30
ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools
Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.
ClearFake compromises websites, injects JavaScript via a malicious Cloudflare Worker, retrieves instructions from BNB Smart Chain contracts (EtherHiding), and presents a fake Google CAPTCHA that tricks Windows users into pasting a command that loads a remote library over WebDAV via rundll32. The crypto-stealer branch uses DLL side-loading with a signed Chrome component to launch ZigCryptoStealer, which hijacks clipboard cryptocurrency addresses, alongside a signed but vulnerable Windows driver used in a BYOVD attack to terminate EDR processes. A parallel branch delivers Amatera secondary payloads that install a hidden remote-access client providing operator desktop control, with Cisco Talos tracking the remote-loader activity as UAT-10820. Talos observed unusual remote library execution at a Ukrainian government organization in April 2026 and assesses the attacks are part of a broader theft operation rather than a single targeted campaign.
62
45
30
30
30
Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain
The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.
The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.
45
30
45
30
30
Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users
Malicious 'Twitch Enhanced Viewer | JeetBot' browser extension stole live OAuth session tokens from roughly 31,000 Chrome and Firefox users.
Socket.dev found the cross-store extension 'Twitch Enhanced Viewer | JeetBot' rerouted Twitch playlist requests through operator-controlled proxies, attaching the victim's account-level OAuth token as a URL parameter where it could be logged in cleartext. About 30,000 Chrome and 552 Firefox installs were exposed, with tokens forwarded for nearly every watched channel to infrastructure tied to a Russian commercial bot service. The stolen bearer token enables chat, whisper, account-setting access and channel-point spending without the password or 2FA.
52
xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations
xHunt deployed custom backdoors Hisoka, Killua, Gon, and EYE against Kuwait shipping and transportation organizations, using DNS tunneling and email-draft C2 channels.
Unit 42 observed the xHunt campaign targeting Kuwait transportation and shipping organizations between May and June 2019, installing backdoors named after characters from the anime Hunter x Hunter, including Hisoka, Killua, Sakabota, and Netero. The tools use HTTP and DNS tunneling for C2, and Hisoka v0.9 added an unusual email-based C2 channel that abuses Exchange Web Services with stolen credentials to exchange email drafts. The Gon tool provides port scanning, file transfer, screenshots, remote command execution, and RDP session creation, while EYE acts as a cleanup failsafe if a legitimate user logs in. Related activity targeting Kuwait between July and December 2018 was reported by IBM X-Force IRIS, suggesting the campaigns are likely related.
52
30
30
30
30
30
30
30
Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members
30
30
30
30
30
50
30
Iranian Hackers Pose as Recruiters to Deliver Cross
Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.
Kaspersky links two previously undocumented malware families, NodeRabbit (Node.js) and PollCat (obfuscated JavaScript), to the Iranian threat actor Nimbus Manticore, also known as Iranian Dream Job. Victims in Afghanistan, Egypt, and Ethiopia received trojanized coding challenge archives containing fake npm packages (colorized_terminal, pretty-log) that silently launched the RATs as background processes. NodeRabbit contacts Azure-hosted C2 servers via checkin, task, and result API endpoints and supports 11 commands including shell execution, file operations, and network enumeration. Persistence is platform-specific: Windows Run keys or scheduled tasks, Linux cron entries, and macOS launch agents, impersonating Microsoft Edge updates or Intel's Driver & Support Assistant.
55
30
45
30
30
30
30
30
30
30
30
30
30