Company
ESET is a Slovak cybersecurity company making antivirus and endpoint protection software; its research arm publishes threat intelligence via WeLiveSecurity.
North Korean fake IT workers are submitting as many as 60 job applications a day, ITPro reported from new research. Interviews are where these candidates succeed, so identity checks at hiring belong on the security team's list.
Reality
ESET says UAC-0099 has reworked its MatchBoil downloader since at least July 2024, with the newest version appearing in April 2026. Repeated changes aimed at security software mean indicators from CERT-UA's August 2025 write-up describe an older build.
Perspective Coverage
4 publishersReality
UAC-0099, a Russia-aligned group, has pushed its MATCHBOIL downloader from Ukrainian transport firms into a manufacturer and an energy company, ESET says. The researchers tracked the tool for almost two years; it installs MATCHWOK, a C# backdoor that grabs screenshots and runs PowerShell.
Reality
TrendAI has tied ASHVEIN, a previously undocumented .NET RAT, to UAC-0099 attacks on Ukrainian government personnel, citing five builds from October 2025. The group has fielded newer tools since, so detection that lasts has to target how it delivers and tasks its implants.
Reality
Scammers posing as Hollyland, Nike and Spotify lure YouTube creators to fake brand-deal portals that take Google passwords and one-time codes, ESET found. One sign-in hands over Gmail, Drive and the channel itself.
Reality
RatHat's malware console now feeds stolen texts to Google's Gemini to estimate each victim's bank balance and rank who to rob first, security firm Cleafy says. Cleafy has traced nearly 100 deployments since April 2026 and found nothing that moves money.
Reality
CTM360 tracked more than 17,000 compromised URLs serving a fake Cloudflare check whose next hostname arrives from an on-chain lookup. Microsoft put 47 percent of its 2025 initial-access cases down to the technique.
Reality
Dominik Reichel's write-up describes a passive Windows implant with no listening port and no embedded payload. Recovering its AES key still leaves you holding bytecode for an interpreter only it understands.
Perspective Coverage
3 publishersReality
ESET found the bait comment in a loader for MATCHBOIL, malware it ties exclusively to the Russia-aligned group that feeds targets to Sandworm. The trick works because a model that refuses to read a file returns no verdict at all.
Reality
A Northern California freelance marketplace's own messaging system carried Excel macro lures to 80,000 of its users across 18 months. Microsoft closed that delivery step in 2022. The same platform lure now shows up in North Korean operations.
Perspective Coverage
6 publishersReality
Sophos says the code patches Apache and hooks the PHP module loader so the shell never lands on disk, which leaves file-integrity checking on an appliance that was never running EDR unable to prove much.
Perspective Coverage
6 publishersReality
Two actor classes are using CVE-2026-20079 against the console that manages every Cisco Secure Firewall behind it. The same week brought a Linux rootkit planted on F5 BIG-IP APM appliances, with the installation route unreported.
Reality
Black Lotus Labs counted about a dozen compromised enterprises, mostly in Asia and South America, on a framework that has been publishing operator commands to infected hosts through IoT message brokers since 2024.
Perspective Coverage
3 publishersReality
ESET traced more than a year of espionage against government organizations in eight Latin American countries and territories to a modular C++ implant that hooks CreateThread so every thread it spawns looks like AnimateWindow.
Perspective Coverage
5 publishersReality
ESET says the group dropped McRat and Trochilus in 2025 and hit government targets in Belgium, Italy, Serbia and Poland. Its two new backdoors call home to Discord and the Microsoft Graph API.
Reality
Meta's first TV spot for its personal AI agent shows Muse sorting email, fixing a schedule and buying school supplies unsupervised. That picture of what an agent does now reaches employees through consumer advertising before any workplace pilot does.
Reality
ESET's Jake Moore says a person can inspect a link exactly as they were taught and still be fooled, because one Cyrillic character renders as the Latin one.
Reality
Meta, Google and Instinct have shipped agents that book travel and clear inboxes, and each one needs a credit card or an email password to do it. The approval prompt for the risky step lands on whoever holds the login.
Reality
ESET's guidance puts the US removal deadline at 48 hours from a valid request, and the study it cites counts 181 nudify sites drawing 40 million visits a month, so the filing path has to exist first.
Reality
ESET calls the technique GuardBreaker and notes that this bait, unlike most evasion tricks, is left in plain sight for the models reading the code to find.
Reality
Security · September 2, 2026 · Confirmed3 publishers