Malware

The attack chain begins when a victim pastes a command into their Terminal, often lured by a ClickFix page.

The kernel-mode rootkit, Daxin, first documented in March 2022, was found operating on a compromised host in Taiwan in 2026.

TELEPUZ is a lightweight and modular malware, likely developed by a small team and potentially offered as a malware-as-a-service.

The OkoBot framework, particularly its SeedHunter module, targets popular hardware wallets like Ledger and Trezor.

The malware is written in C++ and uses a signed and notarized dropper to evade Gatekeeper.

LabubaRAT operates by impersonating NVIDIA's container runtime toolkit, using an executable named "nvidia-sysruntime.exe."

QiAnXin, a Chinese cybersecurity company, reported that while the group's operations may appear unsophisticated due to the use of SEO poisoning and counterfeit software installers, their organizational structure is more complex, involving multiple distributors.

The AI-generated tool, titled "100% Working AD Information Gathering Script - FULLY FIXED," exhibited several hallmarks of LLM assistance, including a placeholder server name, over-engineering with multiple fallback methods, and a "pretty" console output using excessive colors, Huntress said.