SkyW4lker is a phishing kit that targets Microsoft 365 users, primarily in the United States and Europe. It abuses Microsoft's device-code authentication flow to gain access to corporate accounts without stealing passwords or bypassing MFA. The kit uses password-protected email attachments containing links that lead victims through CAPTCHA challenges to Microsoft's legitimate authentication system. Activity increased notably between June and October 2026, with the US accounting for nearly half of the observed submissions. The kit shares infrastructure and code with the Gabagool phishing kit, indicating a common threat actor.
The BOSSAI campaign involves a single operator using a mesh of 12 AI agents to conduct persistent attacks across 11 countries. The attacker leveraged both abliterated and commercial AI models in specialized roles such as infrastructure building, vulnerability scanning, and exploitation. Primary targets included emergency services, universities, financial institutions, and government systems in Taiwan, Thailand, and Mexico. Confirmed breaches include exfiltration of medical records from Taipei emergency services, student data from Thai universities, and over 200,000 Mexican residential phone records. Despite attempts to jailbreak commercial AI models, the attacker relied on less effective abliterated models. The investigation uncovered the full operational infrastructure, including command histories and victim data, highlighting both the capabilities and limitations of AI-augmented autonomous exploitation.
Star Blizzard is a Russian espionage group linked to the Federal Security Service Centre 18, targeting government, defense, NGOs, and academia mainly in the UK, US, Ukraine, and NATO countries. The group uses spear-phishing, impersonation, and relationship building to steal credentials and conduct hack-and-leak operations. Since 2024, they have expanded to deploying endpoint malware including SPICA, YESROBOT, MAYBEROBOT, and CosmicPulse backdoors. Their tactics evolved from targeted to bulk phishing campaigns using fake CAPTCHA lures and exploiting iOS devices with the DarkSword exploit kit. They also use compromised WordPress sites for infrastructure and rapidly develop new malware variants after exposure. Recent campaigns have targeted over 100 organizations with the RedFlick delivery chain, showing increased scale and sophistication.
Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 and highly prolific by 2025 with over 1,000 victims. It uses a flexible platform enabling affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure, including ESXi hosts. Initial access is commonly gained via phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools. The group employs a double-extortion model, encrypting data and threatening to publish stolen information on their blog and WikiLeaksV2 platform. Notable incidents include the 2024 Synnovis attack impacting UK healthcare services. Qilin is linked to other threat groups and has spawned derivative operations, some maintaining affiliate status while operating independent leak sites.
SkyW4lker is a phishing kit active since June 2026 that targets Microsoft 365 authentication by exploiting OAuth 2.0 device-code flows to bypass MFA. It uses password-protected email attachments leading victims through CAPTCHA pages to malicious sites requesting device codes. The kit primarily targets US firms, especially in technology, manufacturing, and government sectors, and shares infrastructure with the Gabagool phishing kit.
In October 2026, a Chinese-speaking threat actor conducted a global AI-assisted hacking campaign using the ARTEX penetration testing framework combined with multiple AI coding assistants. The attacks targeted organizations across finance, retail, education, cryptocurrency, and telecommunications sectors in over 20 countries worldwide. The campaign utilized custom scripts to maintain context across AI sessions and divided tasks among specialized AI agents. The attackers sought bulk personal data, transaction records, and mobile phone numbers, with indications of intent to sell stolen information on underground markets. The workflow included peer review among AI models to improve effectiveness. The campaign is financially motivated and opportunistic in nature.
Infoblox attributes the Help Traffic Distribution System (TDS) to Hotejka, a small Russian-language affiliate program believed to be a rebrand of ROI777, which was exposed in 2018. Operating since April 2017, this TDS delivers tech support scams directing users to call centers where social engineering convinces victims to install remote desktop tools like UltraViewer, enabling persistent access for malicious activities. Hotejka's affiliates include Balada Injector, Detour Dog, and DollyWay, who redirect traffic through compromised websites, malvertising, social media, and spam. Since April 2026, operations have leveraged free Cloudflare Pages infrastructure, creating approximately 300 new domains daily. Infoblox developed predictive detection capabilities that identify malicious domains seven days before deployment, successfully detecting over 16,000 domains and reducing customer exposure from 4% to 0.5%. The scam employs browser locks with alarming warnings impersonating Microsoft, ultimately leading vict...
Operation Master is a sophisticated cybercrime campaign exploiting a GlobalProtect authentication bypass vulnerability (CVE-2026-0257) to compromise enterprise networks across multiple countries. The attackers conducted extensive network scanning to identify high-value targets, executed SQL injection attacks with privilege escalation to steal databases, and exfiltrated Active Directory credentials. They monetized stolen data by selling it on underground forums and operating a multi-tenant automated invoice fraud platform that sent millions of phishing messages and fraudulent links. The operation employed advanced phishing techniques including M365 OAuth device-code phishing and voice-based credential harvesting, with payments collected via PIX through serverless proxies.
RemControl is an Android banking trojan first observed in July 2026 that targets financial institutions across Western Europe, the Middle East, and Canada. The malware is distributed through fake Google Play Store pages advertising TVTap, an IPTV application, using malvertising campaigns with geo-targeted delivery. Once installed, the dropper creates a local VPN to block Play Protect checks and generates unique signing certificates per installation. RemControl exploits Android Accessibility Service permissions to display phishing overlays for over 30 banking applications, capturing PINs, mobile banking codes, and card details. The malware includes remote control capabilities, screen streaming, keylogging, and lock-screen pattern capture. It operates as Malware-as-a-Service with infrastructure showing evidence of AI-assisted development in phishing page creation and documentation.
A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. [...]
RemControl is an Android banking trojan operating as Malware-as-a-Service since May 2026. It targets over 30 financial institutions in Western Europe, the Middle East, and Canada via fake TVTap IPTV download pages distributed through malvertising. The malware abuses Android Accessibility Service to inject phishing overlays, stream device screens in real-time, log keystrokes, and enable full remote control. The criminal infrastructure was partially built using AI-generated content, including phishing pages and C2 panel documentation. The threat actor UNKK operates these campaigns, with possible links to the Medusa UNKN affiliate botnet.
EvilTokens was an AI-powered phishing platform that enabled cybercriminals to compromise over 12,000 email accounts across more than 10,000 organizations worldwide by abusing device code authentication flows. The platform used AI to craft targeted phishing messages, select victims, and extract valuable data from compromised accounts. Microsoft disrupted the platform by seizing infrastructure and arresting two suspects linked to its operation. The platform charged users for access and offered numerous phishing themes to increase success rates.
A Chinese-speaking threat actor group known as Red Heron exploited a recently disclosed remote code execution vulnerability (CVE-2026-60004) in Gitea, a self-hosted Git service, in a multinational campaign. The campaign targeted internet-facing Gitea instances across multiple countries, including Canada, Argentina, Taiwan, the United States, and Sri Lanka, focusing on sectors such as defense, elections, energy, aerospace, telecommunications, government, and research. The attackers used automated tools to steal source code, credentials, and maintain persistent access, including root-level control on some infrastructure. They deployed a novel Linux implant named JITTERLY with extensive post-exploitation capabilities and embedded a previously undocumented rootkit called SIXZUT to maintain stealth and persistence. The campaign demonstrates rapid weaponization of n-day vulnerabilities in development platforms and highlights significant risks to source code confidentiality and infrastructure integrity.
A threat actor exploited CVE-2026-15409, a critical unauthenticated server-side request forgery vulnerability in SonicWall SMA1000 appliances, to gain command execution and steal credentials. The attacker used a modified public proof-of-concept exploit to access internal Erlang services on the appliance, enabling remote code execution. This allowed extraction of LDAP configurations, Active Directory credentials, and deployment of tools to dump secrets from internal Windows systems. The campaign targeted at least 250 SonicWall SMA1000 devices across multiple countries and sectors, with confirmed credential theft in France, India, Italy, and the US. The attack leveraged compromised appliances as pivots into internal networks, exposing sensitive Active Directory data and enabling DCSync attacks against domain controllers. The targeting was opportunistic and technology-driven rather than sector-specific. The campaign was uncovered through an open directory left exposed by the attacker, providing a comprehensive view of the operation.
MacSync Stealer is a macOS information stealer and remote-access stager delivered through ClickFix social engineering and malvertising campaigns. Operating under a malware-as-a-service model, it employs sophisticated evasion techniques including process daemonization, single-byte XOR obfuscation, and in-memory AppleScript execution to bypass Apple Gatekeeper, XProtect, and EDR solutions. The malware exfiltrates credentials, browser data, cryptocurrency wallets, and SSH keys through fault-tolerant 10MB chunked uploads to command-and-control infrastructure. MacSync targets professionals in software engineering, cryptocurrency, fintech, and corporate environments across North America, Europe, and Asia-Pacific regions, with campaigns impersonating legitimate services like Google Meet, Claude AI, Docker, and TradingView to trick victims into executing malicious Terminal commands.
Three distinct implants—SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS—have been discovered embedded in ZBT router firmware distributed through a global supply chain reaching the United States, Canada, Australia, Philippines, Germany, and Russia. DARKLANTERN is an unauthenticated UDP backdoor listening on port 9992, offering root shell access from the internet with trivial MAC address bypass. SPEAKINGSTONE is a phone-home surveillance implant that beacons to ZBT's cloud infrastructure, capable of DNS hijacking, ISP credential theft, and remote command execution. A sinkholed backup domain revealed 392 devices, 390 located in China, primarily on China Mobile's network. Internet scans identified 203 DARKLANTERN instances across 22 countries. These implants use plaintext protocols without authentication, making them hijackable by any network adversary. The affected hardware appears in white-labeled consumer products sold through mainstream retailers, representing embedded surveillance capabilities in commerciall...
The Iranian-linked cyber-espionage group Tortoiseshell has expanded its malware toolkit with a new reverse SSH tunneling utility disguised as wtsapi32.dll and a C++ backdoor similar to TWOSTROKE malware. The SSH tunnel uses the Windows OpenSSH client to connect to command-and-control servers. The backdoor supports executing files, shell commands, in-memory DLL execution, and file manipulation. Infrastructure analysis shows domains linked to multiple countries including the UAE, Saudi Arabia, UK, Belgium, Canada, Australia, Japan, and the United States, indicating broader targeting beyond the Middle East and US defense and military sectors. The group has been active since 2018 and maintains persistent infrastructure despite domain suspensions. No known exploits in the wild or patches are reported.
This is a sophisticated global phishing campaign that abuses legitimate Remote Management and Monitoring (RMM) software to gain unauthorized remote access. Initially targeting Canadians with fake Canada Revenue Agency tax documents, it has expanded to 46 countries, with nearly half of the activity in the United States. Attackers impersonate trusted organizations and use advanced techniques such as password-protected archives, browser fingerprinting, and Telegram-based victim filtering. The campaign uses rapidly rotating infrastructure hosted mainly on Vercel, leveraging legitimate TLS certificates and domain reputations. Signed commercial RMM tools are abused, making traditional signature-based detection ineffective. The campaign has been active steadily since January 2026.
A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seven countries, successfully compromising organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Activities included source code theft, credential collection, SSH persistence, and lateral movement, with one case escalating from a vulnerable Gitea server to root access across a three-node Proxmox cluster. An exposed staging server revealed targeting taxonomies using Simplified Chinese labels covering defense, elections, energy, aerospace, telecommunications, and government sectors. The campaign deployed JITTERLY, a C++ Linux implant with 30+ post-exploitation commands, embedding SIXZUT, a previously undocumented LD_PRELOAD rootkit capable of hiding files, processes, and network connections while protecting the implant from termination.
