Phexia is a modular macOS backdoor and infostealer actively distributed through ClickFix campaigns since late 2025. The malware employs a multi-stage infection chain beginning with Terminal command execution that downloads shell scripts, establishes persistence via LaunchAgents, and deploys AppleScript-based loaders. A significant evolution occurred in May 2026 when operators began using Polygon blockchain smart contracts as command-and-control dead-drop resolvers, replacing earlier Telegram and Steam-based methods. Post-compromise activities include credential harvesting through fake password prompts, browser data theft, keychain extraction, password manager targeting, and XMRig cryptominer deployment. The malware collects login passwords, browser encryption keys, cookies, and cryptocurrency wallet information. Multiple distinct builds communicate with rotating infrastructure, with reinfection potentially leaving concurrent installations active on compromised endpoints.
Gorbag is a Russia-aligned cyberespionage threat actor active since February 2025, targeting Ukrainian law enforcement, justice entities, local administrations near the front line, and defense sectors. The group uses spearphishing emails with malicious attachments to gain initial access and employs simple infostealers for rapid data collection, including browser credentials, VPN configurations, and selected documents. Their toolset includes Prime ReverseShell and BeautyStealer. In early 2026, Gorbag incorporated exploitation of CVE-2025-8088, a WinRAR path traversal vulnerability, into their attack chain. The group appears to focus on quick intelligence harvesting rather than long-term persistence, possibly acting as an initial access broker sharing credentials with other Russia-aligned actors.
VOLTA is a sophisticated Windows infostealer malware that uses AI-powered victim profiling to prioritize targets based on their monetization potential. It harvests credentials, browser data, cryptocurrency wallets, sessions from various platforms, and personal information. The stolen data is compiled into a structured evidence bundle and analyzed by large language models (LLMs) such as Claude Opus via OpenRouter, which rank stolen assets by value and assess victim security posture. VOLTA also performs live enrichment by accessing victim accounts on Gmail, Uber Eats, DoorDash, Discord, and Roblox using stolen tokens. The malware self-deletes after execution and operates through third-party infrastructure without actor-owned servers, indicating a builder-based distribution model allowing customized deployments.
In September 2026, multiple advanced persistent threat (APT) campaigns targeted South Korean organizations using spear phishing emails. The attacks employed various techniques such as LNK files with embedded PowerShell scripts, HTA files downloaded via curl.exe, and malicious DLLs. Five attack types were identified, deploying AutoIt scripts, infostealers, keyloggers, backdoors including XenoRAT, and persistence via Task Scheduler. Attackers used legitimate platforms like GitHub, Google Drive, and PubNub for command and control. Malicious files were disguised as legitimate documents to deceive victims and exfiltrate system information, credentials, and virtual asset data while maintaining persistent access.
In September 2026, infostealer malware was predominantly distributed via SEO poisoning, masquerading as illegal software like cracks and keygens. Distribution platforms included Mediafire, AWS S3, Mega, and Cloudflare Storage. Executable files made up 90.8% of samples, with 9.2% using DLL side-loading techniques involving legitimate DLLs such as python37.dll and POWRPROF.dll. A new Rust-based infostealer named Lzveil was identified, which downloads configuration from command and control servers and employs modified Base64 decryption, XOR encryption, and LZNT1 compression. Email campaigns spread DarkCloud and AgentTesla infostealers, impersonating construction and logistics firms. These malware variants steal credentials, browser data, cryptocurrency wallets, and system information, with stolen data often sold on dark web markets or used in secondary attacks.
Aokigahara is an infostealer malware targeting traditional data sources such as browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications. It uniquely targets AI applications and development tools, stealing authentication files, session data, and configuration files from services like Claude, ChatGPT Desktop, Codex, and GitHub Copilot. It also collects developer credentials including Git files, SSH private keys, and cloud service credentials (AWS, Azure, Google Cloud). The stolen AI credentials may be used for unauthorized access, account resale, or data extortion. The malware uses anti-analysis techniques and secures its command-and-control communications with AES-256 encryption and X25519 key exchange.
On October 21, 2026, the LiteLLM Python proxy library version 1.107.0 was compromised in a supply chain attack. The malicious release was available on PyPI and official Docker images for approximately two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to deploy a malicious fork via a private release workflow. The payload included a credential stealer targeting cloud, developer, AI-tool, browser, and LiteLLM proxy credentials, as well as a second-stage remote access trojan backdoor. The malware executes automatically whenever Python starts by placing files in the site-packages directory. This is the second known supply chain compromise of LiteLLM in 2026, unrelated to the previous incident linked to TeamPCP activity.
The Aoki infostealer malware has recently evolved to target credentials from AI coding assistants such as Claude, OpenAI's Codex, Cursor, Codeium, and Gemini. It steals API keys, tokens, and session files that could allow attackers to impersonate legitimate users and access connected repositories, cloud services, and CI/CD pipelines. In addition to AI-related credentials, Aoki collects data from browsers, cryptocurrency wallets, password managers, messaging apps, gaming platforms, VPN and FTP clients. The stolen data is sent to command-and-control servers. This indicates that AI credentials are increasingly valuable to cybercriminals, alongside traditional targets like payment card data and cryptocurrency wallets.
A phishing campaign distributes the AgentTesla infostealer via emails pretending to be business proposals. The attached ZIP file contains a malicious executable disguised as a café management program with Chinese-language UI. The malware uses multi-stage obfuscation and .NET payload loading to ultimately deploy AgentTesla, which steals credentials, cookies, and contact information from browsers, email clients, FTP, and VPN applications. Stolen data is exfiltrated through FTP to a compromised server. The attack targets business users using social engineering and sophisticated loading techniques.
The Psychedelic Stealer is an active malware campaign targeting Ukrainian small-business websites as of September 2026. It tricks victims with a fake Cloudflare CAPTCHA page to manually run msiexec.exe commands that install malware. This malware steals browser credentials, session tokens, and cryptocurrency wallet data from wallets such as MetaMask and Trust Wallet. It maintains persistence through browser extensions using native messaging and scheduled tasks, and communicates with a REST API for further commands. The campaign uses signed Microsoft binaries and avoids encoded PowerShell scripts to evade detection. It is financially motivated and specifically targets Ukrainian victims.
During August 2026, multiple APT campaigns targeted South Korean entities primarily through spear phishing attacks utilizing LNK files. Six distinct attack types were identified, employing various techniques including PowerShell scripts, AutoIt programs, and DLL side-loading. Type A used HEX data extraction with PubNub command and control, while Type B leveraged curl.exe to download HTA files from GitHub and Google Drive, deploying infostealers and keyloggers. Type C distributed XenoRAT malware via GitHub repositories. Type D used resume-themed lures with VBS, BAT, and PowerShell scripts for backdoor injection. Type E employed Python-based backdoors through disguised pythonw.exe executables. Type F exploited Hangul documents with embedded OLE objects for malicious DLL loading. Attacks focused on information theft, system control hijacking, and additional malware deployment.
A Python-based Malware-as-a-Service builder enables operators to generate customized Windows infostealer executables. The system comprises a builder component and an embedded payload, using Nuitka or PyInstaller compilation to evade detection. The builder features automatic dependency installation, webhook configuration with XOR and Base64 encoding, and multiple compilation backends. The payload targets Chromium and Firefox browsers, extracting credentials, cookies, and credit card data. It harvests Wi-Fi passwords, Discord tokens, and Roblox session cookies while employing anti-analysis techniques including debugger detection, VM process blacklisting, disk size checks, and timing evasion. Persistence is established through registry Run keys and scheduled tasks. All stolen data is packaged into in-memory ZIP archives and exfiltrated via attacker-controlled webhooks, following a scalable affiliate model.
This content is a curated list of publicly accessible, keyless (zero-authentication) cyber threat intelligence (CTI) and infostealer API endpoints useful for rapid triage and investigation. It includes various free APIs for credential exposure, infrastructure reconnaissance, vulnerability scoring, and botnet command-and-control feeds. Additionally, an open-source Python script is provided to query these endpoints concurrently, facilitating efficient threat analysis workflows.
CyberCodex v3.2 is an open-source, zero-dependency command-line interface (CLI) tool that aggregates 22 free threat intelligence, infostealer telemetry, and OSINT feeds. It enables security teams to perform domain and credential exposure checks, infrastructure and DNS telemetry, and offline cyber warfare correlation with detection rule generation. The tool integrates data from sources such as HaveIBeenPwned, Hudson Rock, Shodan InternetDB, RIPE BGP, EPSS, and CISA KEV, providing a unified interface without requiring API keys or external dependencies.
SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands. These include collecting sensitive data from the victim’s device, capturing screens, remotely managing processes and files, controlling bots, and other forms of remote device management.
A detailed technical analysis examines the evolution of MacSync, a macOS stealer-as-a-service initially known as Mac.c, which targets cryptocurrency enthusiasts and developers. The malware has undergone significant changes, replacing AppleScript-based droppers with binary executable files written in Objective-C and Swift. The infection chain utilizes malicious DMG images and employs iCloud infrastructure for payload delivery. MacSync collects extensive data including browser credentials, cryptocurrency wallets, Telegram data, SSH configurations, and keychain files. The stealer incorporates novel techniques like PAM API for password verification and features a backdoor module for persistent access. Distribution occurs through social engineering, fake applications, and cracked software disguised as legitimate crypto wallets like the nonexistent Toria wallet, promoted through dedicated websites and social media channels.
A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is.
A new variant of the PamStealer malware targets macOS users by masquerading as a fake Wavel cryptocurrency wallet application. It uses a complex server-side decryption process involving a custom utility and live ECIES key exchange, preventing offline payload decryption. The malware, rewritten in Swift, steals credentials from seventeen browsers, extracts keychain data, collects system fingerprints, and harvests user files including shell history and account photos. It maintains persistence through multiple redundant mechanisms and suppresses notifications by terminating background task management processes.
This analysis covers infostealer distribution trends during August 2026, focusing on distribution channels, detection rates, and disguise techniques. Primary infostealers identified include Remus, Vidar, LummaC2, and ACRStealer, distributed through crack software disguises, SEO poisoning, and file-hosting platforms like Mega and Mediafire. Malware disguised itself as legitimate companies, with Microsoft Corporation being the most frequently impersonated. Distribution methods included DLL side-loading using python37.dll and python36.dll, and exploitation of Renpy game development tool. Email campaigns delivered Formbook disguised as Turkish bank statements and AgentTesla as business quote requests from Indian companies. EXE files constituted 97.3% of execution types. The stolen information poses risks for dark web trading and secondary attacks, emphasizing the need for cautious handling of untrusted links, avoiding illegal software, enabling two-factor authentication, and maintaining updated security soluti...
The PolinRider campaign compromises developer GitHub accounts to inject malicious code into development versions of popular packages, including visanduma/nova-two-factor on Packagist. It targets multiple ecosystems such as npm, PyPI, Go modules, Packagist, and Chrome extensions by abusing Git-based collaboration workflows rather than directly compromising package registries. The attackers use advanced techniques like rewriting Git history, hiding payloads in configuration and font files, and triggering execution via IDE tasks. PHP projects are specifically targeted with obfuscated JavaScript executed through shell_exec calls. The campaign is attributed to North Korean actors focusing on cryptocurrency theft.
