Malvertising

October 25, 2026

• An Amazon-themed ClickFix campaign abuses the Windows finger utility as a LOLBIN. A sponsored Google result for "amazon business" leads to a spoofed login page with an embedded fake CAPTCHA; the pasted command uses finger to kick off a multi-stage obfuscated chain ending in a pirated NetSupport RMM client and Lumma Stealer. Google pulled the ad but the infrastructure remains live, running on a growing list of barbecue-themed domains (grillmasterspro, EmbersAndBites). Three Huntress customers were hit. (Huntress) · Threat Activity

October 16, 2026

• Targeted ads infected Al Jazeera devices with Candiru spyware without a click. Citizen Lab’s AdFection investigation calls this the first public technical confirmation of an in-the-wild zero-click mercenary-spyware attack delivered through advertising. It says Discover-Tech’s Controlium platform fingerprinted and de-anonymized devices, then let partners trigger infection when an ad rendered. Analysis of four billion bid records over four months found its ads on almost 200,000 unique sites and mobile apps in dozens of countries. Millions of devices contacted Candiru infrastructure, which researchers characterize as likely tracking and reconnaissance rather than evidence of mass infection. The Citizen Lab report includes the recovered sample and technical indicators. (discussion) · Threat Activity & Espionage

October 10, 2026

• ClickFix has exploded, and Finnish sites are hosting it. Microsoft's Digital Defense Report records the lure on more than 1.1 million devices in a few months of its own telemetry, with May volume 23× the level six months earlier and malware delivered in 96.3% of detected cases; NCSC-FI notes campaigns on Finnish websites after the report's cutoff, plus the FileFix variant that uses the Explorer address bar instead of Run/PowerShell (Ilta-Sanomat). Separately, operators are buying Google Ads and abusing Bing redirects to push Claude-branded ClickFix lures (BleepingComputer). · Threat Activity

September 25, 2026

• The placeholder domain third-party.com, referenced across 1,700+ repositories and dev docs, now serves ClickFix. Manifold Security found it while reviewing public AI skills and MCP server documentation. Unlike the IANA-reserved example.com, it is an ordinary registered domain: it displays a fake Cloudflare "Performing security verification" page, copies a PowerShell command to the clipboard, and instructs the user through Win+R and paste. The payload host no longer resolves, but a May VirusTotal scan shows it pulling a 131 MB zip. BleepingComputer, The Hacker News · Threat Activity
• Corp MDM Android spyware targets logistics firms via fake Google Play pages branded CEVA and TKW Logistics, delivering com.corp.mdm disguised as a system service that steals incoming SMS and redirects calls. Have I Been Squatted, The Hacker News · Threat Activity

September 20, 2026

• RatHat, an Android RAT attributed to China-based operators, abuses ADB to retain shell access after the app is uninstalled, and ships an AI-driven component for navigating the compromised device UI. Distribution is via targeted smishing and malvertising into fake third-party download portals. The Hacker News · Detection & Defence

September 19, 2026

• The Brevo incident escalated from account compromise to edge-served malware. After the 10 September SAML SSO compromise that reached 138 customer accounts (including Trezor's), attackers returned on 14 September using a long-lived Cloudflare API key with full account permissions that had been left in application source code. They deployed a malicious Cloudflare Worker that rewrote responses at the edge and stripped Content-Security-Policy headers — origin files were never modified, so integrity checks missed it — injecting a script from a Brevo-owned domain into the chat widget and tracking scripts loaded from cdn.brevo.com. Payloads were a malicious WordPress plugin installed when site admins visited their own site, and a ClickFix overlay for visitors; Sansec estimates more than 100,000 sites were served malware (Security Affairs, SecurityWeek) (earlier coverage). · Supply Chain & Malicious Packages

September 15, 2026

• HBO Max’s verified Reddit account served 108 malicious ads over roughly 48 hours. Adamnetworks tied the hijack to PasteSwitch, a ClickFix operation using HBO Max, OpenAI Codex, macOS utility, and developer-tool lures to deliver infostealers on Windows and macOS. BleepingComputer independently covered the compromise. · Threat Activity

September 8, 2026

• StyleSmuggler now has a payload profile. Sansec reports the first exploitation on 4 September against a target running the latest security updates; the exploit abuses Magento's template system via PHP code injection to generate a fake "failed-payment" email that triggers execution, installing a small Rust backdoor disguised as [kworker/u:8:0], or in newer samples as fc-cache under ~/.cache/fontconfig/, with a cron job every 30 minutes for persistence. Earlier samples beaconed over TLS/WebSockets; newer ones disguise C2 as NTP, sending UDP to port 123 with time-server-styled hostnames, and check TracerPid — if tracing is active the malware installs but stays silent. Sansec flags an unexpected surge of "Payment Transaction Failed Reminder" emails as an indicator and recommends disabling GraphQL until Adobe ships a fix (BleepingComputer, SecurityWeek). @Dinosn claims exploitation attempts have been "massive" and says he will publish a PoC and lab after a patch lands — treat the scale claim as unverified (earlier coverage). · Vulnerabilities & Exploits

August 7, 2026

• Ransom Cartel creator Maksim Silnikau was sentenced to 16 years for running the RaaS operation (and Angler EK distribution) that hit at least 18 companies. The Record, The Hacker News · Threat Activity

August 6, 2026

• Remus infostealer is being pushed via fake cracked-software lures and resolves its C2 from an Ethereum smart contract to dodge takedowns (Unit 42). · Threat Activity

August 3, 2026

• Finland's state lottery Veikkaus was caught in the Adform script poisoning: visitors to Veikkaus.fi on Monday 27 July may have had clipboard-copied Bitcoin, Ethereum or Tron wallet addresses silently swapped by the malicious ad-tech script (Voice.fi), extending the earlier Adform coverage. Adform's own incident notice confirms detection on 27 July and removal of the code (discussion). · Supply Chain & Crypto Theft

August 2, 2026

• DPRK macOS malvertising revives Contagious Interview. A new iteration redirects victims to full-screen fake update sequences to deliver crypto-stealing malware on macOS (The Hacker News). · Threat Intelligence

July 24, 2026

• SourTrade malvertising assembles its payload in the browser via ServiceWorkers. The campaign impersonates trusted crypto brands and builds in-memory Windows executables client-side to dodge detection. Confiant. · Threat Activity
• A fake Claude desktop installer promoted by Bing ads pushes SectopRAT, hosted on a legitimate Claude.ai domain to lend credibility. BleepingComputer. · Threat Activity

July 9, 2026

• ClickFix operators expanded: Unit 42 tracks a macOS variant installing a LaunchAgent backdoor via affiliate/cloaking redirects, and Elastic details SCMBANKER (REF6045), an AI-assisted PowerShell toolkit hitting Mexican banking customers via fake CAPTCHA pages. Unit 42, Elastic Security Labs · Threat Activity · also via phishing email
• Vidar infostealer is hitting SMBs through malvertising for cracked/pirated software, bundling data theft with cryptomining. Dark Reading · Threat Activity

July 8, 2026

• Unit 42 dissected a Vidar Stealer malvertising campaign delivering password-protected .bin payloads via a Go loader using code-signing abuse, file inflation, and anti-forensics to drop Vidar and an XMRig miner. Unit 42 · Threat Activity

July 5, 2026

• Verified X ad pushes Mac malware plus a browser-based M365 token thief. A sponsored post from a verified account impersonated the DynamicLake utility and redirected to a lookalike domain instructing users to paste a Terminal command, delivering an Atomic Stealer variant (tracked as MacSync, with DigitStealer in some cases). The same report flags ConsentFix, a ClickFix-style trick that steals Microsoft 365 session tokens through the browser — no malware, no password. Malwarebytes · Threat Activity · also via phishing email
• Cloudflare quietly killed the NWHStealer campaign. A researcher deobfuscating a BUN-bundled stealer (spread via fake GTA 6 ads) found its C2 (unauth-amper[.]cc) already taken down by Cloudflare, ending the campaign. vx-underground · Threat Activity

June 23, 2026

• OXLOADER delivers CastleStealer via malicious Google Ads — Elastic Security Labs profiles a previously unreported loader fronting malvertising, attributed to a likely Russian-speaking financially motivated actor. The Hacker News · Threat Activity