APT-C-60 continues targeting organizations in Japan with evolved tactics observed throughout 2026. The threat group employs spear-phishing emails containing Proton Drive links or direct attachments with RAR archives. Victims extract LNK files that execute JavaScript via mshta.exe, leading to multi-stage payload delivery. The attackers abuse legitimate services including GitHub, GitLab, jsDelivr, and Codeberg as infrastructure for hosting malicious components. Git.exe is leveraged to execute scripts that deploy downloaders and loaders, ultimately delivering SpyGlace malware versions 3.1.15 through 3.1.18. The attack chain involves multiple obfuscated JavaScript files and persistence mechanisms similar to previous campaigns. By utilizing developer-oriented services and CDNs commonly allowed in corporate environments, the threat actor attempts to evade detection and blend malicious traffic with legitimate communications.
Beginning in August 2025, a sophisticated intrusion was discovered where attackers used log poisoning techniques to deploy a web shell on vulnerable phpMyAdmin panels. The threat actors exploited misconfigured web applications to plant China Chopper web shells, controlled via AntSword, before deploying Nezha, an open-source monitoring tool, to facilitate remote command execution. This led to the deployment of Ghost RAT on compromised systems. Analysis revealed over 100 compromised machines, predominantly located in Taiwan, Japan, South Korea, and Hong Kong. The attackers demonstrated technical proficiency through multi-stage operations, utilizing AWS and VPS infrastructure, with indicators pointing to China-nexus threat actors. The campaign highlights increasing abuse of legitimate publicly available tools to achieve malicious objectives while maintaining plausible deniability.
Aflac, a major American insurance company, disclosed a data breach affecting its Japan subsidiary after unauthorized access to its systems. The breach occurred between June 15 and June 25, 2026, exposing personal, policy, coverage, and bank account information. The incident is limited to Aflac Japan's systems, with no access to U.S. operations reported. Aflac has taken containment measures, suspended affected systems, and is investigating with external cybersecurity experts. Japanese authorities have been notified, and affected individuals will be informed. The full scope and impact remain under investigation. This follows a previous breach disclosed by Aflac a year earlier, linked to a broader campaign targeting insurance companies.
In May 2026, security researchers observed an attack campaign distributing KimJongRAT through GitHub and other legitimate services. KimJongRAT, used by the North Korean APT group Kimsuky since 2013, combines information stealing and remote access capabilities. The infection chain begins with phishing emails containing shortened URLs redirecting to GitHub Releases hosting malicious ZIP files. Victims execute LNK files that download HTA files from GitHub, which then retrieve subsequent payloads from Google Drive. Recent variants demonstrate significant evolution: they now dynamically fetch C2 addresses from external sources rather than hardcoding them, enabling operators to maintain persistent access despite infrastructure takedowns. Additionally, new versions include MeshAgent RMM installation for redundant access. The campaign exemplifies Living Off Trusted Sites (LOTS) techniques, abusing legitimate platforms like GitHub, Google Drive, and Dropbox to evade detection.
Cybercriminals orchestrated a sophisticated malvertising operation leveraging Google Ads to impersonate popular AI developer tools including Claude AI, ChatGPT Codex, Perplexity, Cursor IDE, and JetBrains. Over seven weeks spanning April to June 2026, attackers deployed 106 unique malicious hostnames across six distinct waves, initially hosting ClickFix social engineering pages on GitLab infrastructure before pivoting to weaponize claude.ai's legitimate shared chat feature. The campaign targeted technically proficient users searching for AI development tools, tricking them into executing terminal commands that deployed the MacSync infostealer. This credential-harvesting malware collected browser data, SSH keys, and cryptocurrency wallets. The Asia-Pacific region sustained the heaviest impact with 67.2% of over 2,000 victims, particularly concentrated in Taiwan. Anthropic responded by banning malicious accounts and implementing additional abuse mitigations.
A sophisticated multi-stage malware campaign targets victims through tax-themed phishing emails impersonating Indian and Japanese government authorities. The operation leverages social engineering, fraudulent tax notifications, and trusted third-party email delivery services to distribute ZIP archives containing three staged payloads. The malware implements advanced evasion techniques including DLL Search Order Hijacking, API hooking, token manipulation, Mersenne Twister-based execution logic, COM callback execution, mutated RC4 encryption, and reflective PE loading. Execution occurs primarily in memory, significantly reducing forensic artifacts. The malware establishes persistent WebSocket-based command-and-control communication through HTTP protocol upgrades, allowing malicious traffic to blend with legitimate activity. Chinese-language artifacts were observed throughout the infrastructure and code, though attribution remains at moderate confidence. The campaign demonstrates characteristics of a mature, ...
TA4922 is a highly sophisticated Chinese-speaking threat actor demonstrating rapid operational tempo and continually evolving malware capabilities. Initially targeting East Asia, particularly Japan, the group has expanded globally to Europe and Africa. The actor deploys multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0), alongside legitimate remote management tools like AnyDesk and SyncFuture. Campaigns use localized lures themed around HR, payroll, tax, and invoicing, targeting hundreds to thousands of recipients per campaign. TA4922 conducts credential phishing, fraud operations including credit card theft, and attempts to shift communications to out-of-band channels like LINE, WhatsApp, and Microsoft Teams. The group leverages legitimate cloud hosting services and trusted software for delivery and persistence, combining advanced tradecraft with financially motivated objectives such as data theft, fraud, access resale, and persistent remote access.
A new phishing campaign targets Japanese online banking users by impersonating a legitimate bank with a typographical error in the brand name, using 'PayPoy' instead of the correct name. The phishing emails demand verification within 24 hours but contain a conspicuous branding typo that has reduced the campaign's perceived credibility, turning it into a viral meme in the local tech community rather than causing widespread alarm. The campaign was reported on Reddit cybersecurity forums with minimal discussion and no confirmed exploits in the wild. No patch or official remediation is applicable as this is a phishing campaign rather than a software vulnerability.
The Silver Fox threat group conducted phishing campaigns in December 2025 and January 2026, impersonating tax authorities in India and Russia. Malicious emails contained archives with a modified Rust-based RustSL loader that deployed ValleyRAT backdoor. Over 1600 malicious emails targeted organizations across industrial, consulting, retail, and transportation sectors. During investigation, a previously undocumented Python-based backdoor named ABCDoor was discovered, active since late 2024. The attacks utilized multi-stage infection chains involving encrypted payloads, custom ValleyRAT modules, and various persistence mechanisms including Phantom Persistence technique. ABCDoor features remote control capabilities, screen broadcasting using ffmpeg, and file manipulation functions. The group employed sophisticated evasion techniques including geofencing, string encryption, and mimicking legitimate VPN services.
A newly uncovered campaign abuses the Trillion (formerly Trellian) AdTech network, mimicking the flow of a Traffic Direction System (TDS) to trick visitors of typo-squatted domains into downloading Microsoft Store apps that contain browser hijacking malware. While the abuse of AdTech networks to deliver malware isn’t new, this campaign highlights incredibly similar tactics to VexTrio and previous TDS networks; further blurring the line between AdTech and malicious TDS systems.
The DarkSword exploit kit has been used by both state-sponsored hackers and commercial spyware vendors. The post Apple Rolls Out DarkSword Exploit Protection to More Devices appeared first on SecurityWeek .
Endpoint detection and response (EDR) tools are widely deployed and far more capable than traditional antivirus. As a result, attackers use EDR killers to disable or bypass them. The malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems. It can terminate over 300 different EDR drivers from almost every vendor in the market.
In January 2026, Nacogdoches Memorial Hospital experienced a data breach where a threat actor infiltrated the hospital's internal network and exfiltrated personal and health information of approximately 250,000 individuals. The breach involved unauthorized access to sensitive patient data, potentially including medical records and personally identifiable information (PII). No specific vulnerability or exploit details have been disclosed, and no known exploits are reported in the wild. The incident highlights risks associated with healthcare network security and data protection. Organizations handling sensitive health data should review their network defenses and incident response plans. The breach underscores the importance of robust access controls, network segmentation, and continuous monitoring in healthcare environments. Given the medium severity and lack of detailed technical information, the threat primarily impacts confidentiality and privacy. Healthcare providers globally should be vigilant against similar attacks targeting patient data. Mitigation should focus on strengthening internal network security, employee training, and rapid detection of intrusions.
Mercor, an AI recruiting firm, suffered a supply chain attack involving the LiteLLM component, resulting in the theft of approximately 4TB of data as claimed by the Lapsus$ threat group. The incident highlights risks associated with third-party AI software dependencies in recruitment technology. Although no known exploits are currently active in the wild, the breach could expose sensitive candidate and corporate information, impacting confidentiality and trust. The attack underscores the importance of securing supply chains, especially for AI-driven platforms handling personal data. Organizations relying on similar AI recruiting tools should be vigilant and assess their exposure to LiteLLM or related components. Mitigation requires thorough supply chain audits, enhanced monitoring of third-party software, and rapid incident response capabilities. Countries with significant AI technology adoption and recruitment sector reliance, such as the United States, United Kingdom, Germany, Canada, Australia, and South Korea, are most at risk. Given the medium severity rating, the threat poses a moderate risk primarily to confidentiality with limited immediate availability or integrity impact. No authentication or user interaction is required for exploitation, but the attack vector is indirect via supply chain compromise.
The CrystalX Remote Access Trojan (RAT) is a newly identified malware capable of spying on victims, stealing sensitive information, and modifying device configurations. Although it is described as sophisticated, there are currently no known exploits in the wild and no specific affected software versions have been identified. The malware's capabilities suggest it targets confidentiality and integrity by enabling unauthorized surveillance and data theft. The threat is assessed as medium severity due to the lack of widespread exploitation and limited technical details. Organizations should monitor for unusual device behavior and implement strong endpoint detection measures. Countries with significant use of Windows-based systems and high-value targets in sectors like finance, government, and critical infrastructure are most at risk. Proactive threat hunting and network segmentation can help mitigate potential impacts. Immediate patching recommendations are unavailable, so focus should be on detection and containment strategies.
Today, most malware are called “fileless” because they try to reduce their footprint on the infected computer filesystem to the bare minimum. But they need to write something… think about persistence. They can use the registry as an alternative storage location.
Active since September 2025, Yurei is a double extortion ransomware campaign. The operators run their own Tor data leak site with a low number of victims listed at the time of writing. It is reportedly derived from Prince Ransomware, an open-source ransomware family written in Go. Check Point researchers noted that all samples were first submitted to VirusTotal from Morocco, and that one sample did not include a ticket ID, indicating that this could be a test build, possibly uploaded by the developer themselves. Yurei ransomware samples also contained a link to SatanLockv2, based on the presence of the PDB path string “D:\satanlockv2” present in the Yurei samples.
Hasbro, a major toy manufacturer, has been targeted by a cyberattack currently under investigation. The company is assessing the full extent of the incident, including whether any sensitive files or data have been compromised. No specific technical details, attack vectors, or exploited vulnerabilities have been disclosed yet. There are no known exploits in the wild related to this incident at this time. The severity is currently assessed as medium based on limited information. Organizations should monitor for updates and review their security posture, especially those in the toy and manufacturing sectors. The attack highlights the ongoing risk of cyber threats to large consumer goods companies. Immediate containment and forensic analysis are critical to understand the breach scope. This incident may have implications for supply chain security and customer data protection. Defenders should prioritize incident response readiness and data protection strategies.
