Loading story…
Daniel Plohmann discusses his journey into malware research, the creation of Malpedia to address community fragmentation, and the development of MCRIT for advanced code similarity analysis. He emphasizes the importance of collaboration, high-quality curation, and automation in threat intelligence. Plohmann also highlights the shift from user-targeted banking trojans to organizational extortion attacks and shares insights on integrating tools like Hunt.io for infrastructure tracking and malware discovery.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **distinct malware and intrusion campaigns** active across enterprise, government, developer, and consumer targets, rather than a single shared incident. The activity includes vishing-led abuse of *Quick Assist* for remote access and persistence, a **.NET AOT** malware chain delivering **Rhadamanthys** and **XMRig**, renewed **Horabot** banking Trojan activity using fake CAPTCHA and `mshta`, a compromised *Open VSX* extension that fetched **BlokTrooper** payloads, and a Middle East-focused Ramadan coupon lure delivering a **RAT** with AWS S3-based exfiltration. Additional reporting covers **Operation CamelClone**, which used government-themed spear-phishing and `LNK` files to steal data with *Rclone*, and **Contagious Trader**, a cryptocurrency-focused campaign tied to malicious GitHub and npm projects. One reference stands apart as vulnerability research rather than campaign reporting: watchTowr detailed **pre-authenticated RCE chains in BMC FootPrints**, which is a separate product security disclosure and not part of the malware operations described elsewhere. Because the references cover unrelated incidents, malware families, and victim sets, the material should **not** be treated as one cohesive event. It is also **not fluff**, as the sources contain substantive threat intelligence, technical analysis, exploit research, and incident tradecraft rather than marketing or generic advice.
Jun 29, 2026
Security researchers and industry commentary describe a broader rise in **AI-assisted cybercrime**, with attackers using generative AI to improve phishing lures, clone legitimate login pages, and scale social-engineering operations. Reporting highlights that phishing remains a leading initial access vector, while **phishing-as-a-service** and AI-generated content are making campaigns more convincing and easier to produce at volume. IBM similarly warns that AI is acting as a force multiplier for attackers, lowering the cost of malware development and enabling more disposable, harder-to-attribute malicious tooling. Kaspersky documented active campaigns in which threat actors used **Google Search ads** and fake documentation pages to distribute the **AMOS** infostealer on macOS and **Amatera** on Windows, disguising the malware as popular AI tools including **OpenClaw**, **Claude Code**, and **Doubao**. By contrast, ZDNET's article focuses on the business and product-security shortcomings of Moltbook and OpenClaw acquisitions rather than a specific threat campaign, making it adjacent but not part of the same security event. The material overall is **not fluff** because it includes substantive threat reporting and technical security analysis, even though the references describe related developments rather than one discrete incident.
Jun 29, 2026
Threat actors are increasingly leveraging artificial intelligence, particularly large language models (LLMs), to automate and enhance cyberattacks. Recent research demonstrates that LLMs such as GPT-4o and Claude can be manipulated to generate working exploits for enterprise software like Odoo ERP, significantly lowering the barrier for less-skilled attackers to launch sophisticated attacks. Concurrently, the underground market is witnessing the emergence of AI-powered malware tools, such as metamorphic crypters, which use AI to dynamically rewrite malicious code and evade detection by endpoint security solutions like Windows Defender. These developments highlight a rapidly evolving threat landscape where AI is both a tool for attackers and a challenge for defenders. In response to these threats, the cybersecurity community is developing advanced AI-powered penetration testing frameworks like NeuroSploitv2. This tool integrates multiple LLMs and employs specialized agent roles, grounding techniques, and safety guardrails to automate vulnerability discovery and exploitation in a controlled, ethical manner. Meanwhile, defenders are also exploring granular attribute-based access control and post-quantum encryption to mitigate risks from context window injections in AI systems. The convergence of AI in both offensive and defensive security operations underscores the urgent need for robust safeguards and adaptive security strategies to address the dual-use nature of these technologies.
Jun 29, 2026