Google's new Gemini 3.5 Transcribe model achieves sub-1-second streaming latency and a 4% word error rate, while auto-correcting filler words and speaker corrections.
O Adform, uma importante plataforma de publicidade, permaneceu comprometido por aproximadamente 24 horas (desde o fim do dia 26 de julho até a noite de 27 de julho) após ser alvo de um ataque por invasores desconhecidos. Poucas pessoas fora do setor conhecem o nome, mas o Adform veicula cerca de 1,5 bilhão de impressões de anúncios todos os dias em dezenas de milhares de sites. Isso significa que qualquer pessoa que visitasse um site que veiculasse anúncios do Adform poderia ter sido alvo do ataque.
Os invasores não estavam tentando instalar malware. Em vez disso, eles executaram um script no navegador da vítima que verificava a área de transferência a cada três segundos. Se detectasse que um endereço de carteira de criptomoedas havia sido copiado, o script o substituía pelo endereço de carteira dos invasores. Assim, se alguém tivesse um site com o anúncio malicioso aberto em uma guia do navegador e estivesse realizando uma transação com criptomoedas em outra guia ou em um aplicativo dedicado, os fundos poderiam acabar nas mãos dos invasores. Os responsáveis pelo Adform detectaram o ataque e corrigiram o problema, mas não há garantia de que um incidente semelhante não volte a acontecer. Por isso, todos os usuários devem se proteger contra publicidade maliciosa. Confira nossas dicas no final desta postagem.
O que sabemos sobre o ataque ao Adform
Não há muitas informações disponíveis, pois a declaração oficial da empresa aborda apenas o que aconteceu e quando, sem explicar a causa do incidente. Uma pesquisa independente revelou detalhes técnicos sobre como usuários comuns foram alvo do ataque, mas nada disso explica como o próprio Adform foi invadido inicialmente.
O que está claro é que os invasores inseriram seu próprio código no JavaScript carregado em todos os sites que veiculavam anúncios do Adform. Sempre que um anúncio estava prestes a ser exibido, o script era carregado do servidor do Adform, selecionava o anúncio correto e o exibia. No entanto, os invasores haviam acrescentado um conjunto de funções maliciosas: monitorar a área de transferência, enviar ao próprio servidor dados sobre o site em que o ataque ocorreu e o endereço IP da vítima, além de substituir endereços de carteiras de Bitcoin, Ethereum e Tron.
Para que o ataque funcionasse, bastava uma guia do navegador aberta com qualquer site que veiculasse anúncios do Adform. Não importava o tipo de site, a aparência do anúncio ou a qual anunciante ele pertencia. A única coisa que importava era se o site usava HTTP ou HTTPS. Segundo o Adform, o ataque não poderia ser realizado em um site carregado por HTTPS, pois, nesse caso, a conexão com o servidor dos invasores era bloqueada.
A empresa não divulgou informações sobre quantos usuários foram afetados nem sobre quantos sites ainda veiculam conteúdo e anúncios por HTTP.
Anúncios maliciosos fazem parte do nosso dia a dia
Infelizmente, anúncios on-line perigosos se tornaram um problema sistêmico. E não estamos falando apenas de anúncios de suplementos de procedência duvidosa ou de jogos de azar. Estamos falando de anúncios que disseminam malware ou levam a sites criados para roubar dados de pagamento e outras informações valiosas. Os invasores construíram uma infraestrutura em escala industrial para realizar esse tipo de ataque e utilizam diversas abordagens.
• Sequestro das contas de anúncios de marcas legítimas e respeitáveis. Basta roubar a senha de alguém da equipe de marketing. A partir daí, os cibercriminosos veiculam anúncios se passando pela empresa que invadiram e promovendo atualizações falsas de aplicativos, promoções fraudulentas e golpes semelhantes. Nos piores casos, como nas invasões de contas da adtech.de e da adxpansion.com, os invasores conseguiram veicular anúncios que redirecionavam as vítimas diretamente para a instalação automática de malware (downloads drive-by).
• Comprar anúncios diretamente. Isso mesmo. Os invasores simplesmente criam suas próprias contas de anunciante e veiculam anúncios para seus sites de phishing e malware, como qualquer outra empresa na Internet.
Como os anúncios aparecem praticamente em todos os lugares, em sites, aplicativos e redes sociais, essas ameaças podem surgir em praticamente qualquer contexto. E existem variações dessa ameaça tanto em computadores quanto em dispositivos móveis.
• Use um serviço de DNS seguro com filtragem de conteúdo integrada. Eles são eficazes no bloqueio da maioria das redes de anúncios conhecidas. A ideia é simples: sempre que seu dispositivo tenta se conectar a um servidor, o serviço DNS bloqueia solicitações para domínios de anúncios conhecidos. Isso desativa os anúncios em todos os lugares de uma só vez: em smart TVs, em todos os navegadores e em aplicativos para dispositivos móveis. Alguns provedores de Internet oferecem esse serviço, mas uma solução mais simples e universal é configurar o DNS seguro no roteador da sua casa seguindo nosso guia.
• Ative os bloqueadores de anúncios e rastreadores em sua solução completa de cibersegurança. Recomendamos Kaspersky Premium, que chama esse recurso de Antibanner. Esse tipo de proteção é especialmente importante durante viagens, pois o DNS seguro pode causar problemas de conexão em hotéis, restaurantes e aeroportos.
• Use proteção para o navegador. Um software de segurança básico pode impedir o download e a execução de um malware de roubo de dados, mas um pequeno script, como o usado no ataque ao Adform, ainda pode passar despercebido. Para se proteger contra esse tipo de ameaça, use uma solução capaz de analisar o que realmente está acontecendo no navegador. No Kaspersky Premium, esse recurso é oferecido pela extensão de navegador Kaspersky Protection. Ela protege contra a coleta de dados on-line, bloqueia banners de anúncios, protege seus pagamentos, protege o que você digita e bloqueia ataques de phishing.
Quer saber quais outros riscos podem estar escondidos nos anúncios on-line e como se proteger? Confira outras postagens:
AmnesiaStealer, a multi-stage macOS infostealer written in Rust that moves beyond conventional credential theft by giving attackers covert, interactive control over a victim’s authenticated Chromium browser sessions. The malware is being distributed through a ClickFix social-engineering campaign that directs users to counterfeit GitHub download pages. Instead of delivering a legitimate application, the sites instruct visitors […]
Microsoft tracked over 30 MacSync Stealer domains by focusing on behavioral patterns, revealing a campaign targeting passwords, keys, wallets and other data.
Domain blocking is a losing game when the thing you’re blocking can register a new domain faster than you can add it to a list. That’s the exact problem Microsoft Defender Experts ran into while tracking MacSync Stealer, a macOS-focused information stealer that RST Cloud first flagged for swapping out its command-and-control infrastructure almost immediately after getting publicly outed. Microsoft detailed how its experts stopped chasing individual domains and started tracking the behaviors that stayed constant underneath them.
Instead of tracking individual domains, Microsoft looked at recurring request patterns, HTTP headers and other behaviors. This allowed its researchers to link more than 30 domains to the same campaign and determine that the infrastructure was doing more than just sending commands to infected Macs. It was also being used to collect, stage and exfiltrate stolen data.
“MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud identified the threat through a limited set of domains and documented rapid command-and-control (C2) replacement after public disclosure.” reads the report published by Microsoft.
“Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration.”
The infection chain starts with a trick rather than an exploit. Victims get social-engineered through a technique known as ClickFix, tricked into pasting or running commands directly in macOS Terminal, and once that shell session fires, curl pulls down attacker-controlled payload content from a path formatted as /curl/[token].
Then, native macOS tools decode and unpack the payload, and an AppleScript-driven layer takes over, blending Unix commands like sh, cp, rm, and killall with osascript calls that make the whole chain look more like ordinary system scripting than malware.
Once active, the stealer focuses on valuable data. The malicious code looks for macOS Keychain data, saved browser passwords and cookies, SSH keys, AWS credentials, Kubernetes configurations and files in common user folders. It also searches for Ledger and Trezor wallet data, showing that the malware targets users with valuable credentials and assets rather than simply collecting random browser history.
What actually confirms exfiltration, rather than just suspicious traffic, is the upload mechanism itself. Collected data gets staged under temporary paths, compressed into an archive, split into chunks, and pushed out through HTTP PUT requests carrying parameters like upload_id, chunk_index, and total_chunks.
“The staged archive was uploaded through rotating infrastructure using curl and HTTP PUT requests. Observed requests included –data-binary, API-key headers, macOS User-Agent string, upload_id values, chunk_index values, and total_chunks parameters.” states Microsoft. “These upload traits confirmed active data exfiltration and provided durable hunting pivots even when domains rotated. “
The researchers pointed out that the exfiltration method stays recognizable even when the destination keeps changing.
RST Cloud’s follow-up work backs up how consistent this infrastructure actually is under the surface. Using the same recurring URI patterns, RST Cloud surfaced eleven additional candidate domains and found a static API-key value shared across four confirmed command-and-control domains, even while the build token attached to each deployment kept rotating. A shared static key sitting inside otherwise rotating infrastructure is exactly the kind of detail that makes automated evasion look less impressive up close.
The attack wraps up with cleanup, deleting temporary archives, staging folders, and lock files after the upload completes. Microsoft notes this reduces what’s left sitting on disk, but it doesn’t erase the behavioral sequence itself.
“After exfiltration, the malware removed temporary archives, staging folders, lock files, and other artifacts. Although this cleanup reduced on-disk evidence, the sequence of archive creation, chunked upload, and deletion can still provide a useful behavioral correlation for defenders.” concludes Microsoft.
For anyone defending Mac fleets, the practical takeaway here isn’t a list of domains to block, since that list will be stale within days. It’s building detection around the recurring shape of the attack itself: shell sessions spawning curl with those specific flag patterns, osascript chaining rapidly into network activity, and archives appearing under /tmp/sync* right before outbound PUT traffic starts. Chase the pattern, not the address, because the address was never going to sit still long enough to matter.
AmnesiaStealer malware targets macOS with data theft and remote browser-session control, potentially exposing accounts already open on compromised Macs.
Hackers are exploiting a macOS Screen Sharing flaw to gain root access and install Monero miners on Macs with port 5900 exposed online.
The Dutch National Cyber Security Centre confirmed active exploitation of a critical macOS authentication flaw, tracked as CVE-2026-65400 (CVSS score of 9.8), less than two weeks after Apple shipped the fix.
The bug sits in macOS’s built-in Screen Sharing feature, the remote desktop tool baked into every Mac. Apple’s fix improved how the system manages authentication state, closing a gap that let attackers on the network authenticate to Screen Sharing without valid credentials at all.
“An attacker on the network may be able to authenticate to Screen Sharing without valid credentials” reads the advisory.
That’s a fast, coordinated fix by industry standards. It just wasn’t fast enough to beat whoever started scanning for exposed systems.
NCSC-NL says it received reports of active abuse hitting multiple systems where port 5900, the port Screen Sharing runs on, was reachable directly from the internet.
“The vulnerability concerns an authentication issue in the Screen Sharing functionality where network attackers can gain access without valid credentials. This is made possible by insufficient state management during the authentication process. As a result, unauthorized individuals can perform authentication attempts that would normally not be accepted.” reads the advisory. “The NCSC has received a security advisory indicating that active exploitation of this vulnerability has been observed on multiple systems where port 5900 was accessible from the internet. In all these cases, root access was obtained on the affected system and a Monero crypto miner was placed.”
In every case documented so far, attackers gained root access and dropped a Monero cryptocurrency miner on the compromised machine. Cryptomining is a relatively boring payload compared to what root access on a Mac could actually enable, which makes this look more like opportunistic scanning than a targeted campaign, for now.
This flaw sits in the same source code file as two other Screen Sharing bugs Apple patched a month earlier in macOS 26.6, one of them a genuinely pre-authentication flaw that a researcher going by @osxreverser described needing nothing but a target’s IP address to exploit, no password, no username, nothing.
That researcher claimed to have found around 40,000 exposed Screen Sharing hosts on the internet during a scan, nearly half of them in the US, spanning residential connections, university networks, and at least a few corporate servers.
What ties both bugs together is how mechanically simple they are to trigger. Security firm Calif, which analyzed the flaws, found no memory corruption, no exploitation trickery, no race condition to win, just logic errors that let a couple of correctly ordered packets walk straight past authentication. Calif also said it built a working exploit for both vulnerabilities in about four hours using an AI coding agent, which is the detail that should worry defenders more than the Monero miner itself: the gap between a patch note and a working exploit keeps shrinking, and it’s shrinking because building the exploit barely takes effort anymore.
If you’re running a Mac with Screen Sharing enabled and haven’t updated yet, do it now rather than after finishing this article. And if updating isn’t possible immediately, turn Screen Sharing off entirely under General, Sharing, until you can; leaving port 5900 open to the internet at this point is less a risk than an open invitation.
AmnesiaStealer targets macOS users through fake GitHub pages, stealing passwords, cookies and data while giving attackers live control of the browser.
Jamf Threat Labs researchers disclosed AmnesiaStealer, a new multi-stage Rust-based macOS infostealer that spread through a counterfeit GitHub download page using the ClickFix technique.
The lure looks convincing: correct GitHub dark theme, Octocat logo, “Verified Publisher” badge, and instead of a download button, it asks the visitor to paste a Terminal command. The same fake GitHub template has been observed in Atomic Stealer and MacSync campaigns, which means the lure infrastructure is shared across multiple malware families.
“AmnesiaStealer runs in three stages: The first is a shell script that downloads and launches the payload. The second is a Rust infostealer that harvests the keychain, browsers, Apple Notes and Telegram. The third is a stream_module, fetched on command, that gives the operator hidden, interactive control of the victim’s browser.” reads the report published by Jamf Threat Labs.
The third stage is the part that separates AmnesiaStealer from commodity stealers. Rather than just dumping files, the remote_stream command turns the infected machine into a live browser session the operator can drive in real time, keyboard input, mouse clicks, navigation, tab management, all while the victim’s own browser window stays untouched and shows nothing unusual.
“The stream module clones the victim’s browser profile, launches it headless and gives the operator live, hidden control of the session” states the report.
The Rust payload starts by displaying a native macOS password prompt styled as an Installer dialog.
It validates the password locally against the directory service using dscl, looping with “Incorrect password. Please try again” until the right one is entered.
“The captured password is then reused throughout the chain. It is piped into sudo -S for privileged reads, passed to security unlock-keychain -p, and written to disk in cleartext, both in the staging directory as pwd and in the user’s home directory as ~/.pwd.” continues the report.
With the password in hand the malware unlocks the login keychain, reads Apple Notes via sudo cat, sweeps Desktop, Documents, and Downloads for documents and wallet files, and targets 16 Chromium-family browsers for cookies, credentials, history, and extensions data.
A behavior worth watching on macOS 26 is how AmnesiaStealer handles Chrome’s Safe Storage key. If it cannot retrieve the key normally, the malware deletes it and replaces it with a key it already knows. This lets attackers decrypt newly stolen passwords and cookies, while potentially making previously stored data inaccessible. Since legitimate browsers do not normally delete and recreate Safe Storage entries through the security command, this activity can be a useful detection signal.
The stream module’s cookie theft works through Chrome DevTools Protocol: it calls Network.getAllCookies against the headless browser session, which returns plaintext cookie values because the browser has already decrypted them in memory. This sidesteps at-rest encryption entirely. The module also injects a stealth script through Page.addScriptToEvaluateOnNewDocument to patch browser fingerprinting APIs, keeping the headless session from being flagged as automation by the sites visited. Persistence is installed as a root LaunchDaemon impersonating Apple’s crash reporting service, com.apple.ReportCrash.agent with a random numeric suffix, configured to survive reboots under the console user’s account.
The C2 backend is named Amnesia Panel, sits at the root of the delivery domain, and returns error messages in Russian when login fails. Infrastructure analysis shows the same URL pattern, /d/command?t=token&b=build, across multiple domains resolving to the same address, consistent with a builder that generates per-campaign configurations and embeds them in the payload as an XOR-encrypted blob. The family name, the Russian error messages, and the shared lure templates with other known stealers suggest an established operation rather than a one-off experiment.
“AmnesiaStealer sets out to harvest credentials, browser data and live sessions from macOS users, and it delivers on some of that more than the rest.” concludes the report. “A working collector paired with a working browser-hijack stage, wrapped around a few dated bypasses, makes it worth tracking.”
Os usuários de Mac historicamente confiaram na segurança de seu sistema operacional. Essa tranquilidade vem principalmente do controle estrito da Apple sobre o ecossistema e do fato de que o macOS sempre enfrentou menos ataques em massa do que o Windows. No entanto, isso não significa que os computadores Mac não tenham vulnerabilidades: as ameaças existem, e novas surgem o tempo todo. Nas últimas semanas, pesquisadores de segurança publicaram relatórios sobre pelo menos duas novas campanhas direcionadas a dispositivos Apple.
O malware usado em uma das campanhas foi apelidado de CrashStealer, enquanto o outro é conhecido como ClickLock. Ambos usam truques diferentes para forçar usuários a inserir a senha do Mac, que os invasores usam para roubar credenciais de contas, ativos de criptomoedas, documentos e muito mais. No post de hoje, analisamos em detalhes como o CrashStealer funciona e como evitar ser vítima dele.
Um aplicativo de videoconferência com o CrashStealer embutido
Em maio de 2026, pesquisadores identificaram os primeiros sinais de desenvolvimento desse malware e, no início de julho, detectaram sua atuação em ambiente real. O malware recebeu esse nome devido ao seu mecanismo principal: ele se disfarça da ferramenta integrada de geração de relatórios de falhas do macOS (CrashReporter), enquanto funciona como um infostealer criado para sequestrar dados confidenciais.
Os pesquisadores conseguiram rastrear um dos sites que os usuários visitaram para baixar o malware. O site se passa por uma plataforma legítima de distribuição da ferramenta de videoconferência Werkbit.
Segundo os pesquisadores, esse foi o site usado pelas vítimas para baixar o Werkbit, que continha, sem que elas soubessem, o malware loader CrashStealer. Fonte
No entanto, você não pode simplesmente visitar o site e baixar o software. Antes de iniciar o download, a pessoa precisa informar um PIN de reunião. Essa configuração provavelmente permite que os invasores limitem o alcance da campanha, direcionando-a apenas a vítimas específicas previamente selecionadas. Ainda não se sabe exatamente como os cibercriminosos escolhem seus alvos nem como entregam o PIN.
As pessoas “sortudas” que recebem um código acabam instalando a carga maliciosa inicial, chamada Werkbit Setup. Curiosamente, a carga maliciosa possui um certificado de desenvolvedor da Apple válido e foi aprovada no processo de autenticação de aplicativos da empresa, o que indica que passou pela verificação automatizada destinada a detectar código malicioso. Como resultado, os invasores conseguem contornar o Gatekeeper, mecanismo de proteção integrado do sistema operacional. Isso permite que a carga útil seja iniciada sem acionar os avisos usuais de software não confiável.
[caption] O instalador Werkbit Setup é assinado com um certificado válido de desenvolvedor da Apple e passou pelo processo de autenticação de aplicativos da empresa. Fonte
[/caption]Depois de iniciado, o Werkbit Setup primeiro se conecta ao GitHub. Pesquisadores acreditam que o uso dessa plataforma ajuda os invasores a passar despercebidos, fazendo com que as solicitações iniciais de rede pareçam muito menos suspeitas para as ferramentas de segurança. Depois de obter instruções de um repositório no GitHub, o programa se conecta diretamente ao servidor dos invasores para baixar o próprio CrashStealer.
Em seguida, o carregador salva o malware em uma pasta temporária do macOS, executa-o e apaga a maioria dos arquivos intermediários da instalação. Como resultado, em poucos segundos após a execução do Werkbit Setup, um infostealer totalmente funcional está em operação. Vale destacar que o usuário nunca recebe o aplicativo de videoconferência prometido.
Como o CrashStealer funciona
Ao contrário do carregador Werkbit Setup, o malware CrashStealer em si não é assinado com um certificado de desenvolvedor da Apple. Para evitar que os usuários desconfiem, o malware se disfarça da ferramenta de relatório de falhas do macOS, o CrashReporter, usando exatamente o mesmo nome, identificador de aplicativo e um ícone semelhante.
Depois de executado, o CrashStealer realiza uma sequência de etapas para obter acesso a dados confidenciais, estabelecer persistência no sistema e ocultar rastros:
Remove metadados, incluindo o atributo que identifica o aplicativo como um arquivo baixado da Internet.
Exibe uma solicitação falsa do sistema pedindo a senha do macOS do usuário.
Usa as credenciais capturadas anteriormente para acessar o Keychain, o gerenciador de senhas integrado do macOS.
Verifica se há ferramentas de segurança e softwares de análise de malware instalados no computador.
Coleta senhas salvas nos navegadores, cookies, dados do Keychain e informações de outros gerenciadores de senhas e carteiras de criptomoedas.
Criptografa os dados roubados e os prepara para envio ao servidor dos invasores.
Cria uma cópia de si mesmo e estabelece persistência para ser executado automaticamente sempre que o macOS é inicializado.
Exclui arquivos temporários e outros vestígios da instalação para dificultar ainda mais a detecção.
A segunda etapa merece uma análise mais detalhada. A solicitação de senha exibida ao usuário é extremamente convincente. Além disso, o malware verifica imediatamente se as credenciais estão corretas: se a pessoa cometer um erro de digitação e inserir uma senha inválida, o CrashStealer exibirá a janela novamente para que ela tente outra vez.
[caption] Depois de ser executado, o CrashStealer exibe uma janela pop-up que simula a solicitação padrão de senha do macOS. Fonte
[/caption]
Quais dados o CrashStealer tenta roubar?
A lista de alvos do CrashStealer é extensa. O principal alvo é o Keychain, o gerenciador de credenciais integrado do macOS, onde o sistema armazena credenciais de contas, chaves criptográficas, certificados, tokens e outros dados confidenciais.
Os usuários de gerenciadores de senhas de terceiros também não estão protegidos: o malware rouba dados de 14 desses serviços, incluindo 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass e RoboForm.
Além disso, o malware coleta todas as credenciais e cookies armazenados em navegadores baseados no Chromium (Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium e NAVER Whale) bem como no Firefox. Os invasores demonstram ter um grande interesse em ativos de criptomoedas: o CrashStealer tem como alvo específico os dados de 80 extensões diferentes de carteiras de criptomoedas, incluindo MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Exodus, Keplr e Solflare.
Por fim, o malware verifica as pastas Documentos e Downloads em busca de arquivos que possam ser de interesse dos cibercriminosos. O CrashStealer criptografa todos os dados roubados com o algoritmo AES-256-GCM, os compacta em um arquivo ZIP e os envia ao servidor dos invasores.
Como proteger seu dispositivo
O aumento dos ataques direcionados ao macOS é um claro sinal de alerta: quem usa dispositivos Apple precisa adotar uma postura mais proativa em relação à segurança. Recomendamos:
Pesquisar sobre os aplicativos na Internet antes de instalá-los
Dar preferência a utilitários disponíveis nas lojas de aplicativos oficiais sempre que possível
As soluções de segurança da Kaspersky detectam o malware descrito nesta publicação e atribuem a ele os veredictos HEUR:Trojan-Downloader.OSX.Agent.gen e HEUR:Trojan-PSW.OSX.Agent.gen.
The statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated. The information was provided by Kaspersky users who consented to sharing statistical data.
Quarterly figures
In Q2 2026:
Kaspersky products blocked nearly 400 million attacks that originated with various online resources.
Web Anti-Virus responded to 52 million unique links.
File Anti-Virus blocked more than 16 million malicious and potentially unwanted objects.
There were 2538 new ransomware variants discovered.
More than 71,000 users experienced ransomware attacks.
15% of all ransomware victims whose data was published on threat actors’ data leak sites (DLS) were attacked by Qilin.
More than 213,000 users were targeted by miners.
Ransomware
Quarterly trends and highlights
Threat actor disruption
Microsoft has dismantled an illicit malware-signing service used by ransomware operators. Microsoft’s Digital Crimes Unit has shut down a malware-signing-as-a-service (MSaaS) operation run by the threat group Fox Tempest. The illicit service abused the Microsoft Artifact Signing platform to generate digital signature certificates for malicious software. Malware signed by these certificates was observed in campaigns conducted by such ransomware groups as Rhysida, Akira, INC, Qilin, and BlackByte. The service was also leveraged by operators of the Oyster loader as well as the Lumma and Vidar infostealers. To disrupt the operation, Microsoft seized the domain used by the MSaaS platform, revoked all associated certificates, and disabled the related accounts. Additionally, the company filed a lawsuit against Fox Tempest.
Vulnerabilities and attacks
CISA has confirmed that a Windows vulnerability known as BlueHammer is actively being exploited in ransomware attacks. On April 22, the agency updated its Known Exploited Vulnerabilities (KEV) catalog to note the ongoing ransomware exploitation of CVE-2026-33825. The local privilege escalation flaw in Microsoft Defender was originally disclosed earlier in April. Although Microsoft released a fix on April 14, unpatched systems remain vulnerable. CISA did not disclose further details or attribute the attacks to specific threat groups.
Check Point has linked zero-day exploitation of CVE-2026-50751 to the Qilin ransomware group. The critical vulnerability affects Check Point Remote Access VPN and Mobile Access. Attackers began exploiting the flaw as a zero-day on May 7, with activity spiking sharply in early June. While several dozen organizations have been targeted, at least one incident has been definitively tied to Qilin. Check Point also disclosed a related certificate validation flaw (CVE-2026-50752) that affects site-to-site VPN connections relying on the legacy IKEv1 key exchange protocol.
Researchers assess with high confidence that the PayoutsKing group is leveraging the legitimate QEMU emulator to deploy hidden, Alpine Linux-based virtual machines on compromised hosts. Because security solutions often lack visibility inside virtualized environments, the threat actors use this technique to evade detection. Inside the VM image, the operators deploy various tools — such as credential theft software — and configure the virtual machine as a backdoor managed via a reverse SSH tunnel to their command-and-control infrastructure. While the technique is not new, and we’ve detailed it before, it remains relatively rare in ransomware attacks.
The most prolific groups
This section highlights the most prolific ransomware gangs by number of victims added to each group’s DLS. Qilin reclaimed the top spot (accounting for 14.57% of total listings) after placing second last quarter. It is followed by the Akira ransomware (7.80%) and the DragonForce RaaS group (6.88%).
Number of each group’s victims according to its DLS as a percentage of all groups’ victims published on all the DLSs under review during the reporting period (download)
Number of new ransomware variants
In Q2, Kaspersky solutions detected four new ransomware families and 2538 new modifications. This signals a continued stabilization following spikes seen in Q1 and Q4 of last year.
Number of new ransomware modifications, Q2 2025 — Q2 2026 (download)
Number of users attacked by ransomware Trojans
Our solutions protected a total of 71,860 unique users from ransomware during Q2. Ransomware activity peaked in April, with 31,206 targeted users recorded during that month.
Number of unique users attacked by ransomware Trojans, Q2 2026 (download)
TOP 10 countries and territories attacked by ransomware Trojans
Country/territory*
%**
1
South Korea
0.87
2
Pakistan
0.76
3
China
0.71
4
Libya
0.49
5
Tajikistan
0.46
6
Turkmenistan
0.38
7
Cameroon
0.38
8
Indonesia
0.36
9
Bangladesh
0.36
10
Mozambique
0.34
* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country/territory.
* Unique Kaspersky users attacked by the specific ransomware Trojan family as a percentage of all unique users attacked by this type of threat.
Miners
Number of new miner variants
In Q2 2026, Kaspersky solutions detected 6067 new miner variants, almost twice the number for the previous reporting period.
Number of new miner modifications, Q2 2026 (download)
Number of users attacked by miners
In Q2, we detected attacks using miner programs on the computers of 213,003 unique Kaspersky users worldwide.
Number of unique users attacked by miners, Q2 2026 (download)
TOP 10 countries and territories attacked by miners
Country/territory*
%**
1
Mali
1.56
2
Senegal
1.54
3
Tanzania
1.32
4
Panama
1.04
5
Bangladesh
1.03
6
Ethiopia
0.87
7
Costa Rica
0.67
8
Bolivia
0.67
9
Côte d’Ivoire
0.65
10
Kazakhstan
0.62
* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by miners as a percentage of all unique users of Kaspersky products in the country/territory.
Attacks on macOS
Quarterly highlights
In April, Aikido researchers reported a new attack by the GlassWorm stealer, which was distributed via malicious IDE extensions on the Open VSX Registry. The payload operated by installing a secondary malicious extension across all installed IDE environments on the host machine. Ultimately, this second-stage implant exfiltrated crypto wallet data, environment variables, and other secrets. It also installed a RAT on the infected device.
In May, Socket researchers uncovered a supply chain compromise involving the popular npm package art-template. As a result of the breach, the weaponized package injected the Coruna exploit kit into web applications it was used to build. Coruna targets iOS devices.
In June, Palo Alto Networks’ Unit 42 discovered FlutterShell, a new backdoor family that targets macOS devices. Developed with the Flutter framework, the malware leverages the WebView engine to load web pages that contain malicious JavaScript. On the client side, the backdoor registers bridge functions invoked by the loaded JavaScript that allow threat actors to execute arbitrary payloads on the victim’s device. Notably, the malicious applications successfully passed Apple notarization. Although the specific samples analyzed functioned primarily as adware, the underlying architecture permits the delivery of far more sophisticated malicious payloads.
TOP 20 threats to macOS
* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky security solutions for macOS (download)
* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.
Detections of PasivRobber spyware continued their downward trend. Meanwhile, adware and traffic-routing utilities (categorized as NetTool) rose to the top of the rankings. Additionally, Q2 saw a noticeable spike in detections for the DirtyCow exploit frequently leveraged for iPhone jailbreaking.
TOP 10 countries and territories by share of attacked users
Country/territory
%* Q1 2026
%* Q2 2026
Brazil
1.13
1.13
China
1.04
1.28
Hong Kong
0.92
0.49
Singapore
0.85
0.19
France
0.62
1.18
Mexico
0.43
0.72
India
0.41
0.42
Thailand
0.40
0.24
Germany
0.33
0.71
The Netherlands
0.31
0.62
* Unique users who encountered threats to macOS as a percentage of all unique Kaspersky users in the country/territory.
IoT threat statistics
This section presents statistics on attacks targeting Kaspersky IoT honeypots. The geographic data on attack sources is based on the IP addresses of attacking devices.
In Q2 2026, the breakdown of attacking devices and sessions that targeted Kaspersky honeypots by protocol was as follows:
Distribution of attacked services by number of unique IP addresses of attacking devices (download)
The share of SSH attacks saw a slight uptick compared to the previous quarter.
Distribution of cybercriminal sessions in Kaspersky honeypots (download)
TOP 10 threats delivered to IoT devices
Share of each threat delivered to an infected device as a result of a successful attack, out of the total number of threats delivered (download)
As is typically the case, Mirai botnet variants continue to dominate the IoT threat landscape. Activity of another prominent botnet, Prometei, also saw an increase.
Attacks on IoT honeypots
the Netherlands, Germany, and The United States accounted for the highest proportions of SSH-based attacks during this period. While the top three countries remained the same as last quarter, their relative rankings shifted.
Country/territory
Q1 2026
Q2 2026
The Netherlands
17.57%
21.18%
Germany
10.34%
16.73%
United States
23.74%
6.76%
Bulgaria
1.10%
5.50%
Sweden
2.09%
4.93%
Panama
6.34%
4.67%
Luxembourg
0.16%
4.62%
Romania
5.82%
4.06%
Vietnam
3.50%
3.91%
India
6.05%
2.78%
The percentage of Telnet-based attacks originating from Pakistan continued to climb, knocking China down to second place.
Country/territory
Q1 2026
Q2 2026
Pakistan
27.31%
36.60%
China
39.54%
35.62%
Russian Federation
8.25%
8.75%
India
4.66%
4.19%
Brazil
3.30%
3.34%
United States
0.45%
3.03%
Indonesia
6.71%
1.52%
Philippines
0.36%
0.95%
France
0.17%
0.84%
Thailand
0.55%
0.66%
Attacks via web resources
The statistics in this section are based on detection verdicts by Web Anti-Virus, which protects users when suspicious objects are downloaded from malicious or infected web pages. These malicious pages are purposefully created by cybercriminals. Websites that host user-generated content, such as message boards, as well as compromised legitimate sites, can become infected.
TOP 10 countries and territories that served as sources of web-based attacks
The following statistics show the distribution by country/territory of the sources of internet attacks blocked by Kaspersky products on user computers (web pages redirecting to exploits, sites containing exploits and other malware, botnet C&C centers, and so on). One or more web-based attacks could originate from each unique host.
To determine the geographic source of web attacks, we matched the domain name with the real IP address where the domain is hosted, then identified the geographic location of that IP address (GeoIP).
In Q2 2026, Kaspersky solutions blocked 399,312,961 attacks launched from internet resources worldwide. Web Anti-Virus was triggered by 52,850,592 unique URLs.
Web-based attacks by country/territory, Q1 2026 (download)
Countries and territories where users faced the greatest risk of online infection
To assess the risk of malware infection via the internet for users’ computers in different countries and territories, we calculated the share of Kaspersky users in each location on whose computers Web Anti-Virus was triggered during the reporting period. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.
This ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.
Country/territory*
%**
1
Bangladesh
11.71
2
India
7.40
3
Tajikistan
7.13
4
Venezuela
7.05
5
New Zealand
6.58
6
Vietnam
6.34
7
Taiwan
6.28
8
Belgium
6.24
9
France
5.97
10
Hungary
5.92
11
Nepal
5.91
12
Portugal
5.86
13
Italy
5.77
14
Costa Rica
5.72
15
Canada
5.65
16
Qatar
5.61
17
Dominican Republic
5.52
18
Palestine
5.48
19
Greece
5.47
20
UAE
5.43
* Excluded are countries and territories with relatively few (under 10,000) Kaspersky product users.
** Unique users targeted by web-based Malware attacks as a percentage of all unique users of Kaspersky products in the country/territory.
On average during the quarter, 4.54% of users’ computers worldwide were subjected to at least one Malware web attack.
Local threats
Statistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer by infecting files or removable media, or initially made their way onto the computer in non-open form. Examples of the latter are programs in complex installers and encrypted files.
Data in this section is based on analyzing statistics produced by anti-virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The statistics are based on detection verdicts from the On-Access Scan (OAS) and On-Demand Scan (ODS) modules of File Anti-Virus and include detections of malicious programs located on user computers or removable media connected to the computers, such as flash drives, camera memory cards, phones, or external hard drives.
In Q2 2026, our File Anti-Virus detected 16,986,351 malicious and potentially unwanted objects.
Countries and territories where users faced the highest risk of local infection
For each country and territory, we calculated the percentage of Kaspersky users whose computers had the File Anti-Virus triggered at least once during the reporting period. These statistics reflect the level of personal computer infection in different countries.
Note that this ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out File Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.
Country/territory*
%**
1
Turkmenistan
46.38
2
Cuba
29.70
3
Tajikistan
28.46
4
Afghanistan
28.19
5
Yemen
27.85
6
Burundi
26.82
7
Mozambique
25.01
8
Republic of the Congo
24.88
9
Syria
23.17
10
Uzbekistan
22.49
11
China
21.92
12
Nicaragua
21.60
13
Cameroon
21.47
14
Bangladesh
20.43
15
Democratic Republic of the Congo
20.25
16
Algeria
19.78
17
Uganda
19.48
18
Ethiopia
18.57
19
Tanzania
18.54
20
Mali
18.53
* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users on whose computers Malware local threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.
On average worldwide, Malware local threats were detected at least once on 10.93% of users’ computers during Q2.
Full details and PoC exploit code for CVE-2026-39868 are public. The macOS kernel vulnerability in DTrace lets an app corrupt kernel memory. Patch now.
A public proof-of-concept (PoC) has been released for CVE-2026-39875, a macOS vulnerability in the Common UNIX Printing System (CUPS) that allows an unprivileged local user to perform arbitrary file writes with root privileges. The flaw affects macOS Sonoma, Sequoia, and Tahoe versions before macOS 14.8.8, 15.7.8, and 26.6.
The PoC, published by security researcher Dallas Dubs, demonstrates how two logic flaws in the privileged cupsd printing daemon can be chained.
Although the public code demonstrates a root-level arbitrary file write rather than a complete interactive root shell, such a capability can create a realistic path to local privilege escalation depending on the targeted file and system configuration.
The flaw allows a local attacker to register a malicious printer and steal a valid CUPS authentication token during printer probing.
PoC Released for CUPS Vulnerability
The attacker can then replay the captured token to register another printer. This printer uses a file:// device URI that targets an attacker-selected local path not protected by System Integrity Protection (SIP).
The issue is especially serious because CUPS may begin root-privileged file operations before the related authentication validation process has fully completed.
In the final stage, the attacker submits a print job containing controlled data to the malicious printer. The cupsd daemon writes the supplied content to the selected location as root.
According to the PoC documentation on GitHub, the attack requires no user interaction after execution. It can be reproduced on vulnerable macOS versions. The public repository includes demonstrations against macOS Tahoe 26.4.1, macOS Sequoia 15.7.5, and macOS Sonoma 14.8.5.
PoC on GitHubPoC on GitHub
The developer also clarified that the released script verifies that a file was created with root ownership. It does not directly provide a full privilege escalation mechanism.
However, arbitrary root file writes are a high-impact primitive. An attacker who already has access to a standard local account could abuse this condition to alter configuration files handled insecurely, scheduled task definitions, application support files, or other writable locations.
The practical impact will vary depending on SIP restrictions, file permissions, endpoint security controls, and the availability of a suitable target to turn the write into persistent root-level code execution.
PoC on GitHub
Apple has addressed the vulnerability in macOS 26.6, macOS 15.7.8, and macOS 14.8.8. Organizations should prioritize deploying these updates, particularly on shared Mac systems, developer endpoints, and devices where users can execute untrusted local software.
Security teams should also monitor for unusual local printer registrations, unexpected changes to printer device URIs, and suspicious print jobs targeting file-based destinations.
Restricting unnecessary printer administration access and monitoring CUPS-related activity can provide additional detection coverage while patches are rolled out. The PoC release increases the likelihood of active testing and attempted exploitation, making prompt patching essential.
A recently disclosed privilege-related vulnerability in the Common UNIX Printing System (CUPS) on macOS could allow an unprivileged local user to create attacker-controlled files in arbitrary locations outside the protection of System Integrity Protection (SIP), thereby gaining root ownership. This flaw, tracked as CVE-2026-39875, affects Apple devices running macOS Sonoma, Sequoia, and Tahoe versions before […]
macOS users are facing a new, highly polished ClickFix campaign that abuses fake CAPTCHAs to execute Terminal commands, silently deploy Atomic macOS Stealer (AMOS), and systematically loot crypto wallets and browser‑stored credentials. This evolution of ClickFix underscores how social engineering, not exploits, remains one of the most effective paths to full compromise on Apple devices. […]
ClickLock can shut down Mac apps for more than three days while pressuring users to enter a password and stealing sensitive account data in the background.
New macOS infostealer CrashStealer uses a signed app to bypass Gatekeeper, steals credentials and wallets, then AES-encrypts stolen data.
Jamf Threat Labs first spotted CrashStealer in early May 2026 as a suspicious macOS sample uploaded to VirusTotal. By early July, in-the-wild detections confirmed the malware had moved from development into active deployment. The malware is written in native C++, impersonates Apple’s built-in crash-reporting framework, and encrypts everything it collects before sending it out. Most commodity macOS stealers are thin AppleScript wrappers or lightweight Objective-C tools. This one isn’t.
The initial access arrives through a disk image called “Werkbit Setup,” which contains a single application named Werkbit.app. That app is signed with a valid Apple Developer ID, Emil Grigorov (WWB7JA7AQV), and carries a notarization ticket, meaning it clears Gatekeeper on first launch without any warning.
The domain werkbit[.]io, which serves the installer, was registered in late June 2026, and access to the download is gated behind a meeting PIN so the malicious installer isn’t visible to casual visitors.
“We have since identified the stage that precedes the payload: a signed and Apple-notarized dropper, distributed as a disk image named “Werkbit Setup,” that retrieves the CrashStealer payload from attacker infrastructure and launches it.” reads the report published by Jamf. “Because the dropper carries a valid Developer ID and a stapled notarization ticket, it clears Gatekeeper on first launch, in contrast to the ad-hoc-signed payload it installs.”
When the victim opens Werkbit.app, it queries the GitHub API and fetches a file called sys.cache from a repository at mgothiclove/pkeys. That file contains the curl command the dropper runs next, pulling a shell script from endpoint-api-v1[.]com. The script isn’t written to disk in readable form: it arrives as a series of Base64-encoded blobs decoded at runtime before being piped directly to bash.
“The script downloads the payload disk image over cleartext HTTP from hxxp://endpoint-api-v1[.]com/d/f1b24e/download, retrying up to three times, and saves it as CrashReporter.dmg in /tmp.” continues the report. “It mounts the image without browsing or verification (hdiutil attach -nobrowse -noverify -noautoopen -quiet), copies the first .app bundle it finds into a hidden directory at /tmp/.CrashReporter, then detaches the image and deletes the downloaded .dmg. “
The dropper then strips the payload’s existing signature and re-signs it ad-hoc before launching it from that hidden /tmp path. An application bundle launching from a hidden directory under /private/tmp is an unusual and high-confidence indicator on its own.
The downloaded disk image contains CrashReporter.app, which carries the bundle identifier com.apple.crashreporter and an icon designed to look like Apple’s built-in crash-reporting component. The Info.plist contains the C2 address, 179.43.166.242, hardcoded as an App Transport Security exception, visible in cleartext.
“This is likely a byproduct of the authors’ test setup, as it would let an operator reach the C2 regardless of how the server is configured. The reliable takeaway is for defenders: the C2 address sits in the property list in cleartext.” continues the report. “This ATS exception appears in the earlier samples we identified but not in the more recent ones, which omit it.”
Later samples drop this exception, suggesting the operator has since moved to a properly configured TLS endpoint and no longer needs to relax Apple’s network security policy.
The TCC usage-description strings in Info.plist are also worth reading carefully. The malware requests full disk access under the framing “CrashReporter requires Full Disk Access for system administration,” alongside permissions for Desktop, Documents, Downloads, and removable volumes. These strings pre-populate whatever macOS shows the victim in the permission prompt, and the Desktop, Documents, Downloads description matches exactly where the file-search component later walks.
After launch, the malware shows a native macOS password prompt and validates whatever the user enters by calling dscl, a legitimate Apple directory-service utility, with the -authonly option. It loops until a correct password is supplied, then caches the validated credential in ~/.cache/.sys_auth with permissions set to 600. That password is immediately reused to unlock the login keychain via Apple’s own security command-line tool.
Collection is broad. The malware targets Chromium-based browsers including Chrome, Brave, Edge, Opera, Vivaldi, and others, Firefox credential stores, approximately 80 cryptocurrency wallet browser extensions including MetaMask, Phantom, Coinbase, Trust Wallet, Rabby, and Exodus, and 14 password managers including 1Password, Bitwarden, LastPass, Dashlane, and KeePassXC. It also runs a file searcher across ~/Documents and ~/Downloads that skips executables, disk images, large archive formats, and media files to keep the collected set small and relevant. The login keychain copy and the validated account password end up in the same staging area as everything else.
What distinguishes CrashStealer from most macOS stealers is what happens to the data before it leaves the machine.
“The encryption is authenticated and reasonably modern. Each item is encrypted with AES-256-GCM through Apple’s CommonCrypto, following the standard sequence of creating a cryptor (CCCryptorCreateWithMode), setting an initialization vector (CCCryptorGCMSetIV), encrypting (CCCryptorGCMEncrypt), and finalizing the authentication tag (CCCryptorGCMFinal).” states the report.”The 32-byte key is derived with PBKDF2-HMAC-SHA256 over 10,000 iterations (CCKeyDerivationPBKDF), using a passphrase together with a salt.”
The salt is hardcoded in the sample, labeled panel_salt_v1, and a nearby cleartext development string reads “using fallback salt — set CONFIG_CRYPTO_SALT for production,” confirming the operator intended this to be configurable and shipped a development default. The collected files are then zipped into hidden archives with a .zx_ prefix followed by eight random hex characters under ~/.cache/com.apple.crashreporter/. The stealer removes the staging directories after archiving but leaves the .zx_.zip archives behind, making them a reliable artifact for defenders to hunt for.
CrashStealer persists by copying itself to ~/Library/Caches/com.apple.crashreporter/CrashReporter.app, re-signing the copy ad-hoc, and installing a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist. The label is com.apple.crashreporter.helper, continuing the Apple impersonation into the persistence layer. KeepAlive is set with SuccessfulExit as false, meaning launchd restarts the process whenever it exits with an error, keeping it resident across reboots.
Anti-analysis measures include control-flow flattening applied broadly across functions, runtime decryption of sensitive strings from an encrypted blob in the binary’s __const section, and layered anti-debugging.
“A constructor that runs before main, during dynamic-linker initialization, uses sysctl with a KERN_PROC / P_TRACED query, the standard macOS debugger check, and terminates with exit code 45 if one is attached, before any malicious behavior runs.” states Jamf. “Patching out that first check is not enough on its own: a second check later in application initialization exits the same way.”
The delivery domain also hosts a dark-themed operator panel at endpoint-api-v1[.]com/login labeled “Command Panel,” independently spotted by MalwareHunterTeam.
Additional operator interfaces tied to the same campaign have been identified at cohezo[.]io, cohezo[.]com, and cordinex[.]io. Jamf reported the Developer Team ID to Apple after confirming it was used to distribute the malicious dropper.
“CrashStealer’s delivery chain shows real care: rather than a bare, unsigned lure, the operators front the attack with a signed and notarized dropper that clears Gatekeeper before quietly fetching, re-signing and launching the payload.” concludes the report.”What sets it apart from the commodity stealer crowd is less what it collects than how it is built: client-side AES-GCM encryption of the collected files, and an emphasis on analysis resistance through control-flow flattening, encrypted strings and layered anti-debugging.”
Entrar
