Drive-by

November 5, 2026

• APT29 "PoisonedSource" watering holes delivered zero-click n-day chains to iOS and Android. Sekoia attributes with moderate-to-high confidence; the actor compromised Ukrainian web analytics provider Plerdy and modified its SEO tracker — loaded by thousands of mostly Ukrainian sites between August 27 and September 3 — alongside a Ukrainian gas producer, a US chemical trade association and a Bulgarian military site, plus AitM lookalikes of America250 and Raffles London. Profiling JavaScript selected the chain: Safari cookie theft on iOS 16.7 (CVE-2025-43529, CVE-2024-27834); WhatsApp/Telegram databases, Keychain credentials, location and photos on iOS 18.5 (five CVEs); and AndroSnitch against Chrome for Android 139–145, excluding 143 (Sekoia, BleepingComputer). · Threat Activity

November 2, 2026

• Zimperium zLabs details Coruna and DarkSword, two iOS exploit frameworks selected by target iOS version and delivered via hidden iframes across 608 domains between February 2025 and October 2026 — often from compromised legitimate sites rather than disposable lures, with shared loaders and supply-chain-compromised code. The chains reach Safari/WebAssembly and sandbox-escape primitives, disable code-signing and TLS checks, steal data including Apple Notes and app inventory, then erase traces (Zimperium). · Threat Intelligence

October 26, 2026

• Spoofed ChatGPT Custom GPTs delivered a ClickFix-driven RAT. Huntress confirmed that two of at least 40 campaign-related incidents reached victims through malicious Custom GPTs, which redirected them to a fake verification site before an MSI, DLL-sideloading chain and persistent RAT were installed. As of October 14, Huntress was still seeing affected organizations and rotating delivery domains (Huntress). · AI & Agent Security

October 20, 2026

• Researchers are mapping Coruna-like and DarkSword iOS exploit-kit infrastructure across compromised commerce sites. Unit 42 observed associated pages directing iPhone visitors to reopen content in Safari. A later community tally cited 183 affected websites, with vulnerable PrestaShop instances implicated as one compromise vector and retrohunt evidence extending to July. Those counts represent compromised sites, not confirmed infected phones. Unit 42 and vx-underground · Threat Activity

October 15, 2026

• Malicious ChatGPT Custom GPTs remain an active ClickFix lure. Huntress says attackers are rotating Google Sites and standalone domains that direct users from legitimate ChatGPT-hosted pages into PowerShell-based malware installation. Its SOC handled at least 40 incidents tied to one campaign domain, with two confirmed as originating through a Custom GPT. Huntress · AI & Model Security · also via phishing email

September 29, 2026

• Browser-locking scareware uses the HTML5 Keyboard Lock API to trap victims full-screen in a fake antivirus lockout with a fraudulent support number, served from disposable cloud storage buckets (Unit 42). One practitioner suggests disabling the API on shared and kiosk profiles as a cheap mitigation. · Threat Activity

September 21, 2026

• A DarkSword-linked iOS exploit kit is live in the wild, with redirects pointing at an OKX subdomain and a fake OKX CAPTCHA page, suggesting the crypto exchange's users are the target (malwrhunterteam). The same researcher flagged a second staging host with an OKX redirect and a code comment dated last week about iPad support. Separately, SlowMist published an analysis of FomoPeek App Store poisoning chained with iOS kernel exploitation, also tagged DarkSword (SlowMist). · Threat Activity

September 18, 2026

• MovieReaper spreads through compromised torrents, uses "The Odyssey" rootkit and Solana blockchain records for C2 resolution, and masquerades as legitimate system files; Kaspersky assesses that taking down its initial C2 domain would meaningfully disrupt the campaign (Securelist). · Threat Activity

August 14, 2026

• AmnesiaStealer targets macOS via ClickFix lure. A new Rust-based stealer spread through a fake "verified publisher" GitHub download page hijacks Chromium sessions for live browser control, deployed after victims paste a Base64 command into Terminal. (The Hacker News) · Threat Activity · also via phishing email

August 13, 2026

• A fake CCleaner download page installs "GhostDesk," a malicious Chrome extension acting as in-browser spyware, per Malwarebytes. · Threat Activity

August 8, 2026

• A new ClickFix variant abuses pcalua.exe to launch a WebDAV share over per-victim tokenized URLs, side-loading a spoofed DLL via rundll32 to deploy infostealers. A parallel macOS strain in the same campaign drops a stealer that drains crypto wallets. Unit 42, The Hacker News · Threat Activity

August 7, 2026

• A macOS ClickFix campaign learned to hide behind browser fingerprinting — 250+ front-end domains now gate visitors before serving a Go-based infostealer that steals crypto, browser passwords, and Keychain data, evading crawlers and sandboxes. A Windows variant abuses pcalua.exe and tokenized WebDAV shares. Microsoft, BleepingComputer · Threat Activity

August 2, 2026

• South Korean state-sponsored campaign abuses AnySign4PC via compromised sites. Authorities and four security firms detailed a watering-hole operation exploiting locally installed financial-security software to silently deploy SIGNBT and COPPERHEDGE backdoors with no user prompt (The Hacker News). A parallel "Operation Double Barrel" abuses WebSocket buffer overflows in two Korean financial-security products, with one intrusion chain delivering Gunra ransomware (blackorbird). · Threat Intelligence

July 30, 2026

• A patched Firefox JIT flaw (CVE-2026-10702) can be triggered by a single malicious webpage — and was used to compromise Tor Browser. Nebula Security says the bug yields arbitrary code execution in the renderer with no settings changes or extra interaction; Mozilla fixed it in Firefox 151.0.3. The Hacker News · Vulnerabilities & Exploits

July 25, 2026

• Rhadamanthys impersonates RingCentral after a takedown. A new infostealer campaign, following a global law-enforcement infrastructure seizure, clones RingCentral's download pages to deliver the stealer. Unit 42. · Threat Activity

July 24, 2026

• ClickFix detections doubled (+108%) H2 2025→H1 2026 as ESET tracks new variants: AI-fix pages impersonating Anthropic Artifacts, OpenAI Canvas and Copilot Pages; CrashFix fake browser crashes; and ConsentFix OAuth abuse. ESET. · Threat Activity

July 20, 2026

• wp2shell exploitation broadened in the wild. SecurityWeek confirmed active attacks against CVE-2026-63030 and CVE-2026-60137 shortly after disclosure, and NCSC-FI's Daniel Card reported live batch-route exploitation attempts (most failing against auto-patched or WAF-fronted sites; ~20% of a 3.5K-host sample was still unpatched). Eye Security published a defender's guide with forensic artifacts, a compromise-scanner plugin, and a browser extension to check patch status (SecurityWeek, PwnDefend, Eye Security) (earlier coverage). · Vulnerabilities & Exploits

June 18, 2026

• ClickFix campaigns expanded with three new loaders — BabaDeda, Lorem Ipsum, and Potemkin — via fake update lures and compromised WordPress sites, one cluster possibly linked to Vice Society (The Hacker News). · Threat Activity & Ransomware · also via phishing email

June 17, 2026

• Rokarolla Android trojan targets 217 banking and crypto apps with 137 remote commands — overlays, keylogging, SMS interception, clipboard hijacking — spread via fake TikTok and Chrome downloads. The Hacker News, Dark Reading. · Threat Activity
• Steam Workshop / Wallpaper Engine abused since late 2025 to distribute malware via wallpaper packages, hijacking accounts and primarily targeting gamers in China and Russia. Securelist, BleepingComputer. · Supply Chain