A new multi-stage Rust-based macOS information stealer, dubbed AmnesiaStealer, has been identified as capable of hijacking Chromium-based browsers to give attackers live control over victims' sessions. This malware is part of a broader trend of evolving cyber threats, which includes the Kimsuky APT group integrating artificial intelligence into its attack operations, from generating decoy documents to deploying a local large language model (LLM) for defense evasion, branded as ShieldBreak.
Other notable developments in the threat landscape include the HoneyMyte APT group upgrading its CoolClient backdoor with a kernel-level Windows rootkit. Additionally, the Kimwolf botnet has evolved to version 7, which now hides its distributed denial-of-service (DDoS) traffic behind Chrome fingerprints and Ethereum transactions.
The cybersecurity community is also observing an increase in the exploitation of recently disclosed vulnerabilities. An Adobe Commerce flaw, CVE-2026-71362, came under attack shortly after its public disclosure. Similarly, a SharePoint vulnerability, CVE-2026-55040, is being exploited following the release of a public exploit. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog, underscoring the urgency of patching these issues.
Ransomware continues to pose a significant threat, with the Storm-1175 group replacing its Medusa variant with a new ransomware called StormEncryptor. This new ransomware is suspected to be deployed via an N-central flaw. CISA, the FBI, and other partners have also issued warnings about the Gunra ransomware actors, who are actively targeting multiple critical infrastructure sectors.
Espionage campaigns remain prevalent, with APT36 suspected in the PATCHCORD operation, which utilizes Google Sheets for command and control (C2) communications. This campaign targets Afghan telecommunications and critical infrastructure in South Asia. The North Korean Lazarus Group is also reportedly leveraging a Windows zero-day vulnerability in its "Operation Dream Job."
In the realm of state-sponsored activity, China-linked hackers are deploying the new StormEncryptor ransomware and have been observed using AI agents in autonomous attacks against Taiwan.
Beyond these specific threats, a new malware combination dubbed WindRelay is behind a growing fraud scheme. Furthermore, a macOS screen sharing flaw is being exploited to deploy Monero cryptocurrency miners, and a GeoServer zero-day vulnerability is already being probed by attackers. Crooks are also actively purchasing expired domains to use them for malware delivery.
Finally, Apple has issued warnings to hundreds of users regarding mercenary spyware attacks, indicating a persistent threat from sophisticated surveillance tools.
