ClearFake

Red Canary's May 2026 threat intelligence report identifies ClearFake as the top prevalent threat for a second consecutive month, using fake CAPTCHA lures to deliver malware via paste-and-run execution across multiple threat families. Kali365, a phishing-as-a-service platform debuting at #2, automates OAuth device code phishing against Microsoft 365 environments, capturing access tokens through adversary-in-the-middle techniques. TeamPCP conducted a supply chain worm campaign across npm and PyPI ecosystems using a compromised TanStack CI workflow commit as an entry point.

Red Canary's July 2026 threat intelligence report highlights ClearFake as the top prevalent threat for the third consecutive month, using fake CAPTCHA lures on compromised websites for paste and run malware delivery. CastleLoader debuts in the top 10, distributed via fake background removal sites and job platform impersonation domains, employing a Bring-Your-Own-Interpreter technique with portable Python distributions to execute triple-layer encoded shellcode loaders that inject the CastleLoader binary into python.exe. KongTuke TDS saw significant activity increase, using compromised WordPress sites and caret-obfuscated curl commands to .top domains for initial execution.

Session Hijacking and Developer Tool Poisoning Collapse Authentication Trust This week, attackers proved that multi-factor authentication is no longer a reliable gatekeeper. Campaigns like Tycoon 2FA and Chinese-language PhaaS platforms intercept one-time passwords in real time and steal session tokens to maintain persistent access, while infostealers like EKZ Infostealer harvest browser cookies to bypass authentication entirely. Even when victims reset passwords and revoke sessions, attackers retain access through hidden device registrations — meaning standard incident response playbooks are now incomplete. Developers remain the preferred entry point for supply chain compromise. The Glassworm botnet was disrupted after hiding malware in VSCode extensions and npm packages, while the Megalodon campaign poisoned GitHub Actions workflows across 5,500 repositories. A malicious Sicoob.Sdk NuGet package stole banking certificates from Brazilian developers, and North Korea's Lazarus group compromised the widely used axios npm library — a single attack touching millions of downstream applications. Organizations must move beyond password-and-MFA reliance: adopt hardware security keys, shorten session lifetimes, delete attacker-registered devices before resetting credentials, and audit developer toolchains and CI/CD pipelines for tampering.

2026-05-267 minTrend Microhigh

Threat actors behind the ClearFake campaign are leveraging EtherHiding to host malicious JavaScript payloads within BNB Smart Chain testnet smart contracts, bypassing traditional URL-based blocking. The attack chain begins with a compromised watering hole site and uses a ClickFix social engineering overlay to trick Windows and macOS users into executing malicious commands. This leads to the deployment of SectopRAT and ACRStealer via WebDAV DLL loading and DLL sideloading, enabling extensive credential and browser session theft.