Topic
Malware families whose primary objective is harvesting credentials, wallets, documents and browser data for exfiltration.
Symantec says new Aoki infostealer versions steal API keys and tokens for AI coding assistants, plus AWS credentials, from infected machines. The firm says threat actors now value such credentials like payment card data.
Reality
FakeGit's operator re-aimed more than 13,000 existing GitHub repositories at the SmartLoader malware in 34 hours, Apiiro found. At least 700 of the accounts involved appear to belong to legitimate developers, so a credible-looking owner is weak evidence that a download is safe.
Reality
ANSSI says stolen staff passwords let an attacker take data on about 600,000 French taxpayers and firms, and the theft went undetected for seven weeks. Its report blames password-only portals, a flat government network and a reset that left the attacker's session open.
Reality
ANSSI says an attacker used dozens of stolen DGFIP staff passwords on password-only portals to take data on over 600,000 French taxpayers and businesses. For other operators, the fixes are login checks on devices they do not manage and a password reset that also ends live sessions.
Reality
Australia's Signals Directorate says attackers are using stolen AI API keys, tokens and hijacked sessions to get into organisations' AI services. Its guidance tells customers to protect those credentials themselves. In one reported case, a stolen key ran up about US$600,000 in model credits over three weeks.
Reality
SOCRadar tied 5,434 infostealer records for AI tools to 1,500 corporate email addresses at 482 large enterprises. The report says those AI accounts belong under the same sign-on and session controls as a company's identity provider and code repositories.
Reality
SOCRadar found captured ChatGPT sessions at 358 of the 482 companies whose AI accounts turned up in 90 days of infostealer logs. The firm ties the spread to shadow AI, with employees opening work-email accounts that IT never sees.
Reality
n0n, a ransomware crew first seen September 18, listed over a dozen victims in four days and threatens to wipe the backups of those who refuse to pay. Whether it can depends on what its escalated admin accounts reach.
Reality
A seller using the name TheHatman is offering employee directory exports from nine named enterprises. Hudson Rock ties the theft to infostealer credentials, not a compromise of the provider.
Perspective Coverage
5 publishersReality
OpenSourceMalware flagged the campaign on August 15, 2026. The install hook fakes a clean native build while pulling a Windows stealer that goes after browser credentials and crypto wallets.
Reality
McAfee says the WeedHack stealer's control server is dead and its renter dashboard gone, but ten impersonation sites and the search rankings behind them are still delivering victims.
Perspective Coverage
3 publishersReality
Anthropic is signing affected users out, stripping saved payment methods and issuing refunds after someone began pulling Claude cookies out of ordinary stealer logs and spending other people's quota.
Perspective Coverage
7 publishersReality
Check Point's deobfuscation of 23 compiled V8 bytecode samples shows JSCeal replaying stolen cookies inside the victim's own browser profile, then stuffing local credentials at any password prompt until it holds a fresh OAuth token.
Reality
Hudson Rock and ADAMnetworks link the ads to an operation they call PasteSwitch, which hands Windows and macOS visitors different paste-this-command lures and swaps payloads on the backend depending on who arrives.
Perspective Coverage
5 publishersReality
Arctic Wolf Labs found injected iframes on real Ukrainian business sites showing a Ukrainian-language fake Cloudflare check that copies a Windows Installer command for the visitor to paste into Run. Its exposed panel logged 557 views.
Perspective Coverage
3 publishersReality
LastPass traced a fake Authenticator hosted on GitHub to a months-long impersonation campaign that spoofed at least 40 organizations, including its own brand. The server steering victims to the download was still being updated in September.
Perspective Coverage
4 publishersReality
Kaspersky says the macOS stealer it first tracked as Mac.c has swapped script droppers for FAT Mach-O binaries in a chain found in September 2026, and its loader now reads shell commands out of a public iCloud calendar file.
Reality
LastPass and Delphos Labs say a single malware-as-a-service kit impersonated at least 40 companies on GitHub, and the kernel driver it delivered was Microsoft-attested and undetected by every engine on VirusTotal.
Reality
Island says the adversary-in-the-middle service runs on at least 755 domains against hundreds of organizations. The session it steals arrives after an authentication the identity provider records as entirely normal.
Reality
SpyCloud measured stolen-credential exposure across 10,000 EPA-registered water and wastewater organizations and found it at nearly one in five, with the sharpest single case sitting on a supplier's machine.
Reality
Security · September 1, 2026 · Confirmed2 publishers
Security · August 21, 2026 · Confirmed2 publishers