Fake AI apps steal credentials and plant malware, ANY.RUN says
Researchers tied 1,258 public sandbox analyses from April 15 to October 5 to campaigns impersonating popular AI brands.
58
Product
Google Gemini
- Mentions · 7d0
- Mentions · 30d1
- All mentions7
- First seenAug 20, 2026
- Last mentioned9d ago
Timeline
7 articles · newest firstPortnox detects and removes unauthorized AI applications from managed devices
Portnox introduced a tool to automatically detect and remove unauthorized Shadow AI applications from managed devices to enforce security policies.
50
China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
85
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.
85
Chinese espionage groups swarm to exploit triple-link chain of zero-days
At least four China-aligned espionage groups chained three zero-days in Chromium browsers and Windows ALPC for espionage since late August.
88
Chinese espionage groups swarm to exploit triple-link chain of zero-days
Four China-aligned espionage groups, starting with TA412/APT31, chained zero-days CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 to spy on targets since late August.
85
Fake Gemini installer delivers Vidar infostealer via Google Colab lure
Attackers used a fake Google Gemini installer hosted on Google Colab to deliver a Go-compiled Vidar infostealer that stole browser credentials from an EMEA company.
45
Related CVEs
by mentions- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
Appears with
- Googlevendor · 5
- Violet Typhoonthreat actor · 4
- TA412threat actor · 4
- APT31threat actor · 4
- Microsoftvendor · 4
- UNK_LateNightthreat actor · 3
- Google Chromeproduct · 3
- China Ministry of State Securityorganization · 3
- Proofpointvendor · 3
- UNK_DoubleCheckthreat actor · 2
- Microsoft Windowsproduct · 2
- UNK_QuietRacketthreat actor · 2
- Claudeproduct · 1
- Portnoxorganization · 1
- GemStonemalware · 1
- Claudeai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.