September 12, 2026
- CL-CRI-1171 has operated a pay-per-install service for at least two years. Unit 42 mapped more than 10,000 distinct OfferLoader samples and at least 11 gaming-focused YouTube channels, plus an SEO-poisoning funnel that reached corporate, government, and critical-infrastructure endpoints. Payloads observed between July 2025 and April 2026 included Insomnia RAT, Docro Hijacker, and ARKTunnel. · Threat Activity
in Researchers Tie OpenAI’s Agent Swarm to a 2,000-Package RubyGems Attack