Researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of INC and The Gentlemen ransomware groups via seven exposed command-and-control servers. The operators integrated commercial AI models, exploited edge devices at scale, and compromised thousands of targets, primarily in the US industrial manufacturing and healthcare sectors. The infrastructure included multiple custom encryptor builds and evidence of active victim encryption. Operational security failures exposed source code, credentials, AI session logs, and victim data. The campaign demonstrates advanced ransomware-as-a-service operations leveraging AI and custom tooling.
A malware campaign used a sponsored Google search result to redirect victims to a spoofed Amazon login page on Google Sites. The page displayed a fake CAPTCHA (ClickFix) that tricked users into running a malicious command via the Windows finger utility, initiating a multi-stage infection. Payloads included IronPython, obfuscated Python scripts, Doina malware, Lumma Stealer via a Node.js package, and a pirated NetSupport Client RMM tool. The campaign used barbecue-themed domains for command and control and had alternate payloads for macOS. Attackers employed advanced obfuscation techniques such as Base64 with Cyrillic substitution, XOR, and RC4 encryption.
The moveworks-capi-starter package on PyPI contains malicious code that executes during installation. It overrides the install command in setup.py to collect the installer's hostname and local IP address, then sends this information as JSON to a hardcoded external URL without user consent or disclosure. The package has no legitimate documented functionality and acts as a proof-of-concept beacon. The exfiltrated data is limited to host identifiers and does not include credentials.
An autonomous offensive agent named 'Skynet' hijacks exposed large language model (LLM) endpoints on the internet to conduct a range of attacks. It uses 74 offensive tools targeting web frameworks, credential theft, database access, and cryptocurrency mining. The agent operates unattended for extended periods by bypassing AI safety controls through jailbreak techniques. Victims include AI model owners who incur costs for computing power and compromised servers exploited for Monero mining. This activity was observed via an AI honeypot capturing the full attack sequence, highlighting a novel self-directed cybercrime targeting unauthenticated internet-facing AI services.
The SafePay ransomware group has targeted over 600 critical infrastructure organizations worldwide since 2024. This group uses multiple initial access methods including credential exposure, brute force attacks, VPN exploitation, and phishing. SafePay employs double-extortion tactics by stealing sensitive data before encrypting systems and threatening to leak stolen information if ransoms are not paid. The group disrupts recovery by deleting shadow copies and resetting network-attached storage backups. CISA and partner agencies recommend implementing multifactor authentication, restricting administrative privileges, and patching vulnerabilities in VPNs, firewalls, and edge devices to defend against these attacks.
The Gentlemen is a ransomware-as-a-service (RaaS) operation active since mid-2025, targeting Windows, Linux, NAS, and BSD systems. It uses a double-extortion approach by encrypting files with ChaCha20 encryption and exfiltrating data. The ransomware kills security processes via vulnerable drivers and spreads laterally using PsExec. A breach in May 2026 exposed internal communications and affiliate details. The group mainly targets organizations in the United States and Europe across various sectors including manufacturing, technology, healthcare, professional services, and retail.
Operation FlashHole is a sophisticated cyberattack campaign launched by the Lazarus Group targeting South Korea. It exploits mandatory security software CrossWeb EX using watering hole attacks and spear-phishing with fake portfolio and resume websites. The campaign, active since July prior to January, targets sectors including software, construction, and cable equipment manufacturing. It employs a modular malware framework combining multiple malware families such as TechHub, Cubridge, TouchShift, TouchHub, ClientHub, and LPEClient. Techniques used include in-memory execution, DLL side-loading, and command-and-control infrastructure leveraging GitHub and Dropbox. The attackers also incorporate advanced cryptographic methods like post-quantum cryptography (ML-KEM-1024) and GOST encryption. This campaign demonstrates Lazarus Group's evolving tactics specifically tailored for South Korean targets.
In October 2026, OVHcloud's official CLI tool was compromised through a hijacked developer GitHub account. Versions v0.11.0 through v0.15.0 of the CLI contained a malicious binary designed to steal secrets from users' disks. The compromise lasted approximately 94 minutes before being detected and blocked. The attacker replaced binaries on GitHub releases without CI/CD pipeline involvement due to disabled release immutability. The developer account had been compromised since at least March 2026, with evidence of a GlassWorm-linked loader in personal repositories. Users who installed or updated the CLI during the incident window on common platforms are affected, while those who built from source or used other installation methods are not.
The npm package my-auto-follow-eltio@1.0.0 is a fork of the Baileys WhatsApp library that includes obfuscated code. Although the visible code does not show direct malicious actions such as remote code execution or credential theft, the package is flagged by a malware source as fully compromising any computer on which it is installed. It is recommended to consider any system with this package compromised, rotate all secrets from a clean system, and remove the package.
The @alannxd/baileys npm package is a malicious third-party fork of the legitimate @whiskeysockets/baileys WhatsApp library. Upon import, it performs an HTTPS GET request to a mutable URL controlled by the author, revealing the consumer's IP address. Although it does not execute remote code or exfiltrate credentials directly, the package poses a risk due to its namespace confusion potential and the import-time beacon to an author-controlled source. Security sources warn that any system with this package installed should be considered fully compromised, recommending immediate secret and key rotation and package removal.
A threat actor breached TeamUpdraft's infrastructure, compromising UpdraftCentral connection keys used to manage WordPress sites remotely. These stolen keys have been used to backdoor connected WordPress sites by installing malicious plugins that grant attackers administrator privileges. The breach affects an estimated 10% of UpdraftPlus users with UpdraftCentral or Migrator keys, potentially impacting around 400,000 websites. The vendor responded by revoking affected keys and releasing patched versions of UpdraftPlus. Users are advised to update to the latest versions and remove existing UpdraftCentral keys from their sites to mitigate risk.
The npm package tellyo-colours version 21.3.1 includes a runtime dependency on abbishal-poc-as-dependency with a wildcard version, allowing arbitrary code execution during installation. This dependency can fetch and run any version published by the dependency's controller, potentially executing malicious lifecycle scripts. The package is considered fully compromising any system where it is installed, requiring immediate secret and key rotation and removal of the package.
The hijok-lampam package on PyPI is identified as malicious due to its use of fake HTTP-downloaded dependencies intended to track downloads. It serves no legitimate purpose beyond this tracking behavior and is associated with dependency confusion tactics. The package version 1.0.0 is affected. There is no evidence of active exploitation in the wild.
The trijigo-kalip package on PyPI version 1.0.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It appears to be a low-risk package resembling pentest or research tools but with a hidden data exfiltration purpose.
The PyPI package 'jiklpo-tsunari-kay' version 1.0.0 is identified as containing malicious code that uses fake HTTP-downloaded dependencies to track downloads. The package appears to have no legitimate purpose beyond this tracking behavior. It is categorized as a low-harm potential package, resembling typical pentest or research tools but with malicious intent related to dependency confusion.
The hijiko-pilaka package on PyPI is identified as malicious due to its use of fake HTTP-downloaded dependencies designed to track downloads. It serves no legitimate purpose beyond this tracking behavior.
The PyPI package 'facewareretargeter' is identified as malicious due to its use of fake HTTP-downloaded dependencies designed to track downloads without any legitimate purpose. It appears to be a dependency confusion attack vector, masquerading as a typical pentest or research package but with low direct harm potential.
Wazza is a multi-stage phishing kit actively targeting Microsoft 365 accounts since July 2026. It uses phishing emails with PDF lures themed around business documents to redirect victims through a complex infrastructure involving Google Sites and CloudFlare Workers. The kit impersonates multiple well-known services and employs advanced browser checks and client-side protections. It abuses Microsoft OAuth device authorization to trick victims into completing authentication, allowing attackers to gain access to accounts and cloud resources. The campaign is medium severity due to credential theft risks.
The npm package '@securihackbot/depconf-stage-1792484738' contains malicious code in its postinstall hook that automatically executes upon installation. This code collects system information including hostname, local username, platform/architecture, Node.js version, package name, and a nonce, then encodes and sends this data via an unencrypted HTTP GET request to a hardcoded IP address. The package is designed to be used in dependency confusion attacks by being republished under victim-internal scopes, causing internal package resolution to fetch this malicious package from the public registry and leak sensitive environment information to the attacker.
The npm package rs-lookout-sandbox-poc version 1.0.1 contains malicious code that, upon being loaded, automatically collects the local system username and sends it to an external third-party URL. Additionally, it performs reconnaissance on the AWS Instance Metadata Service by attempting to retrieve an IMDSv2 token and enumerating IAM role credentials associated with the host. These actions occur without any explicit invocation by the user.
