Ransomware threat actors are shifting tactics away from encrypting data to extorting victims through data theft and demonstrating access by hijacking Active Directory environments. The PAYLOAD campaign exemplifies this trend by using malicious Group Policy Objects to display ransom notes and lock screens without encrypting files. This shift is driven by the increasing difficulty attackers face in collecting ransom payments due to widespread backup practices and the complexity of decrypting large-scale infections. Instead, attackers steal confidential data and threaten publication, which can cause reputational damage and regulatory penalties. Data exfiltration is also harder to detect than encryption-based attacks, making it a more attractive method for extortion. Businesses are advised to maintain strong cyber hygiene, including regular backups, patch management, endpoint protection, and access control to mitigate these evolving extortion threats.
Midnight Mimosa is a malware campaign involving preinstalled firmware malware on low-cost Android devices, primarily built on MediaTek platforms. The malware runs with system-level privileges, allowing remote operators to install and remove apps, grant permissions, and load arbitrary code. It is focused on ad fraud, automated click fraud, and building large botnets. The campaign affects devices in over 150 countries, with no single region dominating. Additionally, related apps carrying the same malware code have been found on Google Play, though with less privilege. The malware disables Google Play Protect during malicious app installations to evade detection. This campaign represents a supply-chain threat with persistent, preinstalled malware that cannot be removed by normal uninstall methods.
A malware campaign named 'Midnight Mimosa' has been identified on low-cost Android smartphones. These devices come pre-installed with malicious firmware that enables attackers to silently install additional apps, conduct ad fraud, and convert the phones into residential proxies without user consent.
This analysis discusses a growing trend where malware authors embed natural-language instructions in their code to evade AI-assisted malware analysis. Cisco Talos research identifies this technique as "A3: AI-Analysis Evasion," involving methods from simple comments to advanced template spraying targeting large language models. Although these prompt-injection techniques only influence AI verdicts about 35% of the time, they are increasingly adopted across malware sophistication levels. The research highlights that these evasion instructions must be in plaintext, providing defenders a stable detection surface. The advisory recommends flagging imperative language aimed at analysis systems within binaries as suspicious and treating extracted text as evidence rather than directives. The discussion also includes a real-world example of isolating legacy, vulnerable systems to reduce risk without patching. No specific software versions or exploits are detailed, and no patch status is provided.
The FakeGit malware campaign has resurfaced, distributing the SmartLoader malware through over 17,000 fake GitHub repositories. These repositories use convincing README files with download links to ZIP archives containing SmartLoader, which then delivers additional malware such as the StealC infostealer. The campaign leverages both throwaway and apparently legitimate developer accounts to maintain a large and persistent malicious repository fleet. Attempts to remove these repositories are ineffective due to the attackers' use of multiple backup copies and alternative download locations within GitHub. Users are advised to verify repository ownership and rely on official sources for software installations.
The CyberAgents Exchange by Tenable is an open-source directory for AI agents used in security operations, which undergoes a rigorous vetting process called the Exchange Inspector before listings earn a vetted tag. This process includes automated checks, AI model assessments, and human verification to identify security issues such as SSRF, path traversal, excessive permissions, and memory poisoning. The vetted AI agents help accelerate threat hunting, remediation triage, and cloud posture investigation. The Exchange Inspector aims to mitigate risks associated with deploying AI agents that carry credentials and perform autonomous actions, reducing the potential blast radius compared to typical open-source libraries. The directory promotes transparency by requiring contributors to keep code in public repositories for review prior to deployment. The Exchange Inspector combines Tenable’s exposure detection tools, OpenAI GPT cyber models, and human review to ensure security before deployment.
This analysis covers a new class of malware techniques called AI-analysis evasion (A3), where malware authors embed natural-language instructions in plaintext within malware samples to manipulate or evade automated AI-based analysis tools. These instructions are designed to mislead language models that analyze extracted text from binaries, causing them to misclassify or ignore malicious content. The technique is cheap to implement but only partially effective, influencing outcomes in about 35% of tests. Several malware families, including FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE, have adopted and evolved these evasion methods. The embedded instructions do not affect malware execution but aim to confuse AI analysis pipelines. Despite attempts to intimidate or mislead AI tools, these evasion methods remain detectable as they rely on plaintext strings. This represents an emerging layer of anti-analysis distinct from traditional binary obfuscation or packing.
PoeLLM is malware involved in a cryptomining campaign targeting exposed AI servers. The malware infects these servers to convert them into scanners and exploit launchpads for further attacks. There is no detailed technical information or confirmed exploits in the wild provided.
An alleged leader of the Tren de Aragua transnational criminal organization and developer of the Ploutus ATM malware, Anibal Alexander Canelon Aguirre, was arrested by the FBI. The Ploutus malware was used in ATM jackpotting attacks across 47 US states, DC, and other countries, enabling attackers to dispense cash fraudulently. The malware included anti-analysis features and could self-delete to evade forensic detection. Canelon Aguirre was on the FBI's top 10 most wanted list for cybercrimes and faces charges including bank burglary, fraud, and money laundering conspiracy. To date, 120 individuals have been charged in connection with this conspiracy, with some already sentenced to prison.
Since August 2023, a threat actor has conducted a long-running malware campaign on the NPM registry called MALFEX, publishing eight malicious packages that have accumulated over 40,000 downloads. The campaign distributes malware including the Overlord RAT and various infostealers targeting Windows systems. Some malicious packages remain installable as of October 2026, with one package, function-flag, having over 37,000 downloads and no advisory flags. The malware enables remote control, data theft from browsers, Discord clients, and cryptocurrency wallets. The infection routines are designed to fail silently on non-Windows systems, limiting impact to Windows users who directly install these packages. No geographic or organizational targeting has been observed.
The Blinder Tunnel campaign is an Iranian state-aligned cyber operation targeting Iraqi critical infrastructure using sophisticated social engineering and malware delivery techniques. The attackers impersonated the Dubai Airports IT department to lure targets with fake recruitment portals and coding challenges. The infection chain involves exploiting Windows developer project files, AppDomainManager hijacking, and DLL sideloading to deploy custom malware called ShelbyLoader V2. The campaign uses GitHub API infrastructure for command-and-control communications, blending malicious traffic with legitimate cloud activity. GitHub has taken down the malicious repositories associated with this campaign. The campaign also links to other operations targeting Israeli entities with credential harvesting lures. This activity was observed from November 2025 and activated in March 2026.
The alleged developer of Ploutus malware, used in ATM jackpotting attacks across the United States, was arrested and appeared in US court. Ploutus malware enabled criminals to steal millions of dollars by compromising ATMs, with attacks occurring between February 2024 and December 2025. The malware included anti-analysis features to hinder forensic investigation and attempted to conceal its presence by deleting itself from infected ATMs. The criminal operation was linked to the Venezuelan Tren de Aragua gang, which laundered stolen funds internationally. The DOJ charged the developer with multiple offenses including bank fraud conspiracy and providing material support to terrorists. The attacks targeted financial institutions in 47 US states and several foreign countries, resulting in over $5.4 million stolen in confirmed incidents and additional attempted thefts.
This report details the recovery of a removed npm malware file from the scoped package @goodjavascript/dotenv@1.0.0 using archival sources and CDN metadata. The recovered file contained a timer-based mechanism that collects host information and can execute JavaScript from a server response. The package itself had no installation scripts and an empty exported config function. The recovery was achieved by correlating an older Software Heritage snapshot with a surviving SHA-256 digest from jsDelivr's file manifest. A Python verifier was developed to safely retrieve and hash the file without execution. This analysis supplements an existing OSV advisory and highlights the use of archival tools for malware investigation.
Multiple cheap Android projectors using the Allwinner H713 chipset, sold under various brand names, come pre-installed with a multi-stage malware ecosystem. This malware includes a command-and-control (C2) loader that deploys modular plugins for residential proxy networks, ad-fraud, and botnet activities. The malware has root backdoors and can execute arbitrary code with system privileges. It exfiltrates device identifiers to servers in China and supports geo-fenced malicious activities. The infection chain involves four stages: StoreOS dropper, SilentSDK, PluginManager, and final plugins. Network-level blocking and disabling malicious apps via ADB are recommended mitigations.
Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and post-compromise activity while security teams struggle to keep pace. [...]
This content is an analysis and thought piece from Cisco Talos discussing cybersecurity defense strategies and personal well-being for security professionals. It emphasizes the importance of behavioral detections, deception techniques, and strict controls over legitimate tools to frustrate attackers. The article also highlights the human aspect of cybersecurity work, encouraging professionals to take time for themselves without fear of appearing less capable. It does not describe a specific vulnerability or exploit.
The US Treasury Department has sanctioned Anibal Alexander Canelon Aguirre, aka 'Prometheus,' the alleged developer of ATM jackpotting malware linked to the Tren de Aragua criminal network. The malware, known as Ploutus, enables attackers to remotely force ATMs to dispense cash illicitly. The network operates primarily from Mexico and Venezuela, targeting ATMs in the United States, with reported losses exceeding $40 million from over 1,500 attacks as of August 2025. Several associates and entities linked to this network have also been sanctioned and indicted. The US government has taken extensive legal and financial actions against the individuals and their cryptocurrency addresses to disrupt their operations.
Threat actors are abusing legitimate ScreenConnect client software by distributing a preconfigured version via phishing emails. The malicious executable is signed by the legitimate vendor ConnectWise, making it appear trustworthy and bypassing basic security controls. This technique leverages existing remote management tools to establish unauthorized remote access.
The Russian state-sponsored threat actor Star Blizzard has developed a new malware delivery technique called RedFlick to deploy its CosmicPulse backdoor. This method automates the infection chain by using a password-protected archive containing a virtual disk with a malicious shortcut file, which when opened, triggers hidden commands to download and install malware components via scheduled tasks. These tasks perform distinct roles to evade detection and ultimately deliver the CosmicPulse backdoor, capable of executing attacker-supplied Python code. The campaigns primarily target Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and financial organizations supporting Ukraine. Microsoft recommends phishing-resistant authentication, Conditional Access policies, email protection, and endpoint detection and response solutions to mitigate these attacks.
Malicious custom variants of OpenAI's ChatGPT are being promoted via sponsored Google search results. These variants direct users to websites that employ ClickFix attacks to deliver Remote Access Trojan (RAT) malware. This campaign targets unsuspecting users through deceptive search advertisements.