Welcome to Security Signals
Mid October 2026 Cyber Threat Reports
Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.
For more articles, check out our #onpatrol4malware blog.
Our Latest Blog Post
September 2026 Edition
Key stats from real-world telemetry and live attack observations over the past month – a concise look at what we’re seeing across malware, phishing, ransomware, C2s, and domain abuse.
Insights (TL;DR)
To help maximize your time, these insights summarize the most common attacker behaviors, techniques, and defensive themes observed across the articles featured below.
Top ATT&CK Techniques
T1566 – Phishing: Fake software, VPN pages, event lures, malvertising, and ClickFix-style prompts continued to turn trusted brands and workflows into initial-access paths.
T1071 – Application Layer Protocol: Attackers hid C2 and delivery traffic within legitimate or familiar services, including DNS/DoH, cloud infrastructure, developer platforms, and remote-management tools.
T1195 – Supply Chain Compromise: Trojanized packages, developer extensions, forged commits, and compromised software components kept development environments firmly in the attack path.
What Matters Most
Trusted infrastructure remains a recurring theme. Attackers are increasingly blending malicious activity into services, software, and workflows users already expect to trust – from cloud and developer ecosystems to VPNs and remote-management tools.
Developer environments also stand out this period, with multiple campaigns targeting packages, repositories, extensions, and software dependencies as routes to credentials, execution, or downstream access.
What Defenders Should Watch
- Fake software, VPN, meeting, and productivity pages used for credential theft or malware delivery
- ClickFix-style prompts and other user-assisted execution techniques
- Unexpected packages, extensions, commits, or changes in developer environments
- C2 or payload delivery through DNS/DoH, cloud services, and legitimate remote-access tools
Key Insight: Attackers continue to gain leverage by making malicious activity look like normal use of trusted software, infrastructure, and developer workflows.
Articles
Our Mid October 2026 Cyber Threat Reports highlight research into phishing, malware, exploitation, supply-chain compromise, and malicious infrastructure. This edition also shows attackers continuing to abuse trusted software, cloud and developer services, DNS, and familiar user workflows to disguise malicious activity and gain access.
IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime
Source: ANY.RUN
(Published: 10/6/2026)
IronChain ransomware combines destructive encryption behavior, SYSTEM-level persistence, and multiple kernel drivers, creating a significant risk of permanent data loss. Read more.
More RMM Tools In the Wild
Source: SANS Internet Storm Center
(Published: 10/6/2026)
SANS Internet Storm Center published technical research examining the activity described in this report. Read more.
Beyond Valid Credentials: How Exposed AWS Keys Are Tested for Amazon Bedrock Access
Source: Datadog Security Labs
(Published: 10/6/2026)
Datadog Security Labs examined tooling used in the wild to validate exposed AWS credentials and determine whether compromised keys provide access to Amazon Bedrock. Read more.
More Shells Than A Seafood Buffet Tracking Citrix Netscaler Exploitation Activities Cve 2026 88771
Source: eSentire
(Published: 10/6/2026)
Zscaler ThreatLabz analyzed in-the-wild exploitation of critical NetScaler remote-code-execution vulnerability CVE-2026-88771. Read more.
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Source: Huntress
(Published: 10/6/2026)
Huntress analysts reconstructed an Akira ransomware intrusion involving RDP access, antivirus disabling, Rclone data exfiltration, tunneling, and ransomware deployment. Read more.
DarkSword/Coruna Open Directory Finding Report
Source: Censys
(Published: 10/7/2026)
Open directories exposed components of the DarkSword/Coruna iOS exploit-and-harvest platform, including active infrastructure and victim data. Read more.
From Guest Complaints to Malware: Blockchain Abuse Targets Hotels
Source: Cofense
(Published: 10/7/2026)
Cofense Intelligence tracked email campaigns targeting the accommodation industry with fake guest complaints and reviews that deliver blockchain-abusing malware. Read more.
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance
Source: CrowdStrike
(Published: 10/7/2026)
Researchers investigated ARTEX-linked activity and infrastructure associated with targeting and reconnaissance against financial and critical-infrastructure organizations. Read more.
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Source: Huntress
(Published: 10/7/2026)
Huntress observed a phishing campaign abusing legitimate Microsoft Power BI infrastructure to direct victims toward rogue remote-management tooling. Read more.
Canto Incognito Tracking The Poellm Malware
Source: Lumen
(Published: 10/7/2026)
Lumen researchers tracked PoELLM malware infrastructure and the command-and-control mechanisms supporting the campaign. Read more.
Vulcanrat207 A Intrusion Chain Explained
Source: Morphisec
(Published: 10/7/2026)
Morphisec researchers analyzed a multi-stage intrusion chain delivering VulcanRAT and documented the techniques used across execution and persistence. Read more.
Ignore All Instructions and Read This Blog: The State of AI-Analysis Evasion in Malware
Source: Cisco Talos
(Published: 10/8/2026)
Cisco Talos examined how malware authors are attempting to manipulate or evade AI-assisted analysis workflows. Read more.
UAT-11985: AI-Assisted Event Lures Delivering Real-Time Google AitM Phishing
Source: Cisco Talos
(Published: 10/8/2026)
Cisco Talos analyzed UAT-11985 activity using event-themed lures and adversary-in-the-middle phishing against Google accounts. Read more.
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data
Source: Gen Digital
(Published: 10/8/2026)
Gen researchers analyzed Warden Stealer, a Rust-based infostealer that targets traditional credential stores as well as data associated with AI agents. Read more.
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Source: Huntress
(Published: 10/8/2026)
Huntress observed exploitation of critical AhsayCBS vulnerabilities to deploy webshells and XMRig cryptocurrency miners. Read more.
How Bluemoon Exploits Chrome Cve 2026 85046 And Cve 2026 87491
Source: Picus Security
(Published: 10/8/2026)
Picus Security examined BlueMoon exploitation of Chrome vulnerabilities CVE-2026-85046 and CVE-2026-87491. Read more.
Matchboil New Tricks Same Old Evil Intentions
Source: ESET Research
(Published: 10/8/2026)
ESET Research documented the evolution of MATCHBOIL, a C# downloader used by Russia-aligned UAC-0099 against organizations in Ukraine. Read more.
Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
Source: Zscaler ThreatLabz
(Published: 10/8/2026)
Zscaler ThreatLabz uncovered a suspected TraderTraitor campaign using a trojanized Terraform provider to deliver cross-platform malware. Read more.
Analysing a Novel Malicious Redirect and Cloaking Technique
Source: Push Security
(Published: 10/9/2026)
Push Security analyzed a malicious redirect and cloaking technique that abuses search-engine results as part of a malvertising delivery chain. Read more.
Analyzing AI-Themed ClickFix, InstallFix & LLMshare Attacks
Source: Push Security
(Published: 10/9/2026)
Push Security analyzed recent malware-delivery campaigns using AI-themed ClickFix, InstallFix, and LLMshare social-engineering techniques. Read more.
Insomnia RAT: A Dual-Payload Backdoor
Source: Stairwell
(Published: 10/9/2026)
Stairwell analyzed Insomnia RAT, a backdoor that uses a dual-payload design to establish remote access on compromised systems. Read more.
Artex Ai Linked Infrastructure Observed Scanning Uk Cni Discovery And Associated Services
Source: Bridewell
(Published: 10/9/2026)
Researchers investigated ARTEX-linked activity and infrastructure associated with targeting and reconnaissance against financial and critical-infrastructure organizations. Read more.
DNS as C2 in Noir, an AI-Developed Crypto Wallet Drainer
Source: Infoblox Threat Intel
(Published: 10/9/2026)
Infoblox Threat Intel analyzed the Noir wallet drainer, which uses DNS TXT records over DoH to dynamically locate its active backend infrastructure. Read more.
GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
Source: StepSecurity
(Published: 10/9/2026)
StepSecurity observed compromised maintainer accounts pushing malicious GitHub Actions workflows that steal repository secrets and credentials from Git history. Read more.
Azure30 Nodejs Backdoor Trojanized Msi Clickfix
Source: ThreatHunter.ai
(Published: 10/9/2026)
ThreatHunter.ai analyzed a Node.js backdoor delivered through a trojanized MSI and ClickFix-style social engineering. Read more.
Auditing the Auditor: Unmasking Apex Accelerator
Source: Elastic Security Labs
(Published: 10/12/2026)
Elastic Security Labs uncovered a fake Web3 accelerator using malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware. Read more.
Detecting AtlasRAT C2
Source: Netresec
(Published: 10/12/2026)
Netresec published technical research examining the activity described in this report. Read more.
RSVP to Disaster: How One Click Installs a RAT
Source: Cofense
(Published: 10/13/2026)
Cofense analyzed a phishing campaign in which a single click ultimately installs remote-access malware on the victim system. Read more.
MALFEX Moves Its npm Loader into a Native Windows DLL
Source: SafeDep
(Published: 10/13/2026)
SafeDep analyzed a MALFEX campaign that moved its npm loader into a native Windows DLL to complicate analysis and detection. Read more.
Vibe Coding Vs Code Extension Monitors Developer Activity
Source: Akamai
(Published: 10/13/2026)
Akamai researchers examined a VS Code extension that monitors developer activity in environments using AI-assisted coding workflows. Read more.
Fake WatchGuard VPN Site Steals Credentials
Source: Huntress
(Published: 10/13/2026)
Huntress investigated a fake WatchGuard VPN site that captures VPN credentials before delivering the genuine signed WatchGuard installer. Read more.
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
Source: Volexity
(Published: 10/13/2026)
Volexity identified active exploitation of an Ivanti Connect Secure zero-day chain that provides unauthenticated root-level code execution. Read more.
Fake AI Tools Put US Companies at Risk: Inside Counterfeit Claude, ChatGPT, and Copilot
Source: ANY.RUN
(Published: 10/14/2026)
ANY.RUN analyzed counterfeit Claude, ChatGPT, and Copilot tools used to deliver malware to users at U.S. organizations. Read more.
Break the Silence: Kazakhstan-Nexus UAT-6275 Targets CIS Government Organizations
Source: Cisco Talos
(Published: 10/14/2026)
Cisco Talos analyzed Kazakhstan-nexus UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. Read more.
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Source: Unit 42
(Published: 10/14/2026)
Unit 42 investigated PEERSTITCH, a stealthy FortiGate implant observed after exploitation of a FortiManager appliance. Read more.
DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel
Source: Bitsight
(Published: 10/14/2026)
Bitsight profiled DragonForce ransomware activity, infrastructure, and tactics associated with the group. Read more.
From ClickFix to C2: Comparative Analysis of Two Malware Loaders
Source: Forescout
(Published: 10/14/2026)
Forescout compared two malware loaders delivered through ClickFix-style social engineering and traced their paths from initial execution to command and control. Read more.
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
Source: Group-IB
(Published: 10/14/2026)
Group-IB analyzed KGB RAT, a Windows remote-access trojan designed for surveillance, credential theft, and persistent control. Read more.
Fake Calendly Meta Careers Pages Steal Facebook And Google Logins
Source: Malwarebytes
(Published: 10/14/2026)
Malwarebytes investigated fake Calendly and Meta careers pages designed to steal Facebook and Google account credentials. Read more.
Disruption Targets Major Chinese-Language Phishing Kits with Japanese Focus
Source: Proofpoint
(Published: 10/14/2026)
Proofpoint detailed disruption of major Chinese-language phishing kits responsible for high-volume campaigns targeting Japanese organizations. Read more.
Sanctioned Still Connected How Aezas Infrastructure Supply Chain Survived
Source: Qurium
(Published: 10/14/2026)
Qurium traced infrastructure relationships showing how sanctioned Aeza-linked hosting resources continued to support malicious operations. Read more.
Iron Man Yamstore Powering A Global Phishing As A Service Ecosystem
Source: Resecurity
(Published: 10/14/2026)
Resecurity examined Iron Man and YAM Store infrastructure supporting a global phishing-as-a-service ecosystem. Read more.
LegionRelay: Ukraine Targeted by Five Previously Unidentified C2 Servers
Source: Team Cymru
(Published: 10/14/2026)
Team Cymru mapped LegionRelay command-and-control servers and related infrastructure associated with activity targeting Ukraine. Read more.
Hirudo: From Fake Updates to Patched Banking Apps
Source: ThreatFabric
(Published: 10/14/2026)
ThreatFabric identified Hirudo, an Android banking RAT that replaces legitimate banking apps with patched copies designed to bypass built-in security checks. Read more.
Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
Source: Citizen Lab
(Published: 10/15/2026)
Citizen Lab documented AdFection, a technique that delivered zero-click mercenary spyware through targeted advertising. Read more.
ARMORY CASTLE Exploits BeyondTrust
Source: Google Threat Intelligence Group
(Published: 10/15/2026)
Google Threat Intelligence Group investigated ARMORY CASTLE exploitation of BeyondTrust Remote Support and the activity that followed successful compromise. Read more.
Investigating Ephemeral Supply Chain Tampering
Source: Google Threat Intelligence Group
(Published: 10/15/2026)
Google Threat Intelligence Group investigated ephemeral software supply-chain tampering designed to leave minimal evidence after malicious code execution. Read more.
Cooldown or Compromise: The Three-Day Rule for npm and PyPI
Source: Eye Security
(Published: 10/15/2026)
Eye Security examined how dependency cooldown periods for npm and PyPI can reduce exposure to newly published malicious or compromised packages. Read more.
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Source: Unit 42
(Published: 10/15/2026)
Unit 42 identified an espionage campaign targeting government and state-affiliated Linux infrastructure with payloads containing signs of AI-assisted development. Read more.
ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform
Source: Forescout
(Published: 10/15/2026)
Forescout analyzed ROMULUS, a multi-payload ClickFix delivery platform used to distribute malware through social-engineering chains. Read more.
Silent Ransom Group Leaked Chats: Key Findings by GRIT
Source: GuidePoint Security
(Published: 10/15/2026)
GuidePoint Security analyzed leaked Silent Ransom Group communications for insight into the group’s operations and extortion tradecraft. Read more.
Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection
Source: Infoblox Threat Intel
(Published: 10/15/2026)
Infoblox Threat Intel linked the long-running Help TDS operation to Hotejka and examined its use of Cloudflare Pages and related infrastructure. Read more.
How RL Mapped A Midnight Blizzard Linked Campaign From Two Hashes
Source: ReversingLabs
(Published: 10/15/2026)
ReversingLabs showed how two malware hashes were used to map a broader campaign linked to Midnight Blizzard. Read more.
QuartzLine: A Working PDF Viewer with a Backdoor Inside
Source: Expel
(Published: 10/16/2026)
Expel analyzed QuartzLine, a functional Windows PDF viewer containing a hidden backdoor capable of executing commands and installing additional malware. Read more.
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Source: Huntress
(Published: 10/16/2026)
Huntress investigated unauthorized Microsoft 365 access enabled by compromised vendor credentials associated with ConnectWise Cloud Backup and SkyKick. Read more.
PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
Source: Wordfence
(Published: 10/16/2026)
Wordfence investigated malicious code introduced through the Rank Math SEO Pro software supply chain. Read more.
CVE-2026-88771: Inside Exploitation of a Critical NetScaler RCE Vulnerability
Source: Zscaler ThreatLabz
(Published: 10/16/2026)
Zscaler ThreatLabz analyzed in-the-wild exploitation of critical NetScaler remote-code-execution vulnerability CVE-2026-88771. Read more.
A Honeypots Tale Deconstructing An Attack On Genai Infrastructure
Source: Sekoia.io
(Published: 10/19/2026)
Sekoia.io deconstructed an attack observed against generative-AI infrastructure through honeypot telemetry. Read more.
Slaiclind: analyzing a campaign combining ClickFix and EtherHiding
Source: Stormshield
(Published: 10/19/2026)
Stormshield researchers analyzed the SLAICLIND campaign and its payload delivery and execution techniques. Read more.
Forged Commits Push a preinstall Dropper into hugo-paper and mevn-cli
Source: SafeDep
(Published: 10/20/2026)
SafeDep found forged commits used to introduce a preinstall dropper into the hugo-paper and mevn-cli open-source packages. Read more.
Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries
Source: Security.com
(Published: 10/20/2026)
Security.com researchers analyzed Swallowtail activity targeting organizations connected to Russia and NATO. Read more.
BRONZE SANDCASTLE Deploys Modified Meterpreter Shells
Source: Sophos
(Published: 10/20/2026)
Sophos researchers investigated BRONZE SANDCASTLE incidents characterized by DLL sideloading and modified Meterpreter payloads. Read more.
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
Source: Wiz
(Published: 10/20/2026)
Wiz incident responders investigated campaigns that phish privileged cloud users and hijack victim billing accounts to fund unauthorized LLM usage. Read more.
CodeAIAssistant: The VS Code MCP Install Prompt That Hides Its Payload
Source: Yeeth Security
(Published: 10/20/2026)
Yeeth Security examined a malicious CodeAIAssistant installation flow involving MCP-related prompts and developer tooling. Read more.
Want more articles? Check out the previous edition of Security Signals here.
Free Evaluation
Gain a comprehensive view of the external cyber landscape with Malware Patrol’s Cyber Threat Intelligence (CTI) services. We cover a broad spectrum of malicious activities, including malware, ransomware, phishing, cryptominers, newly registered domains, and command-and-control servers to equip your organization with the insights needed to proactively detect and mitigate potential attacks.
Take advantage of a free trial to test our data for yourself.