Fake AI Tools Deliver Infostealer

In April 2026, a Malware-as-a-Service NodeJS infostealer campaign evolved its delivery methods, shifting from ClickFix social engineering to weaponized GitHub repositories. Attackers clone legitimate AI-related repositories and developer tools, subtly embedding malicious payloads that target developers and AI users. The campaign employs SmartLoader in a redundant two-stage loader chain, with both stages using EtherHiding to resolve C2 addresses from Polygon blockchain smart contracts at runtime. This technique enables operators to redirect all implants by updating blockchain values without code modification. The first stage uses Prometheus-obfuscated Lua scripts, while the second stage likely uses MoonSec obfuscation. Victims are primarily located in North America, Asia, and Southern Europe, with financial services, banking, and technology sectors most affected. The campaign delivers various infostealers including previously documented NodeJS variants, specifically targeting developers' elevated privileges...

• RemusStealer: EtherHiding In Hidden WindowsMalware2026-10-02
• Disposable Domains, Durable HostingMalware2026-09-23
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• September 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-30
• September 2026 Infostealer Trend ReportMalware2026-10-28