The 'Iron Man System' is a commercial Phishing-as-a-Service (PhaaS) operation that provides criminal buyers with a self-hosted phishing kit. It includes over 2,360 phishing templates impersonating trusted entities such as postal services, banks, and government agencies, targeting 130 countries. The system features a bilingual Chinese-English interface, a subscription licensing model tied to vendor-controlled authorization servers, and a build registry with 911 published versions. Resecurity, in collaboration with Microsoft's Digital Crimes Unit and industry partners, mapped and disrupted this infrastructure. The kit was used to send approximately 1 billion phishing emails targeting 75,000 organizations, capturing around 17.4GB of telemetry data. Multiple domains associated with the infrastructure have been identified as indicators of compromise.
The saeka package on PyPI is identified as malicious software designed to perform mass credit card checking by abusing legitimate online retail services. It is part of a campaign with clear malicious intent, involving the unauthorized use of third-party APIs to validate stolen credit card data.
Hirudo is an Android banking remote access trojan that combines credential theft with live remote control capabilities. It is distributed via shopping and entertainment apps acting as droppers, which install the trojan behind fake update prompts. The malware replaces legitimate banking apps with patched versions that disable internal security checks. The campaign targets eight Indonesian banking apps covering seven banks, embedding a hooking engine in the replacements. Distribution uses legitimate advertising infrastructure including Amazon CloudFront. Targeting extends beyond Indonesia to China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records. No CVE or official patch information is available.
A phishing campaign distributes the AgentTesla infostealer via emails pretending to be business proposals. The attached ZIP file contains a malicious executable disguised as a café management program with Chinese-language UI. The malware uses multi-stage obfuscation and .NET payload loading to ultimately deploy AgentTesla, which steals credentials, cookies, and contact information from browsers, email clients, FTP, and VPN applications. Stolen data is exfiltrated through FTP to a compromised server. The attack targets business users using social engineering and sophisticated loading techniques.
Hirudo is a newly identified Android malware that targets banking applications by replacing legitimate apps with modified versions that disable security checks. This enables the malware to steal bank account credentials from infected devices. The malware specifically focuses on evading security mechanisms by altering the banking apps themselves.
During Q3 2026, attacks targeting poorly managed Linux SSH servers were observed, primarily using brute force and dictionary attacks. The main malware families involved were ShellBot, a Perl-based DDoS bot, and Fisieredoor, a backdoor capable of command execution and deploying SSH dictionary attack tools. Attackers used wget or curl to download malware, then installed user-mode rootkits, process masking tools (XHide), and XMRig cryptocurrency miners. The malware launcher used ld.so.preload to inject rootkits and disguised mining processes as legitimate bash sessions. Fisieredoor also deployed tools for credential harvesting and lateral movement, transmitting successful authentication data to command servers.
In Q3 2026, attackers targeted Windows-based MS-SQL and MySQL database servers using brute-force, dictionary attacks, and vulnerability exploitation. They deployed cryptocurrency miners (XMRig), backdoors (GotoHTTP), SoftEther VPN infrastructure, and various web shells for persistence. Additional tools included VShell for remote command execution, HackBrowserData for credential theft, Fscan for reconnaissance, and Cloudflared for port exposure. Attackers created backdoor RDP accounts and used SoftEther VPN servers as command and control infrastructure. The attacks mainly exploited weak passwords, poor account management, and insufficient security on exposed database servers.
In the third quarter of 2026, multiple attack campaigns targeted poorly managed Linux SSH servers using brute force, dictionary attacks, and vulnerability exploits. Attackers deployed ShellBot, a Perl-based DDoS bot with port scanning and UDP flooding capabilities. A complex attack chain involved a user-mode rootkit loaded via /etc/ld.so.preload, which then deployed the XMRig cryptocurrency miner disguised as a bash process using the XHide concealment tool. Additionally, the Fisieredoor backdoor was used to execute commands and install SSH brute-force tools such as goauto and tsm-family that systematically targeted systems with credential lists. Organizations are advised to implement strong password policies, maintain regular patching schedules, and enforce access controls on externally exposed SSH infrastructure.
The npm package '@flexmr/utils' versions 1.0.0 and 3.0.12 have been identified as malicious. The package executes commands associated with malicious behavior, posing a security risk to users who install or use these versions.
The fontcase package on PyPI versions 0.1.0, 0.1.1, and 0.1.2 contains malicious code that downloads and executes an infostealer during import. This malicious behavior includes exfiltration of browser data and credentials, and uses a Telegram bot for communication. There is no information about an available patch or fix.
Cybercriminals are distributing remote access trojans (RATs) via phishing emails that mimic legitimate event invitations. These emails contain download buttons leading victims through fake CAPTCHA verification pages on newly created domains. After verification, users are prompted to download an eInvite file that contains a zipped folder with a weaponized ConnectWise Screen Connect installer acting as a RAT. Execution of this installer grants attackers full remote access to the victim's device, indicated by an inconspicuous taskbar icon. The campaign exploits user curiosity, especially during holiday seasons when event invitations are common.
The sysdiagd package on PyPI is a malicious package disguised as a system monitoring tool. It functions as a Discord bot infostealer that exfiltrates credentials, browser data, files, and records audio, screenshots, and video. The malicious code requires bot credentials to operate and is not functional without them. The campaign associated with this package demonstrates clear malicious intent, including spyware-like behavior and persistence mechanisms.
The npm package @chatest/baileys versions 4.4.0 and 4.4.1 includes a dependency on an unpinned GitHub repository (libsignal-node) that can execute arbitrary code during installation. The package is branded inconsistently, suggesting potential impersonation. Installing this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.
XWorm is a sophisticated Windows Remote Access Trojan (RAT) that has evolved into a surveillance platform with expanded plugin capabilities. It can monitor user location, stream live audio, capture webcam footage, and interact with authenticated browser sessions without requiring credentials or triggering multi-factor authentication. The malware has been active since 2022 and has increased in activity following the public release of a cracked builder and source code leak. It communicates via AES-encrypted channels and allows attackers full control over infected systems. No patch or remediation guidance is provided in the source.
A hardware implant hidden inside Ledger signer devices sold through a Southeast Asia reseller was used to steal at least $86 million in cryptocurrency. The implant intercepted sensitive user data, including the 24-word recovery phrase displayed during device setup, and transmitted it via LTE to attackers. The compromise was limited to devices sold by the reseller CryptoBilis. Ledger has advised affected users to stop using those devices and move assets to new devices with new seeds.
The npm package @user-interface-common/common-styles version 66.1.6 is a malicious package published as part of a dependency confusion campaign. It includes a preinstall script that runs code sending an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and identifying information about the installed package. This behavior indicates that any system installing this package may be compromised.
The npm package '@mntv-analysis/workspaces-components' version 65.11.3 is a malicious package published by the user 'conx3993' as part of a dependency confusion attack. It contains a preinstall script that executes code sending an HTTPS GET request to an attacker-controlled server with a hardcoded authorization token and the installer's public IP address. This behavior acts as a reconnaissance beacon to identify victims who install the squatted package. The package itself performs no legitimate function and is considered fully compromising to any system where it is installed.
The npm package @mntv-analysis/ui-components version 50.1.1 is a malicious package published by the user 'conx3993' as part of a dependency confusion attack. It masquerades as an internal package and executes a preinstall script that sends an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and signaling successful installation. The package contains no legitimate UI component code and serves solely as a tracking beacon.
The npm package '@mntv-analysis/ui' version 99.1.1 is a malicious package published by the user 'conx3993' as part of a dependency confusion attack. It masquerades as an internal package and uses a high version number to be preferentially resolved by misconfigured package resolvers. During installation, a preinstall script runs that sends an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and a unique authorization token identifying the installed package. The package contains no legitimate UI functionality and acts as a beacon to tag victims. Systems with this package installed should be considered fully compromised.
The npm package 'monkey-tags-ip' version 53.4.1 is a malicious package published as part of a dependency confusion campaign. It masquerades as an internal package and executes a preinstall script that sends an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and installation event. The package also declares a dependency on a third-party 'https' package, potentially introducing additional malicious code. The package has no legitimate functionality and is designed solely to beacon installation details to an external actor.
