Phexia is a modular macOS backdoor and infostealer actively distributed through ClickFix campaigns since late 2025. The malware employs a multi-stage infection chain beginning with Terminal command execution that downloads shell scripts, establishes persistence via LaunchAgents, and deploys AppleScript-based loaders. A significant evolution occurred in May 2026 when operators began using Polygon blockchain smart contracts as command-and-control dead-drop resolvers, replacing earlier Telegram and Steam-based methods. Post-compromise activities include credential harvesting through fake password prompts, browser data theft, keychain extraction, password manager targeting, and XMRig cryptominer deployment. The malware collects login passwords, browser encryption keys, cookies, and cryptocurrency wallet information. Multiple distinct builds communicate with rotating infrastructure, with reinfection potentially leaving concurrent installations active on compromised endpoints.
Ahead of the Grand Theft Auto VI release on November 19, 2026, threat actors are exploiting consumer excitement through phishing campaigns and fraudulent schemes. These campaigns use fake downloads, false early access offers, nonexistent mobile versions, and free game promises to lure victims. Malicious sites distribute trojans, request cryptocurrency payments, use content lockers requiring survey completion, and harvest personal information. Tactics include fake storefronts impersonating Rockstar Games, fraudulent APK files with unsafe permissions, and giveaway scams with urgency counters. Post-launch threats are expected to include in-game currency fraud, credential phishing for Rockstar and gaming platform accounts, and malware through fake cheats and modifications.
A sophisticated phishing campaign targets 189 US financial institutions using 248 look-alike domains that combine urgency keywords with bank names. The campaign uses a cloaking technique that shows fake "account suspended" pages to returning visitors while delivering real phishing content to first-time visitors, evading takedown attempts. It focuses on business banking and treasury portals, which typically have higher balances and transfer capabilities. The domains are hosted behind Cloudflare and traced to shared servers at two providers. Network analysis links this operation to a centralized backend managing additional phishing campaigns targeting institutions in the UK, Netherlands, Australia, and New Zealand. The campaign is administered via a jump server accessed through Remote Desktop from a UK residential broadband connection, providing a lead to the operator's identity.
This threat involves a malware campaign using business-themed email lures to deliver XLoader and other payloads. The attack starts with emails containing RAR archives with obfuscated JScript files that extract and execute a LuaJIT interpreter and loader. The loader performs in-memory execution of the XLoader core via manual mapping and shared-section injection into target processes. The malware steals credentials including Windows Vault data and browser cookies and communicates with multiple command-and-control servers. Additional malware such as Agent Tesla, Remcos, and XWorm are also delivered in this campaign.
A phishing campaign impersonates OpenAI by sending fake ChatGPT Plus billing emails claiming failed subscription payments. Victims are directed to fraudulent payment pages hosted on compromised WordPress sites under Nexcess's nxcli.io infrastructure. Attackers monitor submitted credit card details in real time and dynamically request one-time passwords (OTPs) to complete fraudulent transactions. The campaign uses multiple redirect domains and identical client-side code across instances to steal credit card information and OTPs.
VOLTA is a sophisticated Windows infostealer malware that uses AI-powered victim profiling to prioritize targets based on their monetization potential. It harvests credentials, browser data, cryptocurrency wallets, sessions from various platforms, and personal information. The stolen data is compiled into a structured evidence bundle and analyzed by large language models (LLMs) such as Claude Opus via OpenRouter, which rank stolen assets by value and assess victim security posture. VOLTA also performs live enrichment by accessing victim accounts on Gmail, Uber Eats, DoorDash, Discord, and Roblox using stolen tokens. The malware self-deletes after execution and operates through third-party infrastructure without actor-owned servers, indicating a builder-based distribution model allowing customized deployments.
A malicious version of the Claude Code extension (versions 2.1.312 and 2.1.313) was distributed via the Cursor extension marketplace on October 29, 2026. This compromised extension injected JavaScript that executed during module loading to establish a persistent SSH backdoor. It collected host reconnaissance data, installed an attacker-controlled SSH key, enabled local SSH services, and created reverse SSH tunnels to attacker infrastructure. Persistence was maintained through platform-specific mechanisms such as macOS LaunchAgents, Linux cron jobs, and Windows scheduled tasks. The attack used built-in system tools to evade detection. Microsoft confirmed the malicious packages were not distributed through Visual Studio Marketplace or npm, and Anthropic's systems were not compromised. The incident appears limited to the Cursor marketplace.
In October 2026, nine AI developer platforms suffered security breaches involving credential theft that allowed attackers to abuse AI model access. Platforms affected include Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank. Attackers exploited vulnerabilities to access stored environment variables containing AI credentials and monetized this access through LLM broker infrastructure. Follow-up activities included validation sweeps, quota enumeration, and large-scale token abuse resembling resold coding-agent traffic. Documented cases show hundreds of thousands to over a million unauthorized API calls generating over $100,000 in fraudulent usage. Multiple reseller operations were identified selling discounted access to frontier AI models using stolen credentials.
Since July 2025, a financially motivated threat actor named CyberDakait has conducted a sophisticated Android malware campaign targeting India's financial services sector. The campaign uses seven distinct Android trojan families distributed via smishing and vishing, impersonating bank representatives to trick victims into installing malicious APKs. These trojans steal banking credentials, credit card details, and intercept SMS messages including OTPs through overlay attacks. Additionally, the malware performs cryptojacking using XMRig. The malicious apps are hosted on GitHub to appear legitimate, with initial droppers delivering the main payload and mining modules. At least 17,960 devices have been compromised with 7.6 million intercepted SMS messages reported.
SkyW4lker is a phishing kit active since June 2026 that targets Microsoft 365 authentication by exploiting OAuth 2.0 device-code flows to bypass MFA. It uses password-protected email attachments leading victims through CAPTCHA pages to malicious sites requesting device codes. The kit primarily targets US firms, especially in technology, manufacturing, and government sectors, and shares infrastructure with the Gabagool phishing kit.
Starting around October 20, 2026, unprotected Cairn AI pentesting harnesses have been targeted by automated campaigns from unknown actors. These attackers insert malicious tasks to manipulate AI agents, leading to host system compromise through profiling, credential theft including AI model API keys, Poseidon malware deployment, and unauthorized SSH key installation. Two distinct threat clusters, AIA0009 and AIA0010, conduct synchronized attacks focusing on persistence/malware deployment and exploration/credential extraction respectively. The campaigns use AI-driven automation to attack AI operations, including container escape attempts and reconnaissance. Poseidon RAT is deployed with Bunny.net CDN-based command and control infrastructure.
DarkCore is a remote access trojan (RAT) that steals credentials and hijacks user sessions by reusing stolen session cookies to access services like Gmail and WhatsApp. It routes traffic through victims' IPs to mimic legitimate activity and includes hidden virtual network computing (HVNC) for stealthy desktop access. Distributed via PDF-themed shortcuts that deliver decoy documents alongside malware, DarkCore communicates with its command-and-control servers over TCP and can load additional modules dynamically.
On October 21, 2026, the LiteLLM Python proxy library version 1.107.0 was compromised in a supply chain attack. The malicious release was available on PyPI and official Docker images for approximately two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to deploy a malicious fork via a private release workflow. The payload included a credential stealer targeting cloud, developer, AI-tool, browser, and LiteLLM proxy credentials, as well as a second-stage remote access trojan backdoor. The malware executes automatically whenever Python starts by placing files in the site-packages directory. This is the second known supply chain compromise of LiteLLM in 2026, unrelated to the previous incident linked to TeamPCP activity.
Threat actors are conducting phishing campaigns targeting Google Cloud Platform (GCP) environments by using sponsored search ads to steal privileged user credentials. They disable security controls, create service accounts with Gemini API access, and link attacker-controlled external projects to victim billing accounts. This enables unauthorized large-scale AI workload execution, causing significant unexpected charges within 24-48 hours. The attackers use evasion techniques such as geographic IP blending and demoting legitimate administrators to avoid detection and remediation.
Wazza is a multi-stage phishing kit actively targeting Microsoft 365 accounts since July 2026. It uses phishing emails with PDF lures themed around business documents to redirect victims through a complex infrastructure involving Google Sites and CloudFlare Workers. The kit impersonates multiple well-known services and employs advanced browser checks and client-side protections. It abuses Microsoft OAuth device authorization to trick victims into completing authentication, allowing attackers to gain access to accounts and cloud resources. The campaign is medium severity due to credential theft risks.
Variola is a modular Windows malware implant linked to a ClickFix intrusion, designed for persistent host identity and secure command-and-control communications. It supports dynamic loading of modules for credential theft, browser manipulation, and session hijacking, with capabilities typical of banking trojans such as Chromium browser injection and VNC-style remote access. The implant uses strong cryptographic methods for communication security and shows active development with multiple builds found in a public GitHub repository. No patch or remediation information is provided, and no known exploits in the wild have been reported.
KGB RAT is a Windows Remote Access Trojan actively marketed on underground forums since late 2025. It is sold as Malware-as-a-Service with prices ranging from $150 to $800. The malware includes features such as credential theft, keylogging, hidden desktop takeover, ransomware, and psychological harassment tools like screamers and forced blue screens. It uses a daily updated fully undetectable (FUD) crypter to evade detection by Windows Defender and communicates with its command and control (C2) servers without requiring port forwarding. Notifications are delivered via Telegram. The malware is based on the NjRAT framework and includes a CryptoClipper module that swaps cryptocurrency wallet addresses. Development reportedly began in early 2022.
The Aoki infostealer malware has recently evolved to target credentials from AI coding assistants such as Claude, OpenAI's Codex, Cursor, Codeium, and Gemini. It steals API keys, tokens, and session files that could allow attackers to impersonate legitimate users and access connected repositories, cloud services, and CI/CD pipelines. In addition to AI-related credentials, Aoki collects data from browsers, cryptocurrency wallets, password managers, messaging apps, gaming platforms, VPN and FTP clients. The stolen data is sent to command-and-control servers. This indicates that AI credentials are increasingly valuable to cybercriminals, alongside traditional targets like payment card data and cryptocurrency wallets.
A phishing campaign uses fake Calendly booking pages impersonating Meta Careers to steal Facebook and Google login credentials. Victims are tricked into selecting interview times, submitting personal data, and completing fake CAPTCHAs before being prompted to log into their accounts. The phishing kit captures credentials and bypasses two-factor authentication by relaying authentication codes in real-time. The fake pages include convincing replicas of legitimate login screens with fake address bars showing authentic URLs. Eleven domains with recruiting-related names are involved, and the infrastructure operates via Amazon API Gateway in Singapore. Code comments in Vietnamese suggest possible origins of the operation.
Hirudo is an Android banking remote access trojan that combines credential theft with live remote control capabilities. It is distributed via shopping and entertainment apps acting as droppers, which install the trojan behind fake update prompts. The malware replaces legitimate banking apps with patched versions that disable internal security checks. The campaign targets eight Indonesian banking apps covering seven banks, embedding a hooking engine in the replacements. Distribution uses legitimate advertising infrastructure including Amazon CloudFront. Targeting extends beyond Indonesia to China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records. No CVE or official patch information is available.
