On August 31, 2026, threat actors exploited two zero-day vulnerabilities in PaperCut MF version 24.0.2, targeting an internet-facing print server in the Education sector. The attackers deployed an in-memory Java loader to establish a web shell, through which they delivered a trojanized Microsoft Copilot binary containing an AdaptixC2 implant. This implant connected to command-and-control infrastructure hosted on Alibaba servers. After a dormant period, the attackers performed reconnaissance and Active Directory enumeration, stole a token from a domain-privileged service account, and moved laterally to a domain controller. On the domain controller, they dumped credentials, enabled Windows Restricted Admin mode for pass-the-hash attacks, and extracted the NTDS.dit database, achieving full domain compromise.
In February 2026, an active malware delivery campaign named Powercat was observed distributing infostealer malware disguised as utility or cheat software for popular PC games including Roblox, Minecraft, and Grand Theft Auto V. The multi-stage infection chain begins with an initial executable that profiles victims and establishes persistence, followed by a Java-based loader that deploys the final infostealer payload. The malware targets cryptocurrency wallets (Exodus, Atomic, Monero-Gui), browser data from Chromium-based applications, Discord tokens, and gaming accounts with payment information. It includes surveillance capabilities such as keylogging, webcam capture, and screen recording. The campaign particularly targets children who frequent gaming platforms and pay-to-cheat websites, with evidence suggesting collected personal information may be used for blackmail or coercion into illegal activities.