Malware

Experts say Apple’s move shows it understood that older iOS and iPadOS devices were vulnerable and being exploited by DarkSword.

The NoVoice operation, identified by McAfee, concealed malicious components within the com.facebook.utils package, blending them with legitimate Facebook SDK classes.

CrystalRAT, which first appeared in January, operates on a tiered subscription model and shares significant similarities with the WebRAT (Salat Stealer) malware, according to Kaspersky researchers.

The threat actor, identified as Brazilian cybercrime group Augmented Marauder and Water Saci, employs a unique delivery mechanism involving WhatsApp, ClickFix techniques, and email-based phishing.

Attackers are leveraging tools like Process Hacker and IOBit Unlocker, which possess deep operating system access.

Attackers continue to evade defenders by using legitimate platforms like AWS and Microsoft utilities.

Attacks involving the .NET-based Phantom Stealer, which has been bundled with a crypter and a remote access tool under the Phantom Project cybercrime kit, have been aimed at manufacturing, technology, and logistics organizations in Europe as part of a multi-wave phishing operation between November 2025 and January 2026, reports Infosecurity Magazine.