Loading story…
The provided items do not describe a single cohesive incident; they are a mix of unrelated security research, tooling write-ups, newsletters, and commentary. The most concrete incident reporting is an AI-assisted intrusion campaign in which a Russian-speaking financially motivated actor compromised 600+ Fortinet FortiGate devices by targeting internet-exposed management interfaces with weak credentials and no MFA, then using AI-generated scripts for recon, configuration theft, and follow-on activity (including attempts to move laterally into Active Directory, extract database credentials, and access backup infrastructure). Separately, Kaspersky-linked reporting described Arkanix Stealer as a short-lived infostealer operation marketed in late 2025 with a modular design and anti-analysis features, with indicators of LLM-assisted development and a brief operational lifespan after promotion on dark-web forums and use of Discord for “customer” support.
Other references are not about that Fortinet campaign and instead cover distinct topics: academic research demonstrating 27 attacks against major password managers under a malicious server model (undermining “zero-knowledge” assumptions via missing ciphertext integrity/binding), GreyNoise telemetry on OAST/interactsh callback-domain scanning trends, and a vendor-style overview of an AI-driven pentesting framework (PentAGI) integrating 20+ tools. Several entries are primarily roundup/newsletter content or generic guidance/commentary (e.g., phishing what-to-do advice, compliance vs. security, historical/legal computing anecdote), and one is a threat-actor profile tying Lotus Blossom to a separate Notepad++ update-channel incident rather than the Fortinet activity.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
AWS assessed that a Russian-speaking financially motivated threat actor compromised over 600 FortiGate firewalls at scale. Post-compromise activity included lateral movement, Active Directory compromise, credential extraction, and attempts to access backup infrastructure, suggesting possible initial-access-broker activity.
Kaspersky publicly documented Arkanix Stealer, describing coding artifacts consistent with LLM-assisted development and detailing features such as anti-analysis, wallet injection, and the ChromElevator post-exploitation tool. The report also released indicators of compromise including file hashes, domains, and IP addresses tied to Arkanix detections.
Logs from the attackers' misconfigured infrastructure showed automated processing of more than 2,500 devices across 106 countries using custom tools including CHECKER2 and ARXON. The system integrated DeepSeek and Claude to generate attack plans, run tooling, and prioritize post-compromise actions.
In early February 2026, researchers identified an active campaign targeting exposed Fortinet FortiGate devices using weak passwords and no MFA rather than zero-days. The operation used AI-generated scripts and an automated workflow to steal configurations, gain access, and conduct follow-on intrusion activity.
Roughly two months after launch, the Arkanix author took down the malware's control panel and Discord server without notice, ending the short-lived operation and making tracking more difficult. Kaspersky later assessed the project as likely an AI/LLM-assisted experiment.
In late 2025, the Arkanix Stealer malware operation was advertised across multiple dark web forums as a modular information stealer sold in basic Python and premium native C++ tiers. The operator also ran a control panel, Discord server, and referral program to support customers and drive adoption.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
news.risky.biz
Open sourcecybersecuritynews.com
Open sourcenews.risky.biz
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly operationalizing AI and automation to scale attacks and exploit weak controls across both enterprise and consumer environments. An open-source offensive platform dubbed **CyberStrikeAI**—a Go-based “AI-native security testing” framework integrating 100+ tools—was observed in infrastructure used to target **Fortinet FortiGate** edge devices at scale; researchers linked activity to an IP (212.11.64.250) exposing a `CyberStrikeAI` banner and to scanning/communications patterns consistent with mass exploitation. Separately, a newly disclosed and rapidly patched **OpenClaw** vulnerability showed how AI agent tooling can be hijacked: researchers reported that a malicious website could take over a developer’s locally running agent due to inadequate trust-boundary validation, prompting urgent upgrades to **OpenClaw v2026.2.25+**. In parallel, a “vibe-coding” hosted app on the *Lovable* platform leaked data impacting **18,000+ users** after a researcher found **16 flaws (six critical)** tied to mis-implemented backend controls (including missing/incorrect row-level security in *Supabase*), enabling unauthorized access to records and actions like bulk email and account deletion. Criminal monetization also continues to evolve beyond AI-agent risks. **AuraStealer**, a Russian-language infostealer positioned as a successor/competitor after Lumma disruptions, was advertised on multiple underground forums and is supported by a sizable C2 footprint; analysis of 200+ samples identified **48 C2 domains**, with operators abusing low-cost TLDs (e.g., `.shop`, `.cfd`) and using **Cloudflare** as a reverse proxy to mask origin infrastructure. Broader reporting and commentary reinforced that identity and access failures remain a dominant breach driver and that AI adoption is expanding the attack surface via over-privileged agents and “shadow AI,” while ransomware operators increasingly target recovery paths (including backups) and dwell to corrupt restore points. Several items in the set were non-incident thought leadership or workforce content (skills gap, jobs listings, awards, and general AI security tips) and did not add event-specific technical details beyond high-level risk framing.
Jun 29, 2026
The provided items do not describe a single cohesive cybersecurity event; they span multiple unrelated threat reports and opinion pieces. Notable incident-level reporting includes **APT28** activity in Western/Central Europe (“Operation MacroMaze”) using spear-phishing lures with Office macros that beacon via `INCLUDEPICTURE` to `webhook[.]site` and then execute VBScript/CMD/batch stages for persistence and follow-on payload delivery. Separately, **MuddyWater** (Iran/MOIS-linked) was reported running “Operation Olalampo” against organizations in the Middle East and Africa, delivering new custom malware (including a **Char** backdoor using a **Telegram bot** for C2) and, in some cases, attempting exploitation of public-facing servers in addition to phishing. Criminal activity and initial-access tradecraft were also covered across distinct stories: a DFIR case study described exploitation of **Apache ActiveMQ** `CVE-2023-46604` to gain RCE, conduct post-exploitation (Metasploit/Meterpreter, privilege escalation, LSASS access, lateral movement), and ultimately deploy **LockBit**-branded ransomware via RDP using previously stolen credentials (with indications the payload was built using the leaked builder and used *Session* for communications). Multiple reports described malware delivery via compromised web assets and social engineering, including **GrayCharlie** injecting malicious JavaScript into WordPress sites to push **NetSupport RAT**, **Stealc**, and **SectopRAT** via fake updates/ClickFix-style CAPTCHAs, and a separate **ClickFix** campaign delivering a custom C++ RAT (**MIMICRAT**) through fake Cloudflare verification prompts that trick users into running PowerShell. Additional, unrelated threat reporting included a **NuGet** supply-chain attack (typosquatted `NCryptYo` plus companion packages) targeting ASP.NET Identity data and enabling backdoored authorization rules, and malicious Chrome extensions using a “**Promise Bomb**” browser-crash technique to drive users to run fake “CrashFix” PowerShell steps. Several other items were generic commentary/roundups (data breach trends, quantum preparedness, Enigma history, NATO public opinion polling, recon how-to, and a malware-newsletter link list) and do not add event-specific intelligence.
Jun 29, 2026
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026