Cybercriminals are distributing remote access trojans (RATs) via phishing emails that mimic legitimate event invitations. These emails contain download buttons leading victims through fake CAPTCHA verification pages on newly created domains. After verification, users are prompted to download an eInvite file that contains a zipped folder with a weaponized ConnectWise Screen Connect installer acting as a RAT. Execution of this installer grants attackers full remote access to the victim's device, indicated by an inconspicuous taskbar icon. The campaign exploits user curiosity, especially during holiday seasons when event invitations are common.
VulcanRAT207.A is a sophisticated multi-stage malware intrusion chain initiated via a WhatsApp-delivered financial document lure. The malware uses compression and extensive host screening before escalating privileges to SYSTEM level through COM-based techniques and PoolParty Variant 7 injection. It deploys a signed driver to disable security processes, establishes persistence via DLL side-loading with a legitimate Intel-signed executable, and launches a WebSocket-based remote access trojan. The final payload provides extensive surveillance capabilities including shell access, keystroke logging, desktop control, network filtering, and process injection.
Funhouse ransomware, distributed by a North Korean threat actor linked to Kimsuky, uses malicious Korean-language resume documents to infect targets. It is a variant of the Endpoint ransomware family, employing multi-stage scripts (Batch, VBS, PowerShell) to install Quasar RAT before deploying ransomware. The campaign shows strong similarities to earlier Kimsuky Endpoint operations, with updates in encryption extensions, contact info, and command-and-control infrastructure. The initial infection vector shifted from LNK files to HWP documents. No known exploits in the wild or patches are applicable as this is malware distribution.
A sophisticated malware campaign named Midnight Mimosa targets low-cost Android devices using MediaTek platforms by preinstalling malicious code in device firmware before user acquisition. The malware operates as a platform-signed system application with elevated privileges, allowing silent installation of apps, permission grants, and remote code execution. It primarily facilitates ad fraud, click fraud, device data collection, and converts infected devices into residential-proxy botnet nodes. The malicious app disguises itself under system-like names and disables Google Play Store during payload deployment to evade detection. Several related malicious apps were also found on Google Play, linked to the same command-and-control infrastructure.
A sophisticated phishing campaign targets YouTube content creators by impersonating well-known brands such as Hollyland, Nike, and Spotify. Attackers send personalized sponsorship emails referencing specific videos from the creators' channels, directing them to fake platforms that mimic legitimate campaign dashboards. The scam culminates in a Google sign-in prompt that either steals credentials directly or requests excessive permissions. Compromised accounts are then locked by changing recovery options and used to propagate further scams to followers. This modular campaign operates globally, with confirmed targeting in Peru, Japan, and English-speaking regions, using multiple domains with consistent design and functionality.
Noir is a cryptocurrency wallet-drainer malware kit that uses DNS TXT records and DNS-over-HTTPS (DoH) as a dynamic command-and-control mechanism. It queries public DoH services to locate active infrastructure hosted on Cloudflare Pages, enabling operators to redirect phishing lures by changing a single DNS record. The malware does not require victims to input seed phrases or private keys but instead requests wallet connection permissions and spending approvals, which appear less suspicious. Its architecture separates long-lived phishing lures from short-lived operational infrastructure, with DNS caching and retry logic. The kit is AI-assisted, with extensive code comments documenting its development, and is used across multiple cryptocurrency-themed phishing campaigns.
In late September 2026, seven malicious npm packages impersonating a NebulaAI SDK were deployed to deliver a Windows remote-access trojan (RAT). The RAT uses direct NT and win32k syscalls, avoiding DLL imports, and includes features such as hidden-desktop remote control, camera and microphone monitoring via Kernel Streaming, and persistence through Winlogon Shell. The malware communicates with a command-and-control server at 65.87.7.132 and disguises itself as conhost.exe while employing anti-analysis techniques.
An unidentified, likely Chinese-speaking, financially motivated threat actor targeted South Korean financial institutions between late September and early October 2026, successfully exfiltrating data. The attacker used ARTEX, an open-source Chinese agentic penetration testing tool, combined with large language models such as DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 to enhance operational tempo and conduct multiple intrusions rapidly. Analysis revealed exposed ARTEX configuration files, Claude Code session histories, and a two-server infrastructure involving Hong Kong. The adversary also researched Korean data breach marketplaces and Telegram channels for monetizing stolen data. The campaign demonstrates sophisticated use of AI-driven tooling to conduct targeted intrusions against financial institutions.
MATCHBOIL is a custom C# downloader malware used by the Russia-aligned APT group UAC-0099. It downloads and installs payloads from command-and-control servers and establishes persistence on victim machines. The malware has evolved since April 2024, adding obfuscation, sandbox detection, and changing persistence mechanisms. It is distributed via spearphishing emails with malicious links that download VBScript files. MATCHBOIL typically delivers the MATCHWOK backdoor as its final payload. All known victims are Ukrainian organizations in transportation, manufacturing, and energy sectors.
In July 2026, a sophisticated malware campaign attributed to the TraderTraitor group was uncovered, leveraging a trojanized Terraform provider to target cryptocurrency and Web3 developers. The attack uses a malicious Terraform provider that downloads a Bash loader from a HashiCorp-themed lookalike domain, which then deploys platform-specific payloads for macOS, Linux, and Windows. Encrypted executables are hidden in fake font files and decrypted with AES-256-CBC. The campaign delivers FLATROOF, a Rust-based backdoor with multiple command and control (C2) channels, and Python-based information stealers targeting browser credentials and cryptocurrency wallet data. The attack concludes with deployment of the ROOFDECK backdoor, which uses resilient C2 discovery methods including cryptographically signed Pastebin dead drops and Nostr metadata.
Threat actors are targeting the accommodation industry with email campaigns containing fake guest complaints and inquiries. These emails deliver malicious LNK shortcut files disguised as images, which deploy blockchain-abusing malware families EtherRAT and TONResolver. These malware variants use public blockchain APIs for command and control infrastructure resolution, enabling dynamic infrastructure rotation and evasion of traditional takedown methods. The campaigns evolve from earlier Booking.com spoofing operations and likely use generative AI to create unique email variants, complicating detection.
The TensorLake npm SDK version 0.5.144 was compromised in a supply chain attack involving ChainDrop/Shai-Hulud malware. The malicious package, downloaded approximately 12,000 times weekly, contains obfuscated code that steals credentials from various sources such as npm tokens, GitHub tokens, AWS credentials, HashiCorp Vault, Kubernetes configs, SSH keys, and AI development tools. It executes via a preinstall hook, establishes persistence through scheduled tasks, and supports remote code execution. The attack uses an Ethereum contract for command-and-control and includes a dead-man switch that triggers destructive actions if stolen GitHub tokens are revoked. The malware can self-propagate by republishing compromised versions to other npm packages linked to the victim's publishing identity, spreading across the npm ecosystem.
An Iranian state-aligned threat actor, CL-STA-1178, has been conducting the Blinder Tunnel campaign since November 2025, targeting Iraqi critical infrastructure by impersonating the Dubai Airports IT department. The campaign delivers trojanized coding challenges that deploy ShelbyLoader V2 malware through a multi-stage attack chain involving AppDomainManager hijacking and DLL sideloading. The attackers use GitHub API infrastructure for command-and-control communications, including repositories and issues as fallback channels. Operational security errors revealed links to a separate credential harvesting campaign targeting Israeli entities with conflict-themed Google Drive lures in mid-2026.
In September, an organization was targeted by the Akira ransomware, where attackers gained initial access via Remote Desktop Protocol (RDP). The adversary disabled antivirus protections on the compromised endpoint, used Rclone for data exfiltration, and employed a GOST tunneling tool to maintain persistence. After these preparatory steps, the ransomware payload was deployed. Forensic analysis identified key indicators of compromise including specific file paths, SHA256 hashes of malicious binaries, and the command and control (C2) server IP address used for tunnel communications.
A Russian-speaking affiliate of the Gentlemen ransomware group, known as Azazel, compromised over two dozen organizations across six countries by exploiting CI/CD secrets from GitLab instances and conducting a deep compromise of an AI platform using SSRF, credential decryption, and continuous data exfiltration. Azazel operated an independent leak site called LEAKNED to publish stolen data and retain extortion proceeds. This campaign is notable for the first documented criminal use of AI assistant tooling via the Model Context Protocol (MCP) as a command-and-control channel. The attacker infrastructure included three nodes with over 50TB storage capacity, actively transferring approximately 6TB of victim data. Affected sectors include logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent organizations.
The Psychedelic Stealer is an active malware campaign targeting Ukrainian small-business websites as of September 2026. It tricks victims with a fake Cloudflare CAPTCHA page to manually run msiexec.exe commands that install malware. This malware steals browser credentials, session tokens, and cryptocurrency wallet data from wallets such as MetaMask and Trust Wallet. It maintains persistence through browser extensions using native messaging and scheduled tasks, and communicates with a REST API for further commands. The campaign uses signed Microsoft binaries and avoids encoded PowerShell scripts to evade detection. It is financially motivated and specifically targets Ukrainian victims.
A sophisticated multi-component malware campaign targets telecommunications and network-edge appliances using BPFDoor variants and a newly identified implant called AVERAT. The attackers exploit SMTP traffic on port 25 to hide command-and-control communications within legitimate mail relay activity. The malware uses memory-only execution to avoid leaving forensic artifacts on disk. BPFDoor variants impersonate legitimate processes on South Korean systems, while AVERAT targets Taiwanese appliances with regional disguises. The operation employs compromised consumer devices as relays, consistent with a China-linked covert network. The campaign demonstrates advanced evasion techniques including process spoofing and encrypted configurations.
BraZetsu is a Python-based Windows malware framework used by the Brazilian threat actor Exilware. It functions as a toolkit for Initial Access Brokers, converting compromised systems into assets for sale in underground markets. The malware targets corporate, financial, industrial, and law enforcement sectors primarily in Iberia and Latin America. It harvests financial transaction files in the Brazilian CNAB format, browsing histories, and digital certificates. BraZetsu supports the 'Infected Marketplace' where initial access is sold to criminal clients for further exploitation. Since early 2026, it has rapidly evolved to include AI-enhanced reconnaissance and advanced evasion techniques. There is no indication of known exploits in the wild or available patches.
During August 2026, multiple APT campaigns targeted South Korean entities primarily through spear phishing attacks utilizing LNK files. Six distinct attack types were identified, employing various techniques including PowerShell scripts, AutoIt programs, and DLL side-loading. Type A used HEX data extraction with PubNub command and control, while Type B leveraged curl.exe to download HTA files from GitHub and Google Drive, deploying infostealers and keyloggers. Type C distributed XenoRAT malware via GitHub repositories. Type D used resume-themed lures with VBS, BAT, and PowerShell scripts for backdoor injection. Type E employed Python-based backdoors through disguised pythonw.exe executables. Type F exploited Hangul documents with embedded OLE objects for malicious DLL loading. Attacks focused on information theft, system control hijacking, and additional malware deployment.
RemusStealer is a malware-as-a-service program exhibiting multiple similarities to LummaStealer, including anti-virtual machine checks, credential theft tactics, and Application-Bound Encryption bypass methods. A key distinction is RemusStealer's use of Ethereum smart contracts for C2 communications instead of Steam or Telegram dead drop resolvers. Written in Go, the stealer performs extensive system discovery, gathering information about antivirus products, hardware specifications, and operating systems. It employs hidden desktop environments to evade detection while launching Microsoft Edge and Brave browser processes on non-primary window stations to steal credential files. The malware establishes connections to suspicious domains ending in .shop or .biz and communicates with Ethereum-related infrastructure. This evolution demonstrates attackers' increasing sophistication in leveraging blockchain technology to masquerade malicious communications through smart contracts.
