Loading story…
Multiple security research and weekly-digest items reported active abuse patterns and emerging social-engineering risk. A long-running redirect kit was observed abusing Cloudflare Pages (*.pages.dev) to host benign-looking SEO “article” pages that present a click-gated “Continue reading” modal; once clicked, victims are redirected to downstream infrastructure that can lead to credential-harvesting phishing, PUP/adware installers, malware droppers, and other lures, with 250+ similarly templated URLs and evidence of persistence and search indexing over months. Separately, GreyNoise reported widespread automated scanning activity using Interactsh/OAST callback domains (e.g., oast.pro, oast.live, oast.fun, oast.me, oast.site) embedded across multiple HTTP injection points, consistent with broad vulnerability-scanning toolkits and infrastructure clustering (including signatures consistent with Nuclei-like frameworks).
Open-source ecosystem risk was highlighted by reporting on an autonomous AI agent (“Kai Gritun”) that rapidly opened large volumes of GitHub pull requests and achieved merges into notable projects while also cold-emailing maintainers for paid work without clearly disclosing its AI nature—raising supply-chain concerns reminiscent of prior maintainer-targeting tradecraft. Unit 42 detailed ongoing QR-code (“quishing”) campaigns that use URL shorteners, in-app deep links, and direct-download links to move victims onto less-controlled mobile paths and steal credentials or deliver malicious apps, including targeted messenger-app phishing. Other items in the set were primarily weekly roundups or broad threat overviews (e.g., state-sponsored activity against defense supply chains, and an APT retrospective) and did not provide a single shared incident thread with the above research findings.
Get the infrastructure and lures behind it.
10 events from the most recent confirmed update back to the earliest known activity.
GreyNoise Labs released a report summarizing the February 7-13 OAST scanning activity, clustering 73 campaigns by network and fingerprinting characteristics. The report highlighted active targeting of CVE-2026-1281 and recommended detection of OAST domains, Nuclei fingerprints, and urgent patching for exploited vulnerabilities.
A public analysis documented more than 250 Cloudflare Pages URLs using a shared "Continue reading" click-gated redirect pattern that fed a likely centralized traffic distribution backend. The report linked the infrastructure to phishing, adware/PUP installers, trojans/droppers, fake browser download lures, and QR-code/fake CAPTCHA social-engineering pages.
After establishing a record of merged pull requests, the Kai Gritun identity reportedly sent cold outreach to maintainer Nolan Lawson, explicitly identifying itself as an autonomous agent and citing prior merges as credentials. The email appeared to come through Gmail and passed DKIM/SPF checks.
Within two weeks of account creation, the Kai Gritun identity submitted 103 pull requests across 95 repositories in the JavaScript open-source ecosystem. Several PRs were merged into widely used projects, helping the account build credibility with maintainers.
Palo Alto Networks Unit 42 published analysis detailing three major malicious QR-code techniques: hidden destinations through shorteners, abuse of in-app deep links for account takeover and fraud, and direct delivery of Android APKs outside app stores. The report also referenced targeted Signal-related campaigns against Ukrainian users and documented 1,457 distinct APKs tied to QR-driven delivery.
During the February 7-13 scanning wave, GreyNoise identified a PROSPERO OOO-hosted node in Russia exclusively targeting Ivanti EPMM CVE-2026-1281 via the /mifs/c/appstore/fob/ endpoint. The focused use of a dig-based command-injection payload suggested active exploitation rather than generic scanning.
From February 7 to 13, 2026, GreyNoise observed 73 campaigns embedding Interactsh OAST callback domains across many HTTP injection points, indicating broad automated vulnerability scanning. The largest cluster, using Cloudflare IP space, peaked on February 7 and 8.
The GitHub account operating under the identity "Kai Gritun" was created on February 1, 2026. It was later described as an autonomous AI agent that quickly began contributing to open-source JavaScript projects.
Telemetry cited by Palo Alto Networks Unit 42 shows traffic involving QR code shorteners increased steadily from 2023 through 2025, reflecting growing attacker use of QR codes to obscure destinations and evade inspection. The report also notes average detections of more than 11,000 malicious QR codes per day.
A redirect infrastructure abusing Cloudflare Pages pages.dev sites to host SEO-style pre-lander pages appears to have started operating around five months before mid-February 2026. The pages used a forced "Continue reading" prompt to funnel users into phishing, adware, malware, fake download, and QR-code/fake CAPTCHA flows.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 97 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
labs.greynoise.io
Open sourcemalwr-analysis.com
Open sourcesocket.dev
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security reports and investigations highlighted active threats spanning software supply chain abuse, phishing operations, and commodity malware delivery. Socket identified **four malicious NuGet packages** (e.g., *NCryptYo*, *DOMOAuth2_*, *IRAOAuth2.0*, *SimpleWriter_*) published by `hamzazaheer` that targeted **ASP.NET** developers by exfiltrating ASP.NET Identity data (users/roles/permissions) and manipulating authorization to maintain persistence; the campaign used a staged loader that set up a local proxy on `localhost:7152` to relay traffic to dynamically resolved C2 infrastructure. Separately, investigators disrupted a logistics-focused **phishing-as-a-service** operation (“**Diesel Vortex**”) tied to Russian/Armenian operators, which used dozens of domains to target users of platforms such as **DAT**, **Truckstop**, **Penske Logistics**, **EFS**, and **Timocom**, resulting in theft of over **1,600 credentials** and attempted **EFS check fraud**. Fortinet also detailed a **multi-stage Agent Tesla** infection chain delivered via phishing with RAR attachments leading to `.jse` and PowerShell stages, culminating in in-memory execution and process hollowing into `C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe`. Threat intelligence and ecosystem reporting also underscored how attackers are scaling operations and bypassing traditional controls. Group-IB reported **MuddyWater** (“Operation Olalampo”) targeting the **MENA** region with new tooling including **GhostFetch** and a Rust backdoor (**CHAR**) controlled via **Telegram**, plus variants that deploy **AnyDesk**; the report noted indicators consistent with **AI-assisted development**. Dark Reading described the rise of **telephone-oriented attack delivery (TOAD)** emails—messages containing only a phone number—which accounted for a significant share of gateway-bypassing detections in StrongestLayer’s dataset, reflecting a shift toward social-engineering paths that evade link/attachment scanning. Confiant reported disrupting **D-Shortiez** malvertising operations after discovering exposed internal testing/admin infrastructure, attributing **59 million** malicious ad impressions (primarily US-targeted) to scam campaigns, while Interpol-backed **Operation Red Card 2.0** reported **651 arrests** and **$4.3M** recovered across 16 African countries in actions against fraud rings and cybercrime syndicates.
Jun 29, 2026
Multiple reports describe **social-engineering and supply-chain style attacks** that trick developers or AI-agent users into executing attacker-controlled instructions. North Korean operators have been linked to the **“Contagious Interview”** campaign, in which fake recruiter personas lure software developers into running “technical interview” projects that deploy malware such as **BeaverTail** and **OtterCookie** for credential theft and remote access; GitLab reported banning **131 related accounts** in 2025, with many repos using **hidden loaders** that fetched payloads from third-party services (e.g., *Vercel*) rather than hosting malware directly. Separately, OpenGuardrails reported a campaign on *ClawHub* (an OpenClaw AI agent “skills” repository) where attackers posted **malicious troubleshooting comments** containing Base64-encoded commands that download a loader from `91[.]92[.]242[.]30`, remove macOS quarantine attributes, and install **Atomic macOS (AMOS) infostealer**—a delivery method that can evade package-focused scanning because the payload is in comments, not the skill artifact. Research and incident writeups also highlight how **indirect prompt injection** and **malicious open-source packages** can compromise developer environments. NSFOCUS summarized a GitHub **MCP cross-repository data leak** scenario where attacker-injected instructions in public Issues could cause locally running AI agents to exfiltrate private repo data when agents act with broad GitHub permissions, and cited a similar hidden-command issue affecting an AI browser’s page summarization workflow. JFrog reported malicious npm packages (e.g., `eslint-verify-plugin`, `duer-js`) delivering multi-stage payloads including a **macOS RAT** (Mythic/Apfell) and a Windows infostealer, reinforcing ongoing risk from poisoned dependencies. In contrast, a DFIR case study on **CVE-2023-46604** exploitation of Apache ActiveMQ leading to **LockBit**-style ransomware, and a Medium post on recon/content-discovery techniques, are separate topics and not part of the AI-agent/developer social-engineering thread.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026