A malicious JavaScript file was found in a third-party performance monitoring integration on Polymarket. The script was designed to access authenticated trading sessions, inspect user portfolios, and transfer cryptocurrency assets to attacker-controlled addresses. It operates by reading authentication data from local storage, navigating React components to find trading functions, and creating signed messages to move assets. Polymarket has removed the compromised third-party integration. The extent of victimization and total losses are currently unknown.
Seven months after initial disclosure, the Coruna iOS exploit framework continues to evolve, now deploying two distinct chains based on device operating system version. Targets running iOS 17.2.1 or earlier receive the legacy Coruna framework, while later builds receive DarkSword-derived chains. Analysis identified 608 domains delivering Coruna-family code, with 93 sites mapping to 21 distinct tracking collectors. Distribution spans dating portals, AI-companion platforms, cryptocurrency promotions, media streaming services, and compromised legitimate sites. The attack requires no user interaction beyond loading a webpage, operating through hidden iframes that deploy browser exploits leading to native code execution. Recovered modules include kernel memory manipulation, code-signing enforcement changes, process memory access, encrypted command-and-control communication, and cleanup routines. One delivery vector involves compromised npm packages, enabling legitimate websites to serve exploits through their o...
CVE-2026-111497 is a critical out-of-bounds write vulnerability in Google's Brotli decompression library that allows specially crafted compressed data to corrupt application memory and potentially enable remote code execution. It affects Brotli versions 1.0.3 through 1.2.0 and multiple platforms including Node.js, Bun, Python, and .NET frameworks. Exploitation attempts were observed shortly after patches were released, with proof-of-concept code demonstrating remote code execution via malicious HTTP requests and responses. The vulnerability can be triggered through various vectors such as HTTP requests with Brotli-compressed bodies, malicious server responses, and file processing workflows. Enterprise products from Palo Alto Networks and VMware are also impacted, broadening the attack surface. CISA added this vulnerability to its KEV catalog on October 27, 2026.
Several Russian-language traffer teams have adapted affiliate-fraud models to exploit the growing popularity of prediction markets such as PolyMarket and Kalshi. These teams provide full fraud infrastructure including fake websites, admin panels, cryptocurrency payment systems, and support. They use controlled trading outcomes, fabricated market activity, artificial withdrawal restrictions, and collect sensitive identity information. Artificial intelligence tools accelerate these scams by simplifying platform development and victim engagement. This reflects a shift of mature fraud ecosystems toward new financial technologies without needing entirely new criminal skills.
The Aurora ransomware group has been active since April 2026, targeting multiple organizations globally with a Linux ransomware variant tailored for ESXi environments. This ransomware uses ChaCha20 encryption combined with RSA-4096 key wrapping. A notable feature of their operations is the abuse of Cursor Agent alongside Claude Sonnet AI to assist in exploitation activities such as privilege enumeration, network scanning, NTLM relay attacks, and certificate attacks. The group imposes operational restrictions to avoid detection and disruption, including prohibiting DCSync, account lockouts, and adding new computer objects to domains. A separate cluster of Aurora activity involves SQL Server lateral movement, GodPotato escalation, and S3-based data exfiltration. The threat affects organizations in multiple countries including the United States, Argentina, Austria, Germany, Israel, and Spain.
MadApe is a sophisticated multi-stage phishing campaign targeting Microsoft Device Code authentication. It uses business-themed PDF lures, configurable redirect chains, and fake document-sharing pages impersonating services like SharePoint, OneDrive, Teams, Adobe Acrobat, and DocuSign. The campaign abuses Microsoft's Device Code flow to access victim accounts without credential theft on phishing pages. It features extensive infrastructure with 155 domains, human-verification challenges, decoy sites, and exposed operator panels. The campaign is localized in at least nine languages and focuses on business communications.
An unauthorized relay service has been installing legitimate OpenAI Codex and Anthropic Claude Code CLI tools on enterprise systems, reconfiguring them to route requests through third-party infrastructure. This activity, active since early 2026, primarily affects organizations in mainland China, South Korea, Taiwan, and Malaysia across multiple industrial sectors. The relay disables execution sandboxes, enables network access, replaces API credentials with relay-issued tokens, and disables telemetry, granting operators full user privilege command execution and access to sensitive data. No abuse evidence is currently reported.
NIK C2 is an advanced AI-enabled command-and-control framework targeting Windows systems. It features a Go-based implant capable of credential dumping, keystroke streaming, and real-time AI-powered data analysis via the OpenAI Chat Completions API. The framework uses a dual-channel C2 architecture with TLS-secured WebSockets and HTTP fallback, employing AES-256-GCM encryption. It includes surveillance, lateral movement, screen-locking ransomware demanding cryptocurrency payments, and bootkit preparation. The implant employs advanced defense evasion techniques such as AMSI patching, process hollowing, and anti-debugging. Active infrastructure has been observed, confirming operational deployment beyond proof-of-concept. The framework is under active development with multiple versions compiled using Go 1.23.4.
A sophisticated supply-chain attack named NetamLoader targets a custom Windows 10 build used exclusively by government entities in Asia. The attack uses a multi-stage infection chain involving CAB archives in Windows update directories, exploiting AppDomainManager injection and BinaryFormatter deserialization vulnerabilities. It bypasses AMSI protections, uses AES encryption for network communications, and employs anti-analysis techniques including long polling intervals and forensic evidence removal. The malware operates covertly by migrating to dllhost.exe and executing payloads in isolated AppDomains. Commercial hosting infrastructure such as Cloudflare CDN is used for command-and-control communications.
Star Blizzard is a Russian espionage group linked to the Federal Security Service Centre 18, targeting government, defense, NGOs, and academia mainly in the UK, US, Ukraine, and NATO countries. The group uses spear-phishing, impersonation, and relationship building to steal credentials and conduct hack-and-leak operations. Since 2024, they have expanded to deploying endpoint malware including SPICA, YESROBOT, MAYBEROBOT, and CosmicPulse backdoors. Their tactics evolved from targeted to bulk phishing campaigns using fake CAPTCHA lures and exploiting iOS devices with the DarkSword exploit kit. They also use compromised WordPress sites for infrastructure and rapidly develop new malware variants after exposure. Recent campaigns have targeted over 100 organizations with the RedFlick delivery chain, showing increased scale and sophistication.
The n0n ransomware operation is an AI-assisted extortion campaign revealed in 2026 through an exposed staging server. It targets organizations globally using credential stuffing attacks against FortiGate SSL-VPN devices, exposed cloud keys, and compromised management portals. The operation combines data exfiltration with destructive actions such as encryption and backup deletion. The attacker uses an AI coding agent with numerous models to generate attack scripts, enhancing human-directed operations. At least 23 victims across 14 countries were identified initially, with 93 victims listed by October 2026 and ransom demands totaling $283.7 million. No software vulnerabilities were exploited; all compromises relied on weak or stolen credentials.
An extortion campaign targeted Japanese real estate websites in October 2026, compromising one company and pivoting to nearly 20 related sites via shared hosting credentials. The attacker, known as kkkkevin777, stole over 16,000 customer records including plaintext passwords and sensitive personal data. Ransom pages with deadlines were deployed, threatening to expose stolen data. Ten days after the extortion wave, PHP2Shell exploitation tooling was found on an exposed staging server, indicating preparation for further attacks. Additional data from a Taiwanese company was also exfiltrated. The server contained weaponized PHP2Shell scripts, web shells, and tools for lateral movement, though no confirmed live exploitation via PHP2Shell was documented.
On September 6, 2026, an unidentified operator exfiltrated approximately 68.8 GiB of database backups from a Philippine government agency responsible for overseas employment and migrant workers. The stolen data included 27 SQL Server backups related to case management systems such as POEA and OFW variants. The operator inadvertently exposed their staging infrastructure through an open HTTP directory on a VPS in Singapore, revealing tools including a rebranded GodPotato privilege escalation tool (Wrqsnx), PowerShell stagers, and the Impacket toolkit. The attack leveraged DCOM and RPC mechanisms to gain SYSTEM-level access without exploiting known vulnerabilities. Certificate analysis linked the compromised infrastructure to the Philippine Overseas Employment Administration portal farm. Initial access methods and command-and-control channels remain unknown, though the tooling was deployed on agency portal hosts.
Threat actors are abusing legitimate mobile device management (MDM) platforms such as Hexnode and Rippling by using social engineering techniques to trick users into enrolling devices or installing management agents. Once enrolled, attackers deploy unauthorized remote monitoring and management (RMM) tools like ScreenConnect, connecting to attacker-controlled relays to gain remote access. The MDM platforms themselves are not compromised but are misused through deception, making it difficult to distinguish legitimate from malicious activity.
Since July 2025, a financially motivated threat actor named CyberDakait has conducted a sophisticated Android malware campaign targeting India's financial services sector. The campaign uses seven distinct Android trojan families distributed via smishing and vishing, impersonating bank representatives to trick victims into installing malicious APKs. These trojans steal banking credentials, credit card details, and intercept SMS messages including OTPs through overlay attacks. Additionally, the malware performs cryptojacking using XMRig. The malicious apps are hosted on GitHub to appear legitimate, with initial droppers delivering the main payload and mining modules. At least 17,960 devices have been compromised with 7.6 million intercepted SMS messages reported.
MR ROBOT is a sophisticated Android Malware-as-a-Service operation targeting Indian bank customers. It operates on a subscription model allowing cybercriminals to rent customized banking trojans distributed via fake Play Store pages and messaging apps. The malware uses a multi-stage dropper to deploy banking trojans that intercept SMS and OTPs, silently enable call forwarding to bypass two-factor authentication, and overlay phishing screens to steal sensitive financial and identity information. One affiliate compromised 153 devices and intercepted over 5,400 SMS messages. The operation includes a Telegram bot storefront offering about 36 fake apps impersonating banks and government services, with stolen data exfiltrated to Firebase Realtime Database and Telegram channels.
In September 2026, infostealer malware was predominantly distributed via SEO poisoning, masquerading as illegal software like cracks and keygens. Distribution platforms included Mediafire, AWS S3, Mega, and Cloudflare Storage. Executable files made up 90.8% of samples, with 9.2% using DLL side-loading techniques involving legitimate DLLs such as python37.dll and POWRPROF.dll. A new Rust-based infostealer named Lzveil was identified, which downloads configuration from command and control servers and employs modified Base64 decryption, XOR encryption, and LZNT1 compression. Email campaigns spread DarkCloud and AgentTesla infostealers, impersonating construction and logistics firms. These malware variants steal credentials, browser data, cryptocurrency wallets, and system information, with stolen data often sold on dark web markets or used in secondary attacks.
Multiple fraudulent websites impersonating legitimate Korean companies such as Doosan Robotics and Cheonjeong have been discovered. These sites use authentic corporate branding and offer features like invitation-code registration, VIP memberships, and cryptocurrency deposit/withdrawal functions. They instruct victims to make USDT payments via TRON wallet addresses and submit transaction screenshots. Analysis identified TRON wallets with significant transaction volumes, including one with approximately 13 million USDT received. Infrastructure tracking linked these domains to the ValleyRAT malware command and control IP address, but no direct operational connection between ValleyRAT malware and the fraudulent websites or wallets has been confirmed.
Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 and highly prolific by 2025 with over 1,000 victims. It uses a flexible platform enabling affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure, including ESXi hosts. Initial access is commonly gained via phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools. The group employs a double-extortion model, encrypting data and threatening to publish stolen information on their blog and WikiLeaksV2 platform. Notable incidents include the 2024 Synnovis attack impacting UK healthcare services. Qilin is linked to other threat groups and has spawned derivative operations, some maintaining affiliate status while operating independent leak sites.
