Threat Intel Digest: August 1–21, 2026 — The Indicator

92 Reports analyzed

4,382 IOCs extracted

5 Vendors independently tracking the same npm supply-chain worm

666 IOCs in the period's largest single report

3 Talos reports on one AI-orchestrating threat actor

Key Takeaways for Security Professionals

Patch SonicWall SMA appliances immediately — two CVEs chain to zero-click root compromise.

CVE-2026-15409 and CVE-2026-15410 let attackers gain root on internet-facing SonicWall SMA appliances without any user interaction, then stage ransomware. Treat every exposed SMA device as compromised until patched and inspected.
Audit npm lockfiles for keyv, cacheable, and related packages — five vendors confirm the same worm.

The Shai-Hulud/ChainDrop worm backdoored 400+ packages after compromising a maintainer account. It drops setup.mjs, writes to IDE task-runner configs, and beacons to npm-cache[.]com. Pin dependencies and diff lockfiles against known-good hashes.
Patch N-able N-central now — two vendors confirm active exploitation of an unauthenticated admin bypass.

CVE-2026-18556 and CVE-2026-18577 grant unauthenticated administrative access to the RMM console. Huntress and HivePro independently confirmed in-the-wild exploitation eight days apart — treat any internet-facing N-central instance as a priority patch target.
Treat any exposed TrueConf Server as compromised until patched — Head Mare chains flaws twice in one week.

Securelist published two independent write-ups on Head Mare exploiting TrueConf Server to drop PhantomCore and PhantomGraph backdoors against video-conference participants. TrueConf is widely deployed in Russian-speaking enterprises — prioritize accordingly.
Verify Claude installers only from claude.ai/download — brand abuse persists across a returning campaign and a new one.

MacSync's fake Claude install guide (first seen in July) resurfaced with the same C2 infrastructure, and a separate AI-built crypto-fraud pipeline (Operation ASTERIX) used a macos-claude[.]com lookalike domain. Neither indicates any compromise of Anthropic's products.
Build detection for AI-orchestrated post-compromise activity — one actor now uses agentic AI to refine exploits automatically.

Cisco Talos published three reports on UAT-10147, a Chinese-speaking group that uses agentic AI to automate reconnaissance, refine exploits, and validate post-compromise steps at scale — alongside deploying a cross-platform rootkit implant, SPECTRE.
Require out-of-band verification for hotel or public Wi-Fi "repair" prompts — Midnight Blizzard weaponizes captive portals.

Two independent reports track Storm-2945/Midnight Blizzard using fake Wi-Fi repair prompts on hotel captive portals to trick traveling users into running CornFlake RAT and ChocoShell, harvesting Microsoft 365 credentials from a trusted-seeming network context.

Contents

Top Story: The npm Supply Chain Under Siege
AI/Agentic: When Threat Actors Bring Their Own AI
Espionage: A Zero-Day, a Rootkit Upgrade, and a Captive-Portal Campaign
Identity & Phishing-as-a-Service: Five Operations, One MFA-Bypass Playbook
Ransomware & Critical Infrastructure: Zero-Click SonicWall and Two New EDR-Bypass Tricks
Mobile: DarkSword's iOS Kit Returns, Android Head Units Join a Botnet
Also Worth Tracking

A three-week catch-up: 92 reports and 4,382 IOCs since our last post. The period's defining fact is the npm ecosystem taking two separate hits — a Shai-Hulud-family worm (nicknamed ChainDrop) that compromised the keyv/cacheable package family and backdoored 400+ downstream packages, independently confirmed by five different vendors across six days, and an unrelated trojanized-installer campaign (QuickFox → FDMTP) that two more vendors mapped to the same infrastructure. Layered on top: Cisco Talos published three separate reports on UAT-10147, a Chinese-speaking group now using agentic AI to automate its own post-compromise operations, while Claude-brand abuse continued with a returning malvertising campaign and an AI-built crypto fraud pipeline. Two SonicWall SMA CVEs chain to zero-click root compromise, Lazarus burned a Windows zero-day for Operation Dream Job, and Head Mare chained TrueConf Server flaws in two independent write-ups nine days apart.

01 — TOP STORY

The npm Supply Chain Under Siege

Two unrelated supply-chain campaigns dominated the period's vendor output. One is a self-propagating worm inside the npm registry that five separate outlets tracked across six days; the other is a trojanized VPN installer that two vendors traced to the same backdoor infrastructure, five days apart.

Shai-Hulud / ChainDrop — npm Worm — 5 Vendors — 98 IOCs Combined

A Compromised Maintainer Account Backdoors 400+ npm Packages, Confirmed by Five Vendors in Six Days

Aikido Security first flagged the compromise of keyv and related caching packages (over 2 billion combined monthly installs) on August 4. Over the following week, SANS ISC, Elastic Security Labs (which named the worm CHAINDROP), HivePro, and Zscaler each independently confirmed the same self-propagating campaign: a malicious setup.mjs/Math_Symbol.js payload that steals credentials, persists via IDE task-runner hooks (writing to .claude/settings.json and .vscode/tasks.json to auto-execute on next launch), signs its own propagation commits with a spoofed [email protected] identity, and calls home to npm-cache[.]com. None of this indicates any compromise of Anthropic's products — the worm abuses AI-coding-tool config paths and a spoofed commit identity as tradecraft, not an actual breach of Claude or GitHub.

98 IOCs combined · 400+ npm packages backdoored · npm-cache[.]com C2 · Persists via .claude/ and .vscode/ task-runner hooks

QuickFox → FDMTP — Trojanized Installer — 2 Vendors — 361 IOCs Combined

Fortinet and HivePro Independently Map the Same Trojanized QuickFox Installer to the FDMTP Backdoor

Fortinet's largest report of the period (187 IOCs) documented a trojanized QuickFox VPN installer using process-based guardrails to selectively deploy the FDMTP implant only against specific Windows users. Four days later, HivePro (174 IOCs) confirmed the same cdns3[.]51quickfox[.]cn delivery infrastructure, describing host profiling and staged plugin delivery for follow-on tooling.

361 IOCs combined · Trojanized QuickFox VPN installer · FDMTP staged-plugin implant · Process-based victim guardrails

Five independent confirmations of one npm worm in six days is the strongest corroboration signal this blog has tracked to date. Audit any project for the keyv/cacheable package family, diff lockfiles against known-good hashes, and treat any unexpected write to .claude/settings.json or .vscode/tasks.json as a compromise indicator rather than IDE noise. Separately, block 51quickfox[.]cn and icloud-cdn[.]net infrastructure and verify installer provenance for any VPN or utility software before deployment.

02 — AI/AGENTIC

AI/Agentic: When Threat Actors Bring Their Own AI

Five reports this period connect to AI in some way — a threat actor now using agentic AI to run its own operations, an AI agent used as an attack tool against a government ministry, an AI-built fraud pipeline, a returning Claude-brand malvertising campaign, and a defensive case study on distinguishing real attacks from legitimate AI-coding-agent telemetry.

UAT-10147 — SPECTRE + Agentic AI Operations — 3 Talos Reports — 247 IOCs Combined

A Chinese-Speaking Group Uses Agentic AI to Automate Its Own Post-Compromise Operations

Cisco Talos published three separate write-ups on UAT-10147: one detailing SPECTRE, a cross-platform implant with Linux rootkit and BYOVD capabilities deployed against IIS and Linux servers for SEO fraud, and two describing the group's use of agentic AI to automate reconnaissance, refine exploits, and validate post-compromise steps at scale against Windows and Linux web servers globally.

247 IOCs combined · SPECTRE cross-platform rootkit implant · Agentic AI-driven exploit refinement · Targets IIS/Linux web servers globally

Hermes AI Agent — Thai Ministry of Finance — 65 IOCs

An AI Agent Named Hermes Is Used to Deploy the Hades Implant Against a National Finance Ministry

Hunt.io documented attackers using an AI agent (Hermes) alongside the Hades implant — shipped in Linux and Windows variants — to target Thailand's Ministry of Finance, chaining several known privilege-escalation CVEs including CVE-2021-3156 and CVE-2021-4034.

65 IOCs · Hermes AI agent + Hades implant · Linux/Windows dual-platform payloads · Government finance-ministry targeting

Operation ASTERIX — AI-Built Crypto Fraud Pipeline — 60 IOCs — Claude-Brand Abuse

An AI-Assembled Fraud Pipeline Combines Phishing, Vishing, and a Fake Wallet App Behind a Claude Lookalike Domain

Rapid7's Operation ASTERIX (60 IOCs) describes attackers using AI to build a crypto-fraud pipeline that combines phishing, vishing, and fake wallet applications to steal seed-recovery phrases, distributing a fake Trezor Suite drainer through infrastructure that includes a macos-claude[.]com lookalike domain.

60 IOCs · AI-assembled phishing/vishing/malware pipeline · Fake Trezor Suite wallet drainer · macos-claude[.]com lookalike domain

MacSync — Fake Claude Install Guide Returns — 7 IOCs

The Same MacSync Malvertising Campaign From Three Weeks Ago Resurfaces on the Same Infrastructure

Huntress's follow-up report (7 IOCs) tracks MacSync's fake Claude AI installation guide continuing to distribute a macOS infostealer/RAT targeting browser data, credentials, and cryptocurrency wallets — using the same 85.206.161[.]241:8443 C2 endpoint first documented in the July 24–31 digest.

7 IOCs · Same C2 as July campaign · macOS infostealer/RAT · Fourth-plus consecutive cycle of Claude-brand abuse

"Living Off the Coding Agent" — Elastic Detection Case Study — 22 IOCs

Elastic Publishes a Methodology for Telling Real Attacks Apart From Legitimate Claude Code Telemetry

Not an attack report: Elastic Security Labs (22 IOCs) walks through a macOS case study built around Claude Code's project ancestry and free tunnel brokers (trycloudflare[.]com, localhost[.]run), addressing the growing challenge of validating alerts generated by legitimate GenAI-adjacent developer tooling rather than treating every AI-agent artifact as suspicious.

22 IOCs · Detection-engineering methodology, not an incident · Free tunnel broker abuse patterns · Claude Code telemetry triage

AI/agentic activity this period spans both sides: attackers using AI as an operational tool (UAT-10147, Hermes) and continued impersonation of Claude branding to distribute malware (MacSync, ASTERIX). None of the Claude-referencing reports indicate any compromise of Anthropic's products — each is either third-party brand impersonation or malware tradecraft that targets AI-coding-tool config paths. Verify any Claude Desktop or Claude Code installer originates from claude.ai/download directly, and build detection content that can distinguish an agentic-AI-refined exploit chain from conventional manual post-compromise activity.

03 — ESPIONAGE

Espionage: A Zero-Day, a Rootkit Upgrade, and a Captive-Portal Campaign

Espionage reporting was dense this period, with four campaigns each getting independent multi-vendor or multi-report coverage — a pattern this blog has flagged before as a strong signal to prioritize the underlying indicators.

Lazarus — Operation Dream Job — Windows Zero-Day — 2 Vendors — 107 IOCs Combined

Lazarus Burns a Windows Zero-Day for Its Latest Fake Job-Offer Campaign

Check Point Research first documented Lazarus exploiting CVE-2026-68820, a zero-day in Windows AFD.sys, alongside a Roundcube webmail flaw (CVE-2025-49113), to deploy the Troy backdoor, MISTPEN, and a FudModule rootkit variant against defense-sector targets via trojanized PDF viewers. HivePro confirmed the same campaign three days later.

107 IOCs combined · CVE-2026-68820 Windows zero-day · Troy backdoor + FudModule rootkit · Defense-sector fake job offers

Head Mare — TrueConf Server Exploitation — 2 Reports — 163 IOCs Combined

Head Mare Chains TrueConf Server Flaws Twice, Nine Days Apart

Securelist published two separate write-ups on Head Mare exploiting TrueConf Server vulnerabilities to drop PhantomCore and PhantomGraph backdoors against video-conference participants, using shared C2 infrastructure including penzadogshelter[.]site and a DLL sideload chain through inetsrv.

163 IOCs combined · PhantomCore + PhantomGraph backdoors · TrueConf Server exploit chain · Same C2 across both write-ups

HoneyMyte — CoolClient Rootkit Upgrade — 2 Reports — 138 IOCs Combined

HoneyMyte Arms Its CoolClient Backdoor With a Signed Kernel-Mode Rootkit

Securelist, then HivePro, tracked HoneyMyte upgrading its CoolClient backdoor with a signed kernel-mode Windows rootkit driver (msagent.sys) after initial access via PlugX, hiding processes, files, and network connections from standard tooling.

138 IOCs combined · Signed kernel-mode rootkit driver · PlugX initial access · Process/file/network concealment

Midnight Blizzard (Storm-2945) — CaptiveCrunch — 2 Reports — 22 IOCs Combined

Midnight Blizzard Weaponizes Fake Hotel Wi-Fi "Repair" Prompts on Captive Portals

Zscaler and, separately, Cyberpress documented Storm-2945/Midnight Blizzard using fake Wi-Fi repair prompts injected into hotel captive portals to trick traveling users into running CornFlake RAT and the ChocoShell infostealer, harvesting Microsoft 365 credentials from a network context victims are conditioned to trust.

22 IOCs combined · Hotel captive-portal injection · CornFlake RAT + ChocoShell · M365 credential theft

Also Tracked: FamousSparrow, Armored Likho, Jewelbug & Russian Auth Abuse

Four More Espionage Campaigns Rounded Out the Period

FamousSparrow used ProxyNotShell exploits against an Azerbaijani oil and gas company; Armored Likho expanded its toolkit with Telegram-data and audio-surveillance modules; Jewelbug ran parallel espionage and crypto-fraud operations from a single control panel; and Google Threat Intelligence Group tied three Russian clusters (UNC6293, UNC7005, UNC5976) to abuse of legitimate OAuth and app-password authentication flows against academia, defense, and government targets.

183 IOCs combined across four reports · ProxyNotShell, OAuth abuse, and toolkit expansion · Government, energy, and academic targeting

Two independently vendor-confirmed campaigns in one period — Lazarus's zero-day and Head Mare's TrueConf chain — is a strong signal to prioritize both immediately. Patch AFD.sys and Roundcube against CVE-2026-68820/CVE-2025-49113, and treat any internet-facing TrueConf Server as compromised until patched and inspected. HoneyMyte's signed kernel rootkit is a reminder that code-signing alone doesn't clear a driver for trust.

04 — IDENTITY & PHISHING-AS-A-SERVICE

Identity & Phishing-as-a-Service: Five Operations, One MFA-Bypass Playbook

Five distinct phishing/AiTM operations surfaced this period, headlined by the single largest report of the entire three weeks — a real-time, operator-driven framework built to bypass MFA at scale.

JWR Phishing Framework — 666 IOCs — Largest Single Report of the Period

Cisco Talos Dissects a Real-Time, Operator-Driven Phishing Framework Spanning 622 Domains

Talos's two-part analysis of JWR (666 + 23 IOCs) describes a real-time, operator-driven phishing framework that impersonates checkout and login pages to steal payment data, PII, and credentials, bypassing MFA via a live worker-relay architecture (api/open/pollInstruction) that lets a human operator drive each victim session as it happens across 622 tracked domains.

689 IOCs combined · 622 phishing domains · Live operator-driven session relay · MFA-bypass checkout/login impersonation

UNC6671 — Multi-Brand Vishing Extortion — 96 IOCs

UNC6671 Runs Vishing Extortion Under Four Different Brand Personas Simultaneously

Google Cloud/Mandiant's largest report of the period (96 IOCs) tracks UNC6671 conducting vishing extortion campaigns under four separate brand personas (Redact, Pink, Helix, Falcon), stealing credentials via AiTM infrastructure across 76 phishing domains and exfiltrating data from enterprise cloud environments in financial services.

96 IOCs · 76 phishing domains across 4 brand personas · AiTM credential theft · Financial-services + enterprise cloud targeting

Mirage2FA — AiTM PhaaS Targets US — 92 IOCs

Mirage2FA's Phishing-as-a-Service Toolkit Bypasses MFA to Target US Organizations

ANY.RUN documented Mirage2FA (92 IOCs), an AiTM phishing-as-a-service toolkit that steals Microsoft 365 credentials and session cookies to bypass MFA, operating across 68 tracked domains and primarily targeting United States organizations.

92 IOCs · 68 phishing domains · AiTM M365 session-cookie theft · US-focused targeting

Payroll Pirates (Storm-2755) — AiTM Payroll Fraud — 75 IOCs

Storm-2755 Uses AiTM Phishing to Redirect Payroll and Salary Deposits

HivePro tracked Storm-2755, dubbed "Payroll Pirates" (75 IOCs), using AiTM phishing to steal Microsoft 365 sessions and bypass MFA specifically to access payroll and finance systems, redirecting salary deposits away from legitimate employee accounts.

75 IOCs · AiTM M365 session theft · Payroll/finance system targeting · Salary-redirection fraud objective

Also Tracked: Post-DEF CON Lures & StopAndProtect

Conference Attendees and Hacked WordPress Sites Round Out the Identity Theme

Huntress documented a campaign targeting DEF CON attendees with Google Doc Apps Script lures delivering AMOS infostealer on macOS and a NetSupport RAT/Ledger-implant combo on Windows (87 IOCs), while Check Point's StopAndProtect report (63 IOCs) unmasked an operation running ClickFix social engineering through thousands of hacked WordPress sites.

150 IOCs combined · Conference-attendee targeting · ClickFix via compromised WordPress · AMOS + NetSupport RAT delivery

Five distinct AiTM/phishing-as-a-service operations in one period confirms MFA bypass is now table stakes for phishing kits, not a novel capability. Prioritize FIDO2/passkey enforcement over OTP- or push-based MFA wherever payroll, finance, or cloud-admin access is involved, and add JWR's domain list plus UNC6671's brand-persona infrastructure to blocklists — both are large enough to meaningfully move detection coverage on their own.

05 — RANSOMWARE & CRITICAL INFRASTRUCTURE

Ransomware & Critical Infrastructure: Zero-Click SonicWall and Two New EDR-Bypass Tricks

The period's most urgent single item is a zero-click root compromise chain against internet-facing SonicWall appliances, alongside continued exploitation of an RMM platform and two structurally different EDR-bypass techniques surfacing in the same week.

SonicWall SMA — Zero-Click Root Compromise — CVE-2026-15409/15410 — 67 IOCs

Two Chained CVEs Give Attackers Zero-Click Root on Internet-Facing SonicWall SMA Appliances

Cryptika (67 IOCs) documented active exploitation of CVE-2026-15409 and CVE-2026-15410 against SonicWall SMA appliances, achieving zero-click root access with no user interaction required, then deploying malware and staging for ransomware across a widening scan footprint that includes multiple /24 blocks.

67 IOCs · Zero-click root, no user interaction · Ransomware staging observed · Multiple /24 scan blocks

N-able N-central — Active Exploitation — 2 Vendors — 26 IOCs Combined

Two Vendors Confirm Active Exploitation of an N-able N-central Authentication Bypass

Huntress first flagged CVE-2026-18556/CVE-2026-18577 granting unauthenticated administrative access to the N-central RMM console; HivePro confirmed active exploitation eight days later, observing the same operator infrastructure on Synology QuickConnect relay domains.

26 IOCs combined · Unauthenticated RMM admin access · Confirmed by 2 vendors, 8 days apart · Synology QuickConnect relay abuse

Iranian Actors Target PLCs — CISA Advisory — 42 IOCs

CISA Warns of Iranian-Affiliated Actors Exploiting Internet-Connected PLCs Across US Critical Infrastructure

A CISA advisory (42 IOCs) documented Iranian-affiliated cyber actors exploiting internet-connected programmable logic controllers across multiple US critical infrastructure sectors, causing operational disruptions and financial losses through unauthorized access to exposed OT devices.

42 IOCs · CISA-attributed Iranian actors · Internet-connected PLC exploitation · Multi-sector US critical infrastructure impact

Gunra Ransomware — Full RaaS Operation — 75 IOCs

Conti-Derived Gunra Ransomware Evolves Into a Full RaaS Operation Targeting Critical Infrastructure

HivePro (75 IOCs) tracked Gunra, derived from the leaked Conti codebase, operating as a full ransomware-as-a-service platform against global critical infrastructure, using Fortinet vulnerabilities CVE-2024-55591 and CVE-2025-24472 for initial access before data theft and encryption.

75 IOCs · Conti-derived codebase · Fortinet CVE initial access · Full RaaS operation targeting critical infrastructure

Two New EDR-Bypass Techniques Surface in the Same Week

Akira's Safe Mode Reboot and a Weaponized Windows Defender Driver Both Target EDR

Huntress documented an Akira ransomware affiliate rebooting into Safe Mode with Networking to bypass EDR/AV — a technique that ultimately backfired when the constrained environment caused memory exhaustion and ransomware failure. Separately, Check Point detailed BTR Reforged, weaponizing Windows Defender's own Boot-Time Removal driver (BTR.sys) as a kernel operation primitive to disable protections at the driver level.

44 IOCs combined · Safe Mode EDR bypass (self-defeating) · Defender's own driver weaponized · Two distinct kernel-level evasion approaches

SonicWall SMA and N-able N-central both need emergency patching — both are under confirmed active exploitation and both grant an attacker administrative or root access with minimal friction. The EDR-bypass pair is worth flagging to your SOC even without an active incident: Defender's own remediation driver being weaponized against itself is a structurally different problem than a Safe Mode reboot, and both bypassed detection that assumes an attacker needs the endpoint fully booted and unprivileged to start.

06 — MOBILE

Mobile: DarkSword's iOS Kit Returns, Android Head Units Join a Botnet

Mobile-targeted activity spanned both major platforms and, unusually, extended into automotive infotainment hardware.

DarkSword iOS Exploit Kit — 75 IOCs — Campaign Continues

DarkSword's iOS Exploit Kit Spreads Across 180 Web Properties, Building on Infrastructure Mapped Last Cycle

Cryptika (75 IOCs) tracked the DarkSword iOS exploit kit — targeting iOS 18.4–18.7 — spreading across 180 web properties and 27 hosts via GHOSTBLADE modules to steal sensitive data. This builds directly on the multi-panel operator infrastructure Censys mapped via exposed operator tooling in the July 24–31 digest.

75 IOCs · 180 web properties, 27 hosts · GHOSTBLADE data-theft modules · Second reporting cycle on same operator infrastructure

Android Head Unit Malware — MoYu Group — 58 IOCs

Multi-Stage Android Malware Turns Automotive Head Units Into a Proxy Botnet

Securelist (58 IOCs) attributed a multi-stage Android malware campaign targeting automotive head units to the MoYu Group, building a proxy botnet used to commit ad fraud rather than targeting the vehicle's driving systems directly.

58 IOCs · Automotive head-unit targeting · Proxy botnet for ad fraud · Attributed to MoYu Group

DarkSword's persistence across two reporting cycles argues for indicator blocking at the MDM/fleet level rather than per-incident response, and mobile targeting is no longer confined to phones. Automotive head units joining a proxy botnet for ad fraud is a low-stakes objective today, but it establishes that embedded automotive infotainment systems are now a viable, internet-connected target class worth including in asset inventories.

07 — ALSO WORTH TRACKING

Also Worth Tracking

EtherRAT — The Gentlemen Ransomware Precursor — 50 IOCs

EtherRAT Spreads Across a Windows Domain via Remote Scheduled Tasks, Using Blockchain C2

Cryptika (50 IOCs) documented EtherRAT deployed via remote scheduled tasks across a compromised Windows domain, tied to the Gentlemen ransomware operation and using blockchain-based C2 for resilient persistence.

50 IOCs · Remote scheduled-task propagation · Blockchain C2 · Precedes Gentlemen ransomware deployment

SMOKE#SCREEN — ScreenConnect + Cloudflare Tunnel Abuse — 65 IOCs

Trusted-Software Lures and Cloudflare Tunnels Deploy ScreenConnect RMM Agents Across Windows and macOS

Securonix (65 IOCs) tracked threat actors abusing trusted software lures and Cloudflare tunnels to deploy ScreenConnect RMM agents across both Windows and macOS, using evolving toolkits including Windows Defender exclusion commands to evade detection.

65 IOCs · Cross-platform ScreenConnect deployment · Cloudflare tunnel C2 · Windows Defender exclusion abuse

Chinese Malware Delivery Domains, Part V — Silver Fox — 127 IOCs

DomainTools Documents a Continuing Affiliate-Model Malware Delivery Network for Chinese-Speaking Users

DomainTools' fifth installment (127 IOCs) on this large-scale malware delivery network, associated with the Silver Fox threat group, continues to operate an affiliate model distributing modified Gh0stRAT payloads through cloud storage-hosted delivery infrastructure.

127 IOCs · Fifth installment in an ongoing series · Gh0stRAT affiliate model · Cloud storage-hosted delivery

None of this period's smaller stories require urgent standalone action, but together they round out the same patterns seen elsewhere in this digest — trusted-software abuse (ScreenConnect, EtherRAT's scheduled tasks) and long-running affiliate infrastructure (Silver Fox's fifth installment) that rewards a standing watchlist over one-off incident response.

Analyst Assessment: August 1–21 in Context

Supply chain was the dominant vector across both software distribution channels this period tracks. The npm ecosystem absorbed a five-vendor-confirmed worm through a compromised maintainer account, while a completely unrelated trojanized-installer campaign (QuickFox → FDMTP) hit two more vendors' radar independently. Combined, these two campaigns alone account for nearly 460 IOCs and eight separate vendor write-ups — a reminder that supply-chain compromise doesn't need a single point of failure to spread; it needs one, replicated across every consumer of the compromised package or installer.

AI/agentic activity moved from a Claude-brand-abuse watch into genuine attacker tradecraft. UAT-10147 using agentic AI to automate its own exploit refinement and validation, and the Hermes AI agent deployed against a national finance ministry, both represent a step beyond last cycle's pattern of attackers merely impersonating AI-branded software. That impersonation continued too — MacSync's fake Claude install guide resurfaced on unchanged infrastructure, and Operation ASTERIX layered a macos-claude[.]com lookalike into an AI-built fraud pipeline — but the more structurally significant shift is attackers using AI as an operational multiplier rather than just a lure.

Multi-vendor corroboration continued to be the clearest signal for prioritization. Lazarus's Windows zero-day, Head Mare's TrueConf chain, HoneyMyte's rootkit upgrade, N-able's authentication bypass, and Midnight Blizzard's captive-portal campaign were each independently confirmed by two separate outlets within the same period. When two unrelated vendors publish on the same infrastructure without apparent cross-reference, that's the strongest available signal to act on the underlying indicators immediately.

What to do now: (1) Patch SonicWall SMA appliances (CVE-2026-15409/CVE-2026-15410) and N-able N-central (CVE-2026-18556/CVE-2026-18577) immediately — both are under confirmed active exploitation. (2) Audit npm lockfiles for the keyv/cacheable package family and treat unexpected writes to .claude/settings.json or .vscode/tasks.json as compromise indicators. (3) Patch Windows AFD.sys (CVE-2026-68820) and any internet-facing TrueConf Server given two independent multi-vendor confirmations each. (4) Verify Claude Desktop/Claude Code installers only from claude.ai/download. (5) Build detection content for agentic-AI-refined exploit chains, not just conventional manual post-compromise activity. (6) Require out-of-band verification for hotel or public Wi-Fi "repair" prompts. (7) Enforce FIDO2/passkey MFA over OTP-based methods anywhere payroll, finance, or cloud-admin access is involved.

Sources

Aikido Security — Keyv and Friends Compromised in npm Supply Chain Attack
SANS Internet Storm Center — keyv/cacheable npm Worm
Elastic Security Labs — Shai-Hulud: CHAINDROP npm Supply Chain
HivePro — ChainDrop: Shai-Hulud npm Supply-Chain Worm Compromises Keyv Ecosystem
Zscaler — Tracking Shai-Hulud: Inside ChainDrop npm Worm
Fortinet — QuickFox Supply Chain Attack Used to Deploy FDMTP Implant
HivePro — A Fake Update, a Real Threat: The FDMTP Backdoor's Supply-Chain Run
Cisco Talos — UAT-10147 Deploys SPECTRE: A Cross-Platform Implant With Linux Rootkit and BYOVD Capabilities
Cisco Talos — UAT-10147: Chinese-Speaking Adversary Integrates Agentic AI Into Post-Compromise Operations
Cisco Talos — Is Cyber Missing the Marque?
Hunt.io — Thailand Ministry of Finance Targeted With Hermes AI Agent
Rapid7 — Operation ASTERIX: Crypto Fraud, Vishing & Phishing
Huntress — Fake Claude Install Guide Delivers MacSync
Elastic Security Labs — Living Off the Coding Agent
Check Point Research — Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack
HivePro — Operation Dream Job: Lazarus Exploits a Windows Zero-Day to Deploy Backdoor
Securelist — Head Mare Targets TrueConf Server With PhantomCore
HivePro — Head Mare Chains TrueConf Server Flaws to Drop PhantomCore and PhantomGraph
Securelist — HoneyMyte CoolClient Driver Rootkit
HivePro — HoneyMyte Arms CoolClient With a Signed Kernel-Mode Rootkit
Zscaler — CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals
Cyberpress — Bogus Wi-Fi Repairs Weaponized
HivePro — FamousSparrow's Persistent Hold on Azerbaijani Oil & Gas
Securelist — Armored Likho: Still Toolkit
HivePro — One Team, Two Payrolls: Jewelbug's Parallel Operations
Google Cloud / GTIG — Distinct Clusters Target Individuals of Interest to Russia
Cisco Talos — Dissecting the JWR Phishing Framework
Cisco Talos — Curiouser and Curiouser (JWR + Prevalent Malware)
Google Cloud / Mandiant — UNC6671 Targets Financial Services and Enterprise Cloud Environments
ANY.RUN — Mirage2FA Phishing Targets US Companies
HivePro — Payroll Pirates Abuse AiTM Phishing to Compromise Microsoft 365
Huntress — DEF CON Phishing: Google Doc Malware
Check Point Research — Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
Cryptika — Internet-Facing SonicWall SMA Appliances Face Zero-Click Root Compromise
Huntress — N-able N-central Vulnerability Exploitation
HivePro — N-able Confirms Active Exploitation of N-central Authentication Bypass Flaw
CISA — Iranian-Affiliated Actors Target PLCs (AA26-097A)
HivePro — Gunra Ransomware Evolves Into Full RaaS Operation Targeting Global Critical Infrastructure
Huntress — Akira Hits Safe Mode: Ransomware Rebooting Around EDR
Check Point Research — BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive
Cryptika — DarkSword iOS Exploit Kit Spreads Across 180 Web Properties and 27 Hosts
Securelist — Android Head Unit Malware
Cryptika — Remote Scheduled Tasks Spread EtherRAT Across Compromised Windows Domain
Securonix — SMOKE#SCREEN: ScreenConnect RMM Abuse via Cloudflare Tunnels
DomainTools — Chinese Malware Delivery Domains, Part V

This digest was generated with Claude by Anthropic, based on source reporting from the publications listed above and analysis of 92 IOC submissions to iocget.com between August 1 and August 21, 2026.

Threat Intel DigestAugust 1–21, 2026