An underground marketplace on Telegram facilitates unlocking stolen iPhones despite Apple's Activation Lock. Attackers use SMS phishing with lookalike domains to trick owners into revealing passcodes. Unlocking tools, sold for $5-50, can jailbreak older phones and gather data to improve phishing. Over 10,000 domains linked to these operations have been identified, with a significant increase in DNS traffic. The operation spans multiple countries and focuses on wiping devices for resale rather than data theft.
Between July and September 2026, approximately 7.3 billion email-based phishing threats were detected, with a significant 41% increase in attacks in September compared to August. Attack techniques shifted notably, including a decline in QR code phishing and a resurgence of CAPTCHA-gated attacks using SVG attachments. Domain spoofing persisted, affecting 129 million messages impersonating business services. Credential theft remained the primary goal, while business contact impersonation declined. Teams-based phishing increasingly used common personal names instead of help desk identities. Targeted campaigns affected legal organizations and Spanish-speaking users, delivering Agent Tesla malware. The disruption of the Tycoon2FA phishing platform resulted in a 99.8% reduction in its phishing volume.
Hackers linked to Russia's Foreign Intelligence Service exploited previously patched vulnerabilities in iOS and Android devices to target visitors of multiple websites, including a site celebrating American independence and a luxury UK hotel near sensitive government institutions. The attackers used JavaScript injection, proxy domains, and a compromised Ukrainian web analytics service to deliver three zero-click exploit chains, including the DarkSword iOS exploit kit. The attacks aimed to steal browser cookies, Wi-Fi passwords, and device data from diplomatic and high-profile targets related to Ukraine.
SkyW4lker is a phishing kit that targets Microsoft 365 users, primarily in the United States and Europe. It abuses Microsoft's device-code authentication flow to gain access to corporate accounts without stealing passwords or bypassing MFA. The kit uses password-protected email attachments containing links that lead victims through CAPTCHA challenges to Microsoft's legitimate authentication system. Activity increased notably between June and October 2026, with the US accounting for nearly half of the observed submissions. The kit shares infrastructure and code with the Gabagool phishing kit, indicating a common threat actor.
A sophisticated phishing campaign targets 189 US financial institutions using 248 look-alike domains that combine urgency keywords with bank names. The campaign uses a cloaking technique that shows fake "account suspended" pages to returning visitors while delivering real phishing content to first-time visitors, evading takedown attempts. It focuses on business banking and treasury portals, which typically have higher balances and transfer capabilities. The domains are hosted behind Cloudflare and traced to shared servers at two providers. Network analysis links this operation to a centralized backend managing additional phishing campaigns targeting institutions in the UK, Netherlands, Australia, and New Zealand. The campaign is administered via a jump server accessed through Remote Desktop from a UK residential broadband connection, providing a lead to the operator's identity.
The KeyHunter operation is a multi-vector cyber campaign by the Chinese-speaking threat actor leepsmarts targeting academic institutions and cloud infrastructure. It involves theft of large numbers of LLM API keys from misconfigured cloud platforms, creation of fraudulent student accounts at multiple universities, and processing of stolen Harvard alumni data. The operation uses AI agent frameworks and Telegram bots for automation. Parallel financial fraud includes cryptocurrency draining and credit card validation using stolen credentials. The infrastructure spans multiple countries and has been active since early 2026.
A large-scale watering hole campaign attributed with moderate-to-high confidence to APT29 targets mobile devices by compromising legitimate websites, impersonating high-profile domains, and supply-chain compromising a Ukrainian analytics service. The campaign uses injected JavaScript to profile devices and deliver platform-specific n-day exploits against iOS and Android. Exploited vulnerabilities include multiple CVEs from 2024 to 2026. The final payloads exfiltrate sensitive data such as browser cookies, Wi-Fi passwords, and device information without establishing persistence, consistent with intelligence-gathering objectives.
The BOSSAI campaign involves a single operator using a mesh of 12 AI agents to conduct persistent attacks across 11 countries. The attacker leveraged both abliterated and commercial AI models in specialized roles such as infrastructure building, vulnerability scanning, and exploitation. Primary targets included emergency services, universities, financial institutions, and government systems in Taiwan, Thailand, and Mexico. Confirmed breaches include exfiltration of medical records from Taipei emergency services, student data from Thai universities, and over 200,000 Mexican residential phone records. Despite attempts to jailbreak commercial AI models, the attacker relied on less effective abliterated models. The investigation uncovered the full operational infrastructure, including command histories and victim data, highlighting both the capabilities and limitations of AI-augmented autonomous exploitation.
A large-scale supply chain compromise affected MECOOL Android set-top boxes manufactured by Videostrong Technology Co., Ltd. Over 1.3 million devices were pre-infected with the x.cpe backdoor, enabling system-level access via MQTT infrastructure. The backdoor deploys multiple payloads including residential proxy SDKs and various ad fraud modules. Approximately 500,000 infected devices remain active, primarily in Malaysia, Mexico, and Brazil. The operation supports a pay-per-install campaign that fuels ad fraud and proxy ecosystems. Google has permanently banned Videostrong from the Android ecosystem due to this compromise.
VAPOR PANDA initiated a global espionage campaign starting October 17, 2026, leveraging the AI-driven ARTEX framework along with DeepSeek and commercial large language models to conduct simultaneous intrusions against over 200 organizations worldwide. Targets included foreign ministries in Latin America, Europe, Asia, and the Middle East, as well as U.S. semiconductor, defense, pharmaceutical, nuclear, and telecommunications sectors. The adversary deployed the BLOODALCHEMY backdoor, performed credential spraying, and directed AI agents to identify systems lacking endpoint security sensors. This campaign marks a shift from single intrusions to multiple autonomous attack paths coordinated by AI agents under human strategic guidance in Chinese. It highlights the use of open-source AI combined with commercial LLMs to scale intrusion operations beyond manual capabilities.
The Aurora ransomware group has been active since April 2026, targeting multiple organizations globally with a Linux ransomware variant tailored for ESXi environments. This ransomware uses ChaCha20 encryption combined with RSA-4096 key wrapping. A notable feature of their operations is the abuse of Cursor Agent alongside Claude Sonnet AI to assist in exploitation activities such as privilege enumeration, network scanning, NTLM relay attacks, and certificate attacks. The group imposes operational restrictions to avoid detection and disruption, including prohibiting DCSync, account lockouts, and adding new computer objects to domains. A separate cluster of Aurora activity involves SQL Server lateral movement, GodPotato escalation, and S3-based data exfiltration. The threat affects organizations in multiple countries including the United States, Argentina, Austria, Germany, Israel, and Spain.
Star Blizzard is a Russian espionage group linked to the Federal Security Service Centre 18, targeting government, defense, NGOs, and academia mainly in the UK, US, Ukraine, and NATO countries. The group uses spear-phishing, impersonation, and relationship building to steal credentials and conduct hack-and-leak operations. Since 2024, they have expanded to deploying endpoint malware including SPICA, YESROBOT, MAYBEROBOT, and CosmicPulse backdoors. Their tactics evolved from targeted to bulk phishing campaigns using fake CAPTCHA lures and exploiting iOS devices with the DarkSword exploit kit. They also use compromised WordPress sites for infrastructure and rapidly develop new malware variants after exposure. Recent campaigns have targeted over 100 organizations with the RedFlick delivery chain, showing increased scale and sophistication.
The n0n ransomware operation is an AI-assisted extortion campaign revealed in 2026 through an exposed staging server. It targets organizations globally using credential stuffing attacks against FortiGate SSL-VPN devices, exposed cloud keys, and compromised management portals. The operation combines data exfiltration with destructive actions such as encryption and backup deletion. The attacker uses an AI coding agent with numerous models to generate attack scripts, enhancing human-directed operations. At least 23 victims across 14 countries were identified initially, with 93 victims listed by October 2026 and ransom demands totaling $283.7 million. No software vulnerabilities were exploited; all compromises relied on weak or stolen credentials.
Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 and highly prolific by 2025 with over 1,000 victims. It uses a flexible platform enabling affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure, including ESXi hosts. Initial access is commonly gained via phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools. The group employs a double-extortion model, encrypting data and threatening to publish stolen information on their blog and WikiLeaksV2 platform. Notable incidents include the 2024 Synnovis attack impacting UK healthcare services. Qilin is linked to other threat groups and has spawned derivative operations, some maintaining affiliate status while operating independent leak sites.
SkyW4lker is a phishing kit active since June 2026 that targets Microsoft 365 authentication by exploiting OAuth 2.0 device-code flows to bypass MFA. It uses password-protected email attachments leading victims through CAPTCHA pages to malicious sites requesting device codes. The kit primarily targets US firms, especially in technology, manufacturing, and government sectors, and shares infrastructure with the Gabagool phishing kit.
A Korean-speaking threat actor linked with moderate confidence to North Korea's Lazarus Group is conducting a global campaign exploiting two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. The campaign targets government agencies, financial institutions, manufacturing, logistics, aviation, and trading platforms across multiple countries including the US, Japan, and EU. Exploitation attempts have been observed since 17 October 2026, involving web shell deployment and session poisoning. The vulnerabilities affect all internet-facing PHP installations below versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, with Apache mod_php being at highest risk.
Two critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell, were disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory handling corruption that can interrupt PHP while internal request data is partially initialized, leading to invalid data treatment. CVE-2026-109619 exploits stale global state where request-owned internal state survives after memory is freed. Both vulnerabilities can be exploited successfully on ARM64 systems and x86 systems without ASLR. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Over 2.6 million internet-facing hosts running PHP were identified as vulnerable, with 42% on end-of-life branches receiving no official patches. Early exploitation attempts were observed from multiple sources, including scanning activity and webshell deployment attempts targeting the upload-progress vulnerability path.
SiriusQT is a Windows Remote Access Trojan (RAT) distributed as Malware-as-a-Service since April 2026. It offers advanced capabilities including hidden VNC, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, and persistence. The malware uses custom encrypted command-and-control communication and has both native C++ and .NET loader variants. It is distributed primarily by a reseller named GhostKernel and targets victims in several European countries including the UK, Germany, France, Spain, Italy, and the Netherlands.
In October 2026, a Chinese-speaking threat actor conducted a global AI-assisted hacking campaign using the ARTEX penetration testing framework combined with multiple AI coding assistants. The attacks targeted organizations across finance, retail, education, cryptocurrency, and telecommunications sectors in over 20 countries worldwide. The campaign utilized custom scripts to maintain context across AI sessions and divided tasks among specialized AI agents. The attackers sought bulk personal data, transaction records, and mobile phone numbers, with indications of intent to sell stolen information on underground markets. The workflow included peer review among AI models to improve effectiveness. The campaign is financially motivated and opportunistic in nature.
Researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of INC and The Gentlemen ransomware groups via seven exposed command-and-control servers. The operators integrated commercial AI models, exploited edge devices at scale, and compromised thousands of targets, primarily in the US industrial manufacturing and healthcare sectors. The infrastructure included multiple custom encryptor builds and evidence of active victim encryption. Operational security failures exposed source code, credentials, AI session logs, and victim data. The campaign demonstrates advanced ransomware-as-a-service operations leveraging AI and custom tooling.
