Malware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
56
- Mentions · 7d0
- Mentions · 30d1
- All mentions11
- First seenAug 11, 2026
- Last mentioned15d ago
Timeline
11 articles · newest firstKnow Your Enemy: Browser-Based Attack Techniques in 2026
Push Security survey details six dominant browser attack techniques for 2026, including AiTM phishing, ClickFix, OAuth abuse, and session hijacking.
32
CISA: Ransomware gangs now exploiting critical TeamCity flaw
Ransomware gangs are exploiting a critical JetBrains TeamCity flaw (CVE-2026-63077) and are being used in ransomware attacks.
70
Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
Anthropic's 154-page report details Generative Threat Groups, including APT29-linked GTG-20006 and ShinyHunters affiliates, using Claude for reconnaissance, exploitation, and data theft.
78
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.
82
Anthropic caught Russia-linked spies using Claude in hacking operations
Anthropic disrupted Russia-linked APT29 using Claude in espionage against 20+ organizations, including Ukrainian government targets and a military drone maker whose vision SDK was stolen.
84
Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research
Anthropic threat report says APT29, ShinyHunters and others used Claude models to automate cyberattacks, surveillance, and bioweapons research.
78
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.
72
Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google tracks three Russia-linked espionage clusters abusing OAuth, app passwords, and device code phishing against Western researchers and diplomats.
82
Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw
CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.
78
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.
72
Related CVEs
by mentions- CVE-2026-6307794%9.8Unauthenticated Deserialization RCE in JetBrains TeamCity On-Premises
- CVE-2026-7357072%8.9Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
Appears with
- Midnight Blizzardthreat actor · 7
- Microsoftvendor · 5
- Anthropicvendor · 5
- Storm-2945threat actor · 4
- Claudeai model · 4
- Anthropicorganization · 4
- GTG-20006threat actor · 4
- Googlevendor · 3
- ShinyHuntersthreat actor · 3
- Microsoftorganization · 3
- Claudeproduct · 3
- WhatsAppproduct · 3
- Cozy Bearthreat actor · 3
- Microsoft 365product · 3
- UNC6293threat actor · 2
- UNC7005threat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.