Company
SOCRadar is a cybersecurity firm offering extended threat intelligence, including dark web monitoring, attack surface management, and breach research.
SOCRadar estimates broker CyberXero stole more than 628,000 records from four Ukrainian organizations with Claude Code and Cobalt Strike. The actor left a server open, and its logs show where the model's refusals held and where a fresh session got around them.
Reality
The FBI and Secret Service warned Tuesday that FortiBleed is still scanning Fortinet firewalls and SSL VPN gateways with 86,644 stolen credentials. Patching and a password reset will not clear it.
Perspective Coverage
10 publishersReality
SOCRadar tied 5,434 infostealer records for AI tools to 1,500 corporate email addresses at 482 large enterprises. The report says those AI accounts belong under the same sign-on and session controls as a company's identity provider and code repositories.
Reality
SOCRadar found captured ChatGPT sessions at 358 of the 482 companies whose AI accounts turned up in 90 days of infostealer logs. The firm ties the spread to shadow AI, with employees opening work-email accounts that IT never sees.
Reality
A ReliaQuest employee gave up a password and an MFA push five days after the company named the .claims campaign. Device trust, not training, kept the session worthless.
Perspective Coverage
5 publishersReality
SOCRadar's teardown of the AnonyMousKIT service found 200 AI-voiced calls at about $0.10 each, most of them to Brazil. The skill in phone social engineering is now a script file.
Perspective Coverage
4 publishersReality
SOCRadar says the toolkit needs administrative or code execution access first, then writes itself into Chrome and Edge profiles with integrity values the browser accepts and bridges to a native host binary that runs shell commands.
Reality
CISA says all four are under active exploitation, and three of them are unauthenticated flaws in edge and management appliances. Its own alert cites BOD 26-04 and prints no due date for any of them.
Perspective Coverage
4 publishersReality
Hudson Rock and ADAMnetworks link the ads to an operation they call PasteSwitch, which hands Windows and macOS visitors different paste-this-command lures and swaps payloads on the backend depending on who arrives.
Perspective Coverage
5 publishersReality
Huntress worked two Settra intrusions, in July and September, and found MeshAgent installed for remote control, Windows event logs cleared and recovery partitions removed. SOCRadar counts 93 victims claimed since June.
Reality
Checkmarx says a fake sorted-btree clone reached 2 million weekly downloads with clean install scripts, starting its loader only when an application calls BTree.prototype.set with a particular key. Nine related packages have been pulled.
Perspective Coverage
3 publishersReality
SOCRadar's teardown of the $250-a-month service puts the elevation step behind an administrator account and permissive UAC settings, so on a fleet of standard users the rental buys remote access and credential theft and stops there.
Reality
The Windows implant, its Linux control server, the protocol between them and the licensing all came from one author, sold at $250 a month. SOCRadar puts the operator's undetected run at nearly four years.
Reality
SOCRadar says two previously unreported RATs pull their next-stage commands out of FTP greetings. It is a first in the wild, and noisier than the web dead drops it replaces.
Reality
SOCRadar says attackers have used FTP server login banners as dead-drop resolvers since early July 2026 to stage two undocumented remote access trojans, E4del and PINHOLE.
Reality
SOCRadar says LNK files are pulling PowerShell out of FTP pre-login greetings to stage two RATs. The retrieval finishes before any login, so there is nothing for a transfer log to record.
Reality
TheHatman's claimed Entra haul and the FortiBleed spraying wave share one detectable seam: a successful authentication landing just behind a spike of failures.
Reality
SOCRadar's record-level data puts 95 percent of identified victims before the poisoned LiteLLM packages ever hit PyPI. Anyone who rotated only what LiteLLM touched is still exposed.
Reality