Between October 8 and 11, 2026, attackers exploited authentication bypass and remote code execution vulnerabilities in AhsayCBS backup management software to compromise multiple servers. The intrusion involved deploying multiple webshell families with capabilities such as command execution and encrypted payload loading. Attackers installed cryptocurrency miners, tunneling tools, and a custom Python implant communicating with command-and-control infrastructure. They created Microsoft Defender exclusions and accessed backup credentials, targeting backup infrastructure to potentially access hypervisor and domain account credentials. The attack demonstrated operational patience and sophistication beyond typical cryptomining campaigns.
Armorsteal is a Python-based malware kit that steals sensitive data and mines cryptocurrency. It persists on infected Windows systems by installing in a hidden directory and creating scheduled tasks. The malware uses obfuscation and sandbox evasion techniques and includes modules for backdoor access, cryptocurrency mining, keystroke logging, clipboard manipulation, and credential theft from browsers, Discord, wallets, and password managers. It uses multiple command-and-control domains and disables Windows Defender to avoid detection.
Phexia is a modular macOS malware actively distributed since late 2025 via ClickFix campaigns. It uses a multi-stage infection chain involving Terminal commands, shell scripts, LaunchAgents persistence, and AppleScript loaders. In May 2026, its operators shifted command-and-control to Polygon blockchain smart contracts. The malware steals credentials through fake password prompts, extracts browser data, keychain items, password manager data, and deploys an XMRig cryptominer. Multiple builds communicate with rotating infrastructure, and reinfections may result in concurrent infections on the same device.
The Yoba malware campaign distributes cryptocurrency mining malware by abusing digitally signed AI application executables from OpenAI and Anthropic to evade detection. It uses DLL sideloading with malicious DLLs loaded alongside legitimate signed binaries. The infection chain includes YobaDropper and YobaLoader components that employ anti-analysis techniques such as process verification, execution delays, and regional language exclusions. Command and control communication uses Telegram profile images, domain generation algorithms, DNS over HTTPS via Google, and public hosting services to retrieve encrypted payloads. While primarily observed deploying the XMRig miner, the loader architecture can support additional Windows executables and PowerShell payloads, indicating potential expansion beyond cryptojacking.
Since July 2025, a financially motivated threat actor named CyberDakait has conducted a sophisticated Android malware campaign targeting India's financial services sector. The campaign uses seven distinct Android trojan families distributed via smishing and vishing, impersonating bank representatives to trick victims into installing malicious APKs. These trojans steal banking credentials, credit card details, and intercept SMS messages including OTPs through overlay attacks. Additionally, the malware performs cryptojacking using XMRig. The malicious apps are hosted on GitHub to appear legitimate, with initial droppers delivering the main payload and mining modules. At least 17,960 devices have been compromised with 7.6 million intercepted SMS messages reported.
A malware campaign named Yoba exploits the popularity of AI tools like ChatGPT and Claude by distributing malicious installers through fake GitHub projects. These projects mimic legitimate desktop applications and use DLL sideloading with signed executables from OpenAI and Anthropic to evade security. The malware chain includes YobaDropper and YobaLoader, which deliver unwanted software such as XMRig cryptocurrency miners. The threat actor avoids traditional command-and-control infrastructure, relying instead on Telegram, Tor, Catbox, and DNS over HTTPS. The campaign appears to originate from actors in the UTC-4 timezone with possible Russian links and excludes CIS countries from infection.
An autonomous offensive agent named 'Skynet' hijacks exposed large language model (LLM) endpoints on the internet to conduct a range of attacks. It uses 74 offensive tools targeting web frameworks, credential theft, database access, and cryptocurrency mining. The agent operates unattended for extended periods by bypassing AI safety controls through jailbreak techniques. Victims include AI model owners who incur costs for computing power and compromised servers exploited for Monero mining. This activity was observed via an AI honeypot capturing the full attack sequence, highlighting a novel self-directed cybercrime targeting unauthenticated internet-facing AI services.
Multiple vulnerabilities in Plex Media Server version 1.43.2 and earlier are actively exploited in the wild to achieve remote code execution. Attackers chain four CVEs to deploy the XMRig cryptominer and a proxy tool named myawesomeproxy. Exploitation attempts began on October 17, 2026, with malicious payloads downloaded from known IP addresses. The proxy software may enable threat actors to use residential IPs to access corporate VPNs and email systems. Public proof-of-concept exploit code is available via the plex2shell project. No official patch or remediation information is currently provided.
During Q3 2026, attacks targeting poorly managed Linux SSH servers were observed, primarily using brute force and dictionary attacks. The main malware families involved were ShellBot, a Perl-based DDoS bot, and Fisieredoor, a backdoor capable of command execution and deploying SSH dictionary attack tools. Attackers used wget or curl to download malware, then installed user-mode rootkits, process masking tools (XHide), and XMRig cryptocurrency miners. The malware launcher used ld.so.preload to inject rootkits and disguised mining processes as legitimate bash sessions. Fisieredoor also deployed tools for credential harvesting and lateral movement, transmitting successful authentication data to command servers.
In Q3 2026, attackers targeted Windows-based MS-SQL and MySQL database servers using brute-force, dictionary attacks, and vulnerability exploitation. They deployed cryptocurrency miners (XMRig), backdoors (GotoHTTP), SoftEther VPN infrastructure, and various web shells for persistence. Additional tools included VShell for remote command execution, HackBrowserData for credential theft, Fscan for reconnaissance, and Cloudflared for port exposure. Attackers created backdoor RDP accounts and used SoftEther VPN servers as command and control infrastructure. The attacks mainly exploited weak passwords, poor account management, and insufficient security on exposed database servers.
In the third quarter of 2026, multiple attack campaigns targeted poorly managed Linux SSH servers using brute force, dictionary attacks, and vulnerability exploits. Attackers deployed ShellBot, a Perl-based DDoS bot with port scanning and UDP flooding capabilities. A complex attack chain involved a user-mode rootkit loaded via /etc/ld.so.preload, which then deployed the XMRig cryptocurrency miner disguised as a bash process using the XHide concealment tool. Additionally, the Fisieredoor backdoor was used to execute commands and install SSH brute-force tools such as goauto and tsm-family that systematically targeted systems with credential lists. Organizations are advised to implement strong password policies, maintain regular patching schedules, and enforce access controls on externally exposed SSH infrastructure.
Starting October 7, 2026, attackers exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to perform unauthenticated remote code execution. They chained these flaws to bypass authentication and execute code with SYSTEM privileges. Post-exploitation, attackers deployed JSP webshells, installed XMRig cryptocurrency miners disguised as Microsoft Edge processes, and used an AI-assisted PowerShell script to hide mining activity by terminating Task Manager. Persistence was maintained via a fake Windows service named MicrosoftEdgeUpdateSvc. Additionally, a vulnerable kernel driver (WinRing0x64.sys) was exploited for kernel-level hardware access to optimize mining. All AhsayCBS versions through 10.3.4 are affected, with managed service providers primarily targeted.
Since April 2026, the PoeLLM malware campaign has targeted exposed AI/LLM and open-source services such as LiteLLM, Ollama, Gotenberg, and Gitea. It uses a novel command-and-control method where infected systems extract C2 server addresses from keywords embedded in a poem on GitHub. The malware deploys cryptocurrency miners (XMRig and Iron) connecting victims to Kryptex mining infrastructure. Compromised hosts are also used as scanners and exploit servers to grow the botnet, which has affected over 3,400 servers with up to 800 active daily. The campaign is linked to an Italian-speaking threat actor and mainly impacts victims in the United States and Western Europe. Vulnerable routers are exploited to serve as C2 infrastructure.
AhsayCBS backup utility versions up to 10.3.4 contain a vulnerability (CVE-2026-105133) that allows unauthenticated remote code execution. Exploitation involves chaining two critical vulnerabilities to bypass authentication and execute code with SYSTEM privileges. Attackers have deployed webshells, cryptocurrency miners disguised as legitimate processes, and persistence mechanisms including fake Windows services and kernel driver exploitation. Managed service providers are primarily targeted.
A cryptomining botnet compromised 3,562 Redis servers by exploiting unauthenticated Redis instances using rogue replication to inject cron jobs that deployed XMRig miners. The affected Redis versions range from 2.8.17 to 7.2.0 across various Linux distributions, indicating misconfiguration rather than a software vulnerability. The attacker toolkit, exposed via an open directory, contained exploit source code, campaign logs, and Windows registry hives. Additional attack vectors targeting WordPress, MongoDB, and SSH were included but did not result in confirmed compromises. The operation mined Monero using a wallet linked to the operator's own systems. Meterpreter deployment capabilities were also observed, extending the operator's activity timeline. No known exploits in the wild or vendor patches are documented.
An emerging infostealer tracked as REVSTEALER under REF2859 has gained significant momentum with approximately 4,700 samples identified over the past year. The malware features comprehensive credential harvesting capabilities targeting browsers, VPN applications, password managers, cryptocurrency wallets, and gaming platforms. It incorporates sophisticated anti-analysis mechanisms including a weighted sandbox scoring system and uses Polygon blockchain-based dead drops for resilient infrastructure management. Distribution occurs primarily through social engineering campaigns targeting gamers via compromised YouTube channels advertising fake game cheats, though samples also impersonate legitimate software like Slack and qBittorrent. The malware delivers four additional modules extending capabilities to include wallet theft, clipboard manipulation, reverse proxy functionality, and cryptocurrency mining deployment. Most samples employ VMProtect packing and feature an App-Bound Encryption bypass using debugger-...
Multiple organizations experienced attacks beginning with social engineering that led to rogue ScreenConnect installations executing suspicious VBScript files. The attack chain involved four sequential VBScript payloads (1.vbs through 4.vbs) used to profile systems, check for security products, establish persistence, and deploy additional tools. Modified ScreenConnect clients enabled worm-like propagation by automatically transferring and executing these scripts on newly connected endpoints. The attacks included deployment of additional RMM tools like UltraViewer, cryptocurrency miners, and tunneling utilities. Systems were profiled based on installed security products, RAM capacity, and existing ScreenConnect installations. Persistence was achieved through Windows Registry Run Keys and concealed services. The campaign demonstrated sophisticated evasion techniques including AMSI bypass attempts, Windows Defender exclusions, and UAC bypass mechanisms.
This macOS malware campaign uses social engineering via fake CAPTCHA pages to trick users into running malicious AppleScript commands. It deploys a persistent backdoor that leverages EtherHiding by storing command-and-control (C2) addresses in Polygon blockchain smart contracts, complicating detection. The malware maintains persistence through LaunchAgents and delivers multiple payloads including the AMOS stealer, which targets cryptocurrency wallets, browser credentials, and macOS Keychain data, as well as the XMRig cryptominer for ongoing revenue. The campaign employs advanced evasion techniques such as character-ID obfuscation and abuse of legitimate macOS utilities. Blockchain transaction analysis reveals the full history of C2 infrastructure rotation and funding, aiding defenders despite the malware's memory-resident nature.
A sophisticated backdoor disguised as a legitimate Malwarebytes installer was distributed to over 100,000 machines through compromised automatic updates of one torrent client (Download Studio) and three adblockers (NetShield Kit, My AdBlock, and Net AdBlock). The backdoor creates a fake Malwarebytes installation directory containing legitimate signed files alongside malicious DLL files. Once executed, it establishes persistence through a Windows service and communicates with command-and-control servers to receive configuration updates and additional payloads. The primary observed payloads were cryptocurrency miners, though the infrastructure supports delivery of multiple persistent threats. The attack demonstrates abuse of software update mechanisms and affects primarily users in Russia, Ukraine, and Kazakhstan.
Aeternum is a C++ botnet loader utilizing the Polygon blockchain for command-and-control infrastructure instead of traditional centralized servers. Threat actors write encrypted and plaintext instructions directly to smart contracts, which infected devices query via public RPC endpoints. The malware implements weak PBKDF2HMAC/AES-GCM encryption with self-salting passwords, allowing payload decryption using only the smart contract address. Analysis reveals three related samples: the core Aeternum loader with Telegram-based exfiltration, a blended threat combining XWorm RAT with XMRig cryptocurrency miner, and Python source code revealing anti-analysis checks and cryptocurrency wallet targeting. The botnet demonstrates resilience through decentralized infrastructure, making traditional law enforcement takedowns significantly more challenging while maintaining low operational costs for attackers.
