[blinder-tunnel]

October 13, 2026

• Blinder Tunnel has a new, invisible variant. Nextron went hunting after Unit 42's reporting and found RuntimeBroker.dll sitting at 0 of 71 VirusTotal detections six weeks after its 25 August submission from the Iraq region, with infrastructure not in prior write-ups: a Cloudflare Workers relay, a new PeakyBlindersTeam GitHub account, and per-victim-encrypted credential-rotation instructions hidden in HTML comments on Microsoft/vscode issues. Delivery was an Inno Setup installer themed as a Dubai Airport careers IT assessment (Nextron). Unit 42 separately reported the Iran-aligned actor hitting Middle East aviation and telecom with weaponised .csproj files and GitHub C2 (@Unit42_Intel; earlier coverage). · Threat Intelligence

in Malware That Lives Off the Victim's AI Tooling