TIKTOUK is a credential collection toolkit targeting WordPress sites. It includes modules that identify WordPress installations, extract exposed configuration files and database credentials, decrypt email credentials from SMTP plugins, and harvest secrets from client-side JavaScript. The toolkit sends all collected data to a centralized controller. Real-world incidents have revealed approximately 50,000 compromised server credentials across 37,000 domains, including hundreds of validated AWS keys that could be abused.
A large-scale phishing operation has deployed 70 fraudulent websites impersonating legitimate cryptocurrency projects including xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, and Firelight. The fake sites closely replicate authentic platforms and lure visitors with offers to vote on rewards distribution dates in exchange for a 1.25x boost. Upon clicking the vote button, users encounter a wallet connection prompt that ultimately leads to malicious authorization requests designed to drain cryptocurrency tokens. The targeted projects were strategically selected based on recent token launches, airdrops, or active rewards programs, making the phishing attempts appear credible to community members. All malicious domains follow the pattern 'sitemu' followed by random characters on the .xyz domain, suggesting a coordinated campaign using shared infrastructure and phishing kits.
In July 2026, China-aligned threat actor TA419 conducted credential phishing campaigns impersonating prominent economists and AI policymakers, targeting AI experts at US think tanks, universities, and legal organizations. The group sent benign conversation starter emails themed around AI policy topics, such as invitations to join an AI Policy Advisory Committee. Upon receiving responses, TA419 deployed multi-stage URL redirection chains leading to Adversary-in-the-Middle credential phishing pages using a customized Frameless Browser-in-the-Browser tool. Active since April 2025, TA419 consistently targets individuals at US and Japan-based think tanks, defense contractors, universities, and law firms. This activity likely supports Chinese intelligence objectives to monitor US AI policy and regulatory developments amid strategic competition involving AI technologies, model distillation concerns, and export controls between the US and China.
CVE-2026-88771 is a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway. Exploitation involves attacker-controlled usernames triggering command execution, payload retrieval, reverse shell deployment, web shell installation, privileged account creation, and attempted exfiltration of configuration data. Two second-stage payloads, main.py and update_c08937.pl, facilitate persistent access and data theft. Post-exploitation artifacts include creation of superuser accounts and system binary modifications. Public exploit code is available via Metasploit. No patch or remediation details are provided.
On August 31, 2026, threat actors exploited two zero-day vulnerabilities in PaperCut MF version 24.0.2, targeting an internet-facing print server in the Education sector. The attackers deployed an in-memory Java loader to establish a web shell, through which they delivered a trojanized Microsoft Copilot binary containing an AdaptixC2 implant. This implant connected to command-and-control infrastructure hosted on Alibaba servers. After a dormant period, the attackers performed reconnaissance and Active Directory enumeration, stole a token from a domain-privileged service account, and moved laterally to a domain controller. On the domain controller, they dumped credentials, enabled Windows Restricted Admin mode for pass-the-hash attacks, and extracted the NTDS.dit database, achieving full domain compromise.
A malicious actor exploited a Citrix NetScaler Gateway zero-day vulnerability on September 24, 2026, three days before public disclosure. The attacker attempted to establish persistence using a password-protected webshell and tried to escalate privileges by setting setuid and setgid bits on /bin/sh. The attack involved disguising a PHP webshell as a CSS file and manipulating web server aliases to evade detection. Although the targeted sensor was not compromised, the attack demonstrated sophisticated post-exploitation techniques for maintaining access and evading detection.
Since January 2026, the Russian state threat actor Star Blizzard has enhanced its cyberespionage operations by adopting a new malware delivery technique called RedFlick, alongside large-scale phishing campaigns and use of compromised website accounts. These tactics improve detection evasion and target Ukrainian individuals and institutions, as well as international NGOs, Western think tanks, governments, and organizations linked to Ukraine support. Indicators include multiple malicious domains, file hashes, and an IP address associated with the campaign. No specific software vulnerabilities or CVEs are identified.
2CLoader is a newly identified malware loader active since August 2026 that delivers information stealers such as Vidar and Remus, as well as the XWorm RAT. It features advanced anti-analysis and evasion techniques, including anti-VM, anti-debug, indirect system calls via Hell's Gate, and inline trampoline hooks to bypass endpoint security. The loader protects its payloads with rolling XOR and AES-GCM encryption stored as PE resources and supports multiple execution methods. It communicates with command-and-control servers using encrypted JSON over HTTP POST and maintains persistence through registry keys, scheduled tasks, and startup folders.
CVE-2026-73570 is an unauthenticated OS command injection vulnerability in the SNMP notification path of Zimbra Collaboration Suite mail servers. It was actively exploited between July and August 2026. Attackers used this flaw to deploy JSP webshells and reverse shells without authentication, escalate privileges via PAM configuration abuse, and maintain persistence through systemd services. Post-exploitation activities included lateral movement across clusters using Zimbra SSH keys, theft of authentication secrets and mailbox data, and attempts to exfiltrate data using cloud storage tools. Multiple organizations across various regions and industries were targeted through automated and manual attacks on internet-facing Zimbra mail servers.
A China-nexus threat cluster designated UAT-11587 has been targeting government and policy organizations across eight Asian countries since September 2025, delivering a previously undocumented Rust-compiled backdoor called Antino. The campaign primarily affected Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria through sophisticated spear-phishing operations using tailored political and diplomatic lures. The multi-stage infection chain leverages Cloudflare infrastructure for delivery and deploys Antino, which uniquely uses Microsoft 365 services—specifically Outlook and OneDrive—as dead-drop command-and-control channels rather than traditional C2 servers. The backdoor supports reconnaissance, command execution, file transfer, shellcode loading, and persistence establishment. Attribution to Chinese nexus is based on metadata containing Simplified Chinese artifacts, UTC+8 timestamps, use of China-focused Rust package mirrors, and targeting patterns consistent with Chinese intellige...
In July 2026, phishing campaigns targeted organizations across multiple industries by distributing a masqueraded MSP360 Remote Monitoring and Management installer through meeting invitations, PDF-themed lures, and software update prompts. Once executed, the legitimate MSP360 installer established remote management access on affected devices, providing threat actors with an initial foothold using trusted administrative software. The MSP360 deployment was then used to download and install a ConnectWise ScreenConnect client, creating a secondary remote-access channel for redundant access to compromised systems. Following access establishment, threat actors deployed additional tools and conducted post-compromise activity, including information collection and credential-access operations. The campaigns utilized multiple delivery mechanisms including actor-controlled domains, compromised websites, and legitimate cloud services such as Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.
Scammers have weaponized fake iPhone Duo preorder pages to deploy the DarkSword exploit chain against vulnerable iPhones. The fraudulent pages mimic Apple's design and offer a $500 voucher to lure victims, but simply opening the page in Safari triggers an exploitation attempt without requiring user interaction. The attack targets iPhones running unpatched iOS versions, attempting to bypass security protections and deploy a payload designed to steal saved credentials, cryptocurrency wallet data, notes, messages, contacts, and other sensitive information. The exploit leverages vulnerabilities previously disclosed by Google in March 2026 and patched by Apple. If successful, the payload establishes communication with command-and-control servers and can execute additional commands remotely while attempting to cover its tracks by deleting diagnostic reports.
Threat actors exploited ChatGPT's Custom GPT feature to impersonate legitimate models and lure victims via sponsored Google ads to malicious Custom GPTs named 'Plus 5.6'. Victims were shown fake service notices and redirected to Google Sites hosting ClickFix lures disguised as CloudFlare CAPTCHA checks. They were tricked into running PowerShell commands that downloaded malicious MSI installers. The attack used DLL sideloading with legitimate Canon- and Stardock-signed executables to establish persistence via registry Run keys and scheduled tasks. The multi-stage infection involved obfuscated scripts, encrypted payloads hidden in WAV files and NuGet packages, and deployed a remote access trojan with capabilities including remote desktop access, browser hijacking, credential theft, and follow-on payload delivery. Approximately 40 incidents were investigated by Huntress.
RATHat is an Android banking trojan characterized by its unique architecture where the malicious application serves merely as an entry point. After obtaining Accessibility Service permissions, it enables wireless debugging, pairs with the device's ADB daemon, and deploys a native Go service that operates outside Android's permission model. The operation's primary investment lies in its infrastructure, with three successive Command-and-Control panel generations emerging between April and September 2026: BlackCat, followed by Panda Workshop V5 and V6. These panels function as complete malware factories, building, signing, and publishing samples automatically while implementing scheduled rebuilds to evade hash-based detection. Nearly 100 separate deployments across Europe, LATAM, and South-Eastern Asia suggest a Malware-as-a-Service model. Notably, the operation integrates AI on both sides: the malware uses Gemini models to locate on-screen controls when automation fails, while the panel employs LLMs to estim...
NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.
Operation Master is a sophisticated cybercrime campaign exploiting a GlobalProtect authentication bypass vulnerability (CVE-2026-0257) to compromise enterprise networks across multiple countries. The attackers conducted extensive network scanning to identify high-value targets, executed SQL injection attacks with privilege escalation to steal databases, and exfiltrated Active Directory credentials. They monetized stolen data by selling it on underground forums and operating a multi-tenant automated invoice fraud platform that sent millions of phishing messages and fraudulent links. The operation employed advanced phishing techniques including M365 OAuth device-code phishing and voice-based credential harvesting, with payments collected via PIX through serverless proxies.
A Python-based Malware-as-a-Service builder enables operators to generate customized Windows infostealer executables. The system comprises a builder component and an embedded payload, using Nuitka or PyInstaller compilation to evade detection. The builder features automatic dependency installation, webhook configuration with XOR and Base64 encoding, and multiple compilation backends. The payload targets Chromium and Firefox browsers, extracting credentials, cookies, and credit card data. It harvests Wi-Fi passwords, Discord tokens, and Roblox session cookies while employing anti-analysis techniques including debugger detection, VM process blacklisting, disk size checks, and timing evasion. Persistence is established through registry Run keys and scheduled tasks. All stolen data is packaged into in-memory ZIP archives and exfiltrated via attacker-controlled webhooks, following a scalable affiliate model.
Lunex is a sophisticated information stealer malware targeting Ukrainian-speaking users via fake CAPTCHA pages. It uses a four-stage attack chain and employs Bring Your Own Vulnerable Driver (BYOVD) techniques with AMD's PDFWKRNL.sys to disable kernel-level security monitoring. The malware targets seven Chromium-based browsers to extract credentials and cryptocurrency wallets, maintaining persistence through PowerShell-based Chrome Native Messaging Hosts. It operates a large command-and-control infrastructure across multiple countries and is run by a financially motivated threat actor from the CIS region as a Malware-as-a-Service platform.
An investigation reveals that placeholder domains commonly used in documentation are serving malicious content through advertising chains. Two domains, yoursite[.]com and your-domain[.]com, present in hundreds of thousands of GitHub files and agent skills, use cloaking techniques to display scams specifically to macOS visitors while showing legitimate parking pages to others. The scams include fake MacOS Security Center warnings and counterfeit news articles promoting investment schemes. These attacks leverage affiliate fraud models, funneling victims through multiple redirectors to genuine services like McAfee subscriptions to earn commissions. Static security checks fail to detect these threats because malicious redirects occur after JavaScript execution. This follows an earlier disclosure about third-party[.]com serving ClickFix lures. The widespread citation of unregistered placeholder domains in documentation creates significant exposure, particularly for AI agents that fetch and act on this content.
An undocumented remote-access Trojan named Kothamine Agent has been discovered with support for over 30 commands, enabling attackers to control infected Windows systems through command execution, file manipulation, and capability extension. Some variants include browser data theft and camera/microphone recording functionality. The malware has been distributed through malicious npm packages and utilizes tailcat, an open-source Tailscale tool, to establish encrypted command-and-control communications that evade conventional network inspection and blocking. Earlier versions employed Tailscale VPN before transitioning to tailcat. Active since July based on VirusTotal and GitHub evidence, Kothamine features a plugin system for loading additional DLLs, UAC bypass capabilities in certain builds, and employs AES-GCM encryption for C2 communications. The malware achieves persistence through scheduled tasks and adds Windows Defender exclusions during installation.
