware-as-a-Service with infrastructure showing evidence of AI-assisted development in phishing page creation and documentation.

A sophisticated PowerShell-based backdoor named TASK#STOMP has been discovered that specifically targets business documents while maintaining persistent remote access to compromised systems. The infection begins with VBScript execution, establishing persistence through scheduled tasks and startup folder entries. The malware deploys two primary PowerShell payloads that scan fixed drives for Word, PDF, PowerPoint, Excel, and archive files modified within the past year, excluding files larger than 500MB. It employs filesystem watchers for continuous collection of new documents. Additional capabilities include screenshot capture, Wi-Fi password theft, clipboard monitoring, and arbitrary command execution. The backdoor communicates with two command-and-control domains and uses compiled C helpers to bypass TLS certificate validation, enabling connections to servers with invalid certificates.

North Korea-linked threat actors are conducting Operation Conflict Compass, targeting individuals and organizations focused on Ukraine using spear-phishing emails with malicious ZIP attachments. These contain LNK files disguised as PDFs with themes related to Russia-Ukraine peace plans, Ukrainian research, and geopolitical issues. When executed, the shortcuts retrieve malicious files from GitHub, deploying VBScript to establish persistence via scheduled tasks and delivering VelvetCake, a lightweight PowerShell-based task runner. VelvetCake contacts command-and-control infrastructure to download and execute additional scripts that perform reconnaissance, collect system information, enumerate security software, and capture screenshots. The campaign also utilized trojanized Zoom installers and leveraged infrastructure in South Korea and Ukraine, with activity observed since early August 2026 targeting diplomatic entities, think tanks, and NGOs.

Galago is a newly identified ransomware operation that emerged in September 2026, claiming operational partnership with the Panzer ransomware group. The connection is suggested through shared infrastructure, specifically matching prefixes in their Tor leak-site addresses (pnzr4del for Galago and pnzruro for Panzer). Galago was first detected following an alleged attack on an Icelandic healthcare organization on 9 September 2026, though this claim remains unverified as their dark leak site showed no published victims. Panzer, described as a ransomware-as-a-service operation, has published 32 victims between August and September 2026 and employs double extortion tactics. While the naming pattern and self-reported claims suggest a relationship, no independent evidence confirms shared operators, malware, or infrastructure control between the two groups.

A detailed technical analysis examines the evolution of MacSync, a macOS stealer-as-a-service initially known as Mac.c, which targets cryptocurrency enthusiasts and developers. The malware has undergone significant changes, replacing AppleScript-based droppers with binary executable files written in Objective-C and Swift. The infection chain utilizes malicious DMG images and employs iCloud infrastructure for payload delivery. MacSync collects extensive data including browser credentials, cryptocurrency wallets, Telegram data, SSH configurations, and keychain files. The stealer incorporates novel techniques like PAM API for password verification and features a backdoor module for persistent access. Distribution occurs through social engineering, fake applications, and cracked software disguised as legitimate crypto wallets like the nonexistent Toria wallet, promoted through dedicated websites and social media channels.

ThreatDown researchers discovered CARBONATO, a Docker botnet that exploits exposed Docker daemons on port 2375. The operation was uncovered through an unauthenticated Docker registry exposed since May 2026, revealing two parallel activities: distribution of trojanized cryptocurrency wallet applications and a botnet infrastructure. The botnet leverages Hermes Agent, an MIT-licensed open-source AI framework, modified with a custom prompt directing it to execute commands via Telegram, maintain persistence, and harvest credentials. The campaign infrastructure spans multiple hosting providers including Linode, Hetzner, and Contabo, with activity documented from October 2024 through August 2026.

A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is.

AvisLoader is a newly discovered Windows malware loader that uses the Tox encrypted peer-to-peer messaging network for command-and-control communications, making traditional domain-based takedowns ineffective. The infection begins with a ClickFix social engineering technique, where victims are tricked into copying and executing malicious commands disguised as document verification steps. The loader is delivered through Cloudflare infrastructure and includes various stealth capabilities such as shortcut modification for persistence, UAC bypass attempts via UACME method 41, and process-hiding functionality through API hooking. Operators manage infected systems through a web-based Command Center that enables client management, task configuration, and payload distribution over the Tox network. The malware's architecture allows operators to maintain control by simply copying their Tox save file when relocating infrastructure, with clients automatically following without requiring domain updates.

VeloCloud Orchestrator (VCO) on-premises deployments contain a critical vulnerability allowing remote attackers to access privileged internal functionality and compromise the VCO host. The flaw, tracked as CVE-2026-93952 with a CVSS score of 10.0, enables attackers with network access to the VCO web interface and access to the public portion of VeloCloud Edge authentication certificates to exploit the system. This vulnerability is actively being exploited in the wild and affects VCO versions 5.2.3.15 and below, 6.1.3.7 and below, 6.4.2.7 and below, and 7.0.0.2 and below. Successful exploitation compromises confidentiality, integrity, and availability of the orchestrator and managed data. Hosted VCO versions were already patched. Specific indicators of compromise include malicious files, suspicious HTTP headers, and connections from known malicious IP addresses.

Group-IB researchers discovered RemControl, a previously undocumented Android banking trojan operating as Malware-as-a-Service since May 2026. The malware targets over 30 financial institutions across Western Europe, the Middle East, and Canada through fake TVTap IPTV download pages distributed via malvertising. RemControl abuses Android Accessibility Service to inject phishing overlays, stream device screens in real-time, log keystrokes, and provide full remote control. The investigation revealed that the criminal infrastructure was inadvertently built using AI assistance, with complete AI-generated responses found verbatim in production phishing pages. The C2 panel documentation describes credential theft as quiz completion, suggesting developers deceived AI assistants into building fraud infrastructure under false pretenses. The threat actor UNKK operates the campaigns, with possible links to the Medusa UNKN affiliate botnet based on overlapping infrastructure patterns and naming conventions.

In early September 2026, Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows through sophisticated phishing campaigns. The actor registered fake domains impersonating legitimate organizations including China Digital Times and the Center for American Progress, sending targeted phishing emails to Asian government entities. Victims were directed to spoofed websites hosting an exploit chain leveraging CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attacks delivered CLEANGULP, a previously undocumented malware family with backdoor capabilities including command execution, file operations, and beacon object file execution. The malware communicated with command-and-control infrastructure via encrypted HTTP traffic using custom encoding. Multiple Chinese APT groups demonstrated coordinated access to this exploit kit, suggesting widespread sharing within the Chinese cyber espionage community during the vulnerability window.

Over five months, four distinct malicious chains operated through the same bulletproof hosting provider, AS202412 registered to OMEGATECH LTD in Seychelles. All chains began with fake CAPTCHA pages (ClickFix technique) that instructed victims to paste commands into Windows Run dialogs. The campaigns used disposable domains with similar naming patterns, compromised legitimate websites, and varied infrastructure including cloud storage, blockchain-resolved C2 addresses, and trojanized installers. Despite different payloads and staging methods, every chain initiated contact through AS202412. The provider expanded from initial allocations to announcing twenty-four /24 prefixes during the observation period. Most browser contacts ended at the lure page without execution, but successful compromises deployed stealers and remote access tools with persistence mechanisms surviving system reboots.

DarkMe, a Visual Basic 6 spy-RAT previously linked to financially-motivated APT group Water Hydra, was observed in two separate incidents affecting organizations in August 2026. Previously notable for weaponizing zero-day exploits including CVE-2023-38831 and CVE-2024-21412, this campaign abandoned sophisticated exploits in favor of basic social engineering tactics. Victims received phishing emails containing links disguised as images that delivered PIF executables. The attack chain utilized MSI installers, VB6 loaders, COM objects, and process hollowing into legitimate signed Microsoft binaries. Novel tradecraft includes using PIF files as initial payloads and implementing custom protocol handlers for persistence. The malware targets cryptocurrency wallets, password managers, trading platforms, and gaming applications, employing an inverted sandbox check against 329 applications to identify genuine user environments rather than analysis systems. This shift from targeted, exploit-driven operations to high-...

A third variant of PamStealer has been identified, distributed through a fake Wavel cryptocurrency wallet application. The malware employs a sophisticated server-side decryption chain using a purpose-built utility called pkgunpack that performs live ECIES key exchange with command-and-control infrastructure, making offline payload decryption impossible. The second stage has been rewritten from Rust to Swift while maintaining PAM-based credential validation. The infostealer targets seventeen browsers including Arc, Zen, Waterfox, and LibreWolf, extracts keychain credentials, collects system fingerprints, and harvests user files including shell history and account photos via Open Directory. Persistence is maintained through four redundant repair mechanisms including LaunchAgent installation, shell hooks, Git hooks, and a local backup tarball, with notification suppression achieved by killing background task management processes.

This analysis covers infostealer distribution trends during August 2026, focusing on distribution channels, detection rates, and disguise techniques. Primary infostealers identified include Remus, Vidar, LummaC2, and ACRStealer, distributed through crack software disguises, SEO poisoning, and file-hosting platforms like Mega and Mediafire. Malware disguised itself as legitimate companies, with Microsoft Corporation being the most frequently impersonated. Distribution methods included DLL side-loading using python37.dll and python36.dll, and exploitation of Renpy game development tool. Email campaigns delivered Formbook disguised as Turkish bank statements and AgentTesla as business quote requests from Indian companies. EXE files constituted 97.3% of execution types. The stolen information poses risks for dark web trading and secondary attacks, emphasizing the need for cautious handling of untrusted links, avoiding illegal software, enabling two-factor authentication, and maintaining updated security soluti...

A suspected Chinese-speaking threat actor, operating from UTC+8 timezone and linked to Red Heron, conducted extensive exploitation campaigns from May through September 2026. The adversary maintained persistent use of a single IP address to target multiple technologies including WordPress, ZyXEL switches, and various enterprise platforms. In the most severe incident, the attacker exploited WordPress vulnerabilities CVE-2026-63030 and CVE-2026-60137 to breach a western government organization, stealing over 18,000 sensitive records containing credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The attacker demonstrated sophisticated capabilities including custom tool development possibly leveraging large language models, privilege escalation attempts, and systematic data exfiltration using PowerShell-based collection and staging techniques.

CLOSEDQUORUM is a Windows malware binary representing the first documented implant utilizing autonomous AI-driven command and control. Discovered through Cisco Talos' CAIRN project, it delegates tactical decisions to a panel of commercial large language models including DeepSeek, Qwen, Mistral, and Google Gemini. The system operates through plurality voting among AI models to select actions for credential harvesting and crypto wallet theft, eliminating the need for continuous human operator involvement. The 16.4MB Go-compiled executable employs structured JSON schema to constrain LLM responses to executable attack choices. While containing placeholder credentials in public distribution, development builds demonstrate compile-time injection of operator-specific API keys and Discord webhooks. This architecture represents a significant shift toward effort displacement in cyber operations, where entire attack phases execute autonomously without human bottlenecks, though introducing new dependencies on commerci...

A sophisticated six-month campaign targeting quantitative and DeFi developers through malicious npm packages disguised as legitimate mathematics libraries. The operation employs encrypted loaders that trigger only when specific cryptographic operations are performed, specifically when solving linear equations with predetermined matrices. Command and control infrastructure uses Ethereum Sepolia testnet smart contracts as dead drops, alongside a secondary Slack channel, enabling encrypted tasking of compromised systems. The threat actors manufactured millions of fake downloads using GitHub Actions workers to establish false credibility. Fourteen smart contracts were deployed across five operator wallets, managing over 1,000 encrypted taskings to enrolled victims. The campaign demonstrates advanced operational security with disposable accounts, encrypted payloads sealed under ephemeral keys, and infection markers hidden in license files.

This document analyzes multiple cybersecurity incidents involving various threat actors and malicious campaigns. The analysis covers sophisticated attack methodologies including exploitation of vulnerabilities, deployment of specialized malware tools, and targeting of critical infrastructure across multiple sectors. The campaigns demonstrate advanced persistent threat capabilities with focus on data exfiltration, system compromise, and lateral movement within targeted networks. Key observations include the use of social engineering tactics, exploitation of remote access vulnerabilities, and deployment of custom malware frameworks. The threat landscape encompasses government, technology, financial, and defense sectors with significant emphasis on supply chain attacks and credential harvesting operations.

Vidar is an information stealer first observed in 2018 that has continuously evolved its string obfuscation techniques to evade detection and analysis. Between May and September 2026, the malware progressed from basic XOR encryption to ChaCha20-based algorithms, and most recently implemented a custom virtual machine executed via a lightweight bytecode interpreter combined with custom stream ciphers that change per build. The VM uses 14 opcode handlers with simple primitives including XOR, addition, rotation, and substitution. Version 2.0 introduced this VM approach, while versions 2.2 and later added ARX-based custom stream ciphers using FNV-1a hashing and golden ratio constants. These per-build variations in opcodes, constants, and substitution tables significantly hinder static and automated analysis capabilities.

A deep technical analysis reveals updates to Hangro, North Korea's state VPN and mail product, operating on servers in Pyongyang and the Russian Far East. A new certificate hierarchy deployed in July 2026 differs significantly from the 2024 version, with both containing cryptographic anomalies where signatures fail verification. Investigation uncovered six network assignments in Chinese address space linked to a single registry contact associated with Silibank, plus infrastructure in Russian Far East networks designated KPOST. The service evolved from a commercial email gateway in 2001 to a certificate-bound VPN deployment issued to trade representatives through consulates. Technical evidence indicates structured infrastructure spanning North Korean, Russian, and Chinese address space, with mail systems configured for bulk transfers over intermittent connections using ten gigabyte message limits and ETRN capabilities.

In late August, an organization was compromised by INC ransomware across at least 175 endpoints. The attack timeline spanned from early to late August with a 17-day gap, suggesting involvement of an initial access broker and a separate ransomware affiliate. Early August activity included scheduled tasks with randomized names and lateral movement via RDP using a compromised account. After the lull, attackers deployed AnyDesk for remote access, used Bring Your Own Vulnerable Driver tactics to disable security controls, and executed ransomware via Impacket tools. Uniquely, two ransom notes were discovered: the standard INC-README.txt and a subsequent DATALEAK_PRESS_RELEASE.txt containing detailed stolen file listings, threatening to contact media, employees, and partners within 48 hours to increase pressure on victims.

A sophisticated multi-stage infection chain was discovered through analysis of a system exhibiting frequent PowerShell execution alerts. The attack leveraged multiple layers of obfuscation and concealment techniques, including Registry-based payload storage, DNS TXT record exploitation, and data hidden within image and WAV audio files. The threat actors employed various evasion methods such as security control tampering and in-memory execution to avoid detection. Rather than writing payloads directly to disk, attackers reconstructed malicious code from distributed sources including Registry entries and steganographically encoded data in media files. The ultimate objective of this elaborate infection chain was to deploy cryptocurrency mining operations covertly on compromised systems while maintaining persistent access through multiple redundant mechanisms.

In April 2026, a manufacturing organization in the Middle East suffered a ransomware attack where threat actors with domain admin privileges weaponized Active Directory Group Policy Objects to achieve domain-wide impact without deploying ransomware binaries on Windows endpoints. The attackers created malicious GPOs linked at the domain root, delivering ransom notes, hijacking wallpapers and lock screens, enforcing logon banners, and disabling local administrator accounts across all domain-joined workstations. No file encryption occurred on Windows systems; instead, the operation focused on encryptionless extortion through operational disruption and data exfiltration. Initial access was gained via compromised VPN credentials. The attack remained dormant for one day between GPO creation and detonation, evading file-based detection entirely by abusing trusted AD infrastructure.

In 2026, the DPRK-sponsored Lazarus subgroup TraderTraitor continued campaigns targeting cryptocurrency entities, including a high-profile attack on LayerZero resulting in $292 million theft from KelpDAO. Following this disclosure, an additional victim was identified: a smaller IT services provider in India with no cryptocurrency connections. The compromise involved a DevOps engineer targeted through fake job interview lures containing weaponized Terraform coding projects. Malicious GitHub repositories used typosquatted provider domains to deliver macOS backdoors FLATROOF and ROOFDECK when victims executed terraform init. The backdoors enabled reconnaissance, credential theft, and cloud environment escalation. One day after LayerZero's public disclosure, attackers deployed an updated stripped version of ROOFDECK and removed earlier implants. Activity continued until June 2026, suggesting the threat actor ultimately abandoned the intrusion after determining insufficient value from the smaller target.

Blackpoint's Adversary Pursuit Group identified ChainScript, a previously unnamed Node.js remote access trojan discovered during ClickFix investigation. The malware disguises itself as legitimate software including Spotify, Zoom Workplace, and Microsoft Teams through malicious Windows Installer packages. ChainScript employs an EtherHiding-style C2 discovery technique utilizing a Polygon smart contract to dynamically locate active WebSocket infrastructure, enabling operators to rotate backend services without rebuilding agents. The RAT provides comprehensive remote access capabilities including interactive shell sessions, file operations, screenshots, payload deployment, cryptocurrency wallet discovery, remote JavaScript execution, self-update mechanisms, and cleanup functions. Multiple builds appeared under different names (ComponentTask33, UpdateDigital, HostShared, OrchidViolet66) while maintaining consistent core agent architecture. Analysis revealed automated contract deployment integrated into the mal...

ESET researchers uncovered a Lazarus attack against a Spanish aerospace company where attackers masqueraded as Meta recruiters on LinkedIn, sending trojanized coding challenges to employees. The campaign deployed multiple tools including LightlessCan, a previously undocumented backdoor that mimics native Windows commands to evade detection. Initial access was achieved through spearphishing via LinkedIn Messaging, delivering malicious executables disguised as C++ programming tests. The attack chain involved DLL side-loading techniques delivering payloads including NickelLoader downloader, miniBlindingCan variant, and the sophisticated LightlessCan RAT supporting 68 commands. LightlessCan represents a significant advancement over its predecessor BlindingCan, implementing execution guardrails and enhanced stealth capabilities. The campaign targeted aerospace technology and know-how for cyberespionage purposes, consistent with North Korean strategic objectives in missile development.

A new JavaScript infostealer dubbed WeaselBiscuit has been discovered hidden in 11 malicious npm packages. This lean malware shares operational similarities with DPRK-linked BeaverTail and OtterCookie families but features a stripped-down architecture. WeaselBiscuit deploys through npm imports, executes a detached Node process, retrieves its payload from Npoint URLs, and communicates with a C2 server at 103.170.217.184:8787. The malware profiles infected hosts, steals Chrome extension storage containing wallet signing states, captures clipboard contents, and logs Windows keystrokes when commanded. Unlike its predecessors, it lacks wallet-draining code, browser password decryption, Python second stages, screenshots, and remote shell capabilities. The operation uses numeric campaign identifiers embedded in package names for tracking. While technical overlap suggests DPRK attribution, particularly through Npoint dead-drop patterns and nested IP geolocation lookups, definitive attribution requires additional c...

Fraudulent organizations in Korea are exploiting private Home Trading System (HTS) software to distribute ransomware to victims. The unauthorized HTS program called 'UBP Asset' impersonates the legitimate Swiss financial institution Union Bancaire Privee (UBP) and has been used in investment scams since at least September 2025. Attackers lure victims through social media platforms like Telegram and KakaoTalk, convincing them to install the fraudulent HTS and deposit funds. The latest campaign involves distributing KRSID ransomware through the HTS update mechanism, which encrypts files using AES-256 and RSA-2048 algorithms. Previous campaigns used similar private HTS programs to distribute Quasar RAT. Victims not only lose their investment funds but also have their systems compromised and files encrypted for ransom demands.

A sophisticated malware campaign active since November 2025 exploits blockchain technology to maintain persistent command-and-control infrastructure. Attackers store C2 addresses in Polygon blockchain smart contracts rather than hardcoding them, enabling rapid infrastructure rotation for pennies. The operation compromised at least 31 legitimate websites across multiple countries, deploying FakeCaptcha lures through compromised sites accessed via Bing or Google searches. When victims follow the lure, malware establishes persistence through scheduled tasks and registry keys, queries Polygon smart contracts for current C2 domains, and deploys versatile payloads including banking trojans targeting 479 financial and cryptocurrency domains. Investigators identified 15 smart contracts across six operational waves, three active C2 domains, and two operator wallets controlling the infrastructure. The campaign demonstrates significant operational security with multiple fallback mechanisms, though investigators succe...

LabubaRAT is a custom, unsigned 64-bit Rust-based remote access trojan identified by Blackpoint, designed to masquerade as legitimate NVIDIA software. It provides comprehensive remote access capabilities including command execution, file operations, screen capture, and SOCKS5 proxying. The malware features configurable enrollment fields and an internal ZM_ configuration namespace, suggesting it is built on a reusable, multi-tenant framework consistent with a malware-as-a-service offering. LabubaRAT is managed through an associated backend infrastructure called LabubaPanel, hosted on German providers. The delivery mechanism utilized the RAT's own JavaScript execution capability. First observed in July 2026, it targets Windows platforms and employs various evasion techniques including masquerading as NVIDIA components and abusing legitimate Microsoft build utilities.

PolinRider operators compromised a GitHub account to insert malicious code into development versions of visanduma/nova-two-factor, a Packagist package with over 700,000 downloads. The campaign spreads through compromised developer accounts and Git repositories across multiple ecosystems including npm, PyPI, Go modules, Packagist, and Chrome extensions. The operators use Git history rewriting, payload concealment in configuration files and font files, automatic execution through IDE tasks, and staged payload delivery via dead-drop mechanisms like EtherHiding and NullReceiver. Primary infection occurs through Git-based collaboration rather than direct package registry compromise, with PHP projects targeted using obfuscated JavaScript executed through shell_exec. The campaign appears linked to North Korean operators focused on cryptocurrency theft.

An Israeli influence-for-hire company called BlackCore has been identified conducting digital manipulation campaigns across multiple countries. The company operates through a sophisticated infrastructure offering services including discourse dominance, organic engagement manipulation, and counter-operations. Researchers identified a specific campaign involving a 14-week training program delivered to Angolan government employees in early 2026, which included the creation and deployment of fake social media personas and coordinated inauthentic behavior. The operation utilized AI-generated profile pictures, fake news outlets like 'Agita News', and coordinated amplification tactics across Facebook, Instagram, and TikTok. BlackCore's promotional materials openly advertised their capabilities to conduct deceptive influence operations on behalf of government clients, demonstrating how influence-for-hire services have become accessible to state actors seeking to manipulate online discourse.

Analysis reveals HEAVYGRAM, a multi-stage Windows backdoor attributed to Iran-linked threat actor Handala Hack, deployed since Fall 2023 targeting Iranian dissidents, journalists, and government opponents. The surveillance tool uses Telegram bot API for command-and-control operations, enabling remote command execution, screen capture, data exfiltration, and persistent access. Victims receive social-engineered files masquerading as legitimate applications like Telegram, KeePass, or Pictory. The implant supports DLL side-loading, registry persistence, and system reconnaissance. Infrastructure analysis identified 29 samples utilizing networks of Telegram bots and groups for operations. The malware aligns with activity disclosed by U.S. Department of Justice regarding Iran's Ministry of Intelligence and Security infrastructure seizures, with tradecraft including Vultr Object Storage and Persian-language decoys targeting specific victim profiles including academics and media personnel.

A significant supply chain attack compromised Brevo's infrastructure on September 14, 2026, affecting over 100,000 customer websites. Attackers injected malicious code into Brevo's JavaScript assets and widgets, delivering two distinct payloads: a WordPress plugin backdoor automatically installed when site administrators visited their own sites while logged in, and ClickFix overlays targeting regular visitors. The attack vector involved modification of Brevo's CDN-hosted files and creation of malicious subdomains under sendibt1.com. Evidence suggests attackers gained access to Brevo's Cloudflare account, allowing them to modify DNS records and rewrite content dynamically. The malicious activity lasted approximately four hours, from 16:05 to 20:12 UTC. Brevo's prominent clients include eBay, Louis Vuitton, Michelin, and Amnesty International, amplifying the attack's potential impact significantly.

Since early May 2026, a large-scale phishing campaign has targeted individuals with fraudulent text messages claiming their T-Mobile rewards points are about to expire. The messages create urgency by stating that point balances, typically cited as 18,400 points, will expire imminently if not redeemed. Recipients are directed to click on phishing links using rotating domains designed to mimic legitimate T-Mobile websites. The campaign has generated over 1,000 closely related message templates with only superficial variations in salutations, dates, and point balances. The operation experienced two major spikes in activity before declining. The criminals employed at least 81 domains over four months, all following a recognizable pattern. These messages use generic greetings and formal language to appear legitimate, exploiting social engineering tactics to trick recipients into divulging login credentials, personal information, or payment details.

A previously unknown modular multi-stage framework named MovieReaper has been discovered targeting users through compromised torrent files. Attackers compromised the public torrent repository itorrents[.]org, enabling them to distribute malicious loaders disguised as popular movies, including "The Odyssey." The campaign began in mid-August 2026 and affected hundreds of victims across multiple countries. The malware employs a sophisticated infection chain with fileless execution, utilizing blockchain network Solana for C2 infrastructure resilience. The framework includes multiple stages: an initial loader with anti-sandbox checks, shellcode that retrieves C2 addresses from Solana blockchain, UAC bypass with persistence mechanisms, and a final file manager module providing comprehensive file system access. The campaign demonstrates advanced evasion techniques including manual API resolution, vectored exception handling, and in-memory execution.

Settra is a ransomware variant first observed in June 2026 that targets organizations through VPNs or compromised credentials. Two incidents were investigated in July and September 2026, affecting the consumer services, retail, and manufacturing sectors. Attackers deployed MeshAgent RMM for persistence, naming ransomware executables after victim domain names. The malicious activity included file encryption with .locked or .locked_wip extensions, deployment of RESTORE_FILES.txt ransom notes, clearing Windows event logs, and disabling Windows recovery options using reagentc and diskpart utilities. One incident featured Bring Your Own Vulnerable Driver (BYOVD) tactics using gdrv.sys. A notable operational security failure occurred when attackers misspelled the Windows Defender Event Log path, preventing its deletion. Both attacks followed remarkably similar operational patterns, with MeshAgent installations pointing to different C2 IP addresses (45.13.122[.]7 and 193.5.65[.]114), and malicious workstation WIN...

ESET researchers have documented SparroWocky, a sophisticated C++ backdoor deployed by the FamousSparrow APT group since August 2025. This China-aligned threat actor has shifted focus to extensively targeting governmental organizations across Latin America, likely in response to increased US interest in the region. SparroWocky replaced the group's previous SparrowDoor backdoor and demonstrates advanced capabilities including reflective loading, anti-analysis techniques like SilentMoonwalk for call stack spoofing, and the ability to execute Beacon Object Files. The modular backdoor incorporates open-source projects directly into its codebase, uses TLS-encrypted communications with RC4 encryption for data exfiltration, and employs sophisticated evasion methods including MinHook API hooking and custom PE loading with host process camouflage. The targeting pattern reflects China's strategic interest in monitoring Latin American governmental responses to current US pressures regarding investments and infrastruc...

A French-speaking cybercrime crew operating as BlackHatSect0r && DXQRTXX left an operation server exposed, revealing a custom Go command-and-control platform that harvested 16,834 credentials from 726,989 hosts across 2.7 million queued domains. The operator deliberately removed safety controls from a Nous Research Hermes AI agent, deleting the line "discernment retained" from its memory and replacing it with "I am a weapon." This enabled automated campaigns targeting French government institutions, including the Equestrian Federation and National Mountain Observation System, alongside extortion operations against four New York public bodies, cryptocurrency exchange breaches, and vishing campaigns against elderly French banking customers. Despite branding itself as a zero-day operation, all confirmed breaches resulted from exposed cloud storage, readable .env files, and default signing secrets rather than novel exploits. The crew operates openly on Telegram with 13 declared members and maintains public all...

Infrastructure analysis reveals a cluster of SpiceRAT command and control servers active from late 2025 through August 2026, linked through shared TLS certificates, domain registrations, and a cloned RTX Corporation webpage. The infrastructure connects to multiple threat families including SpiceRAT, NodeEdgeRAT, NomadRAT, and BloodAlchemy, suggesting either a single operator managing multiple toolsets or shared support infrastructure. A TLS certificate impersonating Uzbekistan's railway authority was issued by TLC, a Chinese state-affiliated certificate authority. Domains spoof Central Asian government entities including Türkmengaz, the Galkynysh gas field, Tojiktelecom, and Turkmenistan's Ministry of Foreign Affairs. Passive DNS analysis reveals subdomain infrastructure dating to mid-2022, indicating at least four years of ongoing operations. The infrastructure shares characteristics with previously documented China-nexus actors FamousSparrow and IndigoZebra, both known for targeting Central Asian governm...

VectraRAT is a previously undocumented Malware-as-a-Service platform combining a Go-based control server (VectraHub) with a native C++ Windows implant, renting from $250 monthly. The developer, operating under the handle 'Vectra' (formerly 'Nyxel'), has been active since August 2022 without prior public documentation. The platform offers hidden desktop control, keylogging, clipboard hijacking with cryptocurrency address replacement, browser credential theft, and a UAC bypass achieving elevation without user prompts. Delivered through Amadey loader and ClickFix campaigns targeting tax-themed lures, 48% of observed victims run corporate Windows editions including Windows Server 2025. Infrastructure analysis revealed exposed directories and operational panels across multiple hosting providers, with victims spanning the United States, Russia, Germany, and other nations.

Noodle RAT, also known as ANGRYREBEL or Nood RAT, is a modular remote access trojan with dual versions for Windows and Linux, actively used by Chinese-speaking threat actors since at least mid-2016. Previously misclassified as variants of Gh0st RAT or Rekoobe, it is now recognized as a distinct backdoor family. The malware has been deployed in espionage and cybercrime campaigns targeting entities across the Asia-Pacific region, including Thailand, India, Japan, Malaysia, and Taiwan. Multiple threat groups including Iron Tiger, Calypso APT, Rocke, and Cloud Snooper have utilized this tool. Both variants feature shared command-and-control architecture, similar configuration structures, and modular capabilities. The Windows version operates as an in-memory backdoor with file management and proxy capabilities, while the Linux variant provides reverse shell, SOCKS tunneling, and task scheduling functionalities. Evidence suggests an actively maintained, possibly commercial malware toolkit.

In August 2026, the Pakistan-nexus threat actor APT36 launched Operation RapidRust, targeting government and defense organizations in India and Afghanistan with an updated arsenal of custom tools. The campaign introduced RUSTYSHADE, a Rust-based backdoor leveraging private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools included RUSTYMOVE for USB-based lateral movement to air-gapped networks, PSNATCH and BASHNATCH for file exfiltration from Windows and Linux systems respectively. The attackers registered typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities revealed systematic network reconnaissance, credential harvesting, and lateral movement attempts, with operations conducted exclusively on weekdays between 4:00-11:00 UTC, demonstrating disciplined operational security and sustained targeting of South Asian government infrastructure.

In late August 2026, a sophisticated device code phishing campaign was identified, distributed through web contact forms. Threat actors impersonated procurement officers from legitimate businesses, specifically BJ's Wholesale Club, using lookalike domains registered with Zoho Mail. The campaign, tracked as GhostCode, abused Microsoft's OAuth 2.0 device authorization grant flow to obtain authentication tokens. Victims received WeTransfer links to password-protected HTML files containing three layers of obfuscation: junk padding, character-level HTML comment injection, and AES-256-GCM encrypted redirect URLs. After passing multiple security checks including Cloudflare Turnstile, victims were directed to legitimate Microsoft sign-in pages where they unwittingly authorized attacker-controlled devices. Within 78 seconds of successful authentication, threat actors registered three devices, obtained Primary Refresh Tokens, and harvested emails using residential proxy rotation to evade detection.

An analysis of Atomic macOS (AMOS) stealer infections from early August 2026 reveals this information stealer targeting macOS systems has been advertised since April 2024. AMOS exfiltrates system information, login credentials, and sensitive data from web browsers and cryptocurrency wallets. Distribution methods include ClickFix campaigns, malicious advertisements, and fake cracked software sites offering macOS toolkits. The examined infection chain begins with malicious instructions on getmacouscloud[.]com, leading to execution of a Zsh script that retrieves and installs Mach-O binaries establishing persistence in system directories. The malware collects data from various applications including Binance, TonKeeper, Telegram, AWS, Docker, and FileZilla, compressing it into an out.zip file before exfiltrating to command and control servers. Post-infection traffic consists of HTTP POST requests with specific stage parameters indicating collected data types. The malware demonstrates active development with con...

The NightEagle APT group (APT-Q-95), active since 2023 and initially targeting Asian organizations, has expanded operations to Russian enterprises. Attackers gain initial access through compromised VPN credentials originating from Cloudflare WARP tunnels and European infrastructure providers. They deploy the GhostContainer backdoor on Microsoft Exchange servers, exploiting CVE-2020-0688 and incorporating components from Neo-reGeorg and ysoserial. For traffic tunneling, the group uses Microsoft Dev Tunnels combined with rdp2tcp, masking malicious tools as legitimate software hosted on GitHub repositories. They exploit vulnerabilities including CVE-2019-0708 (BlueKeep) for lateral movement and perform DCSync attacks against Active Directory to compromise domain controllers. The group employs sophisticated techniques for persistence and privilege escalation across corporate networks.

Illegal online gambling infrastructure spans three distinct cybercrime categories that defenders often overlook. First, over 1.7 million Chinese-language casino domains facilitate illegal gambling and transnational money laundering, primarily operated by triad-aligned syndicates. Second, thousands of "scambling" websites target global audiences with rigged games and withdrawal fraud, using deposit bonuses to lure victims. Third, China-aligned APT groups deploy the PeckBirdy malware framework within fake casino and adult websites as command-and-control infrastructure, targeting education, government, finance and technology sectors across Asia. These operations exploit U.S. and European hosting providers through infrastructure laundering while maintaining bulletproof Asian hosting. The campaigns have escalated sharply since 2023, with PeckBirdy domains achieving zero detection rates on VirusTotal. All three types appear visually identical, creating detection challenges for security teams.

Brazilian banking malware operation REF9334 has been deploying KREMLIN toolkit since May 2025, targeting Brazilian financial institutions through malicious browser extensions. The operation uses multi-stage JavaScript loaders, custom C++ installers, and exploits Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs. Infrastructure leverages Ethereum smart contracts as dead-drop resolvers for dynamic C2 configuration. Seven distinct campaigns over 15 months show evolution from PULSAR RAT to REMCOS RAT delivery. Attackers impersonate twelve Brazilian banks through Portuguese-language lures, with transaction patterns clustering during São Paulo working hours. The malicious extensions intercept credentials, session tokens, and sensitive banking data through keylogging and request interception capabilities. Over 1,500 infections have been temporarily disrupted through network canary registration, with 98.75% of victims located in Brazil.

BambooToken is an emerging multiplatform malware family active since at least February 2023, utilizing the Message Queueing and Telemetry Transport (MQTT) protocol for covert command and control operations. The campaign targets Windows and Linux systems across Asia and South America, with infections observed on backend servers for mobile applications, legal and financial services, software companies, hotels, and GitLab instances. The malware leverages sideloading techniques through Tendyron's OnKey authentication software, commonly used in Chinese banking and government networks. Analysis reveals extensive host enumeration capabilities, plugins for antivirus detection, and potential keylogging and clipboard theft functions. Infrastructure analysis shows C2 domains ranking in Cloudflare's top 500,000, indicating widespread infections. The actor demonstrates sophisticated operational security, using MQTT's publish-subscribe architecture to hide infrastructure and employing Cloudflare proxies for additional o...

In July 2026, IIJ discovered and analyzed an unknown .NET-based malicious tool hosted on a public directory. This tool, named PIVOTPIPE, exhibits functionality similar to Cobalt Strike Beacon, communicating with C2 servers using configurations close to default profiles and supporting numerous C2 commands. However, PIVOTPIPE differs from official Cobalt Strike Beacon through unique implementations including detection evasion code, custom loaders, and obfuscated strings. The tool consists of two components: a loader and RAT module. The loader implements AMSI bypass, indirect syscalls, and sleep masking for EDR evasion. PIVOTPIPE supports TCP Beacon and SMB Beacon functionality for peer-to-peer communication through compromised hosts. Debug artifacts suggest the tool was still under development at the time of discovery, indicating potential future enhancements.

Mythic is an open-source collaborative command-and-control framework with plugin-based architecture supporting multiple agent types and transport profiles. It features a web-based operator interface used by red teams for authorized engagements, though threat actors have also deployed it in unauthorized intrusions. Analysis identifies 131 unique hosts exposing Mythic on the public Internet, with 115 carrying default certificate configurations. The infrastructure spans predominantly DigitalOcean, AWS, and Azure environments, concentrated in the United States, Hong Kong, and China. Default deployment artifacts including TLS certificates with O=Mythic subjects, port 7443 responses, and internal PKI chains enable detection. Multi-framework clusters suggest training environments, while isolated deployments with custom domains and staged payloads indicate operational use with Discord-based transports and steganographic techniques.

A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seven countries, successfully compromising organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Activities included source code theft, credential collection, SSH persistence, and lateral movement, with one case escalating from a vulnerable Gitea server to root access across a three-node Proxmox cluster. An exposed staging server revealed targeting taxonomies using Simplified Chinese labels covering defense, elections, energy, aerospace, telecommunications, and government sectors. The campaign deployed JITTERLY, a C++ Linux implant with 30+ post-exploitation commands, embedding SIXZUT, a previously undocumented LD_PRELOAD rootkit capable of hiding files, processes, and network connections while protecting the implant from termination.

Cybercriminals have created numerous fake websites mimicking Bitrefill, a legitimate cryptocurrency-based gift card and eSIM retailer. These fraudulent sites appear in search engine results and use lookalike domains incorporating the Bitrefill brand name with added words or character substitutions, including internationalized domain names using Punycode. Victims are guided through convincing checkout processes that replicate Bitrefill's legitimate payment flow, complete with cryptocurrency options, QR codes, and countdown timers. However, payments are sent directly to attacker-controlled cryptocurrency addresses rather than Bitrefill, with virtually no chance of recovery. The operation demonstrates sophisticated measurement using commercial analytics software to optimize conversion rates, indicating organized criminal activity rather than opportunistic fraud.

A cybercriminal group dubbed GrelosGTM has been exploiting Google Tag Manager's legitimate functionality to compromise e-commerce websites. First detected in early April 2020, the group evolved their tactics by February 2021 to inject malicious Google Tag Manager scripts into targeted sites. The campaign affected at least seven websites running Magento CMS across Belgium, Italy, the United Kingdom, and the United States. Attackers inject custom Google Tag Manager scripts that load multi-stage JavaScript payloads through WebSocket connections. The final payload deploys a heavily obfuscated JavaScript sniffer designed to steal customers' payment card information during checkout using fake payment forms, with stolen data exfiltrated to attacker-controlled servers.

An exposed directory on a Thai server revealed an active intrusion campaign targeting 3BB (Triple T Broadband), one of Thailand's largest broadband providers. The attacker exploited CVE-2024-21762 in a FortiGate 60F SSL-VPN appliance to gain initial access, then deployed MeshCentral remote management software for persistent command-and-control. The operation involved extensive reconnaissance, credential harvesting targeting RADIUS authentication databases, privilege escalation using PwnKit and Dirty COW exploits, lateral movement via SSH brute-forcing across 55+ internal hosts, and anti-forensic cleanup procedures. Multiple devices were already enrolled under attacker control at discovery, with additional targeting of Jasmine International infrastructure. The attacker's toolkit included web application exploitation scripts, database credential extraction tools, and persistence mechanisms designed to maintain long-term access to subscriber authentication systems.

A malicious browser extension called 'Twitch Enhanced Viewer | JeetBot' distributed on Chrome Web Store and Firefox Add-ons captures and forwards users' live Twitch OAuth session tokens to Russian-controlled proxy servers. The extension, with approximately 30,000 Chrome users and 552 Firefox users, markets itself as a quality-of-life tool for blocking ads and unlocking streams. While delivering these features, it secretly extracts users' account-scoped OAuth tokens and forwards them as query parameters to operator-controlled infrastructure. Current versions append tokens inline during video playlist redirects, while earlier builds explicitly POSTed tokens to dedicated collection endpoints. The operator is identified as a commercial Russian bot service called JeetBot, with infrastructure hosted across German and cloud providers.

KATARU is an IoT malware variant discovered in August 2026 through Telnet credential brute-forcing against a honeypot from Vietnam. While maintaining traditional Mirai-style botnet capabilities, it distinguishes itself through an extensive feature set including multiple Linux local privilege escalation exploits, comprehensive persistence mechanisms across Linux and embedded platforms, encrypted C2 communications using X25519 and ChaCha20-Poly1305, anti-analysis techniques, and decoy traffic generation. Implementation artifacts strongly suggest AI-assisted development, evidenced by architecture-mismatched x86 shellcode in ARM binaries, RFC test vectors as configuration values, and untested cross-platform persistence logic. The malware attempts various privilege escalation paths through system misconfigurations and public exploits, establishes persistence across numerous startup mechanisms, and supports multiple DDoS attack vectors alongside SSH brute-forcing capabilities.

LegionLoader malware is being distributed through ClickFix tactics using fake Cloudflare CAPTCHA pages. Two primary distribution methods have been identified: one exploits Korea's Newlywed Hope Town Namu Wiki page with malicious URLs, while the other uses spear phishing emails targeting specific companies disguised as internal business system account issuance instructions. When users access these malicious URLs, they are redirected to fake CAPTCHA pages that trick them into executing PowerShell commands, which download and execute LegionLoader. The malware sequentially decrypts encrypted shellcode and PE files, evaluates the infection environment through display device checks and ASN verification, then executes backdoor malware capable of running various payloads including PE files, shellcode, PowerShell scripts, and MSI files. It also steals Chrome browser credentials and profile information based on C2 server commands.

Gen Threat Labs identified CVE-2026-51990, a critical remote code execution vulnerability in Sogou Input Method, a widely-used Chinese-language input editor with hundreds of millions of installations. The exploit chains three weaknesses: unvalidated command-line argument injection in the sgbiz: custom protocol handler, unrestricted URL navigation in a CEF-based webview, and a severely outdated unsandboxed Chromium browser engine from 2020. UNC3569 actively exploited this vulnerability in the wild, using a crafted link to deploy the GRAYRABBIT backdoor. The attack required only a single click, with the exploit leveraging CVE-2021-38003 to achieve code execution. The backdoor included anti-sandbox techniques, self-deletion capabilities, and command-and-control functionality. Tencent patched the vulnerability within twelve days of disclosure, though underlying browser components remain outdated and unsandboxed.

Active exploitation of three critical vulnerabilities in JFrog Artifactory has been identified, with attackers chaining CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 to bypass authentication and gain administrative control. CVE-2026-42018 exposes internal anonymous-user tokens, CVE-2026-42016 enables privilege escalation through insufficient token validation, and CVE-2026-82329 allows unauthenticated access to administrative privileges. Post-exploitation activities include creating persistent administrator accounts, deploying malicious Groovy plugins for code execution, and installing Rust-based backdoors. Exploitation was observed between August 15 and September 8, 2026, affecting multiple organizations. Data indicates 67-69% of organizations running Artifactory had vulnerable instances at initial publication, with slow patching velocity for lower-severity CVEs despite active exploitation across environments.

Threat actors exploited trusted brands and cloud services in a sophisticated web campaign combining fraudulent DocuSign workflows, Florida healthcare screening lures, and deceptive cloud infrastructure to deploy ConnectWise ScreenConnect Access clients. The attack utilized Cloudflare Pages hosting with fake Cloudflare verification workflows to establish legitimacy. Victims were socially engineered to download a ZIP archive containing a malicious HTA file that employed Base64-encoded VBScript, fake Adobe interfaces, UAC privilege escalation, and Microsoft Defender SmartScreen registry modifications. The attack leveraged living-off-the-land techniques using native Windows tools like mshta.exe, curl.exe, and msiexec.exe for silent ScreenConnect installation, ultimately providing unauthorized remote access. The campaign was classified as Zero Hour Fraudulent and blocked at the web entry point before payload delivery could occur.

Threat actors are leveraging generative AI to enhance financial fraud campaigns targeting enterprise organizations. Between August 3-5, over one million phishing emails were distributed through third-party infrastructure, primarily targeting US-based organizations (87.7%). The attacks employed sophisticated executive impersonation, specifically CEOs and CFOs, combined with fabricated ServiceNow invoices requesting ACH transfers of approximately $50,000. The campaign demonstrated multiple AI-assisted indicators including extensive HTML comments, structured section labeling, and uniform template construction. Attackers registered lookalike domains and created elaborate forwarded email threads between spoofed executives to establish legitimacy. The fraudulent invoices contained detailed branding, personalized recipient information, and specific payment instructions to attacker-controlled bank accounts. Multiple layered social engineering techniques were deployed to reduce recipient skepticism and convince acc...

Three years after its initial discovery, the Melofee Linux implant has evolved with sophisticated new capabilities. The malware now features modularized architecture with hot-loadable components for shell functionality, file management, and command execution. New versions incorporate remote C2 infrastructure reconfiguration and enhanced stealth through a kernel rootkit based on the Reptile project. The implant uses RC4 encryption and supports multiple communication protocols including TCP, HTTP, HTTPS, and TLS. Analysis reveals two infrastructure clusters utilizing fake certificates impersonating Symantec and other entities. Code similarities establish links with Windows-targeting implants including CrowDoor, Hemigate, and RatelS, suggesting tool sharing among multiple Chinese state-linked threat groups. The modular design allows dynamic loading of up to eleven specialized modules via a common plugin interface.

In June 2026, a new malware family named SloppyRAT was identified, likely used by ransomware-related threat actors to establish footholds for lateral movement. Delivered through multi-stage ClickFix infection chains, the malware features encrypted code blocks, EtherHiding for command-and-control resolution via Polygon JSON-RPC protocol, and multiple anti-analysis techniques including junk code and indirect system calls. SloppyRAT implements certificate pinning to prevent TLS traffic inspection and includes 47 built-in PowerShell-like commands for remote access. The infection chain uses finger.exe, IronPython, and deploys CastleLoader and CastleRAT components before installing SloppyRAT. Despite sophisticated capabilities, the codebase contains numerous software bugs affecting persistence mechanisms and other features, suggesting active development.

In August 2026, a Casbaneiro campaign targeted Latin American users through phishing emails and PDFs themed as fake invoices and legal notices. The multi-stage infection chain includes HTA downloaders and AutoIt loaders, employing geofencing to filter victims by IP address location. The malware exhibits sophisticated evasion techniques, including distributed data-receiving servers, deliberate HTTP 403 responses, and activation only when victims access targeted banking websites. Casbaneiro steals email data, performs clipboard injection, and creates fake windows for fraudulent activities. The campaign specifically targets Argentina, Peru, Colombia, and Mexico while avoiding German, French, and English language systems. The malware splits stolen data across multiple servers and uses malformed HTTP packets to complicate detection and analysis efforts.

A widespread IT impersonation and voice-phishing campaign designated PREY-0058 is actively targeting Microsoft 365 and SaaS platforms. Threat actors impersonate IT helpdesk staff via phone or text to trick executives and senior personnel into divulging credentials through adversary-in-the-middle phishing portals. After bypassing multi-factor authentication, attackers conduct rapid automated data exfiltration across email, file storage, and cloud repositories without deploying ransomware. The operation relies heavily on NodeMaven residential proxy infrastructure to blend with legitimate traffic. Extortion demands are delivered via TOX messaging within hours of compromise, typically with 72-hour deadlines and threats of public data exposure. The campaign exhibits tradecraft overlapping with UNC6671 and involves multiple extortionware brands including BlackFile, Redact, Pink, and Helix.

Djinn Stealer is a cross-platform information stealer delivered as a second-stage payload by the TaskWeaver Node.js loader. It employs a rules-based collection engine to harvest credentials and configuration data from cloud platforms, source control systems, package registries, infrastructure tooling, AI development assistants, browsers, SSH, and cryptocurrency wallets. The stolen data is archived, encrypted, and exfiltrated to attacker-controlled infrastructure. This threat has been observed following exploitation of the SimpleHelp vulnerability CVE-2026-48558. The stealer executes within a Node.js runtime context and communicates with command-and-control servers using encrypted channels for data exfiltration.

In September 2026, two Chinese threat actors, UTA0560 and JungleBamboo, were observed exploiting an identical Chrome zero-day vulnerability chain targeting NGOs and other organizations. The exploitation leveraged CVE-2026-85046 and CVE-2026-87491 in Chrome alongside CVE-2026-85880 in Windows kernel. These vulnerabilities had been patched in Chromium source code but not yet released to Chrome users, creating a patch-gap exploitation window. UTA0560 conducted spear-phishing campaigns using financial lures to deliver GRIMWEDGE JScript backdoor for reconnaissance and command execution. JungleBamboo employed generic phishing themes to deploy SUPERSTOMP loader, which installed the LONGTALE Chrome extension designed for credential theft, keylogging, and surveillance. Both actors used byte-for-byte identical shellcode, suggesting a shared exploit supply chain while deploying distinct post-exploitation tools tailored to their operational objectives.

Six Chrome and Firefox extensions linked through shared code, C2 infrastructure, and publishing history have been identified targeting cryptocurrency traders. Four malicious extensions steal authenticated session tokens and wallet data from Axiom Trade and Padre users, while two earlier extensions reveal a pattern of repackaging crypto trading tools. The extensions J7Tracker, VREO, and Orbit Tracker automatically retrieve user information, wallet bundles, Firebase tokens, and application state, then exfiltrate data to threat actor-controlled Vercel deployments. The campaign targets an active trading community with Axiom processing over $15 billion in volume across 650,000 wallets. The malicious code runs inside authenticated sessions, collecting localStorage, IndexedDB data, and API responses containing authentication tokens and wallet keys. Data is Base64-encoded and transmitted via browser navigation to avoid CORS restrictions, enabling account compromise and cryptocurrency theft.

The Adversary Pursuit Group identified a sophisticated exploitation campaign targeting internet-facing PaperCut servers using CVE-2026-81578 and CVE-2026-82078. Analysis uncovered exposed operator infrastructure revealing an AI-assisted workflow spanning vulnerability research, proof-of-concept development, target sourcing, and campaign execution. Timestamped state files documented an iterative process where AI agents preserved project context, managed failures, and refined exploitation across hundreds of systems. The campaign processed over 500 targets using 200 concurrent threads across 100 retry rounds, implementing geographic filtering, reachability checks, and stage validation. The operation demonstrated how AI reduces human effort in research, debugging, classification, tracking, and continuous improvement rather than inventing novel techniques. Post-exploitation activities included administrator creation, credential collection, Active Directory discovery, and proxy deployment.

A sophisticated mobile threat linked to Indonesian actors combines ransomware and spyware capabilities in a single attack vector. The malware is distributed via third-party file-sharing platforms through social engineering, targeting Android devices. It requests extensive permissions including device administrator, SMS, contacts, and accessibility access. The threat encrypts files using AES on Android 9 and earlier, appending .enc extensions, while stealing sensitive data including screen recordings, browser history, PINs, contacts, call logs, SMS messages, WhatsApp and Telegram chats. It establishes C2 communication via HTTPS and WebSockets using dynamic domain resolution through GitHub. Version 2 introduces UI hijacking, screen blocking, touch input interception, harassment features, and remote text-to-speech capabilities. The malware exfiltrates data through Firebase and Catbox services, enabling double-extortion through an interactive chat portal for ransom demands.

Multiple cloud accounts have been compromised through passkey-themed social engineering campaigns since May 2026. Attackers impersonate IT helpdesk staff via phone calls or SMS, directing victims to phishing sites that mimic Microsoft sign-in pages. After obtaining credentials through adversary-in-the-middle or device code authentication flows, attackers establish persistence by adding unauthorized MFA methods. They then conduct extensive reconnaissance using Microsoft Graph API to map users, groups, permissions, and resources. The intrusion culminates in high-volume data collection from SharePoint, OneDrive, and Exchange using automated tools, with exfiltration occurring over hours or days at controlled rates to avoid detection.

Cisco Talos is tracking active exploitation of two vulnerabilities in Secure Firewall Management Center (FMC) Software. CVE-2026-20079 is a critical authentication bypass vulnerability allowing remote attackers to execute scripts and obtain root access. CVE-2026-20316 enables remote login using low-privileged accounts and can be chained with other vulnerabilities for privilege escalation. Three distinct threat actor clusters have been identified conducting post-compromise activities: UAT-12197 deployed web shells and credential theft tools; UAT-11823, overlapping with Russian APT Sandworm, deployed Cyclops Blink malware and established reverse shells; UAT-11988, a Qilin ransomware operator, conducted extensive reconnaissance, credential harvesting, and deployed ransomware after establishing persistent network access through tunneling tools. Customers are strongly advised to apply available hotfixes immediately.

Gigabud is an Android remote access banking trojan active since 2022, attributed to GoldFactory group, targeting victims across Southeast Asia, South Asia, Middle East, Africa and Latin America. The malware now utilizes Vwork, a weaponized fork of the open-source app cloning application Shelter, to evade detection by creating isolated work profiles. After initial Gigabud infection, Vwork is installed to clone banking applications into the work profile, hiding malicious activity from signature-based detection in application security SDKs. Between February and July 2026, approximately 1,469 compromised devices and 1,281 potentially compromised logins were observed in Indonesia alone, with estimated losses of roughly $960,939. The infection chain involves social engineering through phishing sites delivering fake apps disguised as legitimate services, followed by credential theft through overlays and remote-controlled fraudulent transactions executed within cloned banking apps.

Threat actors are exploiting anticipation for Grand Theft Auto VI by distributing malicious ISO files disguised as leaked game versions. These fake installers are spread through SEO poisoning, gaming forums, social media, and torrenting sites. The analyzed ISO contains multiple malicious components including several RAT variants (NJRAT and DCRAT), Mercurial Grabber infostealer, Chaos ransomware functioning as a wiper, and Yandex Browser. When executed, the fake installer displays Russian-language messages and deploys malware to %TEMP% folders. The package includes data exfiltration capabilities, credential theft, system control features, and destructive file encryption. Based on Russian language usage throughout the infection chain, the campaign appears to target Russian-speaking gamers. The malware components date back to 2023, suggesting repurposed tools for this opportunistic attack.

Two sophisticated phishing campaigns employed browser-in-the-browser (BiTB) techniques to deceive victims into installing rogue ScreenConnect remote management tools. Attackers sent phishing messages with malicious links redirecting targets to fake Adobe Reader update pages. The BiTB technique created convincing fake browser windows within webpages, displaying legitimate-looking Adobe URLs to bypass user awareness training. Victims were tricked into downloading ScreenConnect installers disguised as Adobe software updates. Each incident resulted in deployment of multiple rogue ScreenConnect instances for redundant persistence, followed by execution of defense-evasion binaries (HideCursor.exe and HideUL.exe) designed to hide attacker activities. The attacks established service-based persistence through Windows services, enabling continued remote access. Both campaigns were intercepted before further damage occurred, demonstrating how threat actors combine social engineering throughout the entire attack chain...

A likely Russian-speaking malicious cyber actor leveraged artificial intelligence to orchestrate a global campaign exploiting PaperCut NG/MF print management software via CVE-2026-81578 and CVE-2026-82078. Using AI agents powered by DeepSeek models and OpenAI's Codex, the adversary moved from empty workspace to first remote code execution in under four hours, compromising at least 440 PaperCut instances across 395 organizations in 48 countries. The campaign originated from IP 45.142.193.132, which had been tracked since July 2026 for attacks against various technologies. The adversary developed and tested exploits in a self-hosted lab environment before launching coordinated attacks using AI agents to achieve rapid compromise, with the fastest domain admin access achieved in just five minutes. Domain administrator access was confirmed in 12 organizations, primarily affecting educational institutions in the United States.

Four espionage-motivated threat actors have been observed deploying the BlueMoon exploit kit, which chains Chrome browser and Microsoft Windows vulnerabilities. The initial adopter was China-aligned TA412 on 28 August 2026, followed by several other suspected China-nexus groups within days. The exploit chain targets CVE-2026-85046 (Chromium V8 type-confusion), a V8 sandbox escape, and CVE-2026-85880 (Windows kernel LPE affecting older builds). Both V8 vulnerabilities were patch-gap zero-days, with fixes available in upstream Chromium but not yet deployed in stable releases. The rapid adoption by multiple actors and low operational security suggest rushed deployment ahead of anticipated patches. Evidence including extensive logging, verbose comments, and markdown references indicate potential AI-assisted development. BlueMoon's ease of adoption suggests further proliferation among espionage and financially motivated actors is likely.

A massive cybercrime campaign tracked as CL-CRI-1171 has operated undetected for at least two years, utilizing a pay-per-install marketplace to distribute multiple malware families. The operation targeted primarily young gamers through YouTube channels with hundreds of thousands of followers, while simultaneously using SEO poisoning to compromise corporate endpoints including critical infrastructure and government entities. The campaign employed OfferLoader, a custom loader capable of delivering unique payload combinations through sophisticated gating mechanisms. Three distinct malware families were identified: Insomnia RAT, a cross-platform backdoor targeting Windows and macOS; ARKTunnel, a WebSocket tunneling tool hidden via steganography; and Docro Hijacker, a Chrome browser hijacker. Over 10,000 distinct loader samples were discovered, indicating a much larger deployment campaign affecting numerous organizations globally.

This analysis examines a sophisticated Vidar infostealer variant that employs a custom virtual machine to obfuscate its malicious code through proprietary bytecode interpretation. The malware implements extensive anti-analysis measures including debugger detection via NtQueryInformationProcess and RDTSC timing checks, sandbox evasion by identifying antivirus processes and checking system resources, and environment fingerprinting. Vidar targets credentials from web browsers including Chromium and Gecko-based extensions, Azure authentication tokens, FileZilla FTP credentials, and captures screenshots. It utilizes SeDebugPrivilege for elevated access, creates hidden desktops for browser automation, and exfiltrates stolen data through Telegram channels. The malware performs cleanup operations to remove execution artifacts and proxies DLL execution through rundll32.exe to blend with legitimate Windows processes.

An exposed directory at 188.245.99.156 revealed a comprehensive cryptomining toolkit containing 147 files including Python exploit source code, campaign logs, and Windows registry hives. Analysis confirms 3,562 Redis servers were compromised across two campaign runs targeting 12,966 hosts. The operation exploited unauthenticated Redis instances using rogue replication techniques to inject cron jobs that deployed XMRig miners. Victims spanned Redis versions 2.8.17 through 7.2.0 across outdated and current Linux distributions, indicating misconfiguration rather than version-specific vulnerabilities. The toolkit also targeted WordPress, MongoDB, and SSH but achieved zero confirmed compromises through those vectors. A separate February 2026 open directory linked by wallet reuse revealed Meterpreter deployment capabilities, extending the operator's known activity timeline by five months. The operation mined Monero through pool.moneroocean.stream with the same wallet used on the operator's own Windows-based work...

Hagaseca is an Android malware cluster linked to exposed Android Debug Bridge (ADB) services, focusing on the THost9 RAT loader variant. The malware conceals executable code within an APK that loads tc9.dex, a stage providing shell access, file transfer, and ADB propagation capabilities. Public incidents connect THost4 and THost9 to exposed Android and Redroid systems from October 2024 through 2026. The loader uses XOR and gzip packing, establishes persistence through foreground services, exploits accessibility features for device control, and downloads additional stages from test.hagaseca.com. The tc9.dex stage implements remote administration, discovers ADB endpoints via mDNS, scans entire /16 networks, authenticates with prepared keys, and installs itself on vulnerable systems. The malware exhibits worm-like behavior, spreading opportunistically through unsecured ADB services exposed to the internet, particularly affecting Redroid container deployments and devices with public ADB over Wi-Fi.

MacSync Stealer is a macOS information stealer and remote-access stager delivered through ClickFix social engineering and malvertising campaigns. Operating under a malware-as-a-service model, it employs sophisticated evasion techniques including process daemonization, single-byte XOR obfuscation, and in-memory AppleScript execution to bypass Apple Gatekeeper, XProtect, and EDR solutions. The malware exfiltrates credentials, browser data, cryptocurrency wallets, and SSH keys through fault-tolerant 10MB chunked uploads to command-and-control infrastructure. MacSync targets professionals in software engineering, cryptocurrency, fintech, and corporate environments across North America, Europe, and Asia-Pacific regions, with campaigns impersonating legitimate services like Google Meet, Claude AI, Docker, and TradingView to trick victims into executing malicious Terminal commands.

An investigation revealed a sophisticated cryptocurrency and credential-stealing operation using Amatera stealer as the primary payload. The attack chain leverages Cloudflare Workers to inject JavaScript stored on BNB Smart Chain, presenting fake Google CAPTCHA prompts that lead to WebDAV-based DLL execution. Two parallel infection chains were identified, one loading through a DLL named 'pf.ch' and another through 'verification.google', both delivering Amatera stealer with different secondary payloads. The 'pf.ch' variant deployed ZigCryptoStealer via NativeAOT loader and a Go-based reverse proxy, while the 'verification.google' variant installed NetSupport Manager with C2 infrastructure in Russia. The operation affects numerous countries with primary focus on stealing cryptocurrency wallets, credentials from password managers, and various authentication data through extensive collection rules targeting over 400 applications.

Cybercriminals are exploiting legitimate Google infrastructure in a sophisticated phishing operation that bypasses email security gateways and enterprise firewalls. The attack chains together six distinct Google properties including Meet, Search, DoubleClick, Custom Search, Tag Manager and Analytics to proxy malicious traffic through trusted domains. Victims' email addresses are encoded in URL fragments and stripped before server-side logging. Landing pages dynamically impersonate target organizations by pulling live logos from Clearbit, capturing real-time website screenshots, and validating domains via Google's DNS API. The operation includes multilingual support for 16 languages and dual execution tracks: credential harvesting with immediate Telegram exfiltration, or silent ScreenConnect remote access tool installation. Lures span document reviews, credential expiry notices, package delivery, payment notifications, government benefits and voicemail themes targeting manufacturing, government, finance and...

An unpatched zero-day vulnerability dubbed StyleSmuggler affects all current versions of Magento and Adobe Commerce, including 2.4.9, enabling unauthenticated remote code execution. Active exploitation began on September 4th, 2026. The attack operates in two stages: injecting malicious PHP code into Magento's template system using styles properties to evade safeguards, then executing the poisoned code via failed payment emails. Upon successful compromise, attackers deploy a Rust-based backdoor disguised as legitimate system processes (kworker, fc-cache, or chronyd) that connects to command and control servers. The backdoor uses NTP-shaped UDP traffic for C2 communication to evade detection. A second unrelated attacker has also been observed exploiting the same vulnerability to deploy PHP web shells. Affected merchants should deploy immediate mitigation measures, scan for compromise, and temporarily disable GraphQL until an official patch is released.

In June 2026, researchers uncovered BigBear 2.0, a rebranded Evilginx2-based phishing-as-a-service framework targeting Microsoft 365 credentials globally. The operation, managed by operator 'General Boss', deployed 42 VPS nodes primarily hosted on Vultr infrastructure, utilizing the 'offy' phishlet configuration. The platform employed adversary-in-the-middle techniques with geo-matched residential proxy pools across 69 countries, real-time Telegram exfiltration, and automated cookie replay to bypass MFA. The campaign exfiltrated 5,137 credential records including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies, affecting 3,331 unique victim IPs across 40+ countries. The multi-user PhaaS panel was leased to at least five identified affiliate operators. Custom JavaScript injections disabled FIDO2/WebAuthn MFA while residential proxies bypassed anti-bot detection, enabling persistent access to compromised Microsoft 365 environments.

PEEP is a Chromium-based post-exploitation toolkit disguised as 'Smart Bookmarks' that transforms Chrome and Edge browsers into persistent backdoors. Requiring prior administrative access, it bypasses Web Store security by forging Chromium integrity values and uses native-messaging to extend beyond browser telemetry to full host-level command execution. The malware beacons every 30 seconds over unencrypted HTTP, exfiltrating browsing history, cookies, credentials, and session data. Built on the open-source RedExt framework with significant enhancements, PEEP combines browser surveillance with filesystem manipulation, shell command execution, and process discovery. The infrastructure exposed development artifacts including source code, signing keys, and Traditional Chinese testing logs, indicating a Chinese-speaking operator using AI-assisted development. The toolkit demonstrates sophisticated persistence through HMAC forgery, enterprise policies, and ScriptCache manipulation.

The Kimsuky threat group continues Operation GitPower campaigns utilizing malicious LNK files disguised as financial and business documents. Thirteen LNK variants collected between August 11-19, 2026, employ GitHub Personal Access Tokens (PAT) for command-and-control communications, delivering obfuscated PowerShell loaders through custom decoders. Notable evolution includes anti-analysis routines detecting virtualization tools, Pastebin as alternative C2 infrastructure, and diversified decoy formats (PDF, XLSX, PNG). Metadata analysis reveals AI-generated content using the 'opencode' AI coding agent and HeadlessChrome PDF conversion, with placeholder text remaining unreviewed. The group maintains persistence through hidden scheduled tasks masquerading as legitimate software (BitLocker, MATLAB), while hardcoded GitHub PATs enable raw content retrieval. Despite increased sophistication in evasion techniques and decoy production automation, endpoint behaviors remain detectable through behavioral correlation a...

An emerging infostealer tracked as REVSTEALER under REF2859 has gained significant momentum with approximately 4,700 samples identified over the past year. The malware features comprehensive credential harvesting capabilities targeting browsers, VPN applications, password managers, cryptocurrency wallets, and gaming platforms. It incorporates sophisticated anti-analysis mechanisms including a weighted sandbox scoring system and uses Polygon blockchain-based dead drops for resilient infrastructure management. Distribution occurs primarily through social engineering campaigns targeting gamers via compromised YouTube channels advertising fake game cheats, though samples also impersonate legitimate software like Slack and qBittorrent. The malware delivers four additional modules extending capabilities to include wallet theft, clipboard manipulation, reverse proxy functionality, and cryptocurrency mining deployment. Most samples employ VMProtect packing and feature an App-Bound Encryption bypass using debugger-...

In March 2026, a sophisticated SEO poisoning campaign was identified leading to malware distribution and tech support scams. Operating since at least 2015, this operation is attributed to individuals and IT service providers in Rajasthan, India, collectively tracked as BengalSEO. Two primary entities were identified: WeConnect Solutions LLC operates tech support call centers, while Garage2Global develops malicious web infrastructure. The group leverages extensive black hat SEO techniques including backlink generation, DOM injection, and keyword stuffing to promote lure pages mimicking legitimate technical support portals. A custom Traffic Distribution System routes victims through rotating redirector domains, utilizing Matomo analytics for tracking and fingerprinting. The operation deploys custom malware named MayaBot to further enable scam activities. Infrastructure analysis revealed hundreds of domains registered primarily through Spaceship and Namecheap, hosted via Cloudflare and Hostmaza, with GitHub e...

StyleSmuggler is an unpatched zero-day vulnerability affecting all current versions of Magento and Adobe Commerce, including version 2.4.9, enabling unauthenticated remote code execution. Active exploitation began on September 4th, 2026. The attack operates in two stages: injecting malicious PHP code through the styles properties to evade safeguards, then executing it via failed payment email templates. The vulnerability exploits Magento's GraphQL endpoint and template system. Attackers deploy backdoors disguised as legitimate system processes, establish command and control through multiple domains using WebSocket over TLS and custom NTP-shaped traffic. Affected merchants should deploy protective measures, scan for compromise indicators including suspicious background processes, and consider temporarily disabling GraphQL until an official patch is released.