Weekly Threat Intel
August 21–28, 2026
-
Audit for unexpected writes to
.claude/settings.json— ChainDrop is now confirmed by seven vendors.Two more vendors (Cyberpress, PolySwarm) independently reconfirmed the exact IDE task-runner persistence mechanism five vendors first flagged in early August. Treat any unexpected write to
.claude/settings.jsonor.vscode/tasks.jsonas a compromise indicator, not IDE noise. -
Patch VMware vCenter against
CVE-2026-59310now — it's already granting root and deploying ransomware.A suspected China-nexus APT chains
CVE-2026-59310andCVE-2026-59309to gain full root access, deploy a webshell, and distribute Linux/ESXi ransomware payloads — HivePro observed this in active exploitation. -
Audit internet-facing PLCs in critical infrastructure for Dropbear SSH or unexplained engineering-software sessions.
Iranian-affiliated actors are disrupting US critical infrastructure using legitimate engineering tools and Dropbear SSH rather than custom malware, so the absence of malware doesn't mean the absence of compromise.
-
Cross-reference new espionage reports against historical IOC data before assuming a campaign is new.
Mirage Kitten/NightLedger and OctLurk/SilkLurk both picked up second vendor write-ups this week matching campaigns Securelist documented weeks ago — apparently without either newer vendor noticing the overlap.
-
Verify AI tool installers (Claude, ChatGPT, Grok) come only from official download sources.
Huntress catalogs
ClaudeDesktop.exeas a recurring fake-installer filename across unrelated campaigns delivering SectopRAT, MacSync stealer, and AMOS stealer — the brand-abuse pattern tracked here for over a month continues. -
Treat AI-assisted tooling in Kimsuky and UAT-10147's campaigns as a capability upgrade, not a novelty.
Kimsuky's Operation GitPower layers a local AI dev environment onto its espionage tooling, and a fourth vendor now confirms UAT-10147's AI-assisted SPECTRE backdoor deployment — state actors are operationalizing AI, not just abusing its brand.
-
Patch Medusa's five-CVE initial-access cluster if your organization runs any of the affected products.
HivePro ties Medusa ransomware's critical-infrastructure double-extortion campaigns to
CVE-2024-1709,CVE-2023-48788,CVE-2025-10035,CVE-2026-1731, andCVE-2026-18577— patch whichever your organization runs.
- Top Story: ChainDrop's npm Worm Picks Up Its Sixth and Seventh Vendor Confirmations
- AI/Agentic: State-Nexus Actors Build AI Into Their Own Tooling
- Espionage Roundup: Iran, China, and Two Campaigns Getting Second Opinions
- Vulnerability Exploitation & Critical Infrastructure
- Ransomware & Extortion: A New Rust Family and a Beast Rebrand
- Social Engineering & Fake Software Lures
- Also Worth Tracking: Banking Trojans, ClickFix Variants, and Two SANS ISC Diaries
.claude/settings.json and .vscode/tasks.json persistence mechanism. PolySwarm itself published in an eight-report burst spanning under three minutes on August 24, mixing genuinely new material (Kimsuky's AI-tooling-equipped Operation GitPower, an Iranian PLC campaign against US critical infrastructure) with second and third opinions on campaigns already tracked here (UAT-10147/SPECTRE, Mirage Kitten/NightLedger, OctLurk/SilkLurk). Security.com matched that publishing cadence four days later with four reports in 24 seconds spanning two ransomware families and two China-nexus backdoors. Elsewhere, a suspected China-nexus actor is exploiting a new VMware vCenter vulnerability for root access and ransomware distribution, and the week's two largest reports — a 145-IOC Minecraft-cheat campaign and a 136-IOC fake-video delivery chain — both funnel into commodity remote-access tools rather than anything novel.
ChainDrop's npm Worm Picks Up Its Sixth and Seventh Vendor Confirmations
Two weeks ago, this blog tracked five independent vendors — Aikido Security, SANS ISC, Elastic Security Labs, HivePro, and Zscaler — converging on the same self-propagating npm supply-chain worm within six days, persisting via malicious writes to .claude/settings.json and .vscode/tasks.json so it auto-executes the next time a developer opens a compromised project in VS Code or Claude Code. This week, two more vendors arrive at the identical mechanism without any visible cross-reference to the earlier five.
Cyberpress Independently Reconfirms ChainDrop's IDE Task-Runner Persistence
Cyberpress's write-up describes malicious configuration files pushed to compromised repositories specifically to execute when a developer opens the project in VS Code or Claude Code. The reported artifacts — .claude/settings.json and .vscode/tasks.json — are identical to the mechanism Elastic named CHAINDROP and HivePro/Zscaler corroborated in early August, not a new campaign.
.claude/settings.json / .vscode/tasks.json persistence · Sixth independent vendor · No compromise of Claude or GitHub itselfPolySwarm's Write-Up Puts ChainDrop at Seven Vendors and Counting
PolySwarm's own analysis — published inside the same eight-report burst covered in Section 2 — separately confirms the worm compromised over 400 npm packages by abusing stolen publisher credentials to modify and republish legitimate releases. A seventh independent vendor, arriving at the same self-propagating mechanism with no apparent coordination with the other six.
Seven vendors independently confirming the same npm worm's exact persistence mechanism is now this blog's clearest standing example of why historical IOC cross-referencing matters. If your organization hasn't already audited for unexpected writes to .claude/settings.json or .vscode/tasks.json following the five-vendor confirmation two digests ago, treat this week's two additional confirmations as the reminder to do it now.
AI/Agentic: State-Nexus Actors Build AI Into Their Own Tooling
Four more reports connect to AI this week, continuing a shift that's been building for a month: away from AI-brand impersonation as the lure and toward AI as an operational tool an adversary builds into its own kill chain — plus, for the first time in this blog's tracking, a report treating an AI vendor's own safety guardrails as a potential attack surface.
Kimsuky Builds a Local AI Development Environment Into Its Espionage Tooling
PolySwarm's largest report of the week's burst documents Kimsuky's Operation GitPower, which layers a local AI development environment and retrieval-augmented-generation (RAG) framework on top of the group's traditional spear-phishing, malicious LNK files, and GitHub-hosted C2 — using AI tooling to enhance operator workflow rather than as a lure aimed at victims.
A Fourth Vendor Confirms UAT-10147's AI-Assisted SPECTRE Backdoor Campaign
Following three Cisco Talos reports on UAT-10147 covered in this blog's last digest, PolySwarm's independent write-up reconfirms the group's AI-assisted workflow for deploying the cross-platform SPECTRE backdoor and Specter rootkit against Windows and Linux servers — chaining known vulnerable-driver CVEs (CVE-2019-16098, CVE-2021-21551) for BYOVD-style privilege escalation.
CVE-2019-16098 + CVE-2021-21551 (BYOVD) · Cross-platform Windows/Linux targeting · Fourth vendor to track this campaignHuntress Catalogs Trusted AI Platforms as a Standing Social-Engineering Surface
Huntress's overview ties together a pattern this blog has tracked for weeks: threat actors abusing the trust users place in Claude, ChatGPT, and Grok to distribute SectopRAT, the MacSync stealer/RAT, and AMOS stealer — reconfirming ClaudeDesktop.exe as a recurring fake-installer filename across multiple unrelated campaigns.
ClaudeDesktop.exe fake installer · Also targets ChatGPT/Grok brands · SectopRAT, MacSync, AMOS stealer payloadsCisco Talos Asks Whether an AI Model's Own Guardrails Can Be Turned Against Defenders
Talos's regular newsletter includes a piece on AI guardrails becoming "the attacker's best friend" — refusal responses and safety framing potentially usable as a signal or shield for malicious activity — alongside its usual roundup (ToxicPanda banking trojan, Jackal IV, and the Android head-unit malware also tracked in this week's dataset) and a prevalent-hash reference list.
None of this week's four AI-related reports involve a new brand-impersonation lure. The pattern has shifted to adversaries building AI into their own operational tooling (Kimsuky, UAT-10147) and researchers starting to examine AI safety mechanisms themselves as a potential attack surface (Talos). Continue treating Claude/ChatGPT/Grok-branded installers as a standing lure category, but also start tracking AI-assisted tooling as a capability upgrade for existing threat actors rather than a novelty.
Espionage Roundup: Iran, China, and Two Campaigns Getting Second Opinions
Six reports span Iranian and Chinese state-nexus operations this week, two of which are independent second write-ups of campaigns Securelist first documented in this blog's July 24–31 digest.
Group-IB Maps a Sprawling Reverse-SSH-Tunneling Infrastructure Behind Iran's Tortoiseshell APT
This week's largest espionage report documents new tooling and infrastructure tied to the Iranian Tortoiseshell APT, including an updated TWOSTROKE backdoor and a reverse SSH tunneling tool that opens a remote port back to 172[.]86[.]98[.]113. Group-IB fingerprinted a cluster of over a dozen geographically-labeled subdomains (uae1 through uae14, sau1-3, uk1-2, and others) across the locat[.]sbs and tiktok-u[.]sbs domains.
A Second Vendor Reconfirms Mirage Kitten's NightLedger Backdoor Weeks Later
PolySwarm's write-up names the same NightLedger backdoor (masquerading as SspiCli.dll) that Securelist documented against Middle East and Africa targets in this blog's July 24–31 digest — an independent confirmation arriving with a smaller IOC set but no apparent knowledge of the earlier report.
SspiCli.dll masquerade · Second independent vendor · Middle East/Africa targetingOctLurk and SilkLurk Also Pick Up a Second Vendor Confirmation
The same pattern repeats: PolySwarm's report on OctLurk and SilkLurk, modular backdoors targeting Central Asian and Middle Eastern government networks, matches Securelist's original coverage from three weeks ago without any visible cross-reference.
Jewelbug Runs State Espionage and a Cryptocurrency Fraud Business Off the Same Infrastructure
Security.com's report on the China-based Jewelbug group documents espionage against governments and militaries running alongside a separate cryptocurrency fraud operation, both using the XG-Web control panel and an Antino backdoor delivered through fake Adobe/browser-update installers hosted on microsoft-flash[.]com and fonts.chrorne[.]com — a single group monetizing two very different objectives from one toolkit.
Backdoor.Daxin Resurfaces in Taiwan Alongside a New Pre-Authentication Trojan
Security.com documents the reappearance of Backdoor.Daxin — a China-nexus implant first disclosed publicly in 2022 — in Taiwan, alongside a newly named Backdoor.Stupig that achieves pre-authentication code execution through a trojanized keyboard-layout DLL (kbdus1.dll).
Suspected Chinese-Speaking Hackers Steal Data From a Philippine Nuclear Research Organization
Cyberpress reports Chinese-speaking threat actors exploiting two known CVEs (CVE-2023-49105, CVE-2024-28000) to steal sensitive data from a Philippine nuclear research organization and a separate marine engineering company, with C2 traffic to 31.58.209[.]241 across two non-standard ports.
CVE-2023-49105 + CVE-2024-28000 · Nuclear research + marine engineering targets · Single C2 IP, two portsTwo more campaigns — Mirage Kitten/NightLedger and OctLurk/SilkLurk — joined the HOLLOWGRAPH and Cl0p/Windchill pattern this blog has now tracked for a month: independent vendors reaching the same infrastructure without visible coordination. That's a strong argument for checking any new espionage report against your own historical IOC data before assuming it describes something new. Separately, Jewelbug's dual-use infrastructure — espionage plus for-profit crypto fraud from the same panel — is worth building detection content for regardless of which motive your organization considers itself a target of.
Vulnerability Exploitation & Critical Infrastructure
A root-access VMware vCenter vulnerability and continued PLC targeting headline four reports spanning active exploitation, a long-running malvertising network, and a cybercrime operator's own operational-security failure.
A Suspected China-Nexus APT Chains Two VMware vCenter CVEs Straight to Root and Ransomware
HivePro's advisory documents a suspected China-nexus APT exploiting CVE-2026-59310 (alongside a related CVE-2026-59309) in VMware vCenter to gain root access, deploy a webshell (vmware-perf-update.jsp), and distribute ransomware — with staged Linux and ESXi payloads pulled from attacker-controlled infrastructure at 5[.]34[.]176[.]100 and 185[.]144[.]28[.]120, and persistence via cron jobs and sudoers entries.
CVE-2026-59310 + CVE-2026-59309 · Root access → webshell → ransomware · Linux and ESXi payloads stagedIranian-Affiliated Actors Exploit Internet-Facing PLCs Across US Critical Infrastructure
PolySwarm documents Iranian-affiliated threat actors exploiting internet-facing PLCs across US critical infrastructure sectors to disrupt industrial operations, using legitimate engineering software and the Dropbear SSH utility rather than custom malware — plus a long tail of over 20 historic CVEs (CVE-2017-7921 through CVE-2026-21509) as the group's standing exploitation toolkit.
DomainTools' Fifth Installment Maps Silver Fox's Affiliate-Model Malware Delivery Network
DomainTools' fifth report in an ongoing series — this week's second-largest — continues documenting a large-scale malware delivery network targeting Chinese-speaking users, attributed to the Silver Fox threat group and operating on an affiliate model that distributes modified Gh0stRAT payloads through fake AI-assistant, trading-platform, and utility installers hosted on legitimate cloud storage (Aliyun OSS, AWS S3, Google Cloud Storage).
An Open Directory Exposes Moobot Source Code, a DDoS Panel, and a Fake Government ID Service
Censys found an open directory exposing Moobot source code, a DDoS-for-hire panel (StresD Pro+), and an unrelated fake Chinese government identity-verification service (gov-verify-v6.zip) — three separate cybercrime operations apparently sharing infrastructure through operator carelessness rather than by design.
CVE-2026-59310 is this week's clearest patch-now item — it's already being used for root access and ransomware distribution in the wild against vCenter, one of the highest-value targets in any virtualized environment. The Iranian PLC campaign is a reminder that "no custom malware" doesn't mean "no compromise": legitimate engineering software and a standard SSH utility were enough. Any organization running internet-facing PLCs should treat that as a call to re-verify exposure, not a reason to deprioritize it.
Ransomware & Extortion: A New Rust Family and a Beast Rebrand
Five distinct ransomware stories surfaced within days of each other this week, notable less for any single incident than for how different their approaches to resilience and evasion are.
Medusa's RaaS Operation Escalates Double-Extortion Attacks on Critical Infrastructure
HivePro's report — this section's largest — tracks Medusa ransomware's continued double-extortion campaigns against critical infrastructure, exploiting a cluster of known CVEs for initial access: CVE-2024-1709, CVE-2023-48788, CVE-2025-10035, CVE-2026-1731, and CVE-2026-18577, alongside five distinct extortion-contact email addresses across ProtonMail, Onionmail, and Cock.li.
A New Rust-Based Ransomware Family, Spirals, Debuts Against an Asian IT Company
Security.com documents Spirals, a newly identified Rust-based ransomware deployed against an Asian IT company, using web shells, Cloudflare tunneling (cloudflared-windows-amd64.exe), and PsExec for lateral movement, plus a PowerShell one-liner that stops any running service matching a list of backup, virtualization, and database product names before encryption.
GodDamn Ransomware Rebrands Beast/Monster, Layers In a Malicious Kernel Driver
Security.com attributes GodDamn ransomware to Hyadina as a rebrand of the Beast/Monster family, using AnyDesk for persistent remote access, a suite of NirSoft credential-harvesting tools (renamed as netpass64.exe, chromepass.exe, mailpv.exe, and others), and a malicious driver (PoisonX, dropped as g11.sys) to disable defenses before encryption.
DeadLock Ransomware Leans on Polygon, Session, and Wasabi for Takedown-Resistant Infrastructure
PolySwarm's brief report documents DeadLock ransomware's use of decentralized infrastructure — the Polygon blockchain, Session messaging, and Wasabi object storage — specifically to increase operational resilience against takedowns for its double-extortion campaigns.
Play Ransomware's Grixba Tool Enumerates Networks and Raids Volume Shadow Copies
Security.com documents Play ransomware's custom Grixba tool systematically enumerating installed software, remote desktop cache, and network shares (exporting to CSV files like all_soft.csv and cached_RDP.csv) while separately copying files out of the Volume Shadow Copy Service, exploiting the same ProxyNotShell CVE pair (CVE-2022-41080, CVE-2022-41082) for initial access.
CVE-2022-41080 + CVE-2022-41082 (ProxyNotShell)This week's ransomware activity is notable less for any single incident than for its diversity — a brand-new Rust family (Spirals), a rebrand layering in a malicious driver (GodDamn), and a family explicitly engineered around blockchain-based takedown resistance (DeadLock) all surfaced within days of each other. Separately, HivePro's C2Looper report (10 IOCs) is worth a mention on its own: a Rust-based backdoor using ClickFix lures and GitHub-hosted C2 specifically built to establish the foothold a ransomware operator deploys later — a reminder that not every ransomware-adjacent report describes the encryption event itself.
Also Worth Tracking: Banking Trojans, ClickFix Variants, and Two SANS ISC Diaries
Grandoreiro Resumes Activity With a Mexico-Focused DLL Sideloading Campaign
HivePro documents Grandoreiro operators resuming activity via DLL sideloading through a renamed Duplicate Files Finder executable, continuing the banking trojan's long track record of outlasting law-enforcement takedowns.
PavinLoader Chains ClickFix and Fake Downloads to Amatera Stealer
Malwarebytes tracks PavinLoader across both ClickFix and fake-download campaigns, using a multi-stage chain involving legitimate MSBuild.exe execution and EtherHiding techniques to ultimately deliver Amatera Stealer.
A Leaked Source Repository Ties ERMAC and HookBot to Shared Lineage
Censys's analysis of a leaked ERMAC/HookBot source repository documents the two Android banking trojans' shared codebase and infrastructure, including a common builder pipeline visible in the leak.
Balonx Sistema Combines Real-Time Phishing With AI Vishing Against Mexican Banks
Group-IB exposes Balonx Sistema, a phishing-as-a-service operation targeting Mexican banks that pairs real-time credential relay with AI-generated vishing calls and a dedicated Android RAT.
AmnesiaStealer Brings Interactive Browser Session Hijacking to macOS
PolySwarm documents AmnesiaStealer, a multi-stage Rust-based macOS infostealer distributed through ClickFix social engineering, capable of interactively hijacking live browser sessions rather than only exfiltrating stored credentials.
Projextor Hides Inside Fully Functional Electron Productivity Apps
Cyberpress documents Projextor malware distributed inside working Electron-based productivity applications (branded as PDF and format-conversion tools) that abuse insecure Electron settings to execute malicious JavaScript and capture the desktop.
A Signed ClickOnce Installer Disguised as a Google Workspace Helper Delivers Dual Malware
Cyberpress tracks a fake-job campaign using a legitimately-signed ClickOnce installer (GapiUpdate.application) posing as a Google Workspace helper to deploy credential stealers and a RAT, leading to cryptocurrency theft.
WordlistLoader Hides Shellcode Inside English Words to Evade Detection
Gen Threat Labs, via Cyberpress, documents WordlistLoader, a new loader used in ClearFake campaigns that conceals its shellcode by encoding it within ordinary English words before deploying Amatera Stealer.
Attackers Disguise the Cloud Metadata IP as a Hostname to Slip Past SSRF Filters
SANS ISC documents attackers using dynamic DNS and DNS-rebinding services to represent the cloud metadata address 169.254.169.254 as an ordinary-looking hostname, bypassing SSRF filters that only pattern-match on the literal IP string.
A Polymorphic Phishing Page's Own JavaScript Obfuscation Sometimes Breaks It
SANS ISC's diary examines a polymorphic phishing page whose broken JavaScript obfuscation causes it to intermittently fail to load altogether — a reminder that evasion techniques carry their own reliability cost for the attacker.
Nothing in this section is individually urgent, but the ERMAC/HookBot source leak deserves a longer look than its 45 IOCs suggest. Leaked builder pipelines for active malware-as-a-service families tend to produce a wave of copycat variants in the following weeks, and it's worth getting ahead of that with the shared infrastructure fingerprints Censys published.
Analyst Assessment: August 21–28 in Context
The defining fact of this week is that ChainDrop's npm worm keeps recruiting confirmations without any of the vendors coordinating. Five vendors in six days two digests ago is now seven, and both new confirmations describe the exact same .claude/settings.json/.vscode/tasks.json persistence mechanism rather than a variant. At some point a worm this well-corroborated stops being a "watch this" item and becomes a standing detection requirement, the same way the HOLLOWGRAPH and Cl0p/Windchill overlaps did in prior weeks.
Two vendors matched publishing cadences this week, with different results. PolySwarm's eight reports in under three minutes on August 24 mixed genuinely new material — Kimsuky's AI-tooling-equipped Operation GitPower, the Iranian PLC campaign — with three independent confirmations of campaigns already tracked here (UAT-10147/SPECTRE, Mirage Kitten/NightLedger, OctLurk/SilkLurk). Security.com's four reports in 24 seconds four days later were all genuinely distinct stories: two espionage (Jewelbug, Daxin/Stupig) and two ransomware (Spirals, GodDamn). A vendor's publishing schedule still tells you nothing about the actual pace of adversary activity, but it's increasingly useful as a signal for where independent corroboration is most likely to show up.
AI keeps moving further from "brand to impersonate" and closer to "capability to operationalize." Kimsuky's local AI development environment and UAT-10147's AI-assisted SPECTRE deployment are the clearest examples yet of state-nexus actors building AI into their own tradecraft rather than using it as bait, and Talos's piece on guardrails as a potential attack surface suggests researchers are starting to ask the next question: not just how attackers abuse AI brands, but how they might abuse the safety mechanisms of the models themselves.
What to do now: (1) Audit for unexpected writes to .claude/settings.json and .vscode/tasks.json — ChainDrop is now at seven vendor confirmations. (2) Patch VMware vCenter against CVE-2026-59310 and CVE-2026-59309 immediately — both are under active exploitation for root access and ransomware distribution. (3) Audit any internet-facing PLC in critical infrastructure environments for Dropbear SSH sessions or unexpected engineering-software activity. (4) Cross-reference new espionage reports against historical IOC data before treating them as new — two more campaigns this week turned out to be second opinions. (5) Treat AI-branded installers (Claude, ChatGPT, Grok) as a standing lure category, and separately start tracking AI-assisted tooling as a capability upgrade in adversary TTPs. (6) Patch whichever of Medusa's five initial-access CVEs (CVE-2024-1709, CVE-2023-48788, CVE-2025-10035, CVE-2026-1731, CVE-2026-18577) your organization runs. (7) Watch for ERMAC/HookBot copycat variants following this week's source-code leak.
Sources
- Cyberpress — ChainDrop OIDC Provenance Worm
- PolySwarm — Self-Propagating ChainDrop Worm Infects More Than 400 npm Packages
- PolySwarm — Kimsuky Expands AI Capabilities Through a Local AI Development Environment in Operation GitPower
- PolySwarm — UAT-10147 Uses AI-Assisted Workflows to Deploy SPECTRE Backdoor
- Huntress — AI Attack Surface
- Cisco Talos — Sorry, I Can't Help With That: How Your Guardrails Might Become the Attacker's Best Friend
- Group-IB — Tortoiseshell APT Toolset and Infrastructure
- PolySwarm — Mirage Kitten Deploys NightLedger Backdoor
- PolySwarm — OctLurk and SilkLurk: Analysis of a Modular Cyber Espionage Framework
- Security.com — Jewelbug: Crypto Fraud and Espionage
- Security.com — Daxin Returns, Stupig Emerges
- Cyberpress — Philippine Nuclear Data Stolen
- HivePro — Suspected China-Nexus APT Weaponizes CVE-2026-59310
- PolySwarm — Iranian PLC Exploitation Campaign Targets US Critical Infrastructure
- DomainTools — Chinese Malware Delivery Domains Part V
- Censys — Open Directory Exposes Moobot Source Code and Activity
- HivePro — Medusa Ransomware RaaS Escalating Double-Extortion Attacks on Critical Infra
- Security.com — Ransomware Spirals: Extortion
- Security.com — GodDamn Ransomware: Beast Rebrand
- PolySwarm — DeadLock Ransomware Leverages Decentralized Infrastructure
- Security.com — Play Ransomware: Volume Shadow Copy
- HivePro — C2Looper Builds Footholds for Ransomware
- HivePro — WeedHack Resurfaces via Fake Minecraft Clients and SEO Poisoning
- Censys — Fake MP4 File Carries Malicious Payload
- HivePro — SynkLoader: When a Teams Message Fakes Your Lock Screen
- ANY.RUN — US Campaign Malware Analysis
- HivePro — StopAndProtect: Nearly 2,000 Hacked WordPress Sites Weaponized as Criminal Infrastructure
- Malwarebytes — Fake GTA 6 Extended Look and Demo Sites Deliver an Infostealer
- Malwarebytes — Fake Microsoft Security Scans Trick Victims Into Uninstalling Their Antivirus
- Malwarebytes — Beware of Fake Indeed Interview Apps Used to Install Spyware
- HivePro — Grandoreiro Outlives Its Own Takedown
- Malwarebytes — Tracking PavinLoader Across ClickFix and Fake Download Campaigns
- Censys — ERMAC Source Leak: HookBot
- Group-IB — Balonx Sistema: Mexico PhaaS
- PolySwarm — AmnesiaStealer Introduces Interactive Browser Session Hijacking to macOS
- Cyberpress — Projextor Abuses Electron Framework
- Cyberpress — Signed ClickOnce Delivers Dual Malware
- Cyberpress — WordlistLoader Conceals Amatera Shellcode
- SANS Internet Storm Center — Obfuscating IPs as Hostnames
- SANS Internet Storm Center — Polymorphic Phishing Page Analysis
This digest was generated with Claude by Anthropic, based on source reporting from the publications listed above and analysis of 40 IOC submissions to iocget.com between August 21 and August 28, 2026.
Social Engineering & Fake Software Lures
The week's two largest single reports by IOC count — a 145-IOC Minecraft-cheat campaign and a 136-IOC fake-video delivery chain — both sit in this section, alongside a cluster of tax-season, job-board, and fake-support lures.
WeedHack Resurfaces via Fake Minecraft Clients and SEO-Poisoned Cheat Sites
HivePro's report — the week's largest — tracks WeedHack targeting Minecraft players through fake game clients, cheat mods, and dupe tools promoted via SEO poisoning, stealing credentials, session cookies, and cryptocurrency wallets. The infrastructure spans a long list of convincingly-named fake client sites (
xenonclient[.]com,nova-client[.]com,kryptonclient[.]gg) alongside a dedicatedweedhack[.]tooperator dashboard.A Fake MP4 File Delivers an Encrypted PowerShell Payload, Ending in a Commercial RAT
Censys's report — this week's second-largest — documents a campaign using a fake
.mp4file to deliver an encrypted PowerShell payload that ultimately installs a NetSupport Manager client for remote administration — a large, sprawling infrastructure footprint (six ASNs, dozens of lookalike domains) for a payload that's a legitimate remote-access tool rather than purpose-built malware.SynkLoader Fakes a Windows Lock Screen Inside a Microsoft Teams Message
HivePro documents SynkLoader, modular malware spread through Microsoft Teams phishing that renders a convincing fake lock screen to harvest credentials directly, then deploys a reverse proxy for follow-on access to corporate systems.
Fake Canadian Tax Documents Deliver Legitimate RMM Software Across 46 Countries
ANY.RUN's analysis tracks a phishing campaign using fake Canadian tax documents to deliver legitimate remote-monitoring-and-management software for direct remote access, spanning 46 countries and relying on disposable Vercel and Netlify app subdomains (
fillingconfirmation[.]vercel[.]app, and similar) that are easy to spin up and abandon.StopAndProtect Weaponizes Nearly 2,000 Hacked WordPress Sites Behind Fake CAPTCHA Prompts
HivePro documents the StopAndProtect operation hijacking close to 2,000 legitimate WordPress sites, using fake CAPTCHA prompts as the ClickFix-style delivery mechanism for a mix of ransomware, stealers, and self-propagating worms.
Three smaller lures round out the section, each targeting a different audience: fake GTA 6 demo sites (Malwarebytes, 29 IOCs) deliver the Vidar infostealer to gamers; fake Microsoft security-scan pop-ups (Malwarebytes, 12 IOCs) trick victims into uninstalling their own antivirus as part of a refund scam; and fake Indeed interview apps (Malwarebytes, 4 IOCs) install Android spyware on job seekers that specifically resists uninstallation. None of this section's eight reports share infrastructure, but together they're a reminder that the lure category doing the most damage this week wasn't a novel technique — it was volume and audience targeting across gaming, tax season, job hunting, and tech support all at once.