60
60
60
60
60
60
60
60
60
60
60
60
60
19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto
Socket found 19 malicious Chrome and Edge extensions, active since February 2024, stealing wallet seed phrases and credentials and draining crypto from about 80,000 users.
Socket researcher Karlo Zanki documented a cluster of 18 Chrome and one Edge extensions with wallet secret stealing and cryptocurrency draining capabilities, tracked as campaign Superior and possibly active since February 2024. The actor created 14 extensions and bought five legitimate ones, later pushing malicious updates; the largest, Enable Right Click & Copy, has roughly 80,000 installs across both browsers. The extensions maintain WebSocket C2 connections with endpoint rotation, strip CSP headers, and load 16 modules including multi-chain wallet drainers, hardware-wallet seed-phrase harvesters, credential grabbers, and ClickFix-style lures.
62
ThreatsDay Bulletin: Stealth Loaders, AI Chatbot Flaws AI Exploits, Docker Hack, and 15 More Stories
60
60
60
60
60
⚡ Weekly Recap: iPhone Spyware, Microsoft 0-Day, TokenBreak Hack, AI Data Leaks and More
60
60
60
60
60
60
60
60
60
60
60
60
Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
US and European authorities with CrowdStrike dismantled the two-decade-old Sality P2P botnet using peer-list manipulation, blocking payload delivery to infected hosts.
The US Department of Justice announced a coordinated takedown of the Sality peer-to-peer botnet, executed August 31, 2026 by authorities from the US, Bulgaria, Hungary, and Romania with CrowdStrike and the Shadowserver Foundation. Sality, active since 2003, infects Windows executables and delivers payloads including the EggJagger crypto clipper, which stole at least $150,000, and was used for DDoS campaigns. The operation abused the botnet's peer-list maintenance cycle to insert sinkhole nodes and isolate both super peers and NAT-hidden infections, cutting off URL and payload distribution to more than 15,000 infected machines across two P2P networks.
62
60
60
60
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Ontinue disclosed TWINLOOT, a Python implant hiding C2 in SharePoint dead drops and Teams TURN relays, harvesting credentials and pivoting via reverse SOCKS5.
Ontinue's Cyber Defense Center identified TWINLOOT during a July 2026 campaign investigation: a modular, PyArmor-hardened Python implant (a 39 MB bootstrap-fat.pyc loader) whose entire C2 infrastructure lives inside trusted Microsoft services. Tasking flows through SharePoint Online file dead drops polled every 15 seconds via the Microsoft Graph API, while interactive operator access uses WebRTC DataChannels relayed by Microsoft Teams TURN servers; Graph traffic is driven by the victim's own headless Edge browser. The implant harvests Windows credentials with fake lock screens, offers a reverse SOCKS5 pivot for lateral movement to SMB, RDP, WinRM, and MSSQL, executes commands, and persists on hosts. Initial access is assessed to be Teams social engineering masquerading as IT support, prompting a PowerShell command to download the payload.
60
60
60
60
60