Malware

Attackers continue to evade defenders by using legitimate platforms like AWS and Microsoft utilities.

Attacks involving the .NET-based Phantom Stealer, which has been bundled with a crypter and a remote access tool under the Phantom Project cybercrime kit, have been aimed at manufacturing, technology, and logistics organizations in Europe as part of a multi-wave phishing operation between November 2025 and January 2026, reports Infosecurity Magazine.

The stealer persists on the victim’s machine and immediately exfiltrates data with no local staging.

Windows environments are at risk of significant compromise with the new, advanced CrySome remote access trojan, which integrates antivirus-killing and hidden virtual desktop control capabilities with post-exploitation tooling, GBHackers News reports.

Enterprise business IT environments have been subjected to the DeepLoad credential-stealing malware campaign that ensured stealth via AI abuse and ClickFix attack techniques, according to CyberScoop.

RoadK1ll functions as a lightweight reverse tunneling implant, designed to blend into normal network traffic and transform an infected machine into a relay point for attackers.

Security Affairs reports that multiple China-linked threat groups executed a complex cyber campaign against a Southeast Asian government in 2025, employing a diverse array of malware and advanced techniques to achieve persistent access and exfiltrate sensitive data.

The campaign, attributed to the Chinese cybercrime group Silver Fox, encompasses a wide range of applications including VPN clients, encrypted messengers, video conferencing tools, and e-commerce software.