57
60
60
57
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.
Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.
58
FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.
The U.S. DoJ announced court-authorized seizure of domains behind QScan and QTRouter, operated by the Chinese state-sponsored group QTFY and employed by Nanjing Xinjiuwei Network Technology Company. QTFY has been active since May 2018 and targeted NASA, the Federal Reserve, the Department of Energy, DoJ, HHS, NIH, the U.S. Senate, and academic institutions. QScan exploits vulnerable IoT devices, feeding them into QTRouter, an OpenWrt-based proxy obfuscation network likened to an operational relay box (ORB) that masks attack origins. The group exploited zero-days such as Ivanti CSA flaws CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380, plus numerous N-days, and maintained persistence with RATs, web shells, and legitimate credentials.
78
Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan
BITTER used three ArtraDownloader variants since 2015 to target Pakistan, China, and Saudi Arabia, deploying BitterRAT and exploiting CVE-2017-11882 in one wave.
Palo Alto Unit 42 documents ArtraDownloader, a previously unreported downloader family used by the suspected South Asian group BITTER, with three variants and roughly 80 unique samples dating back to February 2015. Between September 2018 and January 2019, BITTER used spearphishing documents hosted on compromised Pakistani websites to target Pakistan and, for the first time, Saudi Arabia; one RTF sample exploited the EQNEDT vulnerability CVE-2017-11882. The downloader retrieves BitterRAT over HTTP, uses simple registry keys for persistence, and byte-level string obfuscation. Infrastructure overlap with the previously reported MY24 InPage-exploit payload was also observed.
48
Campaign Evolution: EITest from October through December 2016
Unit 42 details the EITest campaign's late-2016 changes: gates and obfuscation dropped, with Rig EK variants delivering ransomware and infostealers.
Unit 42 tracks the EITest campaign through late 2016, noting it abandoned the gate between compromised websites and exploit kit landing pages after its October 2016 report, and stopped obfuscating injected script URLs by October 15. The campaign primarily uses the Rig-E (Empire Pack) variant and sometimes Rig-V of Rig EK to deliver Cerber and CryptoMix ransomware plus infostealers such as Gootkit, the Chthonic banking Trojan, Ursnif variants, and Latentbot. Tracked since 2014 by Malwarebytes Labs and others, EITest targets unpatched Windows systems without specific victimology.
24
60
57
60
US takes down alleged Chinese hacking tools used against Federal Reserve, DOJ and Senate
DOJ takes down QScan and QTRouter Chinese obfuscation platforms used to breach Federal Reserve, DOE, DOJ, and Senate since 2018.
The DOJ and FBI seized domains hard-coded into QScan and QTRouter, platforms run by Nanjing Xinjiuwei Network Technology Company and used by China's Ministry of State Security and PLA. QScan automatically infected IoT devices worldwide which were absorbed into QTRouter, allowing attackers to disguise intrusions as originating from other countries or local sources. Victims included the Federal Reserve, Department of Energy, DOJ, US Senate, NASA, HHS, NIH, plus hospitals, telecoms, power companies, financial institutions, and defense contractors. The FBI investigated QTFY since 2018, tracing a 2019 NASA incident through Pulse Secure VPN exploitation.
76
EITest Campaign Evolution: From Angler EK to Neutrino and Rig
Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.
Unit 42 updated its tracking of the EITest campaign, first identified in October 2014, which compromises websites with injected scripts that redirect victims through a gate to exploit kits. After Angler EK disappeared in June 2016, EITest switched to Neutrino and then primarily used Rig EK by August 2016. In September 2016 the campaign began using hex-obfuscated JavaScript and simplified gate URLs, while continuing to distribute payloads including Gootkit, Cerber, Bart, CryptFile2, Vawtrak, Ursnif, and Tinba. Gate infrastructure consistently reused IP blocks such as 85.93.0.0/24 even as domain names changed.
36
⚡ Weekly Recap: SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
60
Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild
60
57
Magnitude exploit kit
60
60
57
Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks
Cisco Talos details a crypto-theft ClickFix campaign abusing Google Sheets to swap wallet addresses, with about $10,000 in observed Bitcoin losses.
Cisco Talos tracks a ClickFix-style campaign that tricks cryptocurrency traders into pasting JavaScript into Chrome's address bar or a Tampermonkey extension, promising fake bonuses on SwapZone and SimpleSwap. The loader pulls obfuscated JavaScript from cells in a public Google Sheet via the Visualization API, then behaves like a web skimmer, rewriting deposit addresses on screen, in web responses, and in the clipboard. Researchers counted 49 attacker-controlled Bitcoin addresses, with 24 receiving a combined 0.159 BTC, roughly $10,000, by early August 2026. A Tampermonkey variant re-injects the payload on every return visit, giving the attackers persistence despite takedown efforts.
55
Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency
Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.
Cisco Talos uncovered a cryptocurrency theft campaign that abuses Google Sheets and the Google Visualization API as a covert C2 channel, delivering obfuscated JavaScript into victims' Chrome browser sessions via ClickFix-style social engineering. Victims are lured with a fake "API Logic Flaw" report promising 25-38% bonuses on SimpleSwap and SwapZone swaps; the injected payload acts as a browser-based web skimmer that replaces deposit addresses, overrides the fetch API, and hijacks the clipboard. Later variants use the legitimate Tampermonkey extension with a user script for persistence without OS-level compromise. Talos identified 49 Bitcoin wallets, with 24 reused addresses receiving about 0.159 BTC (~$10,000) before mixing through more than 3,000 addresses.
52
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
Talos tracks a crypto-theft campaign abusing the Google Visualization API for C2, using browser-based ClickFix lures to inject web-skimmer JavaScript.
Criminal actors convinced targets to paste JavaScript into Chrome's address bar or install it in the Tampermonkey extension, injecting a web skimmer into sessions on two cryptocurrency trading websites; Tampermonkey also provides persistence. Since March 2026 the campaign retrieved obfuscated scripts via the Google Visualization API from public Google Sheets documents, hooking the fetch API and replacing cryptocurrency deposit addresses in responses and the clipboard. Lures pose as leaked reports of a nonexistent API flaw at cryptocurrency swap services and spread via Telegram, DarkForums, and paste sites since early October 2025. Talos warns the legitimate-service-abuse techniques could enable wider supply-chain attacks on e-commerce and customer-facing systems.
48
JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
Check Point details JSCeal, a V8-compiled JavaScript stealer that replays stolen cookies to bypass Google authentication, spread via crypto malvertising.
Check Point Research's new report analyzes JSCeal, a compiled V8 JavaScript malware obfuscated with javascript-obfuscator using RC4-protected strings, control-flow flattening, and proxy functions. Delivered through fake TradingView installers on malvertising sites overlapping the WEEVILPROXY/MeadowLocust and SourTrade campaigns, it harvests cookies, passwords and OAuth tokens from Chromium browsers, records keystrokes and screenshots, and can replay stolen Google session cookies to bypass authentication. It also installs a local proxy with service-specific handlers for Binance, Bybit, and Ledger to intercept and modify cryptocurrency-related traffic.
45
ASCII smuggling crosses over from AI prompt injection to phishing evasion
Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.
Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.
70
FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure
FBI seizes China-linked QScan and QTRouter hacking platforms used by QTFY to obfuscate intrusions against US federal agencies.
The DOJ and FBI seized domains hard-coded into QScan and QTRouter, two platforms operated by China-based Nanjing Xinjiuwei Network Technology Company on behalf of state-sponsored group QTFY. QScan automatically infected thousands of IoT devices which were added to QTRouter, an obfuscation network routing malicious traffic through compromised and proxy devices outside China. Targets included NASA, the Federal Reserve, Departments of Energy, Justice, and HHS, NIH, and the US Senate, exploiting flaws in Fortinet SSL-VPN, Citrix ADC, Microsoft Exchange, F5 BIG-IP, Log4j, and others.
78
New Agent Tesla Malware Variant Boosts Evasion Capabilities
KnowBe4 documented an Agent Tesla v4 campaign using emoji-based code obfuscation to evade detection.
KnowBe4 researchers reported a campaign distributing Agent Tesla v4, a long-running Windows keylogger and infostealer. The new variant uses emoji-based code obfuscation, a novel technique, to hinder static analysis and evade security tooling. Defenders should watch for behavioral indicators such as credential theft and unusual process activity.
40
Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT
Cortex XDR threat hunters uncovered a phishing campaign delivering the NetSupport Manager RAT via a fake password-protected NortonLifelock Word document.
Unit 42 identified a January 2020 phishing campaign using a Microsoft Word document disguised as a password-protected NortonLifelock file. Enabling macros triggered an obfuscated command that built alpaca.bat in the temp directory, which used msiexec to download an MSI payload from quickwaysignstx.com, filtered on the Windows Installer user-agent string. The payload installed a PowerShell script and the campaign, which has delivered NetSupport Manager RAT since at least 2018, showed related activity dating back to early November 2019.
42
Campaign Evolution: pseudo
Unit 42 traces the pseudo-Darkleech campaign's 2016 shift from Angler to Neutrino to Rig exploit kits and rotating ransomware payloads.
Unit 42 documents how the pseudo-Darkleech exploit kit campaign evolved through 2016, switching from Angler EK to Neutrino EK in June and to Rig EK in September after Neutrino ceased operations. Payloads rotated from TeslaCrypt to CryptXXX, CrypMIC, and finally Cerber ransomware by October 2016. Injected script on compromised websites changed from 12,000-18,000 character obfuscated blocks to short, unobfuscated hidden iframes starting July 1, 2016.
22
60
60
CosmicSting attack & defense overview
60
60
60
60
60
60
New malicious web shell from the Tropic Trooper group is found in the Middle East
60
60
57
60