57
57
57
57
60
57
60
57
57
57
Low-quality casino sites conceal highly dangerous threat actors
Infoblox reveals China-aligned APT groups hiding PeckBirdy malware C2 domains inside roughly 1.7 million Chinese-language illegal casino websites.
An Infoblox report says it tracks about 1.7 million Chinese-language casino sites enabling illegal gambling, some of which double as command-and-control infrastructure. China-aligned APT groups have hidden PeckBirdy framework C2 domains inside these low-quality casino sites since 2023, injecting scripts that display fake software update pages to deliver malware. Over 3 percent of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, and some sites rely on US cloud providers via 'infrastructure laundering.' Infoblox urges defenders not to dismiss casino-domain alerts as mere employee browsing violations.
58
57
57
57
57
57
57
57
Threat Actors Use Claude AI Agents to Automate Cyberattacks and Steal Sensitive Data
Anthropic reports state-linked and criminal actors used Claude AI agents to automate espionage, extortion, and exploit development, stealing 300,000+ identity records and drone IP.
Anthropic's threat report details AI-driven campaigns disrupted between December 2025 and August 2026, including suspected Russian cluster GTG-20006, which targeted Ukrainian and European governments, defense firms, and drone supply chains using fully automated attack chains. The group stole over 300,000 national identity records and commercial-registry data on 500,000+ companies from a North African government technology authority, plus a proprietary drone-vision SDK. Suspected ShinyHunters affiliates decompiled 1.8 million Android APKs on 10 Amazon EC2 workers to find hardcoded secrets and abused stolen AI API keys, while the Chinese-speaking GTG-10007 cluster generated over a dozen potential zero-day findings against network appliances in one month.
78
Iranian cyber spies target aviation, fintech developers with new malware
Kaspersky links Iranian espionage group Mirage Kitten to fake job offers delivering new NodeRabbit and PollCat malware at aviation and fintech targets.
Kaspersky attributes the campaign to Iran-linked Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm and Nimbus Manticore), which targeted developers and specialists in Egypt, Ethiopia and Afghanistan via fake recruiter contacts on LinkedIn and job platforms. Victims were lured into running malicious coding assessments that deployed two previously unknown families: NodeRabbit, a cross-platform RAT for Windows, Linux and macOS, and PollCat, which provides persistence and delivers additional payloads. The group masks activity behind legitimate Microsoft Azure and Cloudflare infrastructure, sometimes embedding victim organization names in Azure subdomains. The group has been active since at least 2022, focusing on aviation, aerospace and financial technology sectors in Africa and the Middle East.
75
57
57
57
57
60
57
57
57
57
57
57
57
57
57
57
60
57
57
57
57