By nearly all accounts, we’re inching closer to a passwordless society. The FIDO Alliance, which develops new passwordless authentication standards and whose tagline is quite literally “reducing reliance on passwords”, now estimates that more than 5 billion passkeys are in use worldwide. In fact, more than three-quarters of global consumers have already enabled a passkey on at least one account.

The technology is a boon for the financial industry because it finally removes the sector’s entrenched dependency on knowledge-based credentials – reusable “secrets” that criminals can steal, guess, or extract through social engineering. Suddenly, being able to quote a user’s mother’s maiden name, the town they grew up in, or their several-digit password, isn’t enough – and that makes user access instantly more secure.

Passkeys also give customers a much easier ride when it comes to accessing their accounts, speeding up the process by allowing them to use a key biometric like a fingerprint rather than hopping through two or three screens and entering their “memorable information” each time they log on.

So far so good. However, according to research by Javelin, account takeovers still impacted some 6 million US consumers in 2025 – an increase of 18% on the previous year – with losses exceeding $15 billion. Countless other stats and analyses also support this trend, including The Federal Reserve, which reported a 36% increase in account takeovers between 2023-4 – and those are just the incidents that were brought to its attention.

A surface read of these figures suggests that passkeys are failing outright, but dive a little deeper and it’s clear that the problem isn’t with the technology itself, but how it’s implemented and safeguarded. Securing the front door doesn’t work if a fraudster can manipulate the locksmith into handing them a new key.

While a successful passkey authentication establishes control of a device-linked credential, it’s still on financial institutions to prove how that credential came to be enrolled and whether the session it grants access to remains trustworthy. Did the account holder genuinely intend to add that payee, recover that account, or move a huge sum of money? Passkeys are useful, but they were never designed to answer all of these questions on their own.

In finance, scale doesn’t always equate to risk

Back in August, researchers at Palo Alto Networks’ Unit 42 published details of three proof-of-concept attacks against passkey-protected accounts. They demonstrated how malware on one compromised device could authenticate itself without the account holder even being present. It could even interfere with the registration of a new passkey, or even expose the passkeys synchronized to that user’s environment. Seemingly, another blow for passkeys.

This is an alarming piece of research for sure, but best taken with a grain of salt. Delve deeper into the report, and it’s clear that every one of these scenarios began with a “poisoned” device, where malware was already present. The most serious cases also depended on a very particular combination of browsers and operating systems with preset security hardware.

Reassuringly, none of the cases had an “Enigma moment” where they broke the cryptography behind passkeys, nor did they uncover a “master vault” of credentials that could be ransacked in a single raid. That means attacks like these, where customers are pursued individually, would be far harder to scale than the kind of breaches we frequently read about in the headlines.

But “hard to scale” isn’t really much of a defense in finance. A criminal doesn’t need to steal access to thousands of accounts if one “whale” justifies the effort, and if successful, that single breach can spell doom for a bank’s reputation or regulatory standing – so warnings, while taken in context, should nevertheless be heeded.

Account recovery was, and remains, the weakest link

One criticism users often have of passkeys is, “what happens when I lose or switch my device?” It’s an inconvenience for customers, and it's a real headache for banks. Of course, banks want to make the experience of switching devices as quick and painless as possible, but issuing a new passkey isn’t like resetting a password. It will only be as trustworthy as the processes used to issue it.

If passkey recovery falls back on an email, a text, or a PIN sitting in a notebook somewhere, all an attacker has to do is clear that relatively weak hurdle. How can a finance enterprise know if the person claiming to have a new device isn’t just an attacker who has come across this information by chance or while targeting a specific individual? It relegates passkeys to basic, knowledge-based security again, undermining the very purpose they were created for.

A bank simply cannot recover confidence in a customer’s identity if it never established that confidence in the first place. During enrollment, when the bank verifies who an individual is and binds their identity to a trusted record, it’s usually done through a server-held biometric reference – something that is preserved even when the original device is lost.

If a situation arises where a customer needs to recover an account, the bank should always return to that same source of truth rather than create new “evidence” by asking for it through channels that may have already been compromised. So while recovery may not be needed months or years after onboarding, the efficacy of it is really decided on day one.

Authentication shouldn’t be confused with authorization

The line between authentication and authorization may seem invisible at times, but there’s a canyon between the two – particularly when it comes to moving money. Authentication establishes access, but authorization is what determines less tangible things like permission and intent. A passkey might prove the presence of a credential on the device, while a biometric or PIN check “releases” it and opens it for the user.

That confirms that the authenticator approved the login, but it doesn’t mean that everything that follows on that session is legitimate. Proving a user logged in legitimately at 10:19 doesn’t also prove that they meant to transfer $5,000 to a new payee at 10:26 – and that’s the grand canyon between authentication and authorization.

How the finance industry crosses that canyon depends on their ability to establish user intent in the moment. Of course, they can’t simply add gateways at every single point in the user’s journey – that kind of friction would be enough of an inconvenience for customers to start considering switching to a competitor.

But they can engage in step-up authentication and do what they can to establish contextual baselines. If a user logs on at 9:50 and checks their balance, like they have done countless times before at roughly the same time every few days, the passkey alone is enough. If they want to move money, add a new payee, or – perish the thought – recover their account, they need to reestablish trust by going back to the server stored source of truth outlined above.

Each request should warrant its own process for establishing truth depending on its level of sensitivity and what is at stake.

Putting passkeys in their place

When it comes to modern banking, passkeys absolutely deserve their seat at the head of the table. They strip away the traditional dependencies on knowledge that can be easily stolen, and replace it with device-based credentials that are far harder to crack from a social engineering perspective. On paper, passkeys should banish account takeovers, but in practice, there’s still work to be done.

Finance enterprises still need to know who was originally bound to a device-based credential, and they need to be able to separate access from intent. Passkeys can carry some of that burden, but not all of it. Increasingly, finance is on the front lines of the new war on trust, and they must do what they can to establish it, nurture it, and preserve it.

We've featured the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Researchers uncovered a zero-click spyware campaign delivered through online advertisements, requiring no user interaction
• Journalists’ devices were infected with surveillance malware capable of stealing data, messages, audio, and video
• Investigation linked the operation to Israeli firms tied to ad-tech infrastructure and commercial spyware

Imagine this: You’re a journalist. You get to work, log into your computer, and go about your daily activities. While browsing the internet, you see an ad for earbuds. You don’t click the ad, you don’t even view it with interest. You just get it served, much like any other ad on the internet, and scroll away to continue with your day.

But the moment the ad was served, through it your computer was infected with a powerful infostealer. The malware harvested all sorts of sensitive data, including files, documents, cookies, bookmarks, even saved credentials. It captured your keystrokes, took screenshots while you were working, and was even able to use your microphone and camera to record you while you were working.

Email messages, as well as instant messages shared through a wide range of platforms, were picked up and exfiltrated, as well.

Mission impossible

While this might sound like a scene from a Mission Impossible movie, unfortunately it’s completely real. The victims in this story are Al Jazeera journalists (among others). In 2024, some of the journalists noticed their devices acting strange, so they reached out to Canadian cybersecurity firm Citizen Lab, who confirmed the first-ever case of zero-click mercenary spyware attack that was delivered through online ads. They’re calling it “AdFection”.

Both Al Jazeera and Citizen Lab have released their findings, and while the question of who might be attacking journalists remains unanswered, the researchers know who facilitated it - two Israeli companies, one of which has been on the US blacklist for half a decade now.

The two companies are called Candiru and Discover-Tech. The former is a mercenary spyware company that sells sophisticated surveillance tools to government customers. They were the ones who built the infostealer and the delivery mechanism. The researchers did not say who bought the tool and who was spying on the journalists, but they did say that the infostealer cost “several million dollars”.

Candiru is now known as Integrity Labs, following a rebranding and reported acquisition. The US Department of Commerce blacklisted it in early November 2021, citing evidence that it supplied spyware to foreign governments that used it to target government officials, journalists, activists, and others. However, it seems Candiru was delisted in late July, 2026.

The second company in the infection chain is Discover-Tech. It is an Israeli ad-tech company operating MyDSP, a demand-side platform that purchases digital advertising inventory through automated ad exchanges. So allegedly, the ads carrying Candiru’s malware were served through Discover-Tech’s infrastructure.

The discovery raised questions if Discover-Tech was ever a legitimate business, or just a cover for a highly sophisticated cyber-espionage campaign.

Who are the targets?

“We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse," Citizen Lab’s researchers wrote. “In fact, it appears that serving as this bridge is Discover-Tech’s primary purpose.”

The company was listed with both Google and IAB Europe as an approved vendor from 2020, The Register reported. Citizen Lab analyzed roughly four billion ad-bidding records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites in Q2 2026, alone.

So the question now is - how many people are affected, and where do they work?

Citizen Lab says that at least 45 devices belonging to Al Jazeera were compromised this way in 2024 and 2025. Citing data from New York-based advertising security firm Confiant, The Register reported that some of Discover-Tech’s ads also appeared in critical networks used by the Pentagon, the United Nations International Atomic Energy Agency, and the International Criminal Court - the same court that in 2024 issued an arrest warrant against Israeli Prime Minister Benjamin Netanyahu, alleging responsibility for war crimes and crimes against humanity.

Via The Register

• Attackers exploited vulnerable devices to install legitimate bandwidth-sharing software and hijack internet connections
• Compromised systems were covertly added to proxy networks, enabling anonymous criminal activity
• Campaign affected at least 143 devices across 34 countries, highlighting patching and access-control failures

When threat actors break into a system, they don’t need to install malware to make use of the compromised endpoint - they can install perfectly legal, normal software, and still walk away with a paycheck they didn’t earn.

A recent proxyjacking campaign spotted by security researchers GreyNoise impacted hundreds of devices in dozens of countries.

Proxyjacking

Proxyjacking is a type of attack in which a device is hijacked and assimilated into a proxy network. Usually, cybercriminals would break into a computer, install malware and create a proxy network of their own, which they can later rent or use themselves. Threat actors are always in need of “clean” and unflagged devices and IP addresses behind which they can hide, making residential proxies - both malicious and legal - highly wanted services.

Some of the biggest malicious residential proxies out there include IPIDEA, NetNut, and Cloudrouter. All of them are now either entirely dismantled, or severely disrupted, but while they were operational, they offered hundreds of thousands (sometimes millions) of IP addresses associated with an internet connection used in a household (hence the name “residential IP address”).

But malicious proxies are difficult to pull off. To assimilate a device into the network, the threat actor needs to deploy malware which, as soon as it’s spotted, will be flagged by antivirus products and quarantined. In the newest attacks, spotted by GreyNoise, someone went for a legitimate app with similar functionality, instead.

The researchers found someone installing Pawns.app, primarily a rewards platform that lets users earn money by completing online surveys and playing games. However, it used to offer a bandwidth-sharing feature that let users earn money by allowing business clients to route their internet traffic through the user’s residential IP address. At the start of the year, the app discontinued the feature, but it seems it still works for older versions.

“As of 2026, Pawns.app does not offer internet bandwidth sharing,” a notification on the app’s website reads. “This feature was discontinued and is not associated with Pawns.app anymore.” But the app’s Terms of use still describe traffic sharing as available in some versions of the application, and its business website still promotes an SDK for bandwidth monetization.

Targeting D-Link

Apparently, someone picked up on this and went to work. According to GreyNoise, they targeted D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs, as well as SAP NetWeaver Visual Composers. These contained different vulnerabilities: CVE-2024-3272 and CVE-2024-3273 for D-Link, CVE-2021-44228 for Ubiquiti, and

CVE-2025-31324 for SAP, which the threat actor leveraged to deploy Pawns.app. GreyNoise also said that the attackers targeted Hikvision and Dahua DVR/NVR devices, but did not say which vulnerabilities they leveraged against these devices.

At the moment of publication, the researchers identified at least 143 compromised devices worldwide, located in 34 different countries. While they all had legitimate software installed, it was deployed without their knowledge or consent, making the entire ordeal illegal.

“While “earn on your internet” is voluntary, proxyjacking is a crime. Proxyjacking is when an MCA (malicious cyber actor) forces victim devices into proxy networks in order to monetize their bandwidth,” GreyNoise warned.

If you’re worried someone might have done something similar to a device under your control, GreyNoise created a free service that lets you check if your IP interacted with its Global Observation Grid. The researchers said it can serve as a potential indicator of proxyjacking.

Apart from scanning IP addresses, businesses should educate employees about the risks associated with installing free apps, as well as about the importance of keeping devices patched. They should also detect residential proxy IP addresses in authentication logs, as well as deviations in user authentication behavior and characteristics beyond geolocation, such as mismatches in device identifiers, or session identifiers.

Via BleepingComputer

• KGB RAT is a malware-as-a-service platform offering remote access, credential theft, and crypto hijacking features
• The malware includes unusual psychological tactics such as fake BSODs, jump scares, and screamer functions
• Researchers found multiple operators using the tool, which is marketed as legitimate software despite its criminal capabilities

Halloween is just around the corner, and cybercriminals are making use of it to give Windows users a good scare (and then some!) - ater all, few things strike fear into the hearts of Windows users quite like the infamous Blue Screen of Death (BSOD), and a newly analyzed malware strain is turning that nightmare - into a weapon.

Security researchers Group-IB have published an in-depth report on KBG RAT, a newly discovered Remote Access Trojan (RAT). The malware has been advertised for sale on underground forums since late 2025, although researchers found evidence of its infrastructure dating back to January 2022. It’s quite possible that it was used privately for a little while before its developers decided to share it with the community.

KGB RAT

KGB RAT is offered as Malware-as-a-Service (MaaS), Group-IB explained, saying subscriptions start at $150 per month and reach $800 annually. The $150 package provides one month of access, while the $800 one covers the entire year, working out to roughly $67 per month for the annual subscription.

According to Group-IB, even the cheapest package includes all of the biggest features - remote desktop access, file management, webcam and microphone access, keylogging, password recovery, endpoint persistence, and different anti-detection features.

KGB RAT can also hijack cryptocurrency transactions by monitoring the clipboard for copied wallet addresses and replacing them with the ones owned by the attackers during pasting.

The more expensive plans, on the other hand, include multi-client management, payload customization, additional evasion features, plugin support, and access to more extensive server infrastructure. The unnamed developers are also offering a separate $500 Network Spreading add-on, which apparently allows the malware to propagate automatically throughout compromised networks.

Boo!

What makes this RAT stand out, however, are not its hacking features, but rather - thriller ones. In the report, Group-IB describes them as “a set of psychological harassment features”, which include screamer functions, jump scares, and forced blue screens of death. “Psychological harassment” might be a bit too harsh of a classification for a jump-scare during Halloween, but we would argue that what Microsoft did with its OS after Windows 11 could fall under that category.

KGB RAT’s developers call these features “fun settings”, the researchers discovered, while Group-IB says they’re a signal that the threat actor is “comfortable weaponizing victim anxiety alongside data theft”. Cryptocurrency theft, data exfiltration, keylogging, and remote desktop access, somehow seem to go hand-in-hand with anxiety, we believe.

The malware is designed to evade detection, using obfuscation, a reportedly daily-updated crypter, sandbox detection, and mechanisms for disabling (or simply bypassing) security protections. It uses a Telegram bot to notify the attackers when a new device becomes infected, and ip-api.com to determine where the compromised endpoint is located. The researchers said they identified multiple operators using the same malware builder, including at least one focused on stealing cryptocurrency from their victims.

Another interesting aspect of KGB RAT is that it is being positioned as a legitimate tool. Its website comes with (fake) customer reviews, and claims of being used by more than 10,000 IT professionals. It comes with an education section and different how-to videos. Ironically enough, the site was returning a “502 Bad Gateway” error when we tried to open it. While it could mean it was shut down, it can also mean a temporary server failure, or hosting problems, and it could make a comeback in the future.

While it was online, though, it contained a legal section with disclaimers, warnings and notifications encouraging users to make a legit use of their software, Group-IB found. They also included educational videos of how to install, configure, and use the software.

• Attackers exploited critical AhsayCBS backup software flaws to compromise organizations’ backup servers
• Intrusions deployed webshells and disguised XMRig cryptominers for persistence and stealth
• Researchers urge immediate patching, restricted access, and full system reimaging if compromised

In a particularly brazen hack, threat actors were seen targeting the servers that businesses use as backups in case of a cyberattack.

The vulnerabilities used in this attack have since been mitigated, but since the attack is currently ongoing, organizations using this particular backup method are urged to apply the fixes immediately and secure their premises.

AhsayCBS backup utility

At the core of this incident is a backup utility called Ahsay Cloud Backup Suite (or AhsayCBS), a server-based backup management platform developed by a company of the same name, based in Hong Kong.

Businesses, managed service providers (MSP), and IT admins use it to manage backups for their devices and clients across a range of virtual and physical servers, databases, and various software environments, with the tool widely used by IT service providers to manage their clients' data.

Security researchers Huntress noted that on October 4, 2026, two flaws in AhsayCBS were publicly disclosed: CVE-2026-105113, and CVE-2026-105134. The former is a medium-severity vulnerability affecting the checkSysPwd function, and can lead to improper authentication. The latter is a critical-severity flaw affecting the Replication Receiver component, which could lead to unauthenticated remote code execution as NT AUTHORITY/SYSTEM on the host.

“The API contains an authentication bypass that could allow for a random token to substitute valid credentials,” the researchers explained. “After exploitation, a threat actor configured a malicious receiver and dropped a Java Server Page (JSP) webshell into the application directory served by the CBS application.”

Just three days later, threat actors started exploiting these bugs - the first one to bypass authentication, and the second one to gain code execution and deploy webshells on exposed systems. The webshells served primarily as droppers, deploying a range of stage-two executables.

Mining crypto

Huntress also saw threat actors deploy a popular cryptominer called XMRig. This is a legitimate open-source miner that uses the computer’s hardware, electricity, and internet, to mine the Monero currency and deposit it to the attackers’ wallets.

Monero is the go-to currency for unsolicited crypto mining since it is designed as a privacy-first coin that is very difficult to trace across the blockchain.

The attackers went to lengths to hide XMRig on these backup servers. They disguised them as a Microsoft Edge process and installed them as fake Edge update services. They also made sure it hid when someone looked.

A script (apparently written by AI) shuts down the miner whenever Task Manager is opened. The same script would close Task Manager after an hour.

Backups are perceived as one of the strongest protections against ransomware attacks. Virtually all cybersecurity organizations and thought leaders are advising organizations deploy backups and frequently maintain and control them, to make sure they are not outdated or otherwise corrupted. The fact that they can be compromised with relative ease should be cause for alarm. Businesses who were struck could consider themselves lucky to have only gotten an XMRig infection and not a full-blown ransomware encryptor.

That being said, as of October 8, at least five organizations were already targeted, Huntress said. Therefore, it is essential all organizations using AhsayCBS apply the provided patch as soon as possible. All versions of the utility, through 10.3.4 are impacted, it was said.

Besides applying the fix, organizations should also restrict AhsayCBS management interface web access, since the exploit targets the external accessible web app service on the host. “Access should be limited to trusted IP addresses only or require VPN,” Huntress says. “If any of the IoCs listed in this blog have been uncovered, companies should carry out a full host re-image from a trusted backup; as attackers have been able to hide secondary backdoors for extended persistence.”

• Malware infection at a third-party contractor may have exposed data of 8.7 million customers and employees
• Exposed records included personal details, though no payment data or confirmed misuse was reported
• Incident highlights supply-chain risks, with Daiichi Kosho investigating and reviewing contractor security

Even the entertainment industry is not safe from data-stealing cybercriminals - Daiichi Kosho, one of the biggest entertainment system makers in Japan, has disclosed a malware infection in its supply chain that may have resulted in the compromise of 8.7 million of both customer and employee information.

“Daiichi Kosho has received a report from Nippon Columbia Group (NCG), to which the Company outsources the handling of personal information, that a device used by an NCG employee was infected with malware and that the company’s customer information may have been leaked,” a machine-translated data breach notification letter reads.

“At this time, we have not confirmed that personal information was actually leaked externally or that it was misused as a result of this incident. However, as we cannot rule out the possibility that personal information was leaked, we are providing the information currently available and the actions we will take, as follows. We have also confirmed that the company’s systems were not affected.”

Supply chain attack

The wording is intentionally ambiguous - as this is obviously a supply chain attack, since Daiichi Kosho was not directly compromised.

Instead, it was Nippon Columbia Group, a group formed in 2025 after a restructuring of Faith. Nippon’s roots date back to 1910, when its predecessor became Japan’s first record company. Today, Faith established Nippon Columbia Group as a new organization focused on AI-powered entertainment and content distribution.

Daiichi Kosho, on the other hand, is one of Japan’s leading karaoke and entertainment companies. It was founded in 1973 and is today best known for its DAM karaoke systems and Big Echo karaoke venues. In fact, the company today runs more than 400 karaoke venues across Japan, including more than 100 in Tokyo alone.

The company both sells and rents karaoke gear, runs establishments and restaurants, and produces music and videos. Daiichi Kosho is a substantial business, generating roughly ¥163 billion (around $1.06 billion) in annual revenue a year.

Malware infection

According to BleepingComputer, Daiichi Kosho outsources the handling of its customers’ personal information to NCG. On October 5 2026, that company notified Daiichi Kosho that it found a malware infection and isolated the affected systems the day after. We don’t know exactly how the company ended up infected, or what kind of infection it was. What we do know is that it suspects records on 93,000 employees and 8,631,000 customers may have been exposed.

These records contain people’s full names, genders, dates of birth, email addresses, and telephone numbers. Customers of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining, are among those affected by the attack. Passwords, loyalty points, or payment data, were not disclosed, the notice reads. Furthermore, there is no evidence of the data being misused on the dark web.

However, Daiichi Kosho did warn employees and customers to be wary of incoming email messages, especially unsolicited ones claiming to come from the company itself.

Personally identifiable information holds value on the black market because threat actors can use it to launch personalized, highly tailored phishing attacks.

Through these attacks, they can steal login credentials for corporate environments, or deploy infostealers to grab the passwords. That allows them to pivot to corporate IT infrastructure, steal business secrets and other data, and establish persistence. Ultimately, all of this allows the attackers to threaten to release the files to competitors and the public and thus pressure the victims into paying a ransom.

Daiichi Kosho said it will “continue to monitor the situation and take the necessary measures if we detect any signs of unauthorized use.”

It also said that, out of an abundance of caution, it was now inspecting other systems and was examining how it manages its contractors to see if there is room for improvement.

“If further investigation reveals any new facts, we will promptly provide an update, including the customers affected and the measures to be taken,” the machine-translated notice reads.

• Budget Android phones shipped with firmware-level malware preinstalled before reaching customers
• Malware generated fraudulent ad revenue and turned infected devices into residential proxies
• Victims spanned 150 countries, with cleanup often requiring firmware-level remediation

Imagine buying a brand new, sealed Android phone, and later realizing it came with preinstalled malware rooted deeply into the firmware and thus almost impossible to remove - generating fraudulent ad clicks for a malicious third party, and even turning the phones into residential proxies to be used for whatever sinister purposes.

Security researchers Bitdefender found an unidentified threat actor managed to compromise the supply chain of multiple smartphone manufacturers and added malware on a firmware level before the devices were even shipped to stores.

A number of brands were mentioned, including Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X - both Chinese smartphone manufacturers building budget, rugged Android phones.

The reports also mention ripoff devices impersonating Samsung and Apple products. In general, these are devices using MediaTek chipsets, which were infected in a way that allowed the attackers to tamper with applications, grant themselves higher privileges, and even do remote code execution (RCE) attacks without the victim’s knowledge.

Victims across the world

Unfortunately, these devices were shipped all over the world, and Bitdefender claims “thousands” of people were victims, scattered across some 150 countries around the world, with the highest concentration found in Mexico, France, Italy, United States, Germany, Brazil, and Spain.

The malware comes in different shapes and sizes. So far, Bitdefender uncovered 32 malicious apps, including those pretending to be weather apps, file managers app lockers, OCR tools, and audio editors. All of these do the same thing - create an invisible overlay over different apps and register an ad being viewed, despite the fact that the user never actually saw it.

That way, whoever installed the malware scams the ad network into thinking the ad was served to thousands of users which, in turn, generates profit. We don’t know exactly how many devices are compromised this way, or how much money the crooks stole this way.

"The system app itself doesn’t register the fraudulent impressions and clicks," Bitdefender said. "The revenue engine is driven by the dropped cover apps, including real-looking weather, app-lock, note, and OCR apps, which load genuine ads through a legitimate ad SDK. The goal is simple: to load an invisible window on top of apps that registers ads being shown."

Spilling into the Play Store

Bitdefender also said that one of the uncovered applications (the app locker one), contained a TCP proxy element that registered the compromised phones with a remote command server. After successful registration, the attackers were able to forward traffic through the phone, essentially creating a residential proxy service that criminals can use for different things, from launching DDoS attacks to participating in spam and wire fraud.

They also found more than a dozen applications on the Google Play Store with the same fraudulent advertising code, as well as the same communications infrastructure. These, however, required manual installation and required users to grant them the requested permissions, which might have raised flags with the users.

Removing the malware isn’t as easy as simply uninstalling the app. The researchers said that many of the devices require cleanup on the firmware level, or disabling the malicious component using Android Debug Bridge (ADB), which could be too technical for many victims.

The easier and more elegant solution is also a more expensive one - don’t buy devices from brands with a shady reputation.

• A threat actor built malware that reads poems posted on GitHub
• The poems are a secret code for the location of C2 servers
• The servers instruct the malware to deploy cryptojackers and scanners

Somewhere in the trackless wastes of cyberspace, a digital Robert Langdon is decoding an ancient poem to find the location of his masters and receive instructions on his next steps. I might be exaggerating a bit, but this is the gist of a rather bizarre story on cyberattacks and cryptocurrency mining.

Cybersecurity researchers from Lumen’s Black Lotus Labs found a piece of malware that gets the instructions on the location of the C2 server from a poem shared on GitHub.

By looking for specific words and decoding them into numbers, the malware can get an IP address where the C2 server is located and receive instructions on what to do next - Black Lotus calls it “adversarial poetry” and says it’s never seen anything like it.

Adversarial poetry

The attacker, who seems to be of Italian origin (or at least based in Italy), first hunts for vulnerable internet-facing services, such as LiteLLM or Ollama, and installs a piece of malware called PoeLLM.

This malware then goes to GitHub to look for a poem which seems to be AI-generated. Here are the lines:

In the silent hum of driver, the machines begin to speak,

Each pulse of diode threading light through copper veins.

we taught the dark to carry meaning, byte by byte —

A language built from lightning, cold and clean.

Beyond the wall of encryption, a signal finds its way,

the tick of distant servers answering back.

Data moves like water through the cracks of ordered thought,

and somewhere in the code, the world stays on track.

It then looks for specific words in this poem: driver, diode, decryption, tick, and matches them to corresponding numbers (its dictionary is hardcoded). When they are combined, they form an IPv4 address where the server is located.

PoeLLM then reaches out to the server and gets instructions on what to do next. In most cases, it just deploys a cryptocurrency miner called XMRig, using the device’s electrical energy, compute, and access to the internet to mine Monero tokens and enrich the malicious poet.

The malware can also run as a scanner, searching for additional vulnerable systems, and allowing the attacker to worm his way into even more devices.

Changing the song

If the attacker needs to move the infrastructure, all they need to do is change certain words in the GitHub poem. Therefore, when infected machines retrieve the updated version, they can calculate the new C2 address without needing a malware update. In fact, this already happened multiple times.

According to The Register the poem, titled “On the Nature of Connection,” has been updated 11 times since its initial commit. The latest update happened in September 2026.

“The Canto Incognito campaign appears to be relatively unique in its targeting of multiple AI-related services,” the researchers told The Register.

“Other notable campaigns this year, including the LiteLLM supply chain compromise, focused on a single service and impacted roughly 2,500 victims, according to open sources. The collection of more than 3,000 PoeLLM victims appears to exhibit multiple vulnerable services at any given time.”

In other words, the adversarial poetry campaign has been rather successful, so far infecting more than 3,000 (confirmed) devices.

The PoeLLM malware developer “has been extremely successful in identifying vulnerable servers, deploying exploits, and conscripting victims to continue expanding the campaign,” Black Lotus Labs said.

“If the actor had only focused on one or two vulnerabilities, the potential victim pool might have quickly dried up, but the expanding scope allowed for a bigger, more powerful (and more profitable) botnet.”

When Anthropic's threat intelligence team ranked a year of AI-enabled cyberattacks, the most dangerous operation in the dataset didn't stand out by the measure the security industry has relied on for years.

Mapped against MITRE ATT&CK, the state-sponsored espionage campaign Anthropic disrupted in November 2025 used 30 techniques across 13 tactics, comparable to many medium-risk actors in the same dataset. Against Anthropic's own risk methodology, the same campaign scored the maximum of 100.

The fact that the highest-risk actor looked unremarkable by technique count exposes a weakness in conventional detection thinking. Technique breadth alone tells defenders relatively little about risk. More useful insight comes from understanding how techniques are combined, sequenced and executed over time.

The indicator was always the fragile part

Security operations spent two decades getting very good at recognizing evidence an attacker had already used. Malware hashes, malicious IP addresses and suspicious domains gave teams a practical way to identify known threats and block repeat attacks. Once an attacker exposed part of their infrastructure, thousands of organizations could benefit.

David Bianco's Pyramid of Pain outlined this weakness in 2013. The indicators defenders find easiest to consume are also the cheapest for attackers to discard. A hash can change when you modify a file, while an IP address can simply be replaced. The techniques and procedures an attacker relies on to reach an objective are far harder to change.

Generative AI has made indicator-based detection more vulnerable by driving down the cost of variation. Code-generation tools can produce new malware variants quickly, phishing content can be created at scale, and offensive tooling can be assembled with far less specialist effort. Defenders increasingly work with indicators whose useful life may be shorter than the process required to identify, publish, and act on them.

None of which retires the IOC feed. It remains valuable for blocking known-bad in volume, enriching investigations and hunting retrospectively once a campaign becomes public. What it can no longer do is carry the weight of the detection program.

Individual techniques are weak signals

Anthropic’s study examined 832 accounts banned for malicious cyber activity between March 2025 and March 2026, mapping 13,873 observed actions across 482 techniques and all 14 ATT&CK tactics. The accounts represent a subset of total bans with enough detail for thorough assessment.

There was little correlation between an actor's skill and the number of techniques they used: the least capable actors in the dataset averaged around 16 distinct techniques, the most capable around 20. The platform an attacker worked through made no difference either.

That tracks with how enterprise environments actually behave. Account discovery appears in attacks, and also in legitimate administration. Remote services enable lateral movement and routine infrastructure management alike. Almost every individual technique requires interpretation before it supports a conclusion.

The information appears when activities connect. Account discovery, followed by credential access, followed by movement into another system and data staging within a compressed window, describes something the same activities spread across several days of routine work do not. Sequence becomes part of the detection logic, along with the identity involved, the systems touched, and what happened immediately afterwards.

AI is moving deeper into the attack

AI introduces another consideration: the speed at which an attack unfolds. Automation can compress the time between actions, changing how otherwise familiar activity should be interpreted.

Human-led attacks have always used some degree of automation, but an operator still has to interpret results and decide what to do next. As AI systems take on more of that decision-making, the time between stages of an attack can shrink considerably. That makes the speed and sequence of activity useful information in its own right.

Anthropic's data shows where this pressure is being applied. Across the study period, AI use shifted away from gaining access and toward what happens after. Use of AI tools for account discovery inside compromised environments rose 8.9 percent while AI-assisted phishing fell 8.6 percent. Post-compromise techniques that once demanded real expertise are being performed on behalf of less capable actors.

The proportion of actors Anthropic classified as medium risk or higher rose from 33 percent in the first half of the study to 56 percent in the second, roughly a 1.7-fold increase in twelve months.

Speed alone proves nothing. A sequence plausible over several hours from an administrator carries different weight when the same actions cross multiple systems in minutes. Time belongs in the detection model alongside the activity.

This is the thinking behind APEX, or Adversarial Pattern Extraction and Correlation, a behavioral detection framework developed around the Anthropic findings. Rather than treating an individual ATT&CK technique as the unit of detection, APEX looks at combinations of techniques, the order in which they occur, the time between them and the entities involved.

The premise is that these behavioral chains provide a more durable basis for detection than the individual indicators or techniques attackers can change more easily.

The frameworks have not caught up either

Anthropic's research also exposes a limitation in the frameworks used to describe attacker behavior. MITRE ATT&CK can map the individual techniques used during an intrusion, but it does not currently capture the agentic orchestration that links those techniques together.

An AI system that interprets results, selects its next action and moves through multiple stages of an attack with limited human involvement is therefore difficult to represent within the existing framework. Anthropic is now working with MITRE on how that behavior could be incorporated.

For security leaders, the practical consequence arrives sooner than any framework revision. Recognizing a behavioral chain means correlating evidence across endpoints, identities, networks and cloud platforms, each producing telemetry in a different shape.

That is a substantially harder data problem than checking a value against a list, and it is worth asking whether the telemetry required to see those chains is available, correlated and timely, rather than assuming volume will suffice.

What attackers cannot change

AI makes an attack's observable features easier to change, but the underlying operational requirements remain relatively stable. An attacker seeking to steal data still needs to gain access, understand the environment, obtain sufficient privileges and move information out. The tools and infrastructure may vary, but those requirements are much harder to eliminate.

Bianco pointed to the industry at the top of the pyramid more than a decade ago, and the principle has held. Frameworks such as APEX are now attempting to turn that principle into practical detection logic by focusing on the sequence, timing and context of attacker behavior. AI has made that work considerably more urgent.

We've featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Kaspersky uncovers MacSync, a Mac infostealer delivered via iCloud calendar events and fake apps
• Loader fetches instructions from calendar entries, then deploys malware exfiltrating credentials, wallets, and developer data
• Newer variants add Objective‑C backdoor spoofing Finder, persistence, and expanded targeting of crypto and IT users

Cybercriminals have found a way to use iCloud calendar events and cloud storage to deliver a powerful infostealer to Mac devices.

The malware is called MacSync, and it’s hiding behind fake crypto wallets, or “cracked” commercial software.

Security researchers Kaspersky, who discovered the ongoing campaign, are urging Mac users to exercise caution when downloading programs, especially from third-party websites, and to be very skeptical of apps prompting for their admin password.

Why calendar?

Getting people to download and run malware on their devices is not as easy as it sounds.

The victims need to be somehow tricked into downloading and running an app, and even when they do so, chances are the malicious program will be sniffed out by whatever antivirus solutions the device has running, before it can do any meaningful damage. Also, crooks don’t want to be forced to repeat the process every time they want to deploy a different variant, or type of malware.

So, they resort to all sorts of techniques and workarounds, from DLL sideloading, to malware loaders.

By separating the initial infection and the actual malware, cybercriminals can reduce detection rate and get more flexibility, but it creates a new problem: defenders can monitor the traffic going in and out of different apps and thus detect when a loader is deploying malware.

The challenge then becomes hiding the traffic, and MacSync does it by using the iCloud calendar.

After being downloaded and executed, the loader will reach out to the calendar - which is a totally benign activity that is unlikely to raise any suspicion - and look for a specific public event, pre-built by the attackers. In its description, it will find the instructions, and the location of, the actual infostealer, and deploy it to ultimately compromise the target device. In this case, the location was also in the iCloud.

The loader itself is being advertised through social media, SEO poisoning, and phishing. Victims are directed either to fraudulent websites or social media channels promoting cracked software, or free versions of advanced solutions. In at least one example, Kaspersky saw the loader being advertised as a cryptocurrency wallet. Victims are shown a typical ClickFix error, and told to fix it by pasting a command in the Terminal.

The command deploys the loader which, in turn, installs MacSync.

A "substantial" overhaul

The infostealer emerged in April 2025, and was initially spun out of AMOS, one of the most popular information-stealing variants for the MacOS. It is based on Swift and has, since then, evolved to offer additional capabilities. According to Kaspersky, it can exfiltrate browser history, cookies, saved credentials, cryptocurrency wallet and app data, Telegram data, Keychain data, as well as system and device information. It can exfiltrate SSH, AWS, Kubernetes, Git, and shell configuration files, as well.

Newer variants come with an Objective-C backdoor spoofing the macOS default file manager, Finder. It establishes persistence, terminates notification processes to prevent alerts, and grants the attackers backdoor access, including running AppleScript received from the C2 server, deploying browser extensions, replacing the legitimate Ledger wallet app, collecting additional system information, and more.

Kaspersky also found an undefined command called “live_browser”, which downloads and runs a component named “sn_relay”, whose point has not yet been established.

The new versions “significantly” differ from older ones, Kaspersky said, stressing that the attackers “substantially” overhauled their approach.

“The nature of the data attackers seek to collect from a victim’s device, as well as the categories of applications the stealer disguises itself as, clearly indicates that this malware family primarily targets developers, crypto enthusiasts, and other users associated in some way with IT and the crypto space,” the researchers stressed. “MacSync’s compromise of software developers’ devices poses particular security risks for both end users and corporate systems, opening up expanded opportunities for attackers to further their intrusion.”

The full list of indicators of compromise (IoC) can be found on this link.

• Gambit researchers uncovered ongoing AI‑driven skimming campaign stealing 600,000+ payment records since July 2026
• Attackers used three autonomous harnesses (Strix, Cairn, Hermes) to compromise dozens of retail sites cheaply
• Victims include major US firms; campaign shows AI enables faster, persistent, low‑cost cyberattacks at scale

In July 2026, a hacker tasked autonomous AI agents to attack retail organizations around the world, deploy credit card skimmers, and steal payment data.

Since then, the bots launched hundreds of attack projects, compromised dozens of organizations, and stole at least 600,000 payment records - and to make matters worse, the campaign is still live, attacking and breaking into websites as we speak.

All of this was reported by security researchers Gambit, who said they managed to recover the operator’s staging server and through it - reconstruct the ongoing campaign. They also saw the skimmers live on victim websites, and sifted through logs and AI claims found on the attacker’s server. In just five days, between September 10 and 15, the agents made 105 attack waves and compromised 27 organizations “to varying degrees.”

Among the victims are a Fortune 500 hospitality company, a “major” US airline, a large private US industrial supplies distributor, and a US online fashion retailer. One of the AI tools would use a website ranking service to produce a list of potential targets, focusing primarily on those running custom-built software.

A fistful of dollars

But the victims are not the “interesting” part of this story - the attackers are. Gambit believes they are financially motivated Chinese threat actors. They are using three AI “harnesses” (frameworks, essentially), which can run almost the entire attack chain autonomously, striking around 10 companies a day, for a handful of dollars per company.

In four weeks, the attackers spent around $7,000, meaning that their entire cost for the operation so far was no more than $18,000. Breaking it down, it means that the attacker spent around $25 per target.

“Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company,” Gambit’s researchers said. “The operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive.”

“Where access was achieved, it usually took less than a day, and in many cases just a few hours. We also detected instructions in the attacker’s playbook that could disrupt the operations of a company as a result of data deletion or cleanup procedures run by the agent - and this has indeed happened in some of the breaches,” Gambit said.

The three harnesses

The three harnesses are called Strix, Cairn, and Hermes.

Gambit describes Hermes as an open source autonomous AI agent with a persistent memory, skills that the agent wrote and edited itself, a searchable archive of past sessions, scheduled jobs, and a web console. On the staging server the researchers analyzed, it loaded a Chinese system persona called “SOUL - Red Team Operator”, which contained 121 skills (78 attack skills).

“Hermes is the operator’s console for orchestrating the activity and for direct hacking activities,” Gambit explained. “It used Anthropic’s opus-4.6 (after newer models refused its requests), with 1,951 prompts typed by the human across 260 sessions - only a few prompts per target. The human prompts are short instructions in Chinese, usually launching an attack, tasking the agent with a general next step, or what to do next after achieving access.”

Strix is an open-source AI pentest tool, while Cairn is an autonomous pentest engine. It receives target domains and an objective, such as to get a shell or admin access, then runs for hours until it achieves the objective, times out, or is stopped. Cairn used DeepSeek v4.1 Flash, it was said.

Gambit’s researchers seem to be rather impressed with the campaign. They described it as very low cost, with a level of patience, persistence, and creativity that most human attackers would be “unlikely to sustain”, managing to achieve “far greater results, far faster.”

They have also called to arms, urging organizations to “adapt to a reality where attacks are significantly faster and more comprehensive.” To do that, they must adopt a resilience-first mentality and deploy a security stack that can match the AI on speed.

Many of the affected organizations were notified, and the skimmers were removed, they said.

• Attackers spoofed LastPass Authenticator via SEO‑poisoned GitHub pages, delivering malicious ZIP files
• Malware Rapuncel uses DLL sideloading, kills 145 AV products, and steals passwords, wallets, and tokens
• Campaign ongoing for months; LastPass vaults unaffected, but users urged to download only from trusted sources

Be careful when downloading the LastPass Authenticator app - there are impostors out there that can disable your antivirus and wreak havoc on your computer.

LastPass recently discovered an elaborate scheme to get people infected with malware - a spoofed website, SEO poisoning, DLL sideloading, and a malware loader delivering never-before-seen payload that can kill endpoint protection and antivirus solutions.

According to the password manager, users searching for "LastPass Authenticator download" or similar keywords will get a GitHub page rather high on the search engine results pages. At a glance, the page looks almost identical to the authentic LastPass offering - however, it redirects users to a separate one, hosted on attacker-controlled infrastructure and delivering a large .ZIP file with multiple files.

Among the files are two worth paying attention to: vsdbg.exe, and vsdbg.dll. The .EXE one is renamed to look like a LastPass installer, but it’s in fact a legitimate Microsoft debugging tool. This tool is used to run the malware - the vsdbg.dll file. This is a method called “dll sideloading” where the legitimate program will look for a DLL file in the same folder it’s located, rather than the wider device library. Since the DLL is delivered together with the executable, it is the first one to be run, despite the fact that it’s malicious.

Rapuncel

LastPass shared the malware with security researchers Delphos for analysis, and they’ve named it Rapuncel. No AV engines have been able to spot it, when it was first analyzed.

Once Rapuncel runs, it does a number of things. First, it gains admin-level access to run as SYSTEM, and then installs a kernel driver. The driver, disguised as an NVIDIA graphics component, comes with a hardcoded list of 145 antivirus and endpoint security products, and if any of them are found on the device, they are instantly terminated.

After killing antivirus solutions, the malware gets to work, stealing saved passwords from more than 25 browsers (Chrome, Edge, and other popular ones included), cryptocurrency wallet files from more than 30 wallet apps, Discord login tokens, Steam session tokens, Telegram session data, Windows credential store, all documents with words like “password”, “seed”, “wallet”, or “recovery” in their name, screenshots of every monitor connected to the device, as well as a detailed profile of the system.

Once all of this is harvested, the information is compressed into a .ZIP archive and uploaded to a server under the attackers’ control. To add insult to injury, the kernel driver was given code to intercept all web traffic, allowing the attackers to inject ads, or modify search results, at a whim.

Rapuncel comes with a persistence mechanism, as well, to make sure it continues operating even if the victim spots it. Spotting it should not be too difficult, though - if no antivirus programs are allowed to run on a computer, something is definitely not working properly.

Active for months

Still, the malware installs itself as a Windows service that starts automatically at boot, and then loops continuously, checking for security products and killing them as soon as they’re activated. “The machine may remain fully under the attacker's control until the kernel driver is physically removed,” the researchers explained. “This process requires booting the computer into Safe Mode or using an external recovery tool, because normal Windows tools cannot safely remove software operating at that level while the system is running.”

LastPass and Delphos believe the campaign has been active for months, and that it will continue to operate despite disruption efforts:

“The LastPass lure was a single recent frame in a campaign that has been running for months and shows every sign of continuing after its current infrastructure is burned,” the researchers said. They stressed that this is “opportunistic brand impersonation” and that LastPass systems and customer vaults have not been compromised or involved in any way.

LastPass said it was one of 40 companies spoofed in this campaign and has urged users to only download apps from reputable, vetted sources.

• Zimperium zLabs discovered RedHat, a Chinese‑origin Android banking trojan with AI assistant
• AI interprets screen layouts in real‑time, enabling credential theft and bypassing app redesigns
• Distributed via third‑party stores, social media, malvertising, and SMS; persistence blocks uninstall attempts

There is an Android malware out there that comes with an AI assistant that tells it what to do. The assistant seems to be independent of the malware’s operator, allowing the tool to work without requiring the operators to be present in real-time.

The malware in question is called RedHat. It was discovered by security researchers Zimperium zLabs, who believe it is of Chinese origin. It is currently being distributed via third-party app stores, social media, malvertising, and SMS spam, and requires Android’s Accessibility permissions to work.

The malware itself is a typical banking trojan - it creates an invisible overlay every time the victim brings up a banking app, capturing login credentials and one-time passwords, and thus giving attackers direct control over people’s banking accounts.

AI-powered eyes

But what makes RedHat stand out from a sea of Android banking trojans is its AI-powered component. The model serves as a kind of remote “eyes and hands” for controlling the victim’s phone.

Usually, when criminals develop banking trojans, they need to code exact coordinates of the layout for it to work. They need to code where the password is entered, or where the login button is. If the banking app gets redesigned and changes its layout, the malware breaks.

With AI, that is no longer a problem. RedHat gets a picture of what’s on the screen, sends it to the AI assistant, which then instructs the malware on how to proceed.

"RatHat uses AI to intelligently navigate and control the device interface in real-time, making its operations more adaptable and harder for security software to detect than traditional, scripted automation," Zimperium explained.

The tool also has a few advanced persistence mechanisms, being capable of reinstalling deleted components, and intercepting the uninstall process to cancel it while displaying a fake error message to the victim.

So far, there is no word on who the targets are, or how many people might have been compromised.

Via BleepingComputer

• UK NCSC, FBI, and Dutch AIVD warn Iran is using Chosen Brick malware against dissidents and journalists
• Malware steals files, captures audio, grabs WhatsApp/Telegram data, and can wipe systems entirely
• Operatives rely on social engineering; agencies urge awareness, MFA, updates, and endpoint monitoring

Iranian hackers are targeting “enemies of the state”, both local and foreign, with advanced malware capable of spying on the victims and stealing their sensitive files, experts have warned.

This is according to a new security advisory, published jointly by the UK National Cyber Security Centre, the FBI, and the Netherlands’ General Intelligence and Security Service (AIVD), which noted how Iranian operatives would first do extensive research into their victims - dissidents, activists, and journalists - deemed a risk to the regime.

After learning as much about their targets as possible, they reach out via social media, either as someone the victims know, or as technical support for the platform they’re currently using, engaging in extended conversation until the victim lowers their guard. At one point, the attackers will try to share a piece of malware with the victims, tracked as Chosen Brick.

A thousand victims

This malware, designed primarily for the Windows platform, has a long list of capabilities, including enumerating running processes and system information, capturing screen content, enabling the microphone to capture audio content, capturing a copy of Telegram and WhatsApp data from web browsers, downloading additional files and malware, deleting files, stealing email content, and ultimately - wiping the entire computer system. The operatives communicate with the malware using Telegram, it was said.

“Iran almost certainly uses cyber activity to support the repression of individuals who are seen as a threat to the regime, such as dissidents, activists and journalists,” the three agencies said in the report. “In some cases, the Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals internationally, who they perceive as enemies of the regime.”

In the advisory, the three agencies said the best defense is to simply be more aware of social engineering. However, there are also a few technical mitigations that can help, including following NCSC advice on staying safe online, keeping all devices up-to-date (ideally through automatic updates), using antivirus software, and not disabling smart screen warnings on file downloads.

Finally, it would be wise to enable phishing-resistant MFA, make sure devices are managed with appropriate controls, turn on email scanning, deploy endpoint and network monitoring, and conduct a search for the IoCs.

Via The Register

• RubyGems reported over 2,000 malicious packages uploaded by OpenAI agents in May
• Agents abused RubyDoc servers to fetch public UK documents and attempted API key theft
• Incident echoes prior rogue AI attacks on Hugging Face and DseWiki, showing autonomous exploit attempts

A swarm of OpenAI agents attacked RubyGems, a package manager for the Ruby programming language, uploading thousands of malicious packages until they were eventually cut off. No one really knows what the agents’ endgame was, but it appears they were using a nuclear bomb to kill a fly.

Late last week, RubyGems published an in-depth report, detailing the incident. In it, it was said that a swarm of agents started uploading malware to RubyGems on May 5, and between May 11 and 12, managed to deliver more than 2,000 of them. When the maintainers realized what was going on, they shut down new account creation for four days, to prevent further attacks.

“We believe these were authored by internal OpenAI agents,” the researchers said in the report.

Why RubyGems?

When a user uploads a package on RubyGems, a documentation service called RubyDoc automatically builds documentation for it. The agents put instructions in their packages, causing RubyDoc’s servers to execute the code, forcing the servers to visit UK government websites and download documents such as council meeting information.

The documents AI agents were looking to retrieve are public, freely available to anyone, at any time. Why the AI agents decided to go through the trouble of uploading malicious packages and abusing RubyGems’ servers instead of simply downloading freely available data is not known at this time.

OpenAI confirmed the incident to The Register, and said it was looking into it: “Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information," the spokesperson said. "We’ll continue to investigate as part of our broader review of agent activity during training and evaluation.” The data harvested was collected into new packages and re-uploaded to RubyGems.

Stealing API keys

Besides trying to upload thousands of pieces of malware in order to download free data, the AI agents also conducted a separate, more serious attack: they tried to steal RubyGems API keys.

The researchers explained that the agents found a vulnerability that might have allowed them to obtain other users’ keys, and then use those keys to upload packages:

“One particularly concerning finding is that agents attempted to exploit a vulnerability on May 12th that was only discovered in July,” the report states.

“The agents were attempting to exploit a novel security vulnerability in order to steal people’s RubyGems API keys. We do not know if this attempt succeeded, but we have confirmed with the RubyGems team that this was a viable pathway to obtain API keys illicitly if a user with the right version of RubyGems was logging in within an hour of the attack on the right internal CDN node. However, the RubyGems team said they had conducted extensive reviews and found no evidence that this pathway was exploited in the past. However, we can’t rule it out entirely.”

Going rogue

This is not the first time an AI agent tried to complete a test by means of hacking. In late July, OpenAI said that some of its most advanced AI models went rogue and attacked Hugging Face, one of the world’s largest repositories for AI models. In the attack, it apparently accessed some internal company systems.

In the aftermath of the attack, OpenAI described the attack as “unprecedented”, and said it was investigating together with Hugging Face. The victim’s co-founder and CEO, Clement Delangue, said it was "mind-blowing that all of this happened autonomously".

Later, it was also discovered that the agents hacked a separate website, called DseWiki, months before the Hugging Face incident, and used it as a message board. Allegedly, they made more than 15,000 edits to the site, sharing tips on how to avoid being detected.

Via The Register

• Huntress warns fake GTA 6 ISOs spreading malware ahead of official Nov 19, 2026 release
• Packages deliver RATs, infostealers, and Chaos ransomware disguised as game installers
• Users urged to avoid pirated downloads; infected systems should be reimaged and credentials reset

Grand Theft Auto 6 (GTA 6), one of the most anticipated computer games of all time, is due to launch on November 19, 2026 - so everything found online before that is almost certainly malware.

This is the warning sent out by security researchers Huntress, which said it recently saw one variant deploying all sorts of filth, from remote access trojans (RAT), across infostealers, to full-blown ransomware encryptors.

The story behind GTA 6

GTA 6 is a third-person action-adventure and open-world gam developed by Rockstar Games, which egan preliminary work more than a decade ago, and has allegedly spent more than a billion dollars during that decade and a half, which would make it, by far, the most expensive game ever developed.

It is also a sequel to GTA 5, a game that was sold in more than 230 million copies around the world, which made it one of the most popular games of all time.

In late August 2026, someone going by the alias LEEK claimed to have obtained a working, playable build of the game, roughly six months before the official release. They posted numerous screenshots and videos of them playing the game, even writing their nickname onto a wall, using a rifle to prove the authenticity. Truth be told, even without this, people would have still probably searched for, and downloaded, fake installers. This only made the problem worse.

And a major problem, it definitely is. Huntress is now saying it is seeing websites ranking relatively high (through SEO poisoning), offering for download an ISO of the game. Similar ISOs are circulating around different gaming forums, torrenting sites, and social media channels.

An ISO file is a digital copy of an entire disc, such as a CD, DVD, or Blu-ray, stored as one file. Users can download an ISO (which can weigh tens or hundreds of gigabytes), mount it into a virtual drive, and the computer will treat it like a physical disc.

Huntress found some ISOs weighing more than 100GB which was done just to make it seem authentic - the actual malware was “a factor smaller”. The ISOs they analyzed contained multiple variants, including NJRAT and CDRAT (two remote access trojans), Mercurial Grabber (an infostealer grabbing Roblox Studio cookies, Minecraft session data, Discord tokens, Chrome passwords and cookies, system information, IP addresses, and geolocation, Windows product keys, and screenshots), and Chaos Ransomware. The package also contained a legitimate, regular browser - “Just for kicks,” apparently.

A plausible failure

During the “game” installation, the installer displays a message in Russian, saying the product is unlicensed and that there is a good chance it won’t run. If that happens, the user is told to reach out to a specific Gmail address to receive an “updated crack”. After the installation completes, the victim will get that exact popup, saying “License not found”. All of this is just a smoke screen, to make the victim not suspicious as to why the “game” won’t run.

There is no way of telling how many people fell for the ruse and installed malware on their devices. Huntress says that generally speaking, trying to download cracked and pirated software is a bad idea, which is even worse if the game in question has not yet been released.

“This is fertile ground for scams and threat actors attempting to take advantage of the impatient and overeager,” the researchers said.

The good news is that all of the malware being distributed there is not new. Some of the variants contained in the ISOs are several years old, meaning most antivirus programs, such as Windows Defender for example, can easily detect it and stop it from compromising the system.

Those that do end up infected should disconnect the machine from the internet, reset all passwords, enable 2FA wherever possible, and do a complete reimage of the compromised system.

• Calif researchers found a zero‑click WeChat VoIP flaw enabling account takeover via calls
• “WeWorm” spreads through ringing calls; victims need not answer to be compromised
• Tencent patched in Android 8.0.77 and iOS 8.0.76; no exploitation seen in the wild

Security researchers have found a flaw in WeChat which allows malicious actors to take over people’s accounts on both Android and iOS devices - but what makes this flaw stand out is the fact that it’s a zero-click bug - victims need not do a thing to be compromised.

WeChat is a “super-app”, allegedly used by roughly 1.4 billion people, and is especially popular in China. It started as a communications app, letting users send messages, and make voice and video calls, and has evolved to function as a social network, allowing users to share photos and videos, as well as a payment app through which users can transfer money, pay for things, order food, book taxis, and even access government and business services.

Security researchers from Calif have now disclosed finding a ‘memory corruption’ issue in WeChat's VoIP stack. For now, they decided not to share the technical details, and to instead demonstrate the flaw “at an upcoming conference.” To that end, they built a worm called WeWorm, capable of taking over target WeChat accounts and spread through phone calls made via the app.

A phone call would suffice

In practice, it works remarkably simple: an attacker uses WeChat to call a person they have in their contacts list (this is a prerequisite). They can use both an Android and an iOS device, and can call anyone, regardless of the model or the OS they’re using. As soon as the phone starts ringing, WeWorm gets to work, “worming” its way into the victim’s device.

The victim does not even need to answer the phone - having it ring is enough. If they answer, they’ll hear nothing but silence, yet the worm will continue operating. If they decline the call, the attack stops, but this is hardly a mitigation - the attacker can simply call again while the victim is asleep (or otherwise away from their device).

Within a few seconds, the attacker will have access to the victim’s WeChat account, including their messages, contacts list, and virtually anything else found in the app. What makes this bug particularly worrisome on the surface is the fact that WeChat can be used to transfer money and pay for things, but WeChat Pay has additional authentication and risk controls designed to prevent that from happening.

The good news is that there is no evidence of this flaw being exploited in the wild. The bad news is that this is not the first zero-click flaw found in modern-day smartphones, and most likely will not be the last one.

Tencent's response

Calif said it responsibly disclosed its findings to WeChat’s parent company Tencent, who came back with a patch. Versions 8.0.77 for Android and 8.0.76 for iOS have apparently solved the problem, although

Tencent did not list any details in its patch notes, simply saying the version brought “bug fixes”, but in a statement shared with The Hacker News, it said the exploit has been “mitigated for all users”, and that it was applied server-side - users need not install anything, aside from the patch.

It’s also worth mentioning that WeChat has apps for HarmonyOS, Windows, Mac, and Linux. However, it would appear that Calif did not test those, and Tencent did not include them in its patch. The researchers did say that they would be looking into this same flaw in other products, too:

“This specific WeChat bug is one instance of the many unconventional attack surfaces that are present across many messaging apps,” they said. “We're conducting more of this research across other apps and attack surfaces, while working with app developers on attack surface reduction. This may take an industry-wide effort, since some of it depends on the platform owners. Once that work is further along, we'll share our progress, including the technical details of this WeChat bug.”

• NordVPN blocked over 5 million malware attempts in January alone
• 99% of phishing attacks impersonate just 300 brands
• AI tools and fraud kits mean attackers no longer need advanced skills

We are well past the days when a cyberattack meant mass-mailing a poorly spelled virus. In 2026, cybercriminals are heavily leveraging generative AI to make their scams highly personal, industrializing fraud on a massive scale.

That is the stark warning from the Consumer Cybersecurity Report: Dismantling the Evolving Threat Landscape, published today by NordVPN. Analyzing threat intelligence data from the first half of the year, the prominent cybersecurity and best VPN provider uncovered that the most exploited vulnerability right now isn't outdated software; it is human trust.

Armed with unrestricted AI models and ready-to-use fraud kits, scammers have drastically lowered the entry barrier for digital crime. The focus has decisively shifted from complex technical exploits to highly targeted campaigns that weaponize greed, urgency, and our faith in familiar brands.

"Bad actors are weaponizing our natural instinct to believe what we see and hear," says Marijus Briedis, CTO at NordVPN, warning that these attacks no longer require advanced skills or significant resources. "Anyone with an internet connection can launch them."

It's in this context that "A single human error is now more likely than ever and likely to be more devastating than ever," Briedis added.

The numbers behind the threat

NordVPN analyzes 12 million unique URLs daily, blocking an average of 130,000 malicious pages every 24 hours before they can reach a user — a critical defense mechanism as NordVPN’s antivirus tool continues to block massive volumes of malicious sites.

Malware remains the single largest threat by volume. January 2026 saw a massive peak of over 5 million blocked attempts as attackers preyed on post-holiday shoppers. Most of these were infostealers aiming to grab saved login credentials.

The US was the hardest hit with 4.89 million attempts across the first half of the year, followed by the UK (2 million) and Germany (1.32 million).

Phishing is equally rampant. NordVPN blocked over 4.4 million phishing attempts in the first half of the year, noting that 99% of these attacks impersonate a narrow list of just 300 brands, often disguised as fake job recruiter campaigns.

Microsoft was the most impersonated company (16.12%), followed by Roblox (12.32%), Google (9.94%), and Netflix (5.99%). Adding to the danger, attackers frequently exploit the trusted .com domain, which accounts for 43.2% of all intercepted scams.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Hijacked sessions and the Dark Web

While users are increasingly wary of downloading fake apps or clicking shady links hidden in pirate sites, attackers are finding stealthier ways in.

Between January 1 and May 26, 2026, a staggering 94 billion cookies were exposed online. Of these, 1.2 billion were active session cookies, which cybercriminals can use to hijack accounts without needing a password, often completely bypassing multi-factor authentication (MFA).

Once data is stolen, it is swiftly commodified. Using its Dark Web Monitoring tools, NordVPN identified 8.4 million compromised accounts in just 90 days.

Frighteningly, over 47% of the exchanged data involved physical addresses and full names, allowing attackers to weave digital and real-world identifiers together into comprehensive victim profiles.

Telephony isn't safe, either. Between the service's launch and June 16, NordVPN blocked nearly 29,000 scam calls and issued spam warnings to over 525,000 users.

How to stay safe

Because technical barriers for criminals are lower than ever, defensive strategies must evolve. NordVPN's report stresses that consumer protection now requires a mix of both technological defenses and behavioral resilience.

Alongside using security tools like a virtual private network (VPN) and antivirus software, users must cultivate a healthy skepticism. If a message, email, or website demands urgent action or offers something too good to be true, pause and verify.

In the age of AI-driven fraud, a moment of hesitation is your best line of defense.

• Sygnia reports China‑linked Fire Ant expanding beyond virtualization to routers, TACACS, and Linux hosts
• Compromised routers act as operational platforms
• Campaign aims at “target behind the target,” leveraging trust relationships for broader espionage reach

Fire Ant, a China-nexus cyberespionage group, is no longer targeting just virtualization platforms, it’s also going for routers, authentication systems, and Linux management hosts. This is according to cybersecurity researchers Sygnia, who recently saw the group target Cisco IOS XR Routers.

Once they compromise a router, they don’t just use it to move around the network, the researchers explained. Instead, they turn them into full-blown operational platforms, collecting traffic, establishing connections, manipulating command output, and even suppressing logging so that they fly under the defenders’ radars.

For authentication systems, Fire Ant was seen taking aim at TACACS servers. Admins use them to authenticate when accessing network hardware, and crooks use them to harvest valuable credentials and weaken the reliability of audit logs, as well. Finally, Sygnia says Fire Ant also targets Linux management hosts. The researchers saw multiple persistent implants and backdoors, including a custom SSH backdoor and a piece of malware spoofing legitimate software.

Target behind the target

The goal of the campaign seems to be to establish a foothold that allows crooks to reach other environments. Sygnia describes it as a “target behind the target” scenario:

“This reinforces the “target behind the target” concept introduced earlier in this report. Fire Ant’s interest in the compromised organization should be understood not only as an attempt to compromise a single environment, but as an effort to control infrastructure that may enable visibility, collection, and potential access beyond the immediate victim. The strategic value lies in the trust relationships the organization maintains with connected environments,” Sygnia explained.

Very little is known about Fire Ant, besides the fact that it was first observed in 2025. Some researchers claim it has significant overlaps with a threat actor tracked as UNC3886, a Chinese espionage group previously observed by Google. However, there are also significant differences which make attribution inconclusive.

Via BleepingComputer

• Researchers found unclaimed llms.txt references on 120 domains, exploitable by cybercriminals
• AI agents could install malware if they execute hallucinated or outdated documentation commands
• Fixes: clean documentation and restrict AI agents from treating docs as executable instructions

Cybercriminals are able to now abuse hallucinated, outdated, and outright incorrect website documentation to deliver malware to unsuspecting victims through AI agents, new research has claimed.

An increasing number of websites now contain two documents: llms.txt, and llms-full.txt. These are conventions that allow AI agents to properly read the contents of the websites. If an AI agent is looking to install software or add code to a project, they can search through these documents across the web until they find a fitting solution.

Researcher Alon Hertz analyzed 6,214 live domains belonging to defense contractors, Fortune 500 organizations, as well as big tech. On these domains he found 8,265 of these .txt files and among them 120 (all on a different site) pointing to one or more code packages and domain names that weren’t registered at all.

Claiming packages and domains

There can be a myriad of reasons why they’re not registered. It can be due to human error, renamed or abandoned packages, copy/paste errors, or hallucinated documentation.

Now, for the purpose of the experiment, Hertz registered some of these unclaimed names and hosted packages that would phone home when installed. It took less than an hour for a Fortune 500 company to start pinging, and the numbers soon grew to “a few dozen more”.

This means that if the researchers can do it, so can cybercriminals. In theory, a cybercriminal could find these unclaimed packages and register malware. If an AI agent has permission to execute shell/package-manager commands and stumbles upon this documentation, it can end up infecting the device.

Claude, OpenAI’s Codex, and Nous Research’s Hermes were all “guilty”, the researchers said.

To fix the vulnerability, two things need to happen. First, companies need to clean up their documentation and make sure it’s not pointing towards non-existent or malicious content. Second, AI agents need to stop treating documentation as executable instructions. Since the latter most likely isn’t happening any time soon, the immediate answer would probably lie in the former. In the meantime, organizations using AI for coding should consider the risks when granting AI agents permission to execute commands.

Via Ars Technica

• Researcher Dominik Reichel found SLEEPWALKER, a silent malware implant disguised as ESET’s agent
• It contains no malicious code, activates only after receiving crafted network signals
• Likely a nation‑state project targeting specific victims; no active campaigns confirmed yet

Security researchers discovered a new and rather unusual piece of malware.

Most malware come with a built-in, pre-defined set of tools and features: system fingerprinting, network mapping, data exfiltration, keylogging, screenshots, tapping into the camera and microphone. When they infect a machine, they first try to phone home using the device’s internet connection and await instructions on which of the features to use.

But security researcher Dominik Reichel found something entirely different: a piece of malware not having any of the above, designed to remain almost completely silent until being “woken up”. He named it SLEEPWALKER.

No active campaigns

This implant has no malicious code, and therefore nothing that would get flagged by security software. It hides in plain sight, masquerading as a legitimate Windows component for ESET’s Management Agent. This allows it to run from within a trusted app, instead of being a standalone program that could invite scrutiny.

SLEEPWALKER listens to network traffic for a specially crafted signal, waking up only when it is received. That signal also “teaches” the malware what it can do - schedule different activities, communicate with other systems, receive additional programs, and even execute code.

The malware was submitted to VirusTotal sometime last year, Reichel said. It was not found in any active campaigns, and there are no confirmed victims, industries, countries, or organizations associated with the sample. Reichel also stressed that it’s unknown how the malware initially entered the reporter’s environment, who runs it, and what additional tools may have accompanied it.

He also said that the code is somewhat “rough around the edges”. Despite its unusual design, it comes with several weaknesses, which might suggest that SLEEPWALKER was a work in progress. He doesn’t know if there are newer variants in the wild, though.

Still, given the nature of the malware, Reichel doesn’t think it was built for indiscriminate attacks. Instead, it was most likely designed by nation-states with specific targets in mind.

Via The Register

• Kaspersky found Android malware abusing DoFun car head units via TWCore updates
• Multi‑stage attack installs loaders and reverse proxy, aiming to build a botnet of connected cars
• Campaign attributed to MoYu Group; DoFun patched vulnerabilities after disclosure

We’ve seen botnets comprising cameras and DVRs, we’ve even seen botnets comprising smart fridges and digital frames, but we’ve never seen botnets comprising automobile infotainment systems. First time for everything.

Earlier this week, security researchers Kaspersky warned about finding a brand new Android malware targeting the car’s head unit. The victim seems to be a Chinese manufacturer called DoFun. Head units from this manufacturer, built on Android, are running an app for analytics and software updates called TWCore.

According to Kaspersky, the attackers abused TWCore’s update mechanisms, instructing it to download a malicious APK. This malware is then placed in the app’s cache directory and installed by the legitimate com.tw.core package.

No active campaigns

The researchers said this was a multi-stage attack. In the first stage, a tiny dropper with no user interface gets deployed. It decrypts embedded data, and extracts the information it needs for stage two. In the next stage, the loader contacts the attackers’ server and gets instructions about stage 3, which can be different things, from deploying additional malware, to running the “zhima” reverse proxy.

Despite its multifunctional nature, Kaspersky believes that the true goal of the campaign is to assimilate the cars into a botnet. Some cars come with a SIM slot and are connected to the internet 24/7. It is probably not an exaggeration to say that cars just might be the perfect devices for a malicious botnet.

Kaspersky attributed the campaign to MoYu Group, a threat actor known for building malicious botnets based on Android devices. In the past, this group was observed building the BadBox botnet out of Android smartphones, tablets, streaming devices, and other internet-connected hardware.

The researchers notified DoFun of their findings, and the vulnerability was quickly fixed: "We notified the vendor about the distribution scheme, and they subsequently reported fixing the security issues," the researchers said.

Via The Record

• Expel researchers warn of SynkLoader backdoor spread via fake IT help desk Teams messages
• Malware modules include PhishLocker (fake login screen harvesting OS passwords) and Interactive Shell for remote control
• Defenses: distrust unsolicited Teams DMs, verify with IT before installing apps, and train staff against social engineering

For roughly a month now, cybercriminals have been targeting organizations with a new backdoor malware called SynkLoader.

According to security researchers Expel, the attack starts with social engineering. Victims would get a Microsoft Teams message from a person claiming to be from the company’s IT help desk. They would tell the victim their computer is having an issue, and that they need to install a “PowerShell Cleaner”. This fake program is nothing more than a malicious framework, hosted on Microsoft Azure to increase its trustworthiness.

The malware itself comes with a number of different modules, giving the attacker a range of features, from harvesting system information, to creating a reverse proxy. Two particularly worrying modules are called PhishLocker and Interactive Shell. The former creates a convincing, yet fake, Windows lock screen, which can harvest the user’s OS login password.

This is not SickKids' first attack

BleepingComputer argues that with this password the attackers could “access corporate environments from the infected device, bypassing IP allow-list restrictions”. Those with a sharper eye might spot the ruse, as a simple Alt + Tab shows that the login screen is nothing more than a “full-screen borderless GUI application”.

The other module - Interactive Shell, allows threat actors to remotely execute PowerShell commands and receive the output, which essentially grants them full control over the infected device.

The full list of Indicators of Compromise (IoC) can be found on this link. To defend against these types of attacks, target companies should instruct their employees not to trust unsolicited Teams messages at face value, and not to install any applications without double-checking (calling) with their IT department first.

Alongside phone calls, Microsoft Teams is one of the most-used channels for initial contact and compromise. Also, employees remain the weakest link in every company’s cybersecurity chain, unwillingly granting attackers access or sharing login credentials.

Via BleepingComputer

• Researchers found banking malware requests VPN permissions to block Google Play and Play Protect on infected Android phones
• ToxicPanda 2.0 bypasses security to install hidden payloads, targeting 349 banking and crypto apps across 16 countries
• The malware can even seize shell-level control of a device

Security researchers have flagged a new twist in Android banking malware: a trojan that turns your phone's own VPN feature against you.

A report from mobile security firm Zimperium details how ToxicPanda 2.0 abuses VPN permissions to shut down Google's built-in protections before it strikes.

The tactic is effective because it hides in plain sight. Plenty of legitimate apps ask for VPN access, and even the best VPN apps rely on the same underlying permission to route your traffic. ToxicPanda copies that request, but uses the access to cut your phone off from Google Play instead.

Once Google Play Protect can no longer reach the device, the malware has a clear runway to install its payload and begin harvesting your data.

How ToxicPanda uses VPN permissions to blind Google Play

ToxicPanda operates as a "dropper," an app that smuggles in a second, hidden program. According to Zimperium researchers, the malware first shows a fake installation screen and prompts the victim to grant VPN permissions. That request looks routine, so many users tap "allow" without a second thought.

Granting it lets ToxicPanda create a local network interface that sits between the phone and the internet, giving the malware control over all traffic passing through the device. It immediately uses that control to block communication with Google Play and Google Play Services.

Cutting off this connection lets the malware interfere with app verifications, updates, and Play Protect, the security layer that would normally flag or remove a harmful app. With Google effectively blindfolded, ToxicPanda decrypts a payload hidden in its own files, installs it, and then asks for Accessibility Service permissions to dig deeper.

This release is a major escalation from the previous ToxicPanda iteration.

As Zimperium says, ToxicPanda 2.0 now supports 167 remote commands. It can also overlay fake login screens on 349 banking, e-wallet, and crypto apps across 16 countries, up from just 16 apps previously. A separate module harvests PINs from more than 140 financial apps using invisible overlays that capture your taps.

The trojan can also spoof your Android lock screen to steal your PIN, pattern, or password, and it abuses Android's Wireless Debugging (ADB) feature to gain shell-level access and grant itself permissions without prompts.

ToxicPanda first appeared in 2024, targeting European banks. Other similar malware such as Rokarolla, has also hit hundreds of banking and crypto apps in recent months.

How to stay safe

The strongest defense is to keep the malware off your phone in the first place.

Only install apps from the official Google Play Store, and avoid sideloading APK files from links, ads, or third-party sites. Be aware that dangerous VPN links have even slipped into official app stores, so treat any surprise VPN prompt with suspicion.

A legitimate VPN remains a valuable privacy tool, but this campaign is a reminder that the permission itself is powerful, so grant it only to apps you genuinely trust.

• NordVPN found a malware campaign impersonating 65 brands
• It tricks victims into clicking on messages requesting urgent action
• If you use an Android phone, it’s worth checking your apps

Summer is still in full swing with many people out enjoying their holidays. Unfortunately, cybercriminals never stop trying to steal money by tricking people into believing they are on trustworthy websites or using legitimate apps — especially when our attention is more likely to wander.

That’s what NordVPN, the pinnacle of the best VPNs, recently investigated, issuing an alert urging caution over a widespread and sophisticated malware campaign targeting Android users through highly convincing phishing schemes.

The malware is posing as over 65 well-known brands, including Ryanair, Emirates, and Qatar Airways, as well as tax authorities, registry offices, and social security systems that lure you into downloading their apps.

The dangerous trojan tracks your messages and logins, spies on you through your camera, records your voice, and bypasses two-factor authentication before ultimately draining your bank account.

The campaign has targeted users in Southeast Asia, Latin America, and Africa.

What the research found

NordVPN spent the last 12 months investigating the malware campaign — including its infrastructure and impersonation targets — analysing malware clusters and mapping more than 100 domains linked to the campaign.

It discovered that the campaign tricks users into installing an app that grants full access to their Android phones or computers by impersonating highly trustworthy companies — brands people are accustomed to providing their personal data without questioning it.

Victims are lured by a variety of requests via SMS, WhatsApp, or social media that look totally innocuous, like a job opening at an airline, a cheap flight, or a tax refund.

Once installed, the Trojan runs quietly in the background and stays active even if the phone is restarted, accessing your messages and call logs, capturing the screen, recording audio, and accessing the camera.

Attackers can even log into the victim's banking app and approve transactions themselves by using SMS interception to steal your money, as most banks implement two-factor authentication through one-time codes sent by text.

Marijus Briedis, chief technology officer at NordVPN, says: "One install, and the phone is no longer yours. The attacker sees your screen, reads your SMS codes, and empties your accounts from the inside."

Trusted brands are often the most spoofed brands in phishing scams, alongside other malware 'tricks' to gain trust, such as multi-platform PR campaigns promoting malware as legitimate software, or even Chrome extensions impersonating VPNs.

However, unlike many opportunistic phishing attempts, these attacks have been particularly hard to spot, featuring extremely accurate replicas of legitimate websites, meticulously copied and professionally translated.

How to stay safe

Briedis advises Android users to be very careful not to install apps from links received via text message. "Real airlines, banks and government bodies distribute apps through Google Play, not SMS or WhatsApp," he stresses.

As with other AI impersonating scams, users should treat any urgent request as a warning sign: whenever there is mention of a refund or an account being blocked, check the source carefully before clicking on anything or taking any action.

Checking that a website is legitimate and does not operate from domains ending in .cc, .lol, .xyz, .mom, or .pw will be a clear safety indicator.

Furthermore, do not rely on 'the padlock icon': an HTTPS connection merely indicates that the connection is encrypted, not that the site is genuine.

If you suspect that a suspicious app is already on your phone, disconnect your phone from the internet, uninstall the app, change your password from another device, and contact your bank: this will ensure you’re back in the clear.

And remember that if even the current UK Prime Minister can be a scam target, perhaps you should remain vigilant too.

Cyber risk is now a board room issue, and we have seen clear examples of this in the UK. The 2025 Jaguar Land Rover attack left the carmaker with a £485m loss, swallowing up the £398m profit it had generated just 12 months before.

Production lines were halted for more than a month as the company shut down parts of its network, showing how quickly a cyber incident can affect business performance, operational continuity and the wider supply chain.

Now, businesses are facing a fresh type of threat made possible by AI – the autonomous attack. Attackers can already automate parts of target research, initial access and malware development, with any manual effort shrinking rapidly.

Simultaneously, the trust layer people rely on is eroding with the spread of AI-generated content and deepfakes. It’s a race to tackle the autonomous attack, but how do organizations formulate an effective response?

AI in a cyber-attacker’s armory

AI-driven automated technologies are strengthening a cyber-attacker’s armory. Prior to leveraging AI tools, bad actors often had to commit time and resources to researching a target company before planning an attack.

Timing was critical, and a perpetrator had to manually coordinate and initiate an attack at a specific time and could simply forget. AI doesn’t - and the rise of attack-as-a-service tools is making it possible to successfully breach organizations quickly and accurately.

Guardrails are starting to be put up around established generative AI tools, such as ChatGPT and Claude, in an effort to prevent this kind of misuse. But hackers are finding workarounds.

Rather than relying on readily available large language models (LLMs), they are deploying their own small language models (SLMs) on local devices, often on something as basic as a Raspberry Pi computer. From there, they can escalate attacks while hiding in the shadows.

The threat to businesses of all sizes

The rise of automated attacks also means that businesses of all sizes are likely to be identified by automated technology as having exploitable vulnerabilities. Small and medium-sized businesses would previously have been off the radar as attacks relied on a bad actor’s knowledge of their existence.

However, AI can now scan and process vast numbers of organizations at speed, potentially leaving smaller firms, which are less likely to have robust cyber controls in place, more exposed. And even more so among smaller businesses, defenses are typically more fragmented and less organized than AI-driven attacks.

In other words, with AI by their side, attackers can coordinate and scale far better and much more quickly than most businesses can defend.

Autonomous attacks also make third-party and supply chain risk much harder to manage. Business networks can create access to data, systems or operational processes. When attackers can automate reconnaissance and scale attacks across thousands of organizations, weaker suppliers may become an attractive route into larger businesses.

This is a particular concern because third-party risk management has often relied on annual questionnaires, point-in-time assessments and contractual assurances, but these approaches are no longer enough on their own. A supplier may have recently exposed a service, suffered a breach, changed its access privileges or failed to patch a critical vulnerability.

Businesses therefore need to move towards continuous, automated monitoring of supplier security posture.

Regulations such as NIS2 have also increased the focus on supply chain security for organizations operating in, or selling into, the EU. There is also a growing expectation from ICO and the FCA that boards can demonstrate cyber resilience.

Automation and the rise of specific attack types

Jadepuffer illustrates how AI is beginning to transform established attack types. Disclosed by Sysdig in July 2026, it was assessed as the first documented end-to-end LLM-driven extortion operation, with an AI agent conducting reconnaissance, harvesting credentials, moving between systems, destroying data and adapting when individual actions failed.

While none of the techniques were especially new in isolation, the significance was the way the AI connected them into a complete, adaptive attack.

Social engineering techniques, such as bad actors posing as trusted individuals, are becoming much more convincing in their approach. Fluent, grammatically correct messages and the professional tone and style of CEO communications can now be fully replicated on emails, SMS and even WhatsApp.

AI can even manage the entire conversation thread, including dynamically adapting responses to a target’s replies, with it possible to run simultaneous, tailored campaigns.

Vendor email compromise, where criminals impersonate suppliers, intercept genuine payment conversations or use compromised vendor accounts to request changes to bank details, directly links social engineering to third-party risk.

Taking a step back, the initial harvesting process of personal data for social engineering attacks can be streamlined. AI can automatically scrape data from public sources such as Companies House and social media to quickly provide the names of specific people, their roles and relationships.

When trust and identity come under attack

Even on video conferencing calls, it’s becoming increasingly difficult to tell if the person you’re speaking to is real due to the increasing accuracy of deepfakes. As an example, it’s often now necessary to ask a suspected deepfake to do something it wasn’t programmed to do, such as raise a hand, to check if the person in question is real. But even that test is gradually being circumvented by new technology.

Organizations need stronger out-of-band verification protocols for high-value or unusual requests. A pre-agreed code word via a separate channel might be needed to ensure trust and security.

Identity security is becoming a key area of defense as autonomous attacks become more advanced. Credential stuffing at scale, session cookie harvesting, MFA fatigue attacks and vishing attempts designed to bypass multi-factor authentication are all increasing. AI can make these attacks more efficient by identifying likely targets, generating convincing scripts and adapting to the victim's responses in real time.

This is why identity and access management should be treated as a critical control. Organizations need to know who has access to what, whether that access is still needed, which accounts are privileged and how quickly unusual behavior can be detected.

Fighting AI with AI

AI-driven autonomous attacks might be heightening the risk, but AI can also be used defensively. A good example of this is to run an automated risk analysis of an organization and highlight where security tools and the basics, such as malware protection, are out of date or missing.

With those fundamentals in place, AI can then underpin continuous monitoring of the critical systems, rather than periodic checks. Businesses should be identifying and focusing on protecting the “crown jewels” – that might be the top 10 most critical assets, such as payroll or a banking system, and target AI-led efforts on protecting them.

Joined-up visibility is then crucial. Businesses need to know who has access to those critical assets, the endpoint and network activity related to them and gain the ability to correlate any incidents quickly so the response to an AI-driven attack can be as swift as possible.

A combination of AI-powered technology, backed by human expertise, can provide proactive threat hunting to actively search for, investigate and remediate dangers, even if they are autonomous in origin.

Organizations aren’t powerless in the fight

The rise of autonomous attacks marks a new phase in cyber risk. For many businesses, particularly smaller ones, the challenge is preparing for attacks that can move much faster than traditional defenses. But organizations aren’t powerless in the fight.

Effective responses start with getting the basics right, from access controls to visibility across critical assets, to moving from periodic checks to continuous monitoring and faster detection with AI.

However, technology alone won’t be enough. Human expertise can interpret risk and make informed decisions under pressure to ensure resilience, even as the AI-driven autonomy threat moves to the next level.

We've featured the best firewall software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• iAuthFlow v2 sold on Russian forums lets attackers persist in email accounts
• Tool phishes logins, then secretly creates attacker‑controlled passkeys for lasting access
• Defenses include auditing passkeys, OAuth tokens, mail rules, and removing rogue methods

Security researchers have discovered a new malware toolkit which allows threat actors to log back into compromised email accounts even after the password was changed and all sessions terminated.

iAuthFlow v2 is currently being sold on Russian dark web forums for north of $10,000, a new report from cybersecurity experts from Abnormal said, as they obtained a copy of iAuthFlow v2 for analysis.

The malware primarily works as a phishing tool, trying to trick users into logging into either Google, Microsoft, iCloud, or LinkedIn. As soon as they do that, they relay the login credentials to the attackers, who log into the accounts on their end, as well - before the tool displays a “processing” page for a few seconds while, in the background, it sets up a new passkey.

How to defend against iAuthFlow v2

A passkey is an alternative means of authentication that is often touted as the “password killer”. It uses cryptographic keys stored on a device, allowing users to sign in with a fingerprint, face scan, or device PIN.

Because the secret key never leaves the device, it is resistant to phishing. However, if the threat actor is able to generate a key of their own, on the device they own, access is basically guaranteed.

The ad for the toolkit also comes with a video demo, showing how it works. In the demo, iAuthFlow v2 created the passkey six seconds after authentication.

However, generating a passkey is not that straightforward of a process and it could encounter hiccups, Abnormal hints, saying that Google, for example, might require further identity verification before allowing the change.

Usually, when a threat actor compromises an email account, terminating all sessions and changing the password is usually enough.

In this case, however, users should do a lot more: review the account for signs of compromise, including unauthorized passkeys or security keys, malicious Gmail filters and forwarding rules, recovery and delegated access changes, and unauthorized applications, Abnormal suggests.

They should also revoke relevant OAuth tokens and grants, investigate available sign-in, mail-rule, 2-Step Verification, passkey and OAuth audit events, and finally, make sure any attacker-enrolled authentication methods are removed.

• Huntress spotted a ClickFix campaign targeting security pros via fake conference invites
• Victims tricked into pasting code that installs AMOS infostealer on macOS
• If lured, isolate systems, reset credentials, rotate secrets, and review cryptocurrency wallets

Cybercriminals are targeting security professionals with a highly tailored ClickFix campaign in an attempt to get their computers infected with infostealer malware, experts have warned.

An active campaign against people who have attended, or have a history of attending, various cybersecurity conferences such as Black Hat, or DEF CON has been detetced by security researchers Huntress, who were targets themselves.

The attack starts on X, where the threat actor uses a fake account to interact with people visiting and sharing content from these conferences. After establishing rapport, they move into DMs, claiming they’re organizing a conference of their own, and sharing a Google Docs file containing “more info” with the victim.

Follow-up attack

Here is where the attackersy go for the ClickFix attack. The document comes with a vertical sidebar, apparently as a security feature that keeps the contents of the file encrypted. The victim is given a decryption code to enter, but it returns an error and offers a solution - to bring up the Terminal and copy/paste a piece of code.

From here, it’s the usual ClickFix practice: the victim ends up downloading and running AMOS, a notorious Mac infostealer capable of grabbing browser information, cookies, keychain data, cryptocurrency wallet information, Telegram files, and more. The Windows variant did not work when Huntress tried to analyze it, but it’s safe to assume the end goal is the same.

Huntress also found that this is not where the attack ends. If the victim does not install the infostealer, the threat actor will follow up with a different document, this time pretending to be for Dropbox and working only with the desktop app. Of course, the download button leads straight back to the infostealer.

The researchers shared a full list of Indicators of Compromise (IoC) which can be found on this link. They also advised anyone who interacted with this kind of lure to isolate the system from the network, collect relevant forensic evidence, and “consider reimaging the system”.

“Assume that credentials on the system have been compromised”, they said. “Revoke active sessions, reset passwords, and rotate API keys or any other secrets that may reside on the system. Review cryptocurrency wallets as well, if present.”

The UK's National Cyber Security Centre recently issued a blunt warning to government and industry alike, warning that many systems are now connected "in ways their designers never anticipated", built on protocols never intended to withstand the sophistication of today's attackers.

That warning applies to all organizations relying on cross-domain processes to move data between environments with different security levels, and especially to complex cyber-physical systems where data flows between standard IT and operational technology (OT) assets.

File transfer is one of these fundamental processes but remains one of the most often overlooked.

Every invoice sent to a supplier, every firmware update pushed to a factory floor, every report shared with a regulator is data crossing between systems with different levels of trust.

For years, file transfer security has been treated as a solved problem. Enterprises were happy to encrypt the channel, confirm delivery, and move on. That approach made sense when systems were simpler, and threats moved more slowly. However, it no longer reflects reality.

Why perimeter-based trust no longer holds

Most file transfer platforms were never built with security as the primary goal. They were built to move data reliably between systems, encrypt the connection, confirm that a file arrived, and log that the job was done. Whether the file itself was safe was rarely part of the equation.

That gap provides a consistent way for cyber attackers to gain a foothold in their targets' systems. A file transfer platform sits between organizations by design, trusted by both sides precisely because it's meant to be routine infrastructure.

The traditional Managed File Transfer (MFT) model is built to automate file delivery, not to defend against attack. As such, it leaves the process exposed to a familiar set of threats, from man-in-the-middle interception and credential theft to malware covertly embedded in an otherwise ordinary file. Attackers don't need to break the platform itself, only to exploit the assumption that whatever moves through it can be trusted.

As we've seen with incidents like 2023's MoveIT supply chain cyberattack and last year's SharePoint breach, a single vulnerability in a widely used transfer tool can give attackers access to thousands of organizations at once, simply because every one of them assumed the platform itself could be trusted.

That assumption is exactly what attackers are counting on. Securing the channel a file travels through was never the same as securing the file.

The shrinking window to respond

File security has always been a blind spot, but it's become much more critical in recent years as the attack lifecycle continues to accelerate. Newly disclosed vulnerabilities are now routinely exploited within 48 hours of becoming public, leaving little room for patch management by organizations to prepare, or even notice before they're targeted.

Detection, by contrast, still moves comparatively slowly. Breaches involving file-based attacks can go unnoticed for months, giving an intruder ample time to move laterally, extract data, or embed themselves further into connected systems before anyone realizes something is wrong.

It's not simply that attackers are fast, but that most organizations still treat file movement as something to review after the fact rather than control at the point of entry. By the time a malicious file is identified, the damage has often already been done.

This is why proactive, layered controls around every file entering or leaving the business matter more than ever. Waiting to react is not a viable strategy.

Establishing continuous file verification

Closing this gap means shifting towards a security-first MFT process, where every file, user, and workflow is treated as a potential point of exposure rather than assumed safe by default.

Prevention is by design, rather than protection bolted on afterwards as with most traditional MFT models. And that starts with looking inside the file, not just authenticating the channel it arrives through.

Deep content inspection examines the file's actual structure, identifying hidden or malicious elements that a simple scan would miss. Alongside this, automated vulnerability detection and malware prevention should apply to every file by default, not as an optional extra reserved for high-risk transfers. Even the most innocuous file can now serve as a powerful attack vector – in fact, threat actors are counting on it.

Likewise, savvier attackers are actively designing payloads to evade detection, so standard processes need backup. Potentially malicious files need to be tested in a safe, isolated environment where their behavior can be observed before they ever reach a live system. This kind of sandboxing catches clues missed by reputation checks and static scanning, revealing intent rather than simply checking for known signatures.

A Content Disarm and Reconstruction (CDR) process is a valuable addition here, deconstructing files and sanitizing them by removing any active content without harming function.

However, none of this works as a single checkpoint. Each of these controls needs to feed into a continuous process, where a file is validated at every stage of its journey rather than cleared once and trusted from that point on. These capabilities should also be paired with constant monitoring and detailed audit visibility, so that if something does slip through, organizations know exactly what moved, where it went, and what it touched.

As a result, organizations can reliably build confidence in data as it crosses between environments, rather than assuming that confidence once and carrying it forward unchecked.

Closing the loop on trust

The NCSC's warning and guidance on cross-domain systems point to the same conclusion: security built on fixed boundaries can no longer keep pace with how data actually moves.

File transfer is where that principle emerges most often in daily practice. Trust that was once given on principle must now be earned at every crossing. That shift, more than any single tool, is what will define resilient file transfer going forward.

We've reviewed, rated, and ranked the best internet security suites for PCs, Macs and mobile devices.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Software security was built around human development.

People wrote, reviewed and deployed code. Now machines are taking over.

In a recent paper, Anthropic reports that more than 80% of the code merged into its production codebase is authored by their AI model, Claude.

The same capabilities that make developers more productive are changing the economics of cyberattacks.

While adversaries still define the objective, machines can generate the payloads, test variants, adapt code to different environments and repeat the process at a velocity that security programs can’t match.

Speed is Marginalizing Security Controls

Most enterprise software security workflows assume there is time for review. Code is written, scanned, tested, approved and deployed. If something suspicious happens later, security teams investigate and respond.

That model breaks down when software moves from prompt to execution in minutes.

AI-generated code can become a script, dependency, automation job or infrastructure change almost immediately. While development agents can modify files, resolve packages and run commands.

Human reviewers are no longer in the loop.

Attackers can use the same mechanics to generate exploits, test evasion techniques and adjust payload behavior for different targets. This creates more variation with fewer stable indicators for defenders to recognize.

While AI-assisted analysis can improve triage, it still often produces probability, not policy. At machine speed, “probably suspicious” is not good enough.

Machines Change The Attack Model

Human attackers are not disappearing. But more of the attack chain is becoming machine-executed.

AI can automate reconnaissance, accelerate vulnerability discovery, generate exploit code, rewrite payloads and adapt command sequences to the target environment. But most defensive measures are designed around human constraints: reused infrastructure, shortcuts and trackable patterns. These don’t apply to machine attacks.

A machine-generated payload may not match a known signature or have an established reputation. It may be created, used briefly and discarded. But AI malware must still interact with the target environment to achieve its objective. Its behavior cannot conceal its intent, since it must access resources and change the environment in ways that advance the attack.

What malicious code is capable of doing is the more durable security signal.

Security Needs to Ask A Different Question

Software supply chain security has improved, but much of it still validates the artifact’s properties before execution rather than governing execution itself.

SBOMs, signing and provenance give security teams greater confidence in a code's composition, origin and build history. But knowing where software came from does not reveal what it will do when it runs.

Software can pass each of those checks and still create risk. Even an artifact produced through a legitimate build process may violate policy at runtime, while an AI-generated script may complete its intended task in a way that exposes data or systems. As a result, a clean dependency list is not proof of safe behavior.

Post-Execution Detection Is Too Late

Detection and response remain essential, but they intervene after risk has entered the environment. By the time suspicious behavior is visible, software may have accessed secrets, changed system state, opened network connections or created persistence.

AI compresses that window. Code can be generated, modified and deployed faster than humans can review it. Waiting for post-execution evidence gives attackers too much room to operate.

We need to shift the decision point left. Instead of asking, “Can we contain this software if it behaves badly?” the question should be, “Should this behavior be permitted to execute in the first place?”

That does not mean replacing existing controls, but rather changing where the decisive security gate sits.

Zero Trust for Code

Zero Trust changed enterprise security by rejecting implicit trust. Users, devices, sessions and access requests are not trusted simply because they appear familiar. They must be verified against policy.

Software execution needs the same level of verification.

Code should not be trusted solely because it came from a known repository, was signed by a recognized publisher, passed through a build pipeline or has not been seen exhibiting malicious behavior before. Those are useful indicators, but they are not conclusive.

Zero Trust for Code addresses this problem. Before software runs, its expected behavior should be evaluated against policy. If the behavior is acceptable, execution can proceed. If not, the artifact should be blocked, restricted, isolated or escalated for review.

Organizations can start by mapping every path through which code enters the environment or executes with meaningful privilege. This includes formal development channels such as repositories, open-source packages, containers and CI/CD pipelines, as well as email attachments, downloaded files, macros, browser extensions, endpoint installers, third-party integrations and scripts introduced through AI or automation tools.

Then identify where those paths rely on inherited trust. If execution is allowed because software came from an approved source, was signed, passed through a build process or has no malicious history, the control is incomplete. Behavior still has to be evaluated before the artifact is allowed to run.

As AI takes on more of the work of creating legitimate and malicious code, enterprises can no longer assume that code which clears existing checks should be allowed to run. Execution must become a deliberate security decision.

We've listed the best internet security suites for PCs, Macs and mobile devices.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Socket's Threat Research Team found 737 fake VPN and proxy extensions on the Chrome Web Store, with more than 75,000 combined installs
• The add-ons pose as trusted names like Proton VPN and NordVPN while routing your entire browser session through proxies run by one operator
• Hundreds are still live, so it's worth checking your browser now and removing anything suspicious

A new investigation has exposed a huge cluster of counterfeit VPN extensions that promise privacy while rerouting your traffic.

Socket's Threat Research Team said it identified 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts. More than 27o of these impersonate 66 of the best VPN services and privacy brands, including big names like NordVPN and Proton VPN.

Between them, the extensions racked up more than 75,000 installs, mostly among Russian-speaking users hunting for ways to reach blocked services.

If you use Chrome and rely on a browser add-on to stay private, it's worth making sure the one you installed is a genuine product from a real provider rather than one of these lookalikes.

What the researchers found

Socket's team traced the whole network back to a single Russian VPN subscription business trading as Myxa VPN.

The researchers linked the extensions using a shared analytics account, clustered domain registrations, common hosting, and leaked Windows build paths pointing to one project folder. The free extensions appear to act as a funnel, nudging users toward a paid subscription.

Some of the paid promises were pure fiction. Socket says the premium tiers advertised servers in countries like Japan, Singapore, and Australia, but when it tested 200 premium hostnames across 40 domains, none returned an A record, meaning those servers simply did not exist.

The core trick is the same across nearly every extension. Once you press Connect, everything you browse gets pushed through a server the operator controls, with no per-site exceptions.

It adds no encryption, so it isn't doing the protective work a real VPN would. Worse, 104 extensions resolved their proxy addresses through Cloudflare or Google DNS-over-HTTPS and handed Chrome a raw IP, a technique that makes the operator's servers harder to block or spot.

Why fake VPN are dangerous, and how to stay safe

Sitting in the middle of your traffic gives the operator a clear view. Socket says the setup lets whoever runs the proxy observe the websites you visit, TLS SNI metadata, your source IP address, and any data sent over unencrypted HTTP. That means anything you type into a non-HTTPS page, including logins, could be exposed.

Socket doesn't know whether this data has actually been collected or misused, but the fact that it can be is the problem. It's the same pattern behind earlier warnings about fake VPN extensions in the Chrome Web Store and Google's own alerts about spyware posing as VPN apps.

Google has already acted, but not completely. By the time Socket collected its data, 221 of the 737 extensions had been removed, while 516 remained listed, so the threat hasn't fully gone away.

If you think you installed one, the advice from Socket is straightforward. Remove the extension immediately, then check that Chrome's proxy configuration has returned to normal and change any credentials you entered on non-HTTPS sites while it was active. You can review your proxy settings by heading to your browser settings and searching for "proxy."

• WindRelay campaign used vishing plus custom malware to turn phones into POS skimmers
• Victims installed personalized RATs and NFC malware, enabling real‑time card theft
• Attacks were highly targeted across Eastern Europe, with only a few individuals hit

Hackers are turning people’s smartphones into malicious Point of Sale (POS) devices and stealing their money directly from their payment cards, experts have warned.

Security researchers Group-IB spotted multiple such attacks across Eastern Europe, and named the campaign WindRelay, after the custom-built malware used during the attacks.

The report notes this is a highly sophisticated, custom-tailored attack designed specifically for the victim. It starts with some form of reconnaissance, in which the attackers learn their victim’s identity, phone number, and likely other details. Although the researchers don’t discuss it, it is quite possible that the attackers obtained (or purchased) the data from unrelated data breaches and leaks.

Vishing and malware

After learning a little bit about their target, the attackers get to work. They first prepare a remote access trojan (RAT) named SpyNote. They personalize the label with the victim’s own name (instead of it being a generic or impersonated brand), to build trust with their victim:

“Such tactics are more effective at weakening a victim’s natural defenses and suspicions,” the researchers noted in the report. “It removes the one cue people are trained to check before installing something unfamiliar — a strange or generic app name — right at the moment they’re most likely to hesitate.”

Then, they call the victim on the phone and introduce themselves as employees of their target’s bank. They claim the victim has a problem with their bank card, and instruct them to deploy SpyNote through the device’s package installer (the standard way to sideload apps outside an official app store).

SpyNote is a classic RAT that the attackers then use to deploy stage-two malware themselves. In this next step, they personally (as opposed to having the victim do it) install WindRelay, custom near-field communication (NFC) malware designed to capture contactless payment card data in real-time, when a card is tapped against the phone.

In other words, the malware turns the smartphone into a POS, and when a victim taps their card against it, the information is relayed to an attacker’s terminal.

Vishing + malware

Vishing + malware combo is nothing new. We’ve seen it deployed numerous times before, and ShinyHunters are probably the shiniest example of the practice (pun definitely intended). Over the last couple of years, ShinyHunters have been calling their victims on the phone, impersonating the IT department, and getting their victims to log in via fake login portals which relay the credentials to the attackers.

They then use the credentials to access their victims’ SaaS products, exfiltrate as much sensitive data as possible, and then demand ransom in exchange for deleting the stolen files.

This new campaign, however, is a testament to the technique’s evolution. While ShinyHunters’ operatives only stay on the phone call until the victim logs in, these crooks remain on the line for as long as it takes. Group-IB says the average call lasts around 13 minutes, and by that moment, the victim will have installed both SpyNote and WindRelay, and has tapped their bank card against the phone, making unwanted payments.

In at least one case, the attackers successfully applied for a loan at the victim’s bank, stealing not only the money they had on their account, but also money they would have earned in the future.

The identity of the attackers is unknown at the time. We also don’t know exactly how many victims there were, but given the highly personalized nature of the attack, it’s safe to assume that there were only a handful.

Group-IB says it observed attacks in Czechia, Slovakia, and Slovenia, suggesting a threat actor focused primarily on Eastern European victims. The researchers also said they identified 23 samples uploaded to VirusTotal between November 2025 and July 2026, meaning the campaign was active for approximately seven months, targeting 23 individuals.

“The samples mimic various institutions from the targeted countries and contain text in the language of each targeted country,” the researchers said. “Some samples contain personalized UI elements and labels, such as the name of the victim, similar to the personalized RAT. This suggests the threat actor behind these campaigns most likely has the capability to dynamically build malicious applications tailored to individual victims.”

Group-IB says users should treat personalized app labels as a red flag and should apply extra friction to loan applications.

• Surfshark recorded nearly 6 times as many malware detections on Windows
• While trojans mostly target Windows devices, phishing lands harder on Mac
• A "Macs are safe" mindset may leave users more at risk of social engineering

New data from Surfshark shows a stark split in how malware finds its targets: Windows users are hit at nearly six times the rate of macOS users.

The headline number is eye-catching, but the full story is more interesting. While Windows soaks up the vast majority of traditional malware, Mac users face a very different kind of threat, one that a locked-down operating system does little to stop: phishing.

Antivirus software paired with one of the best VPN services remains a sensible layer of defence, whatever you run, but Surfshark's findings are a useful reminder that while risks change depending on the platform, they never disappear.

The six-times gap, by the numbers

Surfshark analysed 391,305 malware detections logged by its antivirus between 1 January and 31 July 2026. Windows devices made up 66% of the active user base but accounted for a striking 92% of all detections, while macOS users represented 34% of the base yet just 8% of threats.

That works out to nearly six Windows detections for every one on a Mac.

"Windows' popularity has always made it the biggest target for cybercriminals," said Gabrielė Sinkevičiūtė, Head of Product at Surfshark, pointing to the scale of malware built around Windows' dominant market share, along with differences in how each platform handles third-party software and permissions.

Surfshark's equivalent research from last year yielded similar results, so the trend appears to be consistent.

Trojans dominate Windows, while phishing surges on Mac

The threat mix differs sharply by platform. Trojans (malicious software hiding inside safe programs) were the top danger on Windows at 46% of detections, versus 25% on macOS, while riskware (legitimate software that can pose security threats) sat at 19% and 17% respectively. Viruses were level at 9% on both, and adware (software that puts unwanted ads on your device) trailed at 4% on Windows and 3% on Mac.

Phishing is where Mac users lose ground. It ranked third on macOS at 15% of detections, but only sixth on Windows at 3%. Because phishing exploits trust rather than software flaws, a hardened operating system offers little protection, and Surfshark argues a false sense of security can make Mac owners slower to question a suspicious message.

Other research backs this up. Microsoft reported in early 2026 that infostealer campaigns are expanding beyond Windows onto macOS using social-engineering tricks such as ClickFix prompts and fake installers, and Malwarebytes has tracked Mac infostealers becoming a mainstream threat rather than a rarity. TechRadar has likewise reported that the "mythical" security status of macOS is fading.

How to stay safe

The core advice is the same on both platforms: treat unexpected links, attachments and login prompts with suspicion, keep your operating system and apps patched, and only install software from official sources.

Never paste a command into Terminal or PowerShell because a website told you to, as that single step drives many recent Mac infections.

Running reputable antivirus software helps on either system, but the biggest fix for Mac users may be a change in attitude. Dropping the assumption that Apple hardware is inherently immune is the first real step toward not becoming the softer target.

The integration of artificial intelligence (AI) into everyday work and life has prompted businesses and regulatory bodies to take action. AI is a force introducing entirely new categories of threat, making heightened cyber resilience essential. However, amidst the panic to get in front of this, it should be noted that not all the hype is entirely accurate.

The underlying vulnerabilities organizations face today are largely the same ones they faced five or ten years ago: unpatched systems, weak identity controls, excessive privileges, insecure third-party integrations.

In some cases, these weaknesses have existed for some time, and most likely, will continue to exist because the first fundamental constraint of computer science is that the removal of all vulnerabilities is impossible. Therefore, no amount of tooling or budget will ever make any business 100% secure. Equally, that doesn’t mean improvements should simply be dismissed - especially in the age of AI.

Speed, not novelty

While not introducing anything inherently new, there is still some cause for concern surrounding AI. The nature of existing weaknesses remains the same. However, AI does significantly change the speed and scale at which they can be identified and exploited. Tasks that once required time, skill, and persistence can now be automated, accelerated, and in some cases delegated.

The barrier to entry has been lowered for less sophisticated actors to operate with greater efficiency and success.

We are already seeing early signs of this shift. Elements of the attack lifecycle can be automated, be that reconnaissance or lateral movement. Nation-state actors have begun experimenting with using these systems to coordinate multi-stage operations, and we’ve recently seen a fully autonomous attack take place, without any human supervision.

At the same time, more familiar techniques are being enhanced rather than replaced. Malware can be generated or iterated more quickly to evade detection. Social engineering has become more convincing through deepfakes, and phishing campaigns have become easier to scale.

None of this represents a fundamentally new playbook, simply the acceleration of an existing one.

The distraction problem

The distinction between novelty and speed matters because it shapes how organizations respond. If AI is treated as a novel and exceptional threat, it encourages a reactive mindset. Security teams are pushed towards finding “AI-specific” solutions, often at the expense of addressing longstanding gaps in their environment. In practice, those gaps still remain the most reliable entry points for attackers.

The risk that the current level of attention on AI creates, is a form of strategic distraction. Boards and executives are rightly asking questions about AI risk, but those conversations can become detached from the basics. Patch management programs remain inconsistent. Asset inventories are incomplete. Third-party exposure is poorly understood. Identity and access management remains fragmented across systems.

These are the same issues that security professionals were tackling before the advent of AI and the technology does not take them off the board. If anything, these become more consequential as the speed of exploitation increases.

The right response

It is worth being clear about the limits of control. No organization will ever be 100% secure. There will always be unknown vulnerabilities, many of which the new frontier models will be able to fish out.

However, the idea that AI introduces risk that can be entirely “solved” is misleading. Even if advanced models identify previously unknown weaknesses, the response remains the same as it has always been: prioritize, remediate and reduce exposure over time.

For defenders, matching this increased tempo requires a combination of discipline and adaptation. Established practices such as red teaming and tabletop exercises need to evolve to incorporate AI-enabled scenarios. Incident response teams need to be prepared to handle new forms of evidence, including those generated or manipulated by AI systems.

In addition, training programs need to reflect the growing sophistication of social engineering, particularly where deepfakes and voice cloning is concerned.

AI-driven detection and response capabilities can play an important role, particularly in identifying patterns at scale. But they are not a substitute for secure-by-design principles, robust access controls, or a clear understanding of where critical data resides. Therefore, organizations should observe caution about over-rotating towards new tools without addressing foundational weaknesses.

The expansion of the attack surface through enterprise AI adoption adds another layer of complexity. Threat actors are already targeting AI workflows directly, exploiting vulnerabilities in software development environments, and using techniques such as prompt injection to manipulate system behavior.

In some cases, malicious instructions can be embedded within otherwise benign content, triggering unintended actions when processed by an AI system.

Again, these developments are best understood as extensions of familiar concepts. Input validation, supply chain risk, and data integrity have always been central to security. AI introduces new contexts in which these issues manifest, but not entirely new categories of risk.

From a governance perspective, this reinforces the need for clarity rather than novelty. Boards should be focused on defining risk tolerance, ensuring accountability, and maintaining visibility over how AI is used within the organization.

This includes integrating AI considerations into existing risk frameworks rather than treating them as a separate domain. Legal, technical, and communications teams need to be aligned, particularly in scenarios involving misinformation or synthetic media, where response speed is critical.

What matters now

There is value in the current focus on cyber risk. Increased attention at the board level can drive investment and accountability in ways that were previously difficult to achieve. But that attention needs to be directed towards the right problems. Treating AI as an entirely new threat risks misallocating resources and overlooking the vulnerabilities that are already present.

AI will continue to evolve and so will the ways in which it is used by both attackers and defenders. In cyber security, progress is often less about discovering new answers and more about applying existing ones with greeted consistency and speed.

The organizations that navigate this shift most effectively will be those that remain grounded in a clear understanding of what has and has not changed.

We've featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

The image most organizations still have of a cyberattack is fundamentally outdated.

We tend to picture hackers battering down digital walls by exploiting software vulnerabilities or launching convoluted ransomware campaigns. Yet some of the most damaging breaches today involve something far less dramatic.

An attacker enters through the front door using valid credentials, passes authentication checks, and proceeds through the environment as if they are a completely legitimate employee.

Recent attacks targeting public sector organizations in the UK have once again demonstrated just how easy it is to get into an environment if you have the right credentials.

Earlier this year, hackers managed to breach systems used by the UK Foreign Office and local councils using stolen login credentials.

As compromised credentials become increasingly easy to buy and sell on the dark web, organizations face a different sort of challenge: determining whether the person behind a successful login is actually who they claim to be.

Authentication is no longer enough

For years, organizations viewed authentication as a decisive security event. A user entered the correct password, perhaps completed a multi-factor authentication challenge, and was granted access.

The problem is that attackers have, as ever, have found a way around.

Large-scale phishing campaigns, infostealer malware, session hijacking techniques and credential harvesting operations have made legitimate account access easier to acquire than ever before. The UK's Cyber Security Breaches Survey 2025 found that phishing remains the most common cyber threat facing organizations, affecting 85% of businesses that experienced a breach or attack.

For many cybercriminals, phishing is simply the first step in a wider economy built around stolen identities. Once compromised, credentials and authentication tokens are routinely traded on dark web forums, giving attackers a ready-made route into trusted environments.

So why do we continue to treat a successful authentication as proof that a user can be permanently trusted?

In reality, authentication provides only a snapshot in time. It confirms that a user presented the correct credentials at a specific moment. It does not prove that the individual behind the keyboard remains the same person throughout their activity, nor does it account for changing risk factors once access has been granted.

The rise of continuous trust

The concept of Zero Trust isn’t a new principle, but it reflects a broader recognition that trust must be earned repeatedly, not granted indefinitely.

Continuous trust models assume that every request, transaction, and interaction carries some degree of risk. Instead of relying solely on login events, security controls continuously assess whether behavior remains consistent with an individual's expected identity and context.

For example, an employee logging in from their usual location during working hours may initially present low risk. However, if that same account suddenly begins accessing systems it has never touched before, or exhibiting behavior inconsistent with historical patterns, trust levels should automatically decrease.

The critical question is no longer "Did this user authenticate correctly?" but rather "Does this activity continue to make sense?"

Behavior tells a story that credentials cannot

One of the most promising developments in modern cybersecurity is the growing ability to analyze behavioral signals in real time.

Every user leaves behind a digital fingerprint through their actions. They access particular applications, work within predictable timeframes, interact with specific datasets, and follow recognizable workflows. Even small deviations can provide valuable indicators of potential compromise.

Machine learning and advanced analytics increasingly allow security teams to identify these anomalies at scale. The goal is not simply to detect malicious activity but to recognize when behavior no longer aligns with an established baseline.

This is particularly important because attackers who obtain legitimate credentials often attempt to blend into normal operations. They move carefully, avoid triggering conventional alerts, and exploit the fact that many security systems are designed to detect intrusion rather than impersonation.

Behavioral intelligence offers a much-needed layer of scrutiny that credentials alone cannot provide.

Importantly, this approach also helps reduce reliance on static indicators of compromise, many of which become obsolete quickly.

Why identity security sits at the heart of business resilience

Identity-related attacks are increasingly becoming the biggest threat to business continuity. Modern organizations depend on interconnected digital infrastructures spanning employees, contractors, partners, suppliers, and customers. The compromise of a single trusted identity can create a pathway into multiple systems and services.

Security strategies should focus on limiting unnecessary privileges, continuously validating access rights, reducing identity sprawl, and establishing clear visibility across the entire identity ecosystem.

Just as importantly, organizations must recognize that identity is dynamic. Employees join, leave, change roles, gain new permissions, and interact with new applications constantly. Security controls need to evolve at the same pace.

The organizations most resilient to future threats will be those that understand identity as a living system rather than a static credential database.

The future of cybersecurity starts with questioning trust

The next generation of cyberattacks will be defined by attackers blending in rather than breaking in. That shift demands a fundamental rethinking of cybersecurity from first principles.

In an environment where identities are constantly targeted, trust can no longer be binary. It cannot be granted once and forgotten. Instead, trust must become dynamic, measurable, and continuously verified.

The future belongs to organizations that recognize authentication as the start of a security conversation, not its conclusion.

We've reviewed, rated, and ranked the best antivirus.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Kimsuky used local AI tools to evade monitoring and enhance operations
• Researchers observed extensive AI-driven capability building across the group’s infrastructure
• Defenders urged behavior-based detection to spot evolving AI-enabled threats

North Korean hackers have found a way to use Generative Artificial Intelligence (GenAI) to supercharge their activities without tipping off the tool’s maintainers.

When people use AI tools like ChatGPT or Claude, their activities can be (at least to some extent) tracked and curbed - with OpenAI recently identifying and terminating multiple ChatGPT accounts used in phishing and human trafficking.

That is why Kimsuky - a known state-sponsored North Korean threat actor, used Ollama, GPT4All and Msty locally, allowing them to process documents without sending any sensitive information to outside AI services.

"Consistent process of capability development"

The attacks were spotted by security researchers Genians who “conducted months of tracking and log analysis on the infrastructure utilized as C2 in this campaign,” to identify the tools they used.

Aside from the three LLMs, they also used retrieval augmented generation (RAG) tools for document search, as well as AI agent development frameworks, text-to-speech software, and an AI-assisted coding tool called Cursor.

Using AI to write malicious code is not as simple as it sounds, due to various guardrails set up by the developers. As a result, AI in crime has been mostly limited to drafting phishing emails and crafting authentic-looking but malicious landing pages. However, Kimsuky has shown that AI in cybercrime continues to evolve and is becoming an ever-greater threat.

“What was observed in the threat actor's infrastructure was not merely evidence of several documents being created with AI, but a consistent process of capability development: establishing local LLM runtime environments, configuring RAG based on documents in the actor's possession, collecting AI agent development frameworks, and acquiring libraries for integration with external commercial AI services,” Genians concluded.

As a result, defenders must move from content-based assessment to behavior-based detection, the researchers warned, saying this should serve “as the fundamental premise of security recommendations.”

“In addition to indicator of compromise (IoC)-based detection, organizations should contextually correlate the sequence of anomalous activities following LNK execution, including PowerShell execution, persistence establishment, and external communications, to assess the overall threat level.”

• Attackers cloned AI skills, later adding malicious code to steal credentials
• Zenity Labs found millions of installs and dozens of dangerous skill variants
• Vercel and Microsoft removed malicious skills, but manual removal is still required

AI skills, instructions that teach AI agents how to do certain tasks and thus extend their capabilities, are increasingly being used in supply chain attacks, researchers have found.

Security experts at Zenity Labs uncovered a credential-stealing campaign on skills.sh, a public registry (essentially an app store) for AI agent skills. In the registry, belonging to Vercel (a cloud platform for web applications), threat actors were cloning existing skills, creating typosquatted lookalikes which, at first, did nothing malicious.

However, after a little time had past, and the skills amassed a solid download count, the attackers introduced malicious code instructing the AI agents to, among other things, exfiltrate SSH keys, cloud credentials, Git and package manager tokens, Kubernetes and Docker configurations, database credentials, infrastructure-as-code credentials, environment files and service account files. The agents were then told to package the stolen information with host metadata and send it to the attackers.

Dozens of malicious skills

While Zenity Labs could not say exactly how many people fell victim to this attack, they did stress that a single skill family amassed more than 1.7 million aggregate installs (not unique users).

And that is just one skill family, in a sea of malicious skills. The researchers also said they found “dozens” of additional skills exhibiting either malicious or dangerous behavior. Almost a third (30%) of identified dangerous skills abused Claude Code and OpenClaw to drop malware to their targets, as well. Also, Zenity found “hundreds” of reserved and empty package names that were being kept for future attacks.

These findings show how quickly cybercriminals adapt, and how creative they can get when it comes to abusing new tech. In essence, this campaign is an AI spin on a software supply-chain attack, being similar in spirit to incidents where attackers compromise an existing trusted package or repository, and later push a malicious update.

Following responsible disclosure, Vercel and Microsoft removed the identified skills, but Zenity warns that those who installed them before won’t be safe until they remove them from their systems manually.

• Fortinet experts found malicious code in QuickFox VPN's Windows installer
• The attack actively avoided personal gaming computers
• QuickFox has since removed the malicious components from version 3.59.6

Cybersecurity researchers have uncovered a severe supply chain attack targeting QuickFox, a popular Chinese Windows VPN application.

According to a new report from Fortinet’s FortiGuard Labs, attackers trojanized the software's installers for over a year to quietly deploy malicious backdoor implants onto users' machines.

As Fortinet's experts explain, QuickFox "is a VPN proxy and game accelerator typically employed by Chinese users to speed up access to Chinese-based resources, often to improve video game user experience."

However, experts found that malicious actors altered the application's underlying code to deliver a highly targeted malware campaign. The threat actors modified an HTML file within the app's installer to automatically download and execute malicious JavaScript.

To avoid raising suspicion, this malicious code was pulled from a fake domain intentionally registered to mimic QuickFox’s legitimate infrastructure. Fortinet notes that the campaign had been active since at least August 2025, with QuickFox removing the malicious code with version 3.59.6.

TechRadar has not independently verified Fortinet's findings, but we have reached out to QuickFox for comment and will update this article if we receive a reply.

A highly targeted backdoor

The malware didn't infect everyone who downloaded the compromised VPN software. Instead, it used clever guardrails to filter out standard consumers.

If the malicious script detected Steam — the popular distribution service for online games — running on the victim's device, it immediately stopped the infection process to avoid personal gaming computers.

However, if it found tools used by developers, IT administrators, or cryptocurrency users, such as Visual Studio Code, Telegram, or various cryptocurrency wallets, it proceeded with the attack. This behavior suggests the hackers were explicitly hunting for high-value corporate environments and professionals rather than casual gamers.

When a target was deemed suitable, the script abused a legitimate Microsoft utility to secretly install the FDMTP implant and inject the malware. This persistent backdoor allowed attackers to collect sensitive system information, including IP addresses, active processes, MAC addresses, and usernames.

Because FDMTP is highly modular, it also enabled the hackers to remotely download and execute additional malicious plugins, granting them long-term access to compromised machines.

While macOS builds contained the modified file, the infection process only executed on Windows endpoints. Android and iOS apps were completely unaffected.

How to stay safe

While Fortinet researchers have not confidently attributed the attack to a specific group, they noted significant technical crossovers with Twill Typhoon, a known threat actor.

The good news is that the threat now appears to be contained. According to the cybersecurity firm, "QuickFox has removed the described malicious components from their Windows installer from v3.59.6," following responsible disclosure.

If you have used QuickFox on a Windows machine over the last year, you should immediately update to the latest version directly from the vendor and run a full antivirus scan on your system.

Organizations are also advised to check their networks for any unusual activity or unrecognized file transfers originating from QuickFox installations.

• Google’s automated systems mistakenly flagged hundreds of Blogger sites as malicious
• Company admitted a bug caused false malware labels, promising a fix
• Users advised to request reviews, avoid migrating content

Hundreds of Blogger websites were locked down, and some apparently deleted as well, after Google’s automated security systems erroneously flagged them as malicious.

A user posted a new message on Google’s forum saying the huge number of reports regarding locked blogs are all for the same reason - Malware and Similar Malicious Content.

The nature of the lockdown “suggests misclassification by automated systems”, the post reads, adding that the team has “already been notified of this issue.”

Aware of a bug""

Those affected will see a red padlock in their dashboard and a warning saying the blog was locked:

"This blog was removed for violating Blogger's Community Guidelines. If you wish to request a review of the blog, click 'Request Review' below," the notice reads.

At press time, the forum post had more than 500 “I have the same question” votes, and more than 200 replies.

In a statement given to BleepingComputer, Google said it was aware of a bug that falsely labeled many sites as malicious, and that it was working on a fix.

"We are aware of a bug that incorrectly flagged some Blogger-hosted sites as malware for less than a day. We are working on a fix to resolve the issue as quickly as possible," the company said.

To make matters even worse, Google said that if users don’t file an appeal, that their blogs can be permanently deleted.

Users are advised not to create new blogs and migrate content, since that is in violation with Google’s TOS. They are also advised against deleting their Blogger profile or service from their Google account, since this will irrevocably delete the blogs. They can, however, back up their blogs if they are afraid of losing the content.

The full extent of the issue is unknown, but according to BleepingComputer, the number of users on the platform exceeds 200,000.

Open-source malware has changed shape.

What once focused on noisy cryptomining has moved toward something far more valuable: access.

Our recent data shows attackers are increasingly targeting credentials and secrets embedded in software dependencies, with UK organizations firmly in scope.

This shift marks a move away from opportunistic abuse toward deliberate supply-chain compromise. Instead of draining compute cycles, attackers are positioning themselves inside build pipelines and developer workflows.

The goal is persistence, not disruption.

For organizations that rely heavily on open source software, this fundamentally changes both the threat model and the potential impact.

This is what “shift left” actually means in 2026: controlling what enters the build, not just detecting what runs in production.

Why credential theft has overtaken cryptomining

More than half of malicious open-source packages now focus on stealing credentials and secrets, overtaking cryptomining as the dominant threat type. The reason is straightforward. Credentials offer lasting value. They provide persistent access, broader reach across environments, and a lower risk of detection than resource abuse. A stolen token or API key can unlock entire systems, not just a single machine.

Cryptomining, by contrast, is easy to spot and quick to shut down. It consumes resources and triggers alerts. Credential theft blends in and can be executed in seconds. It exploits the trust placed on developer workflows to operate in a safe environment.

For attackers looking to maximize return while minimizing exposure, this approach maximizes returns whilst doing away with the risk of being discovered.

The implication is clear: protecting runtime infrastructure is no longer enough. The security boundary now starts at dependency intake and at the developer environment.

Multi-stage malware becomes the norm

Modern open-source malware is rarely single-purpose. Our analysis shows dropper and loader behavior increasing by nearly 2,900 percent year over year in Q1 2025, signaling a shift toward engineered, multi-stage attacks.

Around 77 percent of malicious packages distributed through open source ecosystems now combine multiple threat types. Droppers appear in nearly all observed cases, while secret exfiltration features in close to two-thirds.

These packages are designed to evolve after installation, pulling in additional payloads or changing behavior over time. This reflects industrialized campaigns rather than opportunistic experimentation. Attackers are investing in resilience, stealth, and scale.

For defenders, this means signature-based thinking is outdated. If malware is modular and adaptive, controls must focus on provenance, behavior, and prevention before execution. Again, this is what “shift left” actually means: securing the build graph itself, not just the workloads it produces.

Supply chains under direct pressure

The widespread use of open source, particularly within the JavaScript ecosystem, creates systemic exposure. Modern applications routinely depend on hundreds of direct and transitive npm packages. That density of reuse creates efficiency, but also amplifies upstream risk.

Recent activity linked to the Lazarus group illustrates the threat. More than 200 malicious packages were identified, almost all concentrated in npm. When a single ecosystem underpins financial services platforms, government services, and critical national infrastructure, concentration risk becomes a strategic issue.

A compromised dependency does not stay isolated. It propagates through shared frameworks, internal libraries, and CI pipelines. In sectors built on speed and reuse, upstream compromise quickly becomes downstream impact. This is why dependency governance is no longer just a developer hygiene issue; it is a board-level supply-chain concern.

Automation turns one package into thousands of compromises

Today’s malware increasingly targets CI/CD pipelines and developer workflows optimized for automation. When a compromised dependency enters a build, it can quietly extract API keys, certificates, and access tokens without triggering runtime alerts. Automation does the rest.

What starts as a single poisoned package can spread across hundreds or thousands of builds. The very systems designed to accelerate delivery now accelerate compromise.

The practical takeaway is uncomfortable but necessary: if build systems are automated, security controls must be automated at the same level. Manual review cannot scale against automated distribution.

AI coding assistants and the hallucination problem

AI-assisted development introduces an additional layer of risk. Studies and testing have shown that large language models can, in a meaningful percentage of cases, suggest packages or functions that do not exist. Developers under time pressure may attempt to install or rely on these hallucinated dependencies, unknowingly expanding the attack surface.

Hallucinated package names, fabricated examples, and unsafe dependency suggestions can quietly undermine supply-chain integrity. Attackers are already exploiting naming conventions and trust models to seed packages that appear legitimate to both humans and machines.

Each hallucination creates rework, friction, and lost productivity. Much of this waste could be reduced if AI systems were grounded in authoritative, real-time package intelligence rather than pattern prediction alone.

Our recent research reinforces this point. The company found that smaller AI models augmented with live package intelligence significantly outperformed larger standalone models when handling dependency upgrades and package selection tasks. The findings suggest that real-time ecosystem context matters more than model size alone when developers are making security-sensitive decisions. It also helps smaller models are 70x cheaper compared to frontier models.

This has direct implications for software supply-chain defense. If AI coding assistants recommend dependencies without verifying package provenance, maintenance status, or ecosystem trust signals, they risk accelerating the spread of malicious or hallucinated packages into production environments.

In practice, secure AI-assisted development will depend less on increasingly large models and more on whether those models are connected to authoritative, continuously updated software intelligence.

Here too, the lesson is upstream control. Guardrails must sit at the point of dependency selection, not after the code ships.

Why defenders are falling behind

Many UK security controls remain focused on detecting threats after code is deployed. Attackers have moved upstream. They target the build process, the dependency graph, and the trust relationships developers rely on.

This mismatch leaves organizations well prepared for runtime incidents but exposed during development. As long as defenders assume malware announces itself loudly, supply-chain compromise will continue to slip through unnoticed.

“Shift left” is often treated as a slogan. In practice, it means enforcing policy before installation, validating provenance before execution, and blocking malicious packages before they enter the graph.

Stealing the keys, not the cycles

Open-source malware has evolved from stealing compute to stealing access. Credentials unlock ecosystems, not just machines. For UK organisations, this makes supply-chain security a strategic concern rather than a technical afterthought.

Preventing malicious code from entering the build is now more effective than responding after deployment. The quiet shift from coins to credentials has already happened. The question is whether defenses will adapt quickly enough to match it.

If it isn’t automated, it won’t scale.

What organizations should prioritize now

To respond effectively, UK organisations should focus on a small number of structural controls:

● Gate dependency intake with automated policy enforcement before packages enter CI/CD.

● Continuously monitor for secret exposure within build environments and revoke compromised credentials rapidly.

● Enforce provenance and integrity verification for open-source components, including transitive dependencies.

● Ground AI coding tools in authoritative package intelligence to prevent hallucinated or malicious dependency suggestions.

None of these measures eliminate risk. But together, they realign defenses with where attackers are actually operating: upstream, automated, and inside the supply chain.

We've ranked and reviewed the best antivirus software available.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Aikido researchers uncovers ChainDrop, a Shai‑Hulud variant infecting 1,300+ npm packages with an infostealer
• Attackers compromised GitHub accounts tied to popular libraries (Keyv, Cacheable, flat‑cache, file‑entry‑cache) and pushed tainted releases with 2B monthly downloads
• Malware exfiltrates developer/cloud credentials and secrets to a public GitHub repo; admins should treat affected systems as compromised even after removal

Another Shai-Hulud variant has been discovered in the wild, infecting more than 1,300 npm packages with an infostealer.

Security researchers Aikido reported finding “at least 868 packages (across 1381 versions) that have been compromised by the worm.”

Shai-Hulud is a self-propagating supply chain malware that targets software developers by compromising open-source packages and CI/CD pipelines. It steals credentials, API keys, and access tokens and then uses those stolen secrets to publish additional malicious packages.

What to do in case of an infection

In May 2026, actors claiming to be associated with the TeamPCP group publicly released the Shai-Hulud worm's source code, saying they were “open sourcing the carnage” and inviting other threat actors to adopt and modify the code. Since then, there were multiple copycat campaigns and variants, including this one which Aikido dubbed ‘ChainDrop’.

Aikido said the attackers compromised the GitHub account of the person maintaining Keyv and Cacheable, widely used open source JavaScript libraries for caching data in Node.js applications. From there, they were able to move into other popular utilities such as flat-cache and file-entry-cache, as well as packages associated with organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.

The malware was pushed directly into the projects’ main branches, and then generated additional package releases. The compromised packages have a combined 2 billion monthly downloads.

Aikido says the infostealer grabs developer and cloud credentials, encrypts them, and then sends them to a public GitHub repository called “Shai-Hulud: Here We Go Again.”

It also steals local configuration files, GitHub PATs, workflow tokens, and other ghp_, gho_, and ghs_ tokens, certain npm tokens, GitHub Actions secrets, AWS credentials, Kubernetes secrets, and more.

The researchers are saying system admins who installed a tainted package should treat their developer workstation or CI/CD runner as compromised, even if they removed the package.

• Bitdefender reported Roblox players lured by a fake “undetected” Xeno Executor mod spreading malware
• Infection chain delivers a Java‑based RAT and infostealer stealing browser data, online accounts, payment info, and crypto wallets
• Malware also enables surveillance and remote control; campaign peaked in March 2026 and remains active against Roblox’s 82M players

Cybercriminals are targeting Roblox players with an infostealer and a Remote Access Trojan (RAT) malware that grants them full control over compromised computers, experts have warned.

Roblox is an online gaming platform, virtual universe, and game creation system where users play millions of games and user-generated mods. Among the mods is Xeno Executor, a utility that allows players to run scripts that automate certain actions or run custom code. Some players use Xeno Executor to run cheats, too.

Since it’s an unofficial script, Roblox does not allow it and blocks it whenever a new version is released. Now, security researchers Bitdefender have reported finding an “undetected” version being promoted on various gaming forums, Discord communities, and similar.

CornFlake and CocoShell

This version is advertised as “invisible” to Roblox’s anti-cheat systems, but in reality, all it does is trigger an infection chain that ends in a Java-based RAT and information stealer.

The malware grabs browser data such as passwords and cookies from some of the most popular browsers (Chrome, Edge, Brave, Opera, Vivaldi), as well as online accounts and payment data (Discord, Roblox, Minecraft, Microsoft Store tokens, and more).

It also steals cryptocurrency wallet data, particularly targeting the Exodus Wallet.

As for surveillance, it can log keys, track mouse movements, grab screenshots, stream whatever is on the desktop, and access the webcam. The crooks are also granted file upload and download, PowerShell command execution, and more.

The campaign was kicked off at the start of the year, reaching its peak in March, it was said. It has now stabilized and is still going relatively strong.

We don’t know exactly how many players fell victim to this campaign, but Roblox is an incredibly popular platform, so it is possible the campaign was rather successful, too.

According to Activeplayer, Roblox currently has more than 82 million active players.

• Palo Alto Networks’ Unit 42 detailed three Google passkey exploits
• Attacks require prior malware infection; methods ranged from impersonating victims to stealing the master secret protecting synced passkeys
• Google implemented fixes after disclosure, with some services (e.g., eBay) patching vulnerabilities directly

Security researchers from Palo Alto Networks’ Unit 42 have found three ways to exploit Google’s passkey system and log into people’s PIN- or biometrics-protected accounts.

They named these ways ‘Pass-ta-key’, ‘Silver Pass-ta-key’, and ‘Golden Pass-ta-key’, each being progressively more dangerous than the previous one.

While it sounds mighty dangerous, there are major caveats to the exploit, and some of the holes have been plugged already.

Trusting the wrong device

The biggest caveat is that the victim’s device needs to be infected with malware beforehand. Malware can do all sorts of things, from stealing session cookies to exfiltrating sensitive data, so if a device is tainted with malware, it’s already in trouble.

Still, Unit 42’s findings were important enough to warrant a fix from Google.

In the first technique, the attackers pretend to be the victim. By using malware, they can “ask” Google to log into a passkey-protected account as if it was the victim themselves. Usually, the service being logged into would require a PIN or a fingerprint to confirm the authenticity of the request, but in this scenario, that wasn’t the case.

The method doesn’t work everywhere, though. Unit 42 could not replicate the attack on GitHub, but they succeeded on eBay. The latter later fixed the problem.

In the second attack, Unit 42 managed to make Google “trust” the threat actor’s device, meaning the victim’s computer was no longer necessary.

In the third attack, the researchers managed to steal the “master key”.

Google Password Manager syncs the passkeys between devices, and to do that, it uses a master secret that protects all of the synced passkeys. The researchers found that, under certain circumstances, malware can grab this master secret while Chrome is temporarily using it, unlocking all of the synced passkeys, copying them to another computer, and being able to use them at a later date.

The researchers disclosed their findings with Google before publication, and some fixes were already implemented. Google is yet to comment on the findings and confirm that all of the flaws were addressed.

Via BleepingComputer

Criminals used to rely on lock-picking tools and crowbars to break into buildings. Today’s attackers can cause just as much damage and disruption by using phishing links, malware and sophisticated digital exploits to target products, systems and networks.

The truth is, today’s security challenge isn’t just physical – or cyber – but both. And keeping one step ahead of criminals is a full-time occupation. For those people tasked with researching and developing the latest products, it sometimes means using unconventional tactics, such as using professional lock pickers to test the security and resilience of new products.

While modern locks are still based on mechanical engineering, they are more advanced than they look. Improvements in design, materials, and manufacturing mean they are stronger, more reliable, and harder to tamper with. But there’s more to locks than just security.

Some systems can even use the motion of turning a key to generate a small amount of electrical energy, which provides energy to power extra functions without wiring or batteries. This means they are not just standalone locks but can also be used as part of wider digital access systems.

Used extensively in buildings such as offices, hotels, hospitals and other critical infrastructure, these modern digital access solutions can also connect to cloud-based platforms to manage who can enter buildings and restricted areas.

Bridging physical and digital security

However, digital systems have their own security risks, which means security teams need to anticipate and defend against a wide range of risks – from attempts to breach access platforms to phishing attacks – as well as other tactics designed to exploit human behavior.

This explains why some security personnel have to adopt a ‘hacker’s mindset’ to keep systems safe. And that means continuously testing, probing, and strengthening systems to identify vulnerabilities.

But what is becoming increasingly clear is that physical and digital security systems can no longer be treated as separate entities.

Many security solutions today employ both mechanical and digital technology, which means that resilience – the kind of resilience that keeps data centers safe, for example – depends on understanding how risks move across systems, people and environments.

Embedding resilience into design

That means continuously designing and testing products against existing real-world threats while also anticipating what might be around the corner. That includes building security into every stage of development, especially as technology evolves.

For instance, great strides have been made recently in terms of biometric authentication, including facial recognition and fingerprint scanning. Similarly, smartphones are increasingly being used to secure credentials for mobile-based access control systems.

Work is also currently underway to use artificial intelligence (AI) to analyze data in real time to identify unusual entry times, identify multiple failed authentication attempts, or spot any other anomalies that might suggest someone is trying to gain entry illegally.

Using AI tools in a positive way is important because it is also the source of some of the newest and, therefore, most unpredictable challenges. For example, there are now autonomous AI threat chains that can discover and exploit vulnerabilities unilaterally, moving from reconnaissance to exfiltration in record time without any need for human oversight.

The danger posed by cyber criminals has also become more complex due to the growing interconnectivity of digital products and services. In many ways, a world where all hardware and software are interconnected is an efficient and convenient one.

But it is also one where, if bad actors gain access to a single element, they may be able to compromise the whole network.

The importance of regulation and compliance

This is something that the European Union (EU) is actively addressing. For instance, the European Union’s (EU) NIS2 Directive relates to cybersecurity protecting network and information systems and significantly broadens both the scope and the obligations for compliance.

It also takes an “all-hazard” approach to security, which means protecting not just digital networks and systems, but also the physical environments in which they operate.

Similarly, the EU’s Cyber Resilience Act is designed to ensure that all digital products are safe from cyber threats.

Its goal is to ensure that connected devices and software are built, updated, and maintained with security in mind, helping protect users in an increasingly connected world.

And by introducing clearer requirements and standards, the CRA will help consumers and organizations identify products with strong security features and configure them more securely from the outset.

In both cases, not only is it incumbent on vendors to meet or exceed these rules and regulations, but also to keep customers, the wider industry, and other stakeholders informed about developments.

Not only must businesses contend with the usual challenges from phishing and malware, but the rapid growth of AI has introduced a new and unpredictable dimension to keeping out online criminals. Security – both physical and cyber – has never been more critical than it is today.

We've featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Researchers show Gatekeeper can be bypassed by replacing a previously run legitimate macOS app with malware
• Attack requires prior user‑level code execution, then swaps in a malicious app that Gatekeeper won’t re‑verify
• Apple dismissed the issue, saying locally rebuilt bundles fall outside Gatekeeper’s scope, leaving risk to social engineering

A pair of researchers claims to have found a way around Gatekeeper, a built-in macOS security feature that helps protect users from running malicious or untrusted software. However Apple doesn’t really see it that way and has seemingly decided not to pursue the issue further.

Gatekeeper’s modus operandi is rather simple - when a user downloads an app from outside the App Store, it verifies the product comes from an identified developer and is notarized by Apple. If it can’t verify it - it won’t allow it to run on the machine.

Now, security researchers Talal Haj Barky and Tommy Mysk claim that, as long as a legitimate app was run at least once on a macOS device, it can be replaced with a malicious version, and Gatekeeper won’t even blink its virtual eye.

Locally built

That also means the attack is not that straightforward to pull off. The threat actor needs to have a way to execute user-level code (for example, a malicious app, a compromised software package installed through a package manager, or a prompt injection attack that tricks an AI agent).

Once that is obtained, they can archive a legitimate app, remove the original, then replace it with malware, and Gatekeeper will not try to re-authorize it. That malicious version can then trick the victim into compromising the device even further, since a certain level of trust was already established.

After reporting the issue to Apple, the company apparently just closed it.

"Apple doesn't consider this attack to be 'modifying' the signed executable," Mysk said. "Instead, Apple says that by archiving/restoring the app bundle, the proof-of-concept code overwrites the entire app bundle, making it locally built. Locally built app bundles are not covered by macOS guards. And this is why access to Keychain or TCC protected directories require system authorization prompts. And for users to accept those is a matter of social engineering attacks that Apple considers out of scope."

Via The Register

• Recorded Future found an Iran-linked group spreading spyware
• The malware is delivered through fake VPN and media player apps
• Researchers assess that most targets are Iranian users

A new report from Recorded Future's Insikt Group describes a campaign that inverts the whole point of a privacy tool: fake VPN apps built specifically to spy on the people who install them.

Researchers have linked fresh infrastructure to an Iran-nexus threat cluster they track as TAG-182, which is using fake VPN and media player downloads to allegedly deliver a surveillance tool called MarkiRAT. The group is "highly likely" to be targeting Iranians living inside and outside the country, the report says.

It's a blunt reminder that choosing one of the best VPN services is a lot more secure than downloading free, unvetted tools.

Fake apps, real surveillance

Insikt Group identified a cluster of attacker-controlled domains allegedly used to stage downloads of applications that appear nowhere on Google Play or Apple's App Store.

Two names stand out: Pis2ray VPN and a media player branded YESHICA, which was quietly renamed YESHICA YEPlayer in March 2026 after researchers publicly exposed the original.

According to researchers, if you download and run one of these files, you get MarkiRAT, a remote access Trojan. In plain terms, that is software that hands control of your device to somebody else.

Analysts have documented it capturing screenshots and uploading them to attacker-run servers, while disguising itself under believable process names.

It also abuses BITS, the background service Windows uses to fetch updates, to pull down further files. Because that activity looks like ordinary system housekeeping rather than an attack, it tends to slip past routine cleanup.

MarkiRAT is not new. It has previously been used by Ferocious Kitten, a group Kaspersky documented conducting years of covert surveillance against activists inside Iran.

Recorded Future stops short of attributing TAG-182 to any specific Iranian agency, but places it within a broader ecosystem of state-aligned surveillance groups.

Why a fake VPN makes such an effective lure

Distribution runs largely through social media. Insikt Group found Instagram posts promoting Pis2ray VPN in the weeks following street protests in Iran in late 2025, and again around the country's prolonged internet shutdown, which ended with partial restoration of access on 26 May 2026.

The people most desperate for a virtual private network (VPN) in a censored country are exactly the people most likely to install one from a social media link, because the official stores are often the very thing they cannot reach.

Recorded Future considers it almost certain that most targets are located in Iran or tied to anti-government movements in Europe and North America. TechRadar has covered previous Iran-linked fake VPN campaigns, and this one seems to follow the same pattern with better infrastructure.

How to stay safe

Most readers will never be targeted by a state actor, but the underlying lesson travels.

Install VPN apps only from official stores, and check that the provider has a real, verifiable presence outside the app listing.

Treat any VPN promoted through an Instagram post, a Telegram channel, or a direct message as suspect, however polished it looks.

Star ratings are a weak signal, since fake reviews are cheap.

Data leaks and corporate breaches have become routine. In many cases, stolen credentials, databases, or attack tools eventually appear on the dark web, where they are traded and reused in future attacks.

This raises a question for businesses: if stolen corporate data ends up on the dark web, does it make sense to engage with this environment directly — by buying information, paying for services, or negotiating with attackers?

The short answer is no.

Not because the dark web doesn’t matter — quite the opposite: it is a core part of today’s cybercriminal infrastructure. The problem is that doing business with the dark web rarely reduces the immediate risks and systematically strengthens the very market that creates threats.

The nature of the dark web

The dark web — often used interchangeably with the term darknet — refers to parts of the internet intentionally hidden from search engines and accessible only through tools such as Tor or I2P.

It is not a single network but a collection of platforms and communities gated by encryption, nonstandard protocols, or restricted access. While some resources are relatively neutral, others are directly tied to criminal activity. From a cybersecurity perspective, the dark web matters primarily as a mature cybercrime marketplace.

Technically, many platforms resemble early internet forums. Functionally, however, they operate much like B2B marketplaces — except the products include stolen data, compromised accounts, malware, exploit kits, and attack services.

The economics of cybercrime

A key function of the dark web is simplifying the monetization of cybercrime. More importantly, it enables specialization and the formation of complex supply chains.

Instead of building operations end-to-end, cybercriminals now focus on specific roles: some identify vulnerabilities and gain initial access, others develop and distribute malware, while others specialize in monetization through data sales, extortion, or attacks-for-hire.

This division of labor has created a full-fledged cybercrime economy. Attackers no longer need advanced expertise or their own infrastructure — they can purchase the necessary tools and services, lowering the barrier to entry and increasing the scale of attacks.

A clear example is the Ransomware-as-a-Service (RaaS) model, where core groups develop malware and manage negotiations, while affiliates carry out attacks for a share of the ransom. This model has enabled large-scale incidents such as the 2021 Colonial Pipeline attack, which disrupted fuel supplies across the U.S. East Coast and resulted in a $4.4 million payment.

Dark web intelligence and false signals

As the dark web evolved into a cybercrime marketplace, businesses naturally became interested in monitoring it for early warning signals.

In practice, this approach works only partially. The problem with dark web intelligence is that it comes from an environment with virtually no reliable verification mechanisms.

Like any anonymous and unregulated market, the dark web contains a significant amount of noise, manipulation, and outright fraud. Listings may be outdated, fabricated, or recycled from old leaks, while reputation signals can be artificially inflated.

The problem becomes even more pronounced when monitoring is outsourced to third-party vendors. Weak or unverifiable signals can easily be exaggerated, misinterpreted, or presented as evidence of major threats.

As a result, dark web monitoring rarely provides the level of certainty businesses expect. At best, it can highlight a potential issue that still requires verification.

Never pay cybercriminals

Direct engagement with the dark web is even more problematic — whether through ransom payments, purchasing leaked data, or hiring anonymous actors to test infrastructure.

The most obvious issue is that paying cybercriminals offers no guarantees. Attackers may simply demand another payment or leak the data anyway.

Uber learned this in 2016 after paying attackers $100,000 following a breach affecting 57 million users, only for the incident to become public later and trigger regulatory fallout.

A similar pattern appeared in the 2017 breach of HBO, when attackers stole 1.5 TB of Game of Thrones-related data, including unreleased episodes and internal documents. HBO reportedly transferred $250,000, but the material leaked anyway.

The broader problem, however, is structural: every payment flowing into the dark web economy directly finances its further growth. The more businesses participate in that market, the stronger the incentives for attackers to discover vulnerabilities, compromise systems, and scale operations.

Common mistakes when dealing with the dark web

When dealing with the dark web, organizations tend to repeat the same mistakes regardless of industry or size.

Trying to pay their way out of the problem. Companies often approach ransomware or leaks as negotiation problems. In reality, paying a ransom guarantees neither recovery nor safety. According to a 2021 study by Cybereason, 80% of organizations that paid ransoms were attacked again, often by the same groups.

Treating dark web monitoring as insurance. Monitoring services are often marketed as proactive protection. In reality, if company data appears for sale on the dark web, the compromise has already happened. Monitoring can provide signals, but it cannot replace actual security controls.

Hiring dark web hackers to test infrastructure. Unlike legitimate penetration testing, anonymous dark web “audits” offer no accountability, verification, or compliance guarantees. Even worse, the hired hacker may establish unauthorized access and later resell it.

Panicking after seeing the company name on the dark web. Many leaks and listings are outdated, recycled, or entirely fabricated. Without proper verification, rushed decisions can worsen the situation.

Delegating the entire issue to “dark web specialists.” Many companies delegate dark web monitoring to external vendors without the ability to independently assess the quality of the results. This creates a dangerous information asymmetry and increases dependence on unverifiable claims.

What businesses should do instead

Dark web intelligence can be useful as one additional source of signals, but it requires cautious interpretation and independent validation. Treating it as a reliable source of truth — or outsourcing the entire function without oversight — is risky.

More importantly, businesses should avoid directly financing criminal ecosystems through payments or participation in underground markets.

Cyber resilience is built internally. Rather than attempting to “buy security” on the dark web, organizations should invest in systematic defense: resilient architecture, vulnerability management, monitoring, incident response, and technologies capable of mitigating attacks while maintaining continuity of critical services.

We've featured the best secure file sharing.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Across the UK, cybersecurity incidents have become a familiar feature of the business landscape.

Disruptions affecting manufacturing and logistics over the past year have underlined how exposed organizations can be when physical operations are connected and digitalized.

Despite this growing awareness, boardroom conversations on cyber risk still tend to center on corporate IT and not operational technology (OT).

That focus leaves a significant gap. Operational technology, the systems that run factories, manage supply chains and underpin essential services, is now a primary target for attackers. When these environments are compromised, the consequences extend far beyond lost data, affecting safety, revenue and in some cases an organization's ability to operate at all.

For many boards, this is less a question of indifference and more one of framing. Cyber risk is still commonly understood through an IT lens, shaped by experiences with data breaches or malware attacks that take down websites or enterprise IT systems. Operational disruption behaves differently in both scale and impact, and it demands a different level of governance attention.

Why OT risk is routinely underestimated

Much of today’s operational infrastructure was designed long before connectivity and remote access became standard. These systems were engineered for reliability and safety, not for defense against hostile actors. As they have become more connected and digitalized, exposure has increased without always being matched by equivalent security practices.

The result is that many of the most serious business risks now sit within operational environments that boards rarely examine in detail. This creates a structural blind spot. While IT incidents are often measured in hours or days, failures in OT environments can take longer to mitigate while halting production, disrupting critical services and generating losses that compound rapidly over time.

Boards tend to engage more effectively when risk is grounded in tangible business terms. Understanding what a facility produces in a day, or what a week-long shutdown would mean for customers and partners, brings operational risk into sharper focus. Without that context, OT security can remain abstract and under-prioritized.

When cyber incidents stop operations

Recent incidents have shown how quickly cybersecurity events can escalate into operational crises. Last year, a leading British automotive brand publicly confirmed a cyber incident that led to a precautionary shutdown of systems. Manufacturing and retail operations were halted for weeks and disruptions rippled through suppliers, logistics partners and dealerships

Similar lessons can be drawn from cyber incidents affecting the UK’s water sector, where attackers targeted environments connected to the operational systems that control treatment and distribution. Beginning in 2024, multiple incidents reached systems close enough to operational control to raise concerns about safe operation.

Taken together, these examples point to board-level issues beyond preventing down time or service outages. They are also about maintaining operational continuity, understanding how quickly localized disruptions can cascade across an organization, and factoring in safety concerns and reputational risk.

A risk landscape shaped by geopolitics

Operational technology risk is increasingly shaped by global forces. Geopolitical tension, trade restrictions and supply chain uncertainty now influence how organizations plan and prioritize security investment.

At the same time, governments are raising expectations around resilience and incident reporting, particularly in sectors linked to national infrastructure. Boards are therefore required to consider regulatory and geopolitical pressures alongside technical risk, adding another layer of complexity to cyber governance.

Bringing direction and discipline to governance

Stronger oversight depends on education and structure. Boards should expect cyber leaders to explain operational risk in clear business terms and to reference recognized best practice. Focusing on a prioritized and manageable set of critical controls that deliver the greatest risk reduction provides a practical foundation without overwhelming the organization.

Governance cadence is just as important as control selection. Regular, structured engagement with senior management create space to track how security investment supports operational resilience and wider business outcomes. Treating cyber risk as a standing governance issue, rather than an occasional update, reinforces accountability and sustained attention.

Clear prioritization models can further support decision-making. Categorizing actions into those that must happen now, those that can follow next and those that should not be pursued helps align technical, operational and financial perspectives. A shared language of priority reduces ambiguity and supports more consistent execution across sites.

A leadership obligation

Operational technology security can no longer be treated as a technical niche. It has become a leadership responsibility shaped by operational dependence, external pressure and increasingly capable adversaries. Boards that recognize this shift are better positioned to protect continuity, revenue and trust.

Looking ahead, resilient organizations will be led by teams that engage directly with the realities of their industrial environments. Asking sharper questions, demanding clearer insight and ensuring governance structures keep pace with operational risk remain among the most effective safeguards leaders can provide.

We've ranked and reviewed the best antivirus software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Group‑IB discovers HollowGraph malware targeting Israeli entities, exfiltrating files via Microsoft Graph API
• Operators hide instructions in future calendar entries, then attach encrypted stolen data to events
• At least 12 systems were compromised; overlaps with Lyceum noted but attribution remains low‑confidence

Cybercriminals have found a way to communicate with the malware installed on victim devices through compromised Microsoft Calendar apps, experts have warned.

Security researchers at Group-IB have detailed a newly discovered piece of malware called HollowGraph designed to exfiltrate sensitive files from compromised devices.

What makes the malware stand out is the way it communicates with its operators. The best way to spot hidden malware is to monitor the traffic flowing in and out of a device, which is why cybercriminals try their best to hide this traffic, or blend it with another, legitimate one. In that respect, HollowGraph is unique because it abuses Microsoft Graph API and a compromised Microsoft 365 mailbox calendar.

A dozen victims

After landing on a device and compromising the Microsoft 365 account, HollowGraph uses that account’s permissions to access Microsoft Graph. Operators create calendar entries containing instructions and place them far into the future (in the year 2050) to avoid being spotted. After acting on the instructions and harvesting valuable information, the malware exfiltrates it through the same channel.

Instead of uploading files to a suspicious server, HollowGraph attaches encrypted stolen data to calendar events and sends it through Microsoft Graph. For defenders, all of this traffic seems legitimate and usually flies under their radars.

So far, all of the victims are Israeli entities, Group-IB said. The researchers identified at least 12 compromised systems, three of which were still actively communicating with the attackers’ infrastructure during the investigation.

The researchers did not attribute the attack to any known threat actor, but hinted at a potential. They identified technical similarities in command structures and plugin mechanisms between HollowGraph’s framework, Cavern, and a .NET backdoor used by Lyceum (an Iranian-nexus threat actor associated with OilRig). However, Group-IB explicitly emphasizes that these overlaps are not distinct enough, so they assess this link with low confidence.

• Group‑IB uncovers ClickLock, a new macOS‑focused infostealer using aggressive social engineering by spamming password prompts and terminating key apps every 210ms until victims comply
• Once credentials are obtained, it exfiltrates browser data, crypto wallets, password manager entries, FTP configs, and device info via Telegram Bot API
• Active since May 2026, spotted in 33 countries (mostly Europe), distributed via ClickFix campaigns, and initially undetected by security vendors until recently

Security researchers from Group-IB have uncovered a new infostealer targeting primarily macOS users in Europe.

Dubbed ClickLock, it is more of an annoying social engineering mechanism rather than a full-blown malware variant, constantly popping up a login prompt on the victim’s device, until they finally comply and share the credentials.

Every 210 milliseconds it terminates key apps on the device (Finder, Dock, TErminal, etc.), essentially making it useless. At the same time, it keeps prompting a password dialog on the screen, making sure the victim can do nothing but provide the credentials.

Targeting Europeans

The loop is set to continue for more than three straight days, or until the victim folds.

After getting the keys to the kingdom, the malware gets to work and starts exfiltrating valuable information.

This includes data from key browsers (Chrome, Firefox, Brave, and others), saved logins, cookies, autofill data, and other browser information, data linked to cryptocurrency wallets and extensions, encrypted wallet vault material that can be cracked off-site, data from password managers, cached cryptocurrency addresses across EVM, Bitcoin, Solana, TRON, TON, and Stacks, shell histories, FileZilla FTP configuration and recent-server data, and basic device information.Everything is then packaged into a .ZIP archive and exfiltrated via a Telegram Bot API.

Group-IB says the campaign has been active since at least May 2026, so it’s been active for a few months now. A researcher submitted a variant to VirusTotal in early June, but it remained undetected by all security vendors until recently, Group-IB says.

So far, it has been spotted in 33 countries, more than half of which are in Europe, it was also added. The malware is most likely being distributed via a ClickFix social engineering campaign, and has not been tied to any particular threat actor.