Brevo, a customer engagement platform, suffered a supply chain attack where attackers exploited a vulnerability in SAML SSO to gain access to accounts and later used a compromised Cloudflare API key to deploy malicious scripts. These scripts were injected into Brevo's websites and JavaScript files embedded by over 100,000 customer websites. The malicious code showed a fake Cloudflare verification page to visitors, attempting to trick them into running commands on their machines (ClickFix social engineering). The attack lasted about five and a half hours before Brevo revoked the compromised credentials and removed the malicious worker. The incident highlights risks from compromised API keys and supply chain vulnerabilities.
RatHat is a newly discovered Android malware that leverages AI to automate remote control of infected devices. It abuses Android Accessibility permissions to perform privileged actions, including enabling Developer Options and Wireless Debugging to gain shell-level access without external devices. RatHat installs a persistent Go-based agent that manages execution, persistence, and restoration of the malware and its components. It captures sensitive information such as banking credentials, SMS messages, one-time passwords, and lock-screen PINs via overlays and keylogging. The AI subsystem enables adaptive interface navigation by analyzing the live Accessibility tree and issuing dynamic commands, making detection and removal more difficult. The malware also employs anti-analysis and anti-removal techniques, including fake uninstall screens and obfuscation methods. Distribution occurs through malvertising, SMS, and phishing sites promoting APKs outside Google Play.
Brevo experienced a supply-chain attack where attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into Brevo's websites and JavaScript files embedded on customer sites. This injection was used to distribute malware to visitors of affected sites.
The FamousSparrow espionage group, linked to China, has deployed a new backdoor malware named SparroWocky targeting government organizations in Latin America since mid-2025. SparroWocky is a modular C++ backdoor with advanced anti-analysis and evasion techniques, including DLL side-loading, runtime code patching, and thread creation interception to disguise malicious activity. It enables extensive system reconnaissance, file operations, screenshot capture, process creation, and network proxying. Persistence is maintained via Windows services or registry keys. The malware communicates with multiple command-and-control servers over common ports and proxies. The attacks aim to gather intelligence on Latin American governments' responses to U.S. pressure on Chinese economic interests.
Iranian state-linked hackers are deploying a Windows malware strain named CHOSEN BRICK to conduct espionage on dissidents, activists, and journalists globally. The malware is used to spy on targeted individuals, indicating a focus on surveillance rather than widespread disruption or destruction.
A banking malware operation active since mid-2025 uses a toolkit called KREMLIN to forcibly install malicious Chrome and Edge browser extensions. These extensions are designed to steal credentials, session tokens, and other sensitive user data. The malware bypasses normal browser security checks to achieve installation.
An analysis of Atomic macOS (AMOS) stealer infections from early August 2026 reveals this information stealer targeting macOS systems has been advertised since April 2024. AMOS exfiltrates system information, login credentials, and sensitive data from web browsers and cryptocurrency wallets. Distribution methods include ClickFix campaigns, malicious advertisements, and fake cracked software sites offering macOS toolkits. The examined infection chain begins with malicious instructions on getmacouscloud[.]com, leading to execution of a Zsh script that retrieves and installs Mach-O binaries establishing persistence in system directories. The malware collects data from various applications including Binance, TonKeeper, Telegram, AWS, Docker, and FileZilla, compressing it into an out.zip file before exfiltrating to command and control servers. Post-infection traffic consists of HTTP POST requests with specific stage parameters indicating collected data types. The malware demonstrates active development with con...
Chosen Brick is a Windows malware family used by Iranian state-sponsored actors to surveil dissidents, activists, and journalists globally. Active since at least 2025, it harvests personal data such as contacts, emails, and social media messages to track individuals. Infection typically begins via messaging platforms like WhatsApp and Telegram, using social engineering to deliver malicious files disguised as legitimate utilities or medical documents. The malware establishes persistence through registry keys, evades Microsoft Defender by adding exclusions, and uses Telegram bots for command-and-control and data exfiltration. It can capture screenshots, record audio, steal browser chat data, deploy secondary payloads, and wipe data on command. The FBI and allied agencies have published advisories detailing its use and infrastructure. No automated lateral movement is observed, but operators can manually expand access via secondary payloads.
A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. [...]
A threat actor compromised the official HBO Max Reddit account and used it to run a malvertising campaign that directed macOS and Windows users to a fake HBO Max site. The site prompted users to execute commands that installed malware designed to steal credentials, messages, browser data, and cryptocurrency wallet information, and maintain persistence. The campaign, active for 48 hours, used multiple malware families including MacSync, AMOS Helper, Amatera Stealer, AnimateClipper, and ZigClipper. Clipboard stealers replaced cryptocurrency addresses to divert transactions. Reddit suspended the malicious ads after notification.
Hackers compromised HBO Max's official Reddit account and used it to push malicious ads that launched ClickFix attacks to infect Windows and macOS devices with information-stealing malware. [...]
A critical remote code execution vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows is actively exploited by the UNC3569 threat group to deploy the GrayRabbit backdoor malware. The attack chain abuses a custom URI handler, an unrestricted URL navigation in an embedded Chromium webview, and a known flaw in an outdated Chromium 80 engine running without sandboxing. Tencent released a patch in version 16.3.0.3498 that validates URL arguments and restricts navigation to approved domains, but the underlying Chromium engine remains outdated and unsandboxed.
Threat actors are chaining critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication and gain administrative privileges on self-hosted servers. This unauthorized access is then used to deploy a Rust-based backdoor malware. The attacks target vulnerable self-hosted instances of Artifactory, potentially compromising the affected systems.
Anthropic disclosed that a Russian state-linked group, Midnight Blizzard, used the Claude AI model to automate malware evasion by iteratively modifying malware to avoid detection. The group targeted over 20 organizations including government ministries, defense bodies, and think tanks across Ukraine, Europe, the Middle East, and Asia. They also exfiltrated sensitive data from drone manufacturers and compromised hospitality vendors to hijack guest Wi-Fi traffic. Additionally, other financially motivated groups targeted AI infrastructure by stealing API keys and attempting to access pre-release Claude models. Anthropic disrupted these operations and enhanced AI safeguards accordingly.
Tourmaline is a sophisticated multi-stage Windows malware distributed via a fake Cloudflare CAPTCHA popup that tricks users into manually executing a malicious installer. The malware uses a custom Inno Setup installer bundling a full Python 3.11 runtime and employs an anti-sandbox time-lock mechanism to evade analysis. It establishes persistence under the name "TourmalineUpdate" disguised as a hardware monitoring service. The backdoor communicates with its command-and-control (C2) server via a custom DNS-over-UDP tunnel to a dynamically resolved IP address obtained from an Ethereum Sepolia testnet smart contract, making IP blocklisting ineffective. Commands from the C2 are ECDSA-signed and executed via Python's exec() function, allowing arbitrary remote code execution. Indicators of compromise and deobfuscated source code are publicly available for defensive research.
Mantax Otax is a newly identified Android malware strain that combines ransomware and spyware functionalities. It encrypts files on infected devices, steals sensitive user data, and additionally spams and harasses victims. This multifaceted malware poses a significant threat to Android users by compromising both data confidentiality and user experience.
An investigation revealed a sophisticated cryptocurrency and credential-stealing operation using Amatera stealer as the primary payload. The attack chain leverages Cloudflare Workers to inject JavaScript stored on BNB Smart Chain, presenting fake Google CAPTCHA prompts that lead to WebDAV-based DLL execution. Two parallel infection chains were identified, one loading through a DLL named 'pf.ch' and another through 'verification.google', both delivering Amatera stealer with different secondary payloads. The 'pf.ch' variant deployed ZigCryptoStealer via NativeAOT loader and a Go-based reverse proxy, while the 'verification.google' variant installed NetSupport Manager with C2 infrastructure in Russia. The operation affects numerous countries with primary focus on stealing cryptocurrency wallets, credentials from password managers, and various authentication data through extensive collection rules targeting over 400 applications.
Cisco Talos is tracking a cryptocurrency theft campaign that abuses the Google Visualization API to deliver obfuscated JavaScript from Google Sheets, which victims are socially engineered to inject into their browser sessions. The attack uses a variation of ClickFix social engineering, convincing targets to paste malicious JavaScript into the Chrome address bar or install it via the Tampermonkey extension for persistence. The malicious script acts as a web skimmer, hooking the browser's fetch API to replace cryptocurrency deposit addresses and manipulate clipboard contents, deceiving users with fake bonus interfaces. The campaign targets users on cryptocurrency and hacking forums with a lure about a nonexistent API vulnerability to entice quick financial gain. The actors moved their hosting to Google Docs and Sheets after disruptions on paste sites. While this campaign primarily targets individuals, the techniques used could be adapted for broader supply-chain or web-based attacks.
Since mid-2025, a Chinese-speaking cybercrime group dubbed Gambling Goblin has conducted a sustained campaign targeting Brazilian organizations, mainly government and educational institutions. The attackers compromise web servers and install malicious Apache modules that stealthily reverse-proxy visitors to phishing pages impersonating trusted app stores. These phishing pages promote online gambling and sports betting while leveraging hijacked high-reputation domains to manipulate search engine rankings and hijack traffic. The group uses a heavily obfuscated Linux toolkit including downloaders, backdoors, credential stealers, and brute-forcers. The infrastructure is scalable and extends beyond Brazil, with parallel phishing networks targeting Vietnamese, Spanish, and English-speaking victims. The phishing infrastructure could be reconfigured to deliver malware directly, posing a latent escalation risk.
A Russian national was indicted in the United States for conducting a phishing campaign that infected approximately 80,000 freelancers with TVRAT and DarkVNC malware. The attacker used fake accounts to send malicious Microsoft Excel attachments containing macros, which downloaded malware onto victims' systems. The malware enabled remote control of infected devices and exfiltration of stolen data, including e-commerce credentials and personally identifiable information. The campaign primarily targeted users of a freelance employment platform, with half of the victims located in the United States, especially in Northern California. The attacker has been extradited and is in federal custody.
