Welcome to Security Signals
Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.
For more articles, check out our #onpatrol4malware blog.
Our Latest Blog Post
August 2026 Edition
Key stats from real-world telemetry and live attack observations over the past month – a concise look at what we’re seeing across malware, phishing, ransomware, C2s, and domain abuse.
Insights (TL;DR)
To help maximize your time, these insights summarize the most common attacker behaviors, techniques, and defensive themes observed across the articles featured below.
Top ATT&CK Techniques Observed
T1566 – Phishing: ClickFix and related lures, fake software downloads, SEO poisoning, job-themed lures, and IT-support impersonation remained common paths to initial access.
T1071 – Application Layer Protocol: Attackers continued placing C2 and malware delivery within legitimate or trusted services, including Cloudflare, Google-hosted infrastructure, WebDAV, and remote-access tooling.
T1195 – Supply Chain Compromise: Developer ecosystems remained a target, with compromised npm packages spreading malicious code, stealing cloud credentials, and in some cases propagating into additional packages.
What Matters Most
Trusted infrastructure was a recurring feature of this period’s activity. ClickFix campaigns, cloud-hosted C2, legitimate remote-access software, compromised websites, and software distribution channels all gave attackers ways to blend malicious activity with expected traffic and tools.
Information theft also featured heavily, alongside ransomware, espionage activity, and new RATs and stealers targeting enterprise and government environments.
What Defenders Should Watch
- ClickFix, fake downloads, SEO poisoning, and IT-support impersonation
- C2 or payload delivery through trusted cloud and web services
- Unexpected npm packages, remote-access tools, and software installations
- Credential and information theft followed by account or system access
Key Insight: Attackers repeatedly used trusted services, software, and infrastructure to disguise initial access, malware delivery, and C2 activity, reducing the value of reputation alone as a detection signal.
Articles
Early September 2026 Cyber Threat Reports highlight new malware and infostealers, phishing and social engineering campaigns, ransomware activity, supply-chain compromises, and actively exploited vulnerabilities. This edition also examines evolving ClickFix techniques, state-linked threat activity, malicious infrastructure, and attacks targeting software dependencies, AI services, and enterprise environments.
Dark Caracal Reloaded: New Malware, Same Hunting Grounds
Source: Arctic Wolf Labs
(Published: 8/26/2026)
During a targeted intrusion investigation, Arctic Wolf uncovered GoCaracal, a previously undocumented, modular framework written in Go. Read more.
Built to Blend: Miraak’s Modular Post Exploitation Framework
Source: Blackpoint Cyber
(Published: 8/26/2026)
Blackpoint’s Adversary Pursuit Group identified Miraak, a previously undocumented post exploitation framework, through proactive threat hunting. Read more.
Cambodia-Focused Cluster Uses Multi-Stage Infection Chain With Localized Lures
Source: Acronis
(Published: 8/26/2026)
Acronis’ Threat Research Unit identified a recent campaign focused on Cambodia. Read more.
‘The Gentlemen’ Profile: Why This Ransomware Group Wants In Before It Locks You Out
Source: Bitsight
(Published: 8/26/2026)
The Gentlemen is a financially motivated ransomware group that combines data theft with encryption to increase pressure on victims. Read more.
ClickFix via Cloudflare Zaraz and the BW Panel
Source: DERP
(Published: 8/26/2026)
A malicious JavaScript action served through Cloudflare Zaraz on edgeupstudio[.]com loaded a BW Panel bootstrap used by ErrTraffic ClickFix campaigns. Read more.
Tortoiseshell: New Toolset and Operational Infrastructure Exposed
Source: Group-IB
(Published: 8/26/2026)
Group-IB Threat Intelligence began investigating Tortoiseshell activity following public reporting by Kaspersky. Read more.
The Infrastructure Quartermaster: Inside a China-Nexus State Enablement Model
Source: Lumen Black Lotus Labs
(Published: 8/26/2026)
When advanced threat actors want to stay hidden, the infrastructure they use can matter as much as the tools for gaining access. Read more.
Beware of Fake Indeed Interview Apps Used to Install Spyware
Source: Malwarebytes
(Published: 8/26/2026)
From several independent reports, we’ve seen evidence of scammers using fake Android “interview” apps to target job seekers on the Indeed platform. Read more.
ModeloRAT Malware: How the CrashFix Campaign Delivers a Python RAT
Source: Picus Security
(Published: 8/26/2026)
ModeloRAT is a Python-based Windows Remote Access Trojan first observed in January 2026, delivered only to domain-joined hosts in enterprise environments. Read more.
Inhospitable: Tracking Russian Cyber Espionage Infrastructure
Source: Validin
(Published: 8/26/2026)
On August 20, 2026, the Google Threat Intelligence Group published research on several Russian cyber espionage threat clusters. Read more.
Open Directory Exposes Moobot Source Code and Activity
Source: Censys
(Published: 8/27/2026)
An open web directory, exposed on 30 July 2026, held the source code for Moobot, a variant of the Mirai DDoS malware. Read more.
Caught in 4K: The Aurora Files
Source: CloudSEK
(Published: 8/27/2026)
An exposed open directory revealed months of activity belonging to a Russian-speaking Aurora ransomware affiliate, active against more than twenty organisations. Read more.
The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
Source: Huntress
(Published: 8/27/2026)
As more people use AI models, threat actors are abusing trusted AI platforms in a variety of ways to trick users into downloading malware. Read more.
Carry-On Compromise: TA4922 Packs PackClient
Source: Proofpoint
(Published: 8/27/2026)
Proofpoint researchers recently discovered a RAT framework we named PackClient. Read more.
Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More
Source: TrendAI Research
(Published: 8/27/2026)
TrendAI Research tracked three campaigns that ship completely different decoy applications and unrelated payloads, all riding one shared toolkit. Read more.
Stolen Creds and Stinging Loaders: An Initial Access Campaign via SEO Poisoning
Source: WithSecure
(Published: 8/27/2026)
WithSecure is tracking an ongoing campaign that leverages SEO poisoning with the goal of gaining initial access into victim environments. Read more.
Inside 90 Days of Attacks on AI Infrastructure
Source: Wiz
(Published: 8/27/2026)
Wiz Threat Research operates honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others. Read more.
The Video That Plays You: Fake MP4 File Carries Malicious Payload
Source: Censys
(Published: 8/28/2026)
On 22 August 2026, Censys ARC observed a Cloudflare-fronted host serving raw PowerShell as text/html over port 80. Read more.
The StealC Info-Stealing Chain Behind the Qwen Impersonation Repository
Source: SlowMist
(Published: 8/28/2026)
When downloading an open-source large model, you usually worry about whether it can run properly and whether the weights are authentic. Read more.
Popular Code Generator for TanStack Query Hit by Supply Chain Worm
Source: Aikido Security
(Published: 8/28/2026)
A supply chain worm was found hiding in @7nohe/openapi-react-query-codegen, a popular code generator for TanStack Query, stealing credentials and spreading itself. Read more.
Mini Shai-Hulud Worm Hits openapi-react-query-codegen, Spreads Across npm, RubyGems, and PyPI
Source: Endor Labs
(Published: 8/28/2026)
A compromised release of @7nohe/openapi-react-query-codegen runs a dropper on install through three separate triggers, then harvests cloud credentials and republishes itself. Read more.
TerminalFix Campaign Deploys Reverse Tunnel Through Multistage Intrusion
Source: Microsoft Security
(Published: 8/28/2026)
Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. Read more.
Mini Shai-Hulud Strikes Again: openapi-react-query-codegen
Source: SafeDep
(Published: 8/29/2026)
On August 28, 2026, an attacker published 10 malicious versions of @7nohe/openapi-react-query-codegen to npm. Read more.
Reverse Engineering the Auto-Color Linux Backdoor
Source: Zyad Waleed Elzyat
(Published: 8/30/2026)
Static and dynamic analysis of Auto-Color’s execution flow, C2 communication, and LD_PRELOAD rootkit. Read more.
Fire Ant Evolves: From Hypervisors to Trusted Infrastructure
Source: Sygnia
(Published: 8/30/2026)
Fire Ant, first reported in 2025, remained active in 2026 and expanded its operations beyond hypervisors into trusted infrastructure. Read more.
So Your CFO’s Phone Has Been Pwned: A DFIR Journey
Source: Censys
(Published: 8/31/2026)
Your CFO’s phone has malware on it. Read more.
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
Source: Check Point Research
(Published: 8/31/2026)
JSCeal is a stealer delivered as compiled V8 bytecode and executed by a bundled Node.js runtime, targeting cryptocurrency applications. Read more.
ValleyRAT Masquerading as Adware
Source: Kaspersky Securelist
(Published: 8/31/2026)
Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download. Read more.
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Source: Palo Alto Networks Unit 42
(Published: 8/31/2026)
Between January and April 2026, we uncovered a coordinated social engineering operation that leveraged external Microsoft Teams accounts to masquerade as IT help desk personnel. Read more.
Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem
Source: Group-IB
(Published: 8/31/2026)
The Group-IB Threat Intelligence team has identified BraZetsu, a sophisticated Python-based Windows malware framework. Read more.
Daisy-Chaining Trust: Investigating Faronics Deploy Abuse
Source: Huntress
(Published: 8/31/2026)
Huntress has identified a surge in phishing campaigns that abuse Faronics Deploy, with more than 457 endpoints encountering Faronics-related lures. Read more.
Guildma (Astaroth) Malware Infection From Brazilian Portuguese Email
Source: SANS Internet Storm Center
(Published: 9/1/2026)
On Monday 2026-08-31, I used a link from a malicious Brazilian Portuguese email to infect a Windows host in my lab. Read more.
A Malicious npm Package Hidden Three Dependencies Deep: The ulid-xyz Delivery Chain
Source: SafeDep
(Published: 9/1/2026)
SafeDep malicious package analysis flagged ulid-xyz on npm in June 2026. Read more.
Dual-RMM Phishing and PowerShell RAT Campaign Hits SLTTs
Source: Center for Internet Security
(Published: 9/1/2026)
The CIS Cyber Threat Intelligence team identified an active phishing campaign that is opportunistically targeting multiple U.S. SLTT government networks. Read more.
Peer Pressure: Inside the Sality Botnet Disruption Operation
Source: CrowdStrike
(Published: 9/1/2026)
On August 31, 2026, CrowdStrike’s Counter Adversary Operations team executed a coordinated disruption of the Sality peer-to-peer botnet. Read more.
Counterfeit Installers Lead to System Compromise in Deceptive Software Download Campaign
Source: Microsoft Security
(Published: 9/1/2026)
Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. Read more.
Ungentlemanly Behavior: Insights Into a Ransomware Operation
Source: Sophos
(Published: 9/1/2026)
Counter Threat Unit researchers identified a consistent post-exploitation playbook used in The Gentlemen ransomware-as-a-service scheme. Read more.
Gaming the System: How a Chinese-Speaking Actor Turned Brazilian Government Sites Into an SEO Weapon
Source: Check Point Research
(Published: 9/2/2026)
Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. Read more.
REVSTEALER Ramps Up: Analysis of an Up-and-Coming Infostealer
Source: Elastic Security Labs
(Published: 9/2/2026)
Elastic Security Labs is tracking an emerging infostealer, REVSTEALER, under REF2859. Read more.
Impersonating IT Support: Threat Actors Turn Remote Session Into Enterprise-Wide Access
Source: Microsoft Security
(Published: 9/2/2026)
Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support. Read more.
Python NodeStealer: AI-Assisted to Full Spyware
Source: Netskope Threat Labs
(Published: 9/2/2026)
Since 2023, Netskope Threat Labs has been tracking the Python-based NodeStealer, an infostealer targeting sensitive browser data and Facebook accounts. Read more.
Detection and Removal of the Syslogk Rootkit in a Linux Environment
Source: AhnLab ASEC
(Published: 9/3/2026)
The AhnLab SEcurity intelligence Center continuously monitors various threats targeting Linux environments. Read more.
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
Source: Palo Alto Networks Unit 42
(Published: 9/3/2026)
We have analyzed two ongoing, multi-stage network intrusion and data-exfiltration campaigns targeting organizations in Latin America. Read more.
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Source: Huntress
(Published: 9/3/2026)
Recently, Huntress observed a strange pattern across unrelated endpoints within several different organizations that we protect. Read more.
Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
Source: Wordfence
(Published: 9/3/2026)
On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms. Read more.
ASCII Smuggling Crosses Over From AI Prompt Injection to Phishing Evasion
Source: Microsoft Security
(Published: 9/3/2026)
Microsoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized in AI prompt injection research as ASCII Smuggling. Read more.
Contagious Interview Steps Outside the Developer Workflow
Source: Jamf Threat Labs
(Published: 9/3/2026)
Jamf Threat Labs identified a cluster of macOS disk images and installer packages impersonating known Mac applications. Read more.
Analyzing a Go-Based IoT Self-Propagating DDoS Botnet
Source: Akamai
(Published: 9/3/2026)
This Go-based Internet of Things botnet combines an independently operating scanner with a command and control client. Read more.
Angry Birds: Toy Ghouls’ New Toys
Source: Kaspersky Securelist
(Published: 9/4/2026)
We continue tracking the activity of Toy Ghouls, a financially motivated group that has been targeting Russian organizations since 2025. Read more.
Critical Vulnerabilities in MikroTik RouterOS Are Being Actively Exploited
Source: CERT Polska
(Published: 9/5/2026)
The CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS. Read more.
StyleSmuggler: Magento and Adobe Commerce 0-Day RCE Under Active Attack
Source: Sansec
(Published: 9/5/2026)
Sansec discovered StyleSmuggler, a Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. Read more.
Chinese Darcula Phishing Kit Harvesting Taiwanese Credit Card Data
Source: TeamT5
(Published: 9/7/2026)
In May, we intercepted a phishing campaign harvesting Taiwanese credit card data. Read more.
Shai-Hulud Rises From the Dead After 111 Days
Source: Aikido Security
(Published: 9/7/2026)
Do you remember the Shai-Hulud attack that hit @AntV on May 19th, 2026? Read more.
Beyond Lazarus: Organization of DPRK Cyber Capabilities
Source: Sekoia
(Published: 9/7/2026)
The Democratic People’s Republic of Korea has established itself as one of the more prominent state actors in cyberspace. Read more.
ClearFake WebDAV Infection Chain Delivers Amatera Stealer, ZigCryptoStealer, and NetSupport Manager
Source: Cisco Talos
(Published: 9/8/2026)
In April 2026, Cisco Talos identified an unusual WebDAV DLL execution in endpoint telemetry from a Ukrainian government organization. Read more.
ClickFix Moves Into the Browser: Cryptocurrency Theft With Google-Hosted C2
Source: Cisco Talos
(Published: 9/8/2026)
Cisco Talos has recently observed a criminal campaign that leveraged an interesting twist on what we refer to as legitimate service abuse. Read more.
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
Source: SOCRadar
(Published: 9/8/2026)
One of the most common entry points for attackers is the exploitation of public-facing edge devices such as VPNs, routers, and firewalls. Read more.
MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures
Source: Seqrite
(Published: 9/8/2026)
MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service model. Read more.
Want more articles? Check out the previous edition of Security Signals here.
Free Evaluation
Gain a comprehensive view of the external cyber landscape with Malware Patrol’s Cyber Threat Intelligence (CTI) services. We cover a broad spectrum of malicious activities, including malware, ransomware, phishing, cryptominers, newly registered domains, and command-and-control servers to equip your organization with the insights needed to proactively detect and mitigate potential attacks.
Take advantage of a free trial to test our data for yourself.