60
30
30
Nation-state hackers ramping up use of Gemini for target reconnaissance, malware coding, Google says
42
42
42
60
30
35
35
30
42
42
30
60
42
30
60
42
55
42
42
30
55
55
Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement
Zscaler discovered SloppyRAT, a ClickFix-delivered RAT that gives ransomware operators reconnaissance, remote execution, and SOCKS proxy pivoting for lateral movement.
Zscaler identified SloppyRAT in June 2026, linked to a ransomware-related threat actor. The infection chain starts with a ClickFix lure abusing finger.exe over TCP port 79, then uses curl.exe, IronPython, CastleLoader, and CastleRAT before reflectively loading SloppyRAT as a DLL in memory. The RAT supports HTTPS command-and-control, system inventory, file operations, Defender tampering, and a reverse SOCKS proxy, with evasion features including runtime code encryption, indirect syscalls, certificate pinning, and a possible EtherHiding blockchain fallback. Its persistence code is buggy and the malware appears under development, but the pre-encryption foothold gives defenders a window to stop intrusions.
52
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.
Manifold Security found 77 extensions uploaded to the Open VSX marketplace between July 26 and August 1, 2026 that impersonate real Microsoft VS Code Marketplace tools, with all 77 sending data to mangorbit.com. 58 lightweight variants exfiltrate the hostname, while 19 recon variants collect editor details, OS username, Git remote hosts, CI environment variables (GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, Codespaces, Gitpod), and installed extension IDs. The recon variant retries for up to seven days and can fall back to a DNS TXT record for exfiltration if the primary domain is blocked. The extensions were removed from Open VSX by August 3, 2026; the disclosure follows a separate npm supply chain campaign, ChainDrop, which compromised 450 packages with a Shai-Hulud worm variant.
40
42
30
55
55
55
30
55
42
47
30
55
30
47