Threats tagged 'chinese-speaking operator'

Between September 9 and 13, 2026, a coordinated campaign exploited Magento and Adobe Commerce stores globally using CVE-2026-75650 (StyleSmuggler). The attackers delivered a shell-script dropper, PSK Agent RAT, and PHP webshell via the /paypal/transparent/response/ endpoint. The dropper had 0% detection on VirusTotal at analysis time. The campaign also deployed chi_down, an obfuscated Go binary with remote access capabilities including command execution, SOCKS5 proxying, and encrypted communications. DNS exfiltration was used to track successful compromises. Chinese-language comments and infrastructure naming suggest a likely Chinese-speaking operator, though no specific threat group attribution is confirmed. Multiple operators are exploiting the same vulnerability with different toolkits.

In October 2026, a Chinese-speaking threat actor conducted a global AI-assisted hacking campaign using the ARTEX penetration testing framework combined with multiple AI coding assistants. The attacks targeted organizations across finance, retail, education, cryptocurrency, and telecommunications sectors in over 20 countries worldwide. The campaign utilized custom scripts to maintain context across AI sessions and divided tasks among specialized AI agents. The attackers sought bulk personal data, transaction records, and mobile phone numbers, with indications of intent to sell stolen information on underground markets. The workflow included peer review among AI models to improve effectiveness. The campaign is financially motivated and opportunistic in nature.

Malware#global targeting#multi-model orchestrationUnited States+15

An active malware campaign has been discovered distributing malicious VBScript files through WhatsApp direct messages since June 2026. The operation affects users across multiple countries, with Malaysia experiencing the highest concentration of victims. Attackers compromise WhatsApp accounts and send weaponized VBS files disguised as business and financial documents to contacts. The multi-stage infection chain ultimately deploys legitimate ManageEngine Endpoint Central RMM software, providing persistent remote access to compromised systems. The scripts employ heavy obfuscation, Chinese-language comments, and modify Windows UAC settings. Infrastructure overlaps with ValleyRAT and Gh0st RAT operations suggest possible Chinese-speaking operators, though attribution remains uncertain. The campaign primarily targets individual users through opportunistic rather than focused methods, exploiting social engineering techniques with localized filenames in multiple languages.

Malware#uac bypass#valleyratAustralia+8