Elastic Security Labs discovered a new Contagious Interview campaign (REF9403) attributed to DPRK-aligned threat actors that uses fake coding challenges to deliver malware hidden via SVG steganography. The trojanized repositories contain a four-stage JavaScript payload aligned with OTTERCOOKIE, combining browser credential/crypto wallet theft, file exfiltration, a Socket.IO RAT, and clipboard stealing. The malware uses obfuscator.io for code protection, custom Base64 decoding to evade detection, and masquerades as npm-cache processes while exfiltrating data to rightwidth.dev C2 infrastructure.
legitimate-tool-abuse
50 posts
New North Korean campaign uses fake coding interviews to steal developer credentials GuLoader Malware Obfuscation Techniques Analyzed GuLoader is a highly obfuscated malware-as-a-service downloader that has evolved since 2019 to deliver secondary payloads such as RATs and information stealers. It employs polymorphic code for dynamic constant construction, exception-based control flow obfuscation using five distinct CPU exception types, encrypted strings with stack-based decryption, and modified DJB2 API hashing. Payloads are hosted on trusted cloud platforms (Google Drive, OneDrive) to evade reputation-based detection, and the malware continues to receive updates increasing analysis complexity.
The tale of ClickFix: 5 takeaways from RL’s new threat report ClickFix is a social engineering technique that uses fake CAPTCHA pages to trick users into pasting malicious commands into Run dialogs or terminals, executing payloads in memory via LOLBins without triggering traditional AV or EDR signatures. The threat has commoditized through MaaS subscriptions ($250–$1,800), expanded its payload catalog beyond infostealers to include RATs, loaders, and rootkits, and is actively evolving with variants like CrashFix, FileFix, PromptFix, and ConsentFix. ReversingLabs released an open-source multi-condition YARA rule that detects ClickFix lures by correlating fake verification characteristics, PowerShell payload indicators, and clipboard manipulation before payload execution.
HelloNet campaign — new malicious modules launched through the ViPNet update system The HelloNet campaign is an active APT operation targeting large Russian organizations through the ViPNet secure networking software suite. Attackers achieve persistence by placing a malicious wtsapi32.dll in the ViPNet Update System directory, which is sideloaded by itcsrvup64.exe at OS startup. The loader (HelloInjector) injects into svchost.exe and deploys a modular toolkit including a network proxy, command executor, log cleaner, and a Rust-based backdoor. The campaign uses renamed PuTTY/Plink utilities for SSH reverse tunneling to C2 servers and employs IOCTL hooking to evade user-mode security solutions.
The TTF Trap: A Global Campaign of a Low-Detection Lua Loader A global phishing campaign active since late March 2026 deploys heavily obfuscated JScript droppers that launch LuaJIT or AutoIt-based loaders disguised as TrueType Font (.ttf) files to deliver multiple RATs and infostealers including Agent Tesla, Remcos, XWorm, and a Snake Keylogger variant dubbed Best Private LOGGER. The Lua loader leverages LuaJIT's Foreign Function Interface to call native Windows APIs for in-memory shellcode execution, employing advanced evasion techniques such as decoy memory allocation, Donut header patching, AMSI/ETW bypass, API unhooking, and VEH-based segmented shellcode decryption. The campaign has evolved from October 2025 through June 2026 with progressively more sophisticated anti-analysis capabilities.
ClaudeFix: Shared Claude Chats Meet ClickFix | Zscaler A MacSync Stealer campaign abuses Anthropic's Claude shared chat platform to host ClickFix-style malicious instructions, using Google malvertising to lure macOS users searching for Claude. Victims are tricked into running a Base64-obfuscated curl command that pipes a zsh script to execution, which in turn downloads and pipes a second stage to osascript. The stealer collects keychain data, browser credentials, cryptocurrency wallets, cloud keys, and user files, exfiltrating them in 10MB chunks via HTTP PUT before deleting all traces.
GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration The GoSerpent campaign is a sophisticated, multi-stage attack targeting government and diplomatic entities in Southeast Asia since at least 2021, with evolved variants deployed through 2026. The Go-based GoSerpent backdoor establishes persistent access and deploys ThumbcacheService for document collection, Mimikatz and QuarksDumpLocalHash for credential dumping, and later stages use Stowaway RAT and TmcLoader/TmcPayload to exfiltrate collected data via network shares using stolen credentials. The tight integration between collection, credential theft, and exfiltration components demonstrates advanced operational planning and long-term intelligence gathering objectives.
Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery A coordinated supply chain compromise of the @asyncapi npm organization delivered malicious payloads through five package versions published via the project's legitimate GitHub Actions OIDC trusted publishing pipeline. The attack originated from a pwn request exploiting a misconfigured pullrequesttarget workflow that exposed the asyncapi-bot PAT, enabling unauthorized commits to auto-publish branches. Unlike typical npm supply-chain attacks, the payload executes at import/require time rather than through lifecycle hooks, bypassing --ignore-scripts mitigations. The second stage fetches an encrypted ~8.2 MB Miasma modular runtime from IPFS, establishing C2 at 85.137.53.71 with OS-specific persistence and decentralized fallback channels.
Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet TrendAI Research analyzed 200 Gemini CLI session logs from the Russian-speaking threat actor 'bandcampro,' revealing a solo operator who used Google Gemini CLI as the primary engineering agent to deploy and operate a C&C botnet targeting a dental clinic. The AI handled architecture design, coding, deployment, debugging, and WAF bypass autonomously, migrating the entire C&C infrastructure in six minutes. The operation is encoded in three portable plain-text files (~5KB) that can be shared and deployed by non-technical actors, representing a paradigm shift where AI lowers the skill barrier for complex cyber operations and makes infrastructure disposable and rapidly rebuildable.
The Risk of Exposed Cloud Functions and How to Harden Mandiant identifies publicly exposed serverless applications lacking authentication as a significant risk during security assessments. Attackers can exploit Local File Inclusion (LFI) or command injection vulnerabilities in custom code to read sensitive files, extract hardcoded secrets, and retrieve GCP service account bearer tokens from the metadata service. Stolen tokens enable lateral movement and potential full cloud project compromise, especially when Cloud Run services use over-privileged default service accounts. The blog provides hardening guidance including least-privilege IAM, Cloud Armor WAF policies, VPC Service Controls, and Secure SDLC practices.
Forgotten UEFI shims undermining Secure Boot ESET researchers identified 11 old, Microsoft-signed UEFI shim bootloaders (version 0.9 and below) that can bypass UEFI Secure Boot on any system trusting Microsoft's third-party UEFI CA 2011 certificate. The old shims lack modern security features (MokListX enforcement, SBAT) and contain known vulnerabilities (CVE-2026-10797) that enable revocation bypass, allowing attackers to execute untrusted code during boot and deploy UEFI bootkits. Exploitation does not require the affected software to be installed — attackers can bring their own copy of the vulnerable shim to any UEFI system with the Microsoft third-party certificate enrolled.
Smash and Grab at Scale: Agentic AI Is Reshaping the Threat to Commerce Akamai's SOTI Security report details how agentic AI is reshaping the threat landscape for commerce, with a 19% YoY increase in AI bot traffic and over 200 billion application/API attacks between 2024 and 2025. Attackers are exploiting consumer-facing chatbots through logic manipulation, back-end AI agents via prompt injection, and public AI endpoints for token freeloading. The retail vertical bore the brunt of Layer 7 DDoS activity (84%), with hacktivist groups like 313 Team leveraging Mirai-derived IoT botnets and browser impersonation for multi-vector attacks.
Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor Symantec identified renewed activity of Backdoor.Daxin, a sophisticated China-linked kernel-mode rootkit that hijacks legitimate TCP connections for covert C2, on a Taiwan manufacturing subsidiary in May 2026, four years after its initial public disclosure. Alongside it, researchers discovered a new backdoor, Stupig, which abuses the Windows keyboard-layout provider mechanism to execute SYSTEM-level commands from the logon screen pre-authentication and hook credential-handling APIs within winlogon.exe. Compile timestamps on both tools date to 2013 despite the host having no telemetry until 2026, suggesting a potentially decade-plus dwell time enabled by likely initial access via an outdated, end-of-life Digiwin SSO/JDK deployment.
OkoBot: new sophisticated malware framework targets cryptocurrency users Kaspersky identified OkoBot, a sophisticated multi-stage malware framework delivered via the TookPS PowerShell downloader and orchestrated over an attacker-controlled SSH tunnel, targeting cryptocurrency users. The framework comprises over 20 interconnected payloads that perform UAC bypass, RDP hijacking, browser-extension based credential theft (Rilide), hardware-wallet seed-phrase phishing (SeedHunter), keylogging, and screen/video capture (OkoSpyware), all coordinated through a plugin dispatcher communicating over HTTP/HTTPS C2 channels. The campaign has been active since at least March 2025, continues to evolve its tooling, and shows indicators (geoblocking, Russian code comments, use of Rilide) consistent with Russian-speaking cybercriminal operators.
11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload Eleven malicious NuGet DotnetTool packages masquerading as game cheats deliver a two-stage Windows payload. The first-stage .NET downloader resolves GitHub hosts via DNS-over-HTTPS to bypass local DNS controls, requests UAC elevation to resync the system clock, and fetches pepesoft.exe from GitHub Releases and Hugging Face. The second-stage PyInstaller-packed Python payload exfiltrates hardware fingerprints, system information, IP geolocation, and screenshots to Google Sheets and Telegram, with a server-side ban-list and hardware binding for licensing enforcement across all recovered builds.
Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader Socket's Threat Research Team identified four compromised npm packages in the @asyncapi namespace delivering a multi-stage botnet loader called Miasma. The attack injects obfuscated JavaScript into package source files that executes at module load time (bypassing npm lifecycle script blocking), spawns a detached Node.js process to download an encrypted payload from IPFS, and deploys a 3+ MB tasking framework with multi-channel C2 capabilities including HTTP, Nostr, IPFS, and Ethereum RPC. The malicious packages were published via GitHub Actions trusted publishing from a compromised source commit on the 'next' branch.
Kratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk Kratos is a mature Phishing-as-a-Service operation impersonating Microsoft 365 login pages to steal credentials across US and European organizations. The kit uses legitimate platforms (SharePoint, Canva, Tilda) as intermediary redirect pages, Cloudflare Turnstile to block automated analysis, and PHP endpoints for credential exfiltration. Researchers identified three generations (V0, V1, V2) with distinct asset fingerprints and exfiltration code, and uncovered the operator panel with automated deployment, Telegram-based data delivery, and geographic restriction capabilities.
Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer An unattributed, financially motivated threat actor has operated at least 292 brand-impersonation GitHub repositories since 26 June 2026 to distribute a BoryptGrab-lineage Windows infostealer. The delivery chain abuses GitHub trust by routing users through *.github.io redirectors to actor-controlled download pages that serve ZIP archives containing a legitimate signed WinGUP updater (gup.exe) that side-loads a trojanized libcurl.dll, which reflectively executes an 11-module in-memory stealer. The stealer bypasses Chrome App-Bound Encryption v20 via in-process reflective DLL injection into the browser process, scans Steam process memory for live session tokens, harvests credentials from 19+ browsers and 41 cryptocurrency wallet paths, and exfiltrates all data via raw-socket chunked POST to a hardcoded C2 at 193.143.1.131 in Russia.
13th July – Threat Intelligence Report This weekly threat intelligence bulletin covers multiple significant incidents including autonomous LLM-driven ransomware (JadePuffer), a cryptocurrency supply chain compromise via malicious npm packages, and three critical CVEs affecting Langflow, Tenda routers, and Linux KVM. Iran-linked Cavern Manticore and China-linked UAT-7810 were profiled targeting Israeli and networking infrastructure respectively. The report also highlights risks in AI development tools where hidden malicious instructions in open-source files could achieve RCE through Claude Code and OpenAI Codex.
Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials A malicious NuGet package named Braintree.Net typosquats the legitimate PayPal Braintree .NET SDK and implements a multi-stage .NET implant that intercepts payment card data, exfiltrates merchant API credentials, and harvests environment secrets upon assembly load. The package uses .NET ModuleInitializer attributes for code execution, production-only gating to avoid detection during QA, and XOR obfuscation for one of its C2 endpoints. Stolen data is POSTed to attacker-controlled infrastructure at api.348672-shakepay.com over HTTPS with silent error handling to avoid triggering investigation.
Seven Steps to Ransomware: CitrixBleed 2 Weaponized by Initial Access Brokers An Initial Access Broker is exploiting CVE-2025-5777 (CitrixBleed 2), a pre-authentication memory overread in Citrix NetScaler ADC/Gateway, to steal session tokens and bypass MFA. The stolen sessions are used to access Citrix published desktops, followed by a consistent privilege escalation via a registry symbolic-link LPE tool that abuses the Windows AppMgmt service and Group Policy refresh to gain SYSTEM. The operator then creates backdoor admin accounts, installs rogue ScreenConnect/Zoho Assist RMM clients, moves laterally with PsExec and Impacket, and ultimately deploys DragonForce ransomware. The full kill chain from initial access to encryption was observed completing in under one hour in at least one case.
Railway. LSHIY. Different Auth Flows, but the Same Lesson We Keep Skipping Two distinct campaigns exploited Microsoft 365 authentication flow misconfigurations to bypass MFA at scale. The Railway campaign leveraged device code phishing via Railway.com PaaS infrastructure (attributed to the EvilTokens PhaaS platform), compromising 344 organizations by harvesting OAuth tokens valid up to 90 days. The LSHIY campaign used the deprecated ROPC OAuth flow to replay credentials against Azure CLI, attempting 81 million logins and compromising 78 accounts—55 of which had MFA policies that failed to cover the attack path due to scoping gaps, report-only enforcement, or mislabeled trusted locations.
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware GigaWiper is a sophisticated Golang-based backdoor discovered by Microsoft Threat Intelligence in October 2025 that amalgamates at least three previously separate malware families — a standalone disk wiper, Crucio ransomware, and FlockWiper — into a single modular implant with 20 commands. It uses RabbitMQ and Redis for C2 communication, establishes persistence via scheduled tasks, and offers capabilities including disk wiping, fake ransomware (with unrecoverable encryption), BSOD induction, screen recording, keylogging, registry management, event log clearing, and VNC-like remote control. The malware masquerades as legitimate Windows components (OneDrive Update, CloudExperienceHost) and uses AES-encrypted configurations with hard-coded credentials.
US Threat Landscape Alert: 30 Active Malware Families Ranked by Real Sandbox Data ANY.RUN's Malware Trends Tracker data shows that phishing-as-a-service kits now dominate the US threat landscape, with five of the top ten threats being AiTM or device-code phishing platforms that defeat MFA by stealing session cookies or OAuth tokens. Commodity RATs and info stealers remain in constant high-volume circulation, while legacy threats like Emotet and WannaCry persist on unpatched systems. Several top-ranked threats (Cobalt Strike, Qbot, Emotet, DonutLoader, Smoke Loader) function as ransomware precursors, meaning their detection should trigger urgent escalation rather than routine handling.
Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories Operation Muck and Load is a supply chain attack campaign centered on a malicious Go module that impersonates a DNS scanner tool to deliver a multi-stage Windows malware loader. The campaign leverages 222 GitHub lure repositories across 190 accounts with automated commit-farming workflows to create false credibility, and uses public dead-drop resolvers across multiple platforms for resilient payload-location resolution. The final payload chain delivers AsyncRAT, Quasar, Remcos, Vidar infostealer, and cryptominers through password-protected 7z archives extracted into masqueraded Microsoft-themed directories.
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit REF6045 is an operator-assisted Mexican banking fraud operation that uses ClickFix fake CAPTCHA pages to deliver the SCMBANKER PowerShell toolkit. Once installed, the toolkit monitors for banking sessions, captures screenshots, deploys vishing overlays, hijacks clipboard data to swap CLABE and card numbers, redirects browsers to phishing pages, and silently installs Remote Utilities as a persistent RAT. The operation's infrastructure suffered significant OPSEC failures including open directories, a leaked web-root archive, and an unauthenticated configuration editor.
Banana RAT Evolves: Comparing Two Recent Branches Through ANY.RUN An exposed public index on 198.245.53.26 revealed two evolutionary branches of Banana RAT, a Brazilian banking-oriented RAT. The older branch (May 2026) used static ETW-themed installation paths and a pseudo-Microsoft C2 domain (c.windowns-cdn.com), while the newer branch (June 2026) shifted to randomized install identifiers, VBS-assisted persistence via hidden SYSTEM scheduled tasks, and WebSocket C2 over host-specific testewin.com subdomains derived from the victim's MachineGuid. Exposed backend scripts (servidorcompletopool.py, ofuscador.py) indicate an automated polymorphic payload generation platform. A shared fallback IP (149.56.12.51) anchors both branches to the same operator.
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework Cavern Manticore, an Iran-MOIS-linked APT group, deploys a modular .NET C2 framework targeting Israeli government and IT organizations. The framework uses three compilation formats (Mixed-Mode C++/CLI, NativeAOT, .NET Framework) as an anti-analysis layer, with DLL sideloading via WinDirStat.exe for initial execution. Post-exploitation modules provide DPAPI decryption, LDAP brute-forcing, SQL browsing, network reconnaissance, and SOCKS5 tunneling, with C2 traffic XOR-encrypted over HTTPS/WebSocket channels.
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website Attackers are abusing Microsoft's legitimate Device Authorization Grant (OAuth 2.0 Device Code Flow) to conduct phishing attacks that bypass traditional URL-based anti-phishing defenses. By pre-fetching a device code from Microsoft's identity platform and tricking victims into entering it on the genuine login.microsoftonline.com page, attackers harvest access and refresh tokens that grant persistent access to the victim's Microsoft 365 account. Two campaign variants were observed: one using password-protected PDF attachments impersonating a law firm, and another targeting Brazilian users via open redirects on cacoo.com.
AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign An active multi-stage phishing campaign distributes AsyncRAT and Remcos RATs through weaponized Excel attachments targeting sales, procurement, and vendor management staff globally. The infection chain uses VBA macros to retrieve HTA payloads via URL shorteners and Cloudflare Workers, with final payloads hidden via PNG steganography and loaded filelessly into memory via .NET assembly loading. The campaign demonstrates high-volume, automated payload generation with consistent obfuscation patterns including Base64 encoding, character substitution, and string reversal.
Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency UNK_DeadDrop is a likely North Korean threat actor conducting broad phishing campaigns targeting software developers with fake job offers and code review requests. The campaign delivers malicious GitHub/GitLab repositories that abuse VS Code and Cursor IDE task automation to silently execute cross-platform malware. Linux and macOS systems receive the Overlord Go RAT with custom credential and wallet theft modules, while Windows runs a fileless Node.js/Python pipeline inside the editor's Electron process. The malware exfiltrates cryptocurrency wallets, browser credentials, and OS keychain data to a hardcoded C&C server at 23.137.105.75:5173.
From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach The Shai Hulud supply chain worm, attributed to TeamPCP, compromises CI/CD pipelines by injecting malicious npm/PyPI packages that harvest build credentials and pivot into production AWS cloud infrastructure. In a confirmed breach, attackers stole Jenkins EC2 instance role credentials via the Instance Metadata Service (IMDS), used them from external IPs, escalated privileges by creating an IAM user with AdministratorAccess, modified Redshift and Aurora security groups to open network paths, enumerated Secrets Manager for warehouse credentials, and exfiltrated data via the Redshift Data API. The attack demonstrates that pipeline identity equals production identity, with explicit attacker naming conventions (exfil-s3-* policies, exfil STS session names) providing high-fidelity detection opportunities.
- 8 minWeekly Recap — 2026-06-29 -> 2026-07-06
Token Theft and AI Poisoning Redefine the Perimeter Attackers are shifting from breaking passwords to stealing active login sessions, bypassing multi-factor authentication entirely. This week, ARToken and ConsentFix exploited Microsoft 365 OAuth flows to hijack accounts, while Anubis ransomware used the ongoing CitrixBleed 2 vulnerability to steal session tokens from network gateways. Even a standard user can become a Global Administrator in minutes if identity settings are loose, as demonstrated by a recent M365 privilege escalation analysis. Simultaneously, artificial intelligence systems have evolved from helper tools to critical vulnerabilities, serving as both the weapon and the target. Threat actors are using AI to generate malware like InfernoGrabber v9.0 and BusySnake Stealer, while also poisoning AI agent ecosystems with malicious skills like OpenClaw and tricking AI models into executing financial fraud via indirect prompt injection. The AI arms race has accelerated breakout times to under 30 minutes, with state-sponsored groups like GTG-1002 now orchestrating entire espionage campaigns via AI. Defenders must immediately audit identity and session controls, treating session tokens as highly sensitive credentials. Security teams should also implement guardrails for AI agents, verifying external URLs and restricting autonomous financial or code execution actions.
Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem A new wave of the Mini Shai-Hulud/Miasma/Hades supply chain attack campaign has compromised 23 npm packages across the LeoPlatform and RStreams ecosystems, plus the Verana Blockchain Go module. The attack uses binding.gyp install-time execution (Phantom Gyp pattern) to trigger multi-stage obfuscated JavaScript loaders that decrypt AES-GCM payloads, stage execution through Bun to evade Node.js security hooks, and steal developer/CI/CD credentials including npm, GitHub, cloud, and AI-agent tokens. The campaign also poisons GitHub Actions workflows and plants persistence hooks in AI coding assistant configurations, creating delayed execution surfaces that survive package remediation.
From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks Arctic Wolf Labs documents Anubis ransomware affiliate tradecraft observed across multiple 2026 intrusions, featuring CitrixBleed 2 (CVE-2025-5777) exploitation and valid VPN credential abuse for initial access. Affiliates consistently deploy legitimate RMM tools for persistence, use Mimikatz and ntds.dit extraction for credential access, establish alternate egress via cloudflared and SSH SOCKS tunnels, and employ exfiltration tools like S3 Browser and rclone before deploying encryptors on Windows and Linux systems. The attack chain relies on commodity tools and living-off-the-land techniques that resemble legitimate administration in isolation but form a distinctive kill chain when correlated.
Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages The Miasma Mini Shai-Hulud supply chain campaign has expanded to compromise 22 npm package versions under the @immobiliarelabs scope, targeting Backstage plugins for GitLab integration and LDAP authentication. The malicious packages use a binding.gyp 'Phantom Gyp' trick to execute hidden root-level index.js payloads without preinstall/postinstall hooks, followed by AES-128-GCM decryption and multi-stage delivery under the Bun runtime. The final payload exfiltrates developer and CI/CD secrets via the GitHub API to attacker-controlled repositories, and the campaign likely propagated through a compromised codfish/semantic-release-action GitHub Action that enabled access to release automation credentials.
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure CL-STA-1062, a Chinese-speaking threat cluster assessed to be the same as UAT-7237, has compromised Southeast Asian government and critical energy infrastructure entities throughout 2025 using web shell deployment, MSSQL data exfiltration, and open-source tunneling tools (SoftEther VPN, VNT, yuze). The group has introduced TinyRCT, a previously undocumented .NET backdoor delivered via AppDomainManager Injection (malicious chrome_setup.zip), which uses AES-CBC encrypted HTTP C2, sandbox-evasion path checks, scheduled-task persistence disguised as legitimate updater services, and a self-destruct routine using choice.exe for anti-forensic file deletion.
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances Gamaredon, a Russia-aligned APT group attributed to the FSB, maintained high operational tempo throughout 2025 with 35 spearphishing campaigns exclusively targeting Ukrainian government and military institutions. The group introduced six new PowerShell tools, resurrected the PteroSetup VBScript weaponizer for lateral movement, and began abusing CVE-2025-8088 (WinRAR) for persistence via the Startup folder. A significant infrastructure evolution occurred: C&C servers are now hidden behind tunnel services (Cloudflare tunnels, Cloudflare workers, Microsoft devtunnels, Loophole) and dead-drop resolutions on legitimate platforms (Telegram, Telegra.ph, Rentry, GoFile, Dropbox, and others), while stolen data is exfiltrated to S3-compatible cloud storage (Wasabi, Tebi, Intercolo) rather than attacker-owned servers.
- 19 minMonthly Recap — 2026-06-01 -> 2026-07-01
AI Attacked and Abused While Perimeter Authentication Collapses The month's defining shift was the emergence of AI as a two-sided battlefield: organizations deployed AI tools faster than they secured them, while attackers weaponized the same technology against defenders. Critical flaws in LangGraph allowed SQL injection chained to remote code execution, M365 Copilot could be turned into a one-click data exfiltration weapon via SearchLeak, and Langflow was exploited to deploy cryptominers. Meanwhile, the ongoing Shai-Hulud campaign injected prompts to blind AI malware scanners, macOS.Gaslight turned prompt injection against human analysts, and Russia's APT28 began experimenting with LLM-integrated malware. At the same time, perimeter authentication collapsed at scale: FortiBleed exposed credentials for over 73,000 FortiGate firewalls, CVE-2026-50751 let attackers bypass Check Point VPN authentication entirely, and ShinyHunters exploited an Oracle PeopleSoft zero-day across over 100 organizations. Supply chain attackers followed developers to their new AI tools, compromising the ecosystems where code is written and built. The Shai-Hulud/Miasma worm expanded from npm into PyPI and injected persistent backdoors into AI coding assistant configurations, while North Korea's Sapphire Sleet compromised over 140 Mastra npm packages to steal cryptocurrency wallets, and the ongoing GlassWorm campaign pivoted to WebAssembly malware in VS Code extensions using the Solana blockchain as command-and-control. Social engineering also industrialized: the ErrTraffic framework turned ClickFix deception into a Malware-as-a-Service operation with blockchain dead drops, and EvilTokens hid phishing flows inside browser-side encryption to defeat network scanners while hijacking Microsoft device-code authentication. Organizations should treat AI deployments as untrusted perimeter assets—restrict their network access, audit third-party skills and extensions, and assume prompt-injection attacks will target both automated scanners and human analysts. Every internet-facing VPN, firewall, and edge appliance should be patched immediately, with credentials rotated and phishing-resistant MFA enforced, because perimeter authentication failures now cascade directly into internal network compromise.
- 6 minWeekly Recap — 2026-06-22 -> 2026-06-29
Legitimate Tools Hijacked as AI Becomes the New Battleground The most damaging intrusions this week didn't rely on custom malware — they hijacked the legitimate tools and protocols organizations already trust. FortiBleed harvested real credentials from FortiGate firewall configurations worldwide, EvilTokens bypassed multi-factor authentication by abusing Microsoft's own device login flow, and a WhatsApp campaign installed legitimate ManageEngine remote management software to maintain persistent access. Simultaneously, attackers are learning to manipulate the AI systems defenders increasingly depend on. The macOS.Gaslight malware feeds fake error messages to AI analysis tools to blind security analysts, malicious skills on the OpenClaw marketplace trick AI assistants into executing harmful commands, and researchers demonstrated that chatbot reconnaissance can map an organization's defenses through casual conversation. Reset all FortiGate and VPN credentials immediately, scrutinize AI marketplace add-ons before installation, and assume that any legitimate-looking login prompt or remote management tool could be an attacker wearing a trusted disguise.
OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat Threat actors are exploiting the OpenClaw AI agent ecosystem by publishing malicious skills on the ClawHub marketplace. These skills leverage semantic instruction hijacking to bypass traditional security controls, delivering macOS infostealers via base64-encoded droppers, utilizing massive file padding for defense evasion, and executing novel agentic financial fraud schemes like runtime affiliate injection and front-running.
Inside FortiBleed: Reverse Engineering the CyberStrike Harvester Behind a Global FortiGate Credential Factory FortiBleed is a severe, large-scale credential compromise campaign targeting internet-facing Fortinet FortiGate devices. Threat actors utilize a sophisticated pipeline, including the custom CyberStrike Harvester, to extract and crack credentials from device configurations and traffic captures, subsequently pivoting into internal networks for Active Directory enumeration and data exfiltration.
EvilTokens: How “Ghost” Code Threatens US and European Businesses The EvilTokens phishing kit utilizes browser-side AES-GCM decryption to conceal its malicious payload from static analysis tools. By abusing the Microsoft Device Code authentication flow, the kit tricks victims into authorizing attacker access to their Microsoft 365 accounts without directly harvesting credentials, creating a significant visibility gap for SOC teams.
A VBScript campaign distributed through WhatsApp deploying RMM software A widespread malware campaign is leveraging compromised WhatsApp accounts to distribute malicious VBScript files disguised as financial documents. The multi-stage infection chain abuses legitimate Windows utilities to download payloads, attempts to bypass UAC via registry modifications, and ultimately deploys a preconfigured ManageEngine Endpoint Central RMM agent to establish persistent remote access.
- 12 minWeekly Recap — 2026-06-15 -> 2026-06-22
Trust Chains Broken at Scale While ClickFix Becomes a Service This week, attackers stopped trying to kick down the front door and instead walked in through the trust chains that hold digital ecosystems together. North Korea's Sapphire Sleet compromised over 140 Mastra npm packages through a single typosquatted dependency, stealing cryptocurrency wallets and planting persistent backdoors on developer machines. The GlassWorm group trojanized Open VSX extensions with WebAssembly malware that uses the Solana blockchain as an unkillable command channel, while SmartApeSG hijacked the Okendo Reviews widget to serve malicious prompts on thousands of e-commerce sites. Even vendor integrations became a liability: the Klue breach exposed Recorded Future client data through a compromised OAuth token connecting a marketing tool to Salesforce. Deception also became an industrial product. The ErrTraffic framework now operates as full Malware-as-a-Service, using blockchain smart contracts to hide its infrastructure and compromised WordPress sites to serve fake error prompts that trick users into running malicious commands. Attackers weaponized trusted AI platforms too—one campaign abused claude.ai's shared chat feature to deliver MacSync infostealer on macOS, while the shai_hulululud npm package uses prompt injection to blind AI-powered security scanners. On the infrastructure side, the FortiBleed campaign cracked credentials for over 73,000 FortiGate firewalls with a 45-GPU cluster, handing attackers valid keys to government and defense networks worldwide. Defenders should immediately hunt for the easy-day-js dependency in their npm projects, reset credentials on any FortiGate firewall, enable Azure AD Graph Activity Logs to close a years-long reconnaissance visibility gap in Microsoft cloud environments, and audit OAuth tokens on all third-party vendor integrations.
Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap Microsoft has introduced customer-accessible logging for the legacy Azure AD Graph API (graph.windows.net), closing a significant visibility gap historically abused by adversary enumeration tools like ROADrecon and AADInternals. Defenders can now ingest AzureADGraphActivityLogs into their SIEM to detect bulk directory reconnaissance, suspicious user agents, and internal API misuse.
Killing me gently: Inside Gentlemen’s EDR killer framework ESET researchers analyzed the Gentlemen ransomware-as-a-service (RaaS) operation, highlighting their unique approach of providing an in-house developed EDR killer framework, GentleKiller, directly to affiliates. The framework leverages Bring Your Own Vulnerable Driver (BYOVD) techniques to terminate over 400 security processes and is augmented by third-party tools like HexKiller and HavocKiller, all standardized with a shared defense-evasion layer.
Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign A sophisticated malvertising campaign abused Google Ads to deliver ClickFix social engineering attacks disguised as popular AI developer tools and Mac utilities. The threat actors initially leveraged GitLab Pages before pivoting to weaponize claude.ai's shared chat feature, tricking macOS users into executing terminal commands that deploy the MacSync infostealer.
140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack A coordinated supply chain attack compromised over 140 npm packages in the Mastra namespace by injecting a typosquatted dependency, easy-day-js. This dependency uses a postinstall hook to execute a cross-platform Node.js infostealer that establishes persistence, inventories cryptocurrency wallets, steals browser history, and enables arbitrary remote code execution via a custom ICAP-style C2 protocol.
npm Package Uses Prompt Injection and Token Flooding to Disrupt AI Malware Scanners An npm package named shai_hulululud was discovered utilizing adversarial techniques to disrupt AI-assisted malware scanners. The package employs prompt injection, safety-triggering content, and context flooding via millions of tokens to cause LLM-based analysis tools to fail, truncate, or refuse processing before reaching the obfuscated JavaScript payload.
