30
Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes
SOCRadar details AnonyMousKIT, a phishing-as-a-service platform using AI voice agents posing as Apple Support to steal passcodes and 2FA codes.
SOCRadar's Threat Research Unit documented AnonyMousKIT, a credit-metered phishing-as-a-service platform that strips Activation Lock from stolen Apple devices across email, SMS, WhatsApp, recorded calls and AI voice agents. The 'Alice from Apple Support' personas request the device passcode, Apple ID credentials and a live 2FA code, with lures citing the handset's model identifier and live Find My status. Of 200 recovered AI calls made between August 31, 2025 and May 30, 2026, 179 targeted Brazil, and the calls cost $19.24 total via voice platform Vapi. Exposed log paths revealed 30 kit installations on 42 domains and 6,092 send attempts family-wide between March and July 2026.
58
30
30
30
30
Angry Birds: Toy Ghouls’ new toys
Kaspersky tracks ransomware group Toy Ghouls deploying new custom backdoors, mqtt-bird-agent and matrix-bird-agent, using HiveMQ MQTT and Element as C2 channels.
Kaspersky reports that Toy Ghouls (also known as Bearlyfy, Laboo.boo and Feral Wolf), a financially motivated group targeting Russian organizations since 2025, shifted from leaked Babuk and LockBit builders and public GitHub tools to its custom GenieLocker ransomware. In early July 2026 the group deployed two custom backdoors: mqtt-bird-agent 0.1.0 using the public HiveMQ MQTT broker as C2, and matrix-bird-agent 0.1.0 using the Element messenger. The backdoors are delivered via WinRM using Evil-WinRM and WinRM-fs, persist as Windows services, and encrypt their configuration with ChaCha20-Poly1305 keyed to the machine's MachineGuid registry value.
45
30
30
45
30
Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs
Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.
PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.
55
30
Iranian Hackers Pose as Recruiters to Deliver Cross
Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.
Kaspersky links two previously undocumented malware families, NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), to the Iranian threat actor Nimbus Manticore, also known as Iranian Dream Job. Victims in Afghanistan, Egypt, and Ethiopia received trojanized coding challenge archives containing fake npm packages (colorized_terminal, pretty-log) that silently launched the RATs as background processes. NodeRabbit contacts Azure-hosted C2 servers via checkin, task, and result API endpoints and supports 11 commands including shell execution, file operations, and network enumeration. Persistence is platform-specific: Windows Run keys or scheduled tasks, Linux cron entries, and macOS launch agents, impersonating Microsoft Edge updates or Intel's Driver & Support Assistant.
55
30