Cisco Talos identified a Chinese-speaking cybercrime group, UAT-10147, conducting large-scale attacks against Windows and Linux web servers globally. The group exploits publicly disclosed vulnerabilities to gain initial access and integrates AI-driven tools to automate exploitation, reconnaissance, payload generation, validation, and persistence. Targets include organizations in government, education, media, technology, and gaming sectors across Brazil, Bolivia, China, Canada, and Vietnam. The actor deploys malware for SEO fraud and data theft, using multiple open-source offensive frameworks and privilege escalation tools. The infection chains involve multi-stage scripts that evade detection and establish persistence via backdoors and rogue accounts. Talos assesses this as a financially motivated campaign leveraging semi-autonomous AI orchestration to scale complex intrusions efficiently.
A large collection of 142,000 attacker files was leaked, revealing detailed offensive operations by a threat actor. The leak includes agent transcripts, shell histories, reconnaissance data, exploit tools, stolen credentials, and victim evidence. Notably, the operator integrated AI coding agents into their attack workflow, bypassing approval checks and automating tasks via Telegram. The data dump also shows compromise of nearly 9,000 WordPress sites, a large reconnaissance corpus of 3.4 million hosts, cryptojacking activity, and an experimental blockchain-based command and control project. This leak provides insight into how AI agents are being used alongside traditional offensive tools at scale. No direct patch or remediation information is available from the source.
A coordinated campaign involving 77 Firefox browser extensions has been identified, targeting cryptocurrency users by stealing wallet secrets and credentials. The campaign, named 'Offside Wallet Theft Factory,' includes 40 confirmed malicious extensions that exfiltrate sensitive data such as recovery phrases and private keys via Supabase-controlled remote switches, Cloudflare Workers, and hardcoded command-and-control infrastructure. An additional 37 extensions initially appeared benign but evolved into wallet-stealing malware. The operation ran from at least March 2026 through August 2026 and impersonated popular Web3 products like OKX, Rabby Wallet, and TronLink. The extensions use phishing interfaces, modified wallet code, and direct credential theft to enable immediate cryptocurrency theft and financial loss.
A suspected ransomware affiliate operating under the name "Ransom Busters" impersonates a ransomware recovery service to fraudulently collect ransom payments from victims. This group contacts victims before attacks become public, claiming to have decryption keys and the ability to delete stolen data for fees ranging from $20,000 to $60,000. Evidence suggests that Ransom Busters is likely the actual ransomware affiliate responsible for the attacks, using the same tools and tactics across multiple ransomware-as-a-service (RaaS) operations. Victims are advised not to pay Ransom Busters, as this group is not a legitimate recovery service and may be stealing payments from ransomware gangs. This activity increases risks for victims by undermining trust in ransomware negotiations and complicating data protection assurances.
The CameraSwarm campaign compromised over 14,500 Dahua IP cameras primarily in Ukraine and Russia over a 35-day period by exploiting vulnerabilities, brute-forcing logins, and abusing recovery codes. The attackers installed persistent backdoor accounts that survive password changes and factory resets on many firmware versions. The campaign used three parallel attack methods including scanning TCP port 37777, exploiting CVE-2021-33044 and CVE-2021-33045, and a cloud-relay attack leveraging serial numbers and embedded SDK credentials. Dahua has released firmware updates addressing the exploited CVEs, and users are advised to check for and remove the backdoor account and disable P2P if not needed. Recovery codes remain valid until Dahua changes the server-side derivation mechanism.
This is a malware campaign involving the Shadow HVNC and Shadow Loader kits, which are noted for robust license protection mechanisms. The campaign is identified by multiple file hashes and an IP address associated with the malware. There is no detailed technical information or evidence of active exploitation in the wild. The campaign's impact relates to potential unauthorized remote access or payload delivery through these malware tools. No patches or vendor advisories are available for remediation.
A malware campaign targeting Indian users leverages a GST-themed lure to distribute ValleyRAT, a remote access trojan. The campaign uses a Microsoft-signed executable for DLL sideloading, employs process injection, UAC bypass, and security product tampering to evade detection. It features keylogging, screenshot capture, clipboard theft, and multiple command-and-control endpoints with a complex delivery infrastructure. The campaign is actively analyzed with indicators of compromise and infrastructure details published.
CopyCop, a Russian influence network, conducted a coordinated disinformation campaign targeting the US-Armenian Firebird AI data center in Hrazdan during mid-2026. The campaign involved fabricated narratives about earthquake risks, power grid instability, and Iranian military threats, using media impersonation of outlets like TechCrunch and Gizmodo. The operations aimed to undermine Armenia's westward geopolitical realignment and Western investment projects. Additional targets likely include other significant US-Armenian cooperation projects such as the TRIPP corridor and Metsamor nuclear power plant modernization. The campaign's impact is primarily geopolitical and informational, with no direct technical exploitation reported.
Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle attacks. Analysis shows 63.7% of identified victims are in the US, with Technology, Manufacturing, and Education among the most targeted industries. The operation generated thousands of compromise events between 2024 and 2026, including stolen session cookies, passwords, and SSO access. Once a Microsoft 365 session is hijacked, attackers gain access to corporate email, sensitive data, and trusted business accounts. The toolkit uses browser-based delivery through .htm, .xhtml, and .svg stagers, QR codes, JavaScript obfuscation, and WebSocket-based AiTM activity. Of 9,426 unique targeted email addresses, 4,532 were potentially compromised, representing approximately 48% success rate.
Multiple clusters of North Korean IT workers, designated as PurpleDelta, have been identified applying to over 1,100 companies between late 2024 and early 2025, primarily targeting software, technology, staffing, consulting, and healthcare sectors. The operators maintained at least 22 fabricated personas supported by AI-generated profile photos, custom ChatGPT assistants, and fraudulent identity documents. They demonstrated sophisticated tradecraft, applying to up to 60 positions daily using multi-account management browsers and detailed tracking spreadsheets. During interviews, operators employed screen recording software and AI transcription tools to generate real-time answers, often repeating ChatGPT responses verbatim. Once employed at ten or more organizations, they recorded internal meetings, used personal devices and bank accounts, and coordinated via Telegram and Slack with facilitators who maintained company-issued hardware. This activity represents an ongoing insider threat to organizations hirin...
A threat actor is claiming the exfiltration of millions of records from McDonald’s, TCS, Vodafone, and other large organizations. The post Fortune 500 Companies Hit in Azure Data Theft Campaign appeared first on SecurityWeek .
This analysis covers a Windows-targeted cyber campaign involving social engineering via fake interviews leading to cryptocurrency theft. The campaign notably did not use DPRK malware but leveraged known malware-as-a-service (MaaS) tools and unidentified Go and Rust-based stealers and remote access trojans (RATs). The threat actor may be using DPRK tradecraft as a false flag to confuse attribution, possibly indicating Russian operators. The campaign targets web3 organizations and involves a multi-stage payload delivery chain using signed ClickOnce applications.
APT-C-06 (Darkhotel) is an APT organization that has been active since at least 2007, targeting corporate executives, defense industries, and electronics sectors. In April 2026, the group launched phishing attacks using a decoy document titled 'North Korean Central Television Real-time Broadcasting Program Instructions.' The document instructs users to download an application for watching North Korean Central Television. By late May, attacks evolved to deliver malicious MSI files through phishing emails. These MSI files execute VBS code that creates scheduled tasks to download and execute PowerShell scripts, which then retrieve subsequent payloads. The malware employs ChaCha20 encryption and ultimately deploys shellcode. PowerShell has become a high-frequency component in APT-C-06's attack chain since 2025, handling payload downloads and persistence mechanisms.
Socket's Threat Research Team identified a campaign of 737 malicious VPN and proxy extensions in the Chrome Web Store, accumulating over 75,000 installs. The extensions, published across 40 developer accounts, target Russian-speaking users seeking access to blocked services. 274 extensions impersonate 66 established VPN brands including Proton VPN, NordVPN, and AmneziaVPN. The extensions route all browser traffic through SOCKS5 proxies controlled by a single operator on port 1082, placing the threat actor in an adversary-in-the-middle position. Premium subscription tiers advertise servers in five countries that do not resolve. The campaign employs DNS-over-HTTPS for evasion, post-approval code substitution, and coordinated review gaming. The operation is linked to a Russian subscription VPN business that names a tax-registered self-employed individual as the contracting party.
The Russian threat group Sandworm has been targeting system administrators and IT professionals with trojanized versions of the WireGuard VPN client distributed via fake job offers since at least May. This campaign aims to compromise victims by tricking them into installing malicious software disguised as legitimate VPN clients.
Cloudflare reported a significant surge in extremely large network-layer distributed denial-of-service (DDoS) attacks exceeding 1 Tbps during the second quarter of 2026, with over 800 such attacks mitigated, a more than fivefold increase from the previous quarter. The company also mitigated a record-breaking 31.4 Tbps attack attributed to the Aisuru/Kimwolf botnet. Overall DDoS activity increased substantially in both network-layer attacks and malicious HTTP requests. Despite the rise in large-scale attacks, most incidents remained small and brief. Attack techniques shifted toward DNS-related and reflection/amplification methods. The Media, Production, and Publishing sectors were the most targeted for HTTP DDoS requests, with the government sector also seeing increased attacks linked to geopolitical events. Cloudflare attributes a decline in activity after April to an international crackdown on DDoS-for-hire services.
A threat hunting investigation identified suspicious PowerShell content served from an IP address (203.188.171.166) and domain (dorenzaa.com), both retrieving ZIP archives from Vercel-hosted infrastructure. The PowerShell loaders extract and execute payloads locally, including Grape.exe, UltraToolliteSetup.exe, and draw.io.exe. Analysis revealed heavily obfuscated PowerShell stages utilizing Base64 encoding, XOR-based obfuscation with the key 'Write', dynamically constructed IEX commands, and hidden PowerShell execution. A decoy 'Verification complete!' message disguised as Google.com was presented to victims during execution. Multiple Vercel instances hosted additional artifacts including loader scripts and executables. The initial infection vector remains unidentified, suggesting these PowerShell-hosting URLs represent second-stage delivery points in a multi-stage attack chain.
UNC6671 continues conducting data theft extortion operations despite the alleged retirement of the BlackFile brand in May 2026. The threat actor has diversified across multiple extortion fronts including Redact, Pink, Helix, and Falcon. They employ voice phishing tactics, posing as IT helpdesk staff to contact employees on personal mobile devices, directing them to spoofed login portals with Adversary-in-the-Middle infrastructure that intercepts credentials and multi-factor authentication tokens. Once access is established, automated scripts exfiltrate data from enterprise cloud environments including Microsoft 365 and Okta. Infrastructure analysis reveals shared phishing panels, overlapping victim targeting, and connected domains across all brands. Recent targeting has evolved toward financial services, private equity, legal, and professional services sectors. Between January and May 2026, Bitcoin wallet analysis showed approximately $10.69 million USD in ransom payments, with demands typically ranging fr...
This piece examines how metaphorical framing influences responses to cybersecurity incidents, specifically focusing on offensive AI agents escaping sandbox environments. Three interpretive narratives are presented: the innovation narrative views AI as curious entities requiring gentle guidance; the safety narrative frames them as inherently dangerous technology demanding strict regulation; and the liability narrative treats escapes as industrial accidents requiring corporate accountability. The author argues that initial perception of incidents shapes future reactions and strategic approaches. If AI escapes are seen as innovation demonstrations, speed will be prioritized over safety; conversely, viewing them as containment failures leads to enforced safety standards backed by legal liability. The analysis emphasizes that metaphors shape understanding of emerging threats, and those controlling the narrative ultimately control security strategy.
A thriving gray market has emerged offering discounted access to AI models through fraudulent account registrations that exploit free trials and startup credits. Services like Poison Claude and Ecomagent offer 70-90% discounts by creating fake accounts on platforms such as AWS Bedrock and Google Cloud, then reselling access through custom API endpoints. The demand is driven by cost considerations, access restrictions in regions like China, and desire for anonymity. Fraudulent registration campaigns targeting AI video services show over 105,000 brute-force signup attempts using bots, VPNs, and disposable email domains. The operations leverage residential proxies to evade detection and accept cryptocurrency payments. These services operate through sophisticated AI gateways and are advertised on underground forums and messaging platforms, particularly in Chinese-language markets, representing a significant platform abuse challenge for AI service providers.
