AI Fuels New Cyber Threats as Spyware, Linux Bugs, and Crypto Laundering Emerge

Cybersecurity defenders are confronting an increasingly complex threat landscape, where artificial intelligence (AI) is both weaponised by attackers and deployed for defence, alongside new forms of spyware, critical software vulnerabilities, and sophisticated cybercrime operations.

Recent reports detail a surge in AI-driven attacks, including novel phishing techniques and state-sponsored espionage, highlighting the evolving tactics used by threat actors to compromise systems and steal sensitive data.

AI Integrates into Attack Operations

Attackers are rapidly integrating AI into their toolkits. Proofpoint has disclosed a new technique, dubbed BluePhishing, which leverages malicious AI agent identities within Microsoft Entra ID to gain initial access to cloud environments. This method exploits governance gaps around emerging AI agent adoption, tricking users into granting consent to harmful blueprints.

Further demonstrating AI’s role in cyber espionage, CloudSEK uncovered an exposed Silent Lynx server revealing operations targeting Central Asian governments and critical infrastructure. The group was found to be relying on an AI agent to conduct intrusions and manage tooling, suggesting a Kazakhstan nexus with intelligence collection objectives.

Even ransomware groups are adopting AI. A new Russian-speaking group, Citrus, is targeting corporate Windows systems, using AI-generated PowerShell scripts and batch files during intrusions. Kaspersky researchers observed Citrus employing compromised contractor accounts for initial access and then using AI-assisted scripts for lateral movement and encryption with a Sn00py-family ransomware variant.

Palo Alto Networks Unit 42 has also detected an indirect prompt injection (IDPI) campaign spanning 26 domains. These sites attempt black-hat Generative Engine Optimisation (GEO) to manipulate AI-powered search results, appearing as AI-powered digital asset trading platforms designed to collect user information through hidden prompts visible to AI agents.

Conversely, Meta is expanding its AI age-estimation technology globally to automatically place millions of teens into Teen Account protections on Instagram, even if they have misrepresented their age. This illustrates AI’s dual potential in both offensive and defensive cybersecurity strategies.

New Spyware and Malware Campaigns

In other developments, a command and control (C2) framework named Falcon (also known as XG or Xiàng Gē) has been identified compromising victims’ browsers by running malicious JavaScript. Palo Alto Networks Unit 42 states that Falcon has been leveraged to compromise webmail portals and government web applications, stealing passwords, emails, and session cookies. The activity has targeted government entities in the Middle East and Southeast Asia.

Microsoft reports a 356.2% surge in detections of GSocket, an open-source remote access tool, on internet-facing Linux servers between March and August 2026. Threat actors are deploying GSocket to maintain persistent access after initial vulnerabilities have been patched, primarily targeting PHP web applications, cPanel hosts, and Apache servers in sectors such as education, technology, and government.

Information stealers continue to evolve. Zscaler detailed an SEO poisoning campaign using fake Chocolatey package manager and Microsoft Activation Scripts (MAS) websites to distribute Armorsteal, a Python-based malware. Armorsteal is designed to steal browser data, Discord tokens, cryptocurrency wallets, seed phrases, saved passwords, SSH keys, and Steam data.

Separately, the RevStealer information stealer is being propagated through an industrial-scale, financially motivated campaign. Akatsuki Legion reports distribution across over 100 interconnected domains, trojanised Electron applications masquerading as AI tools like Anthropic’s Claude Opus 5, and hijacked YouTube channels. The malware employs sophisticated evasion techniques to harvest credentials from numerous applications.

A new Grandoreiro banking malware campaign is also targeting users in Argentina, Chile, Colombia, Mexico, and Peru. Arctic Wolf found the campaign uses highly localised phishing lures, recently registered domains, and layered redirection to deliver a Delphi-based loader disguised as a PDF reader.

Vulnerabilities and Security Enhancements

Microsoft has flagged 59 Linux kernel bugs, with its scan of a subset of kernel subsystems revealing 26,502 raw findings between late May and mid-June 2026. These findings led to 33 assigned CVEs, including working root privilege-escalation exploits for eight of them, such as CVE-2026-64563—a state-reset bug in the rhashtable that affects Linux and Android with SELinux enforcing.

In a move to bolster Windows security, Microsoft is enabling NTLM signing by default from November 10, 2026, to mitigate CVE-2026-118737, a critical remote code execution (RCE) flaw in Remote Procedure Call Runtime. These updates enhance NTLM message signing to establish cryptographic session keys, reducing exposure to relay attacks. Windows servers will fully require NTLM signing by May 2027.

An 18-month exposure of a Microsoft Entra ID application credential affecting the UK’s Planning Inspectorate has come to light. ControlPlane reported that the credential, committed in plaintext to a GitHub repository, remained retrievable via GitHub’s raw object CDN despite being removed from the branch via a force push. The client secret was deleted following responsible disclosure.

Major Cybercrime Operations and Takedowns

North Korean threat actors responsible for the record-breaking $6.43 billion theft from Binance are employing a highly complex and automated method to launder the illicit proceeds. Elliptic’s Dr. Tom Robinson detailed the use of over 20,000 wallets on 16 blockchains, 36 services, and 65,000 transactions. Tactics include creating meme coins, cross-chain swaps, and using privacy pools to obscure the money trail.

In a significant law enforcement action, Europol, in collaboration with global partners, has dismantled the criminal infrastructure behind the GootLoader, CastleRAT, and StealC malware families. The operation seized 235 servers and 257 domains, disrupting ‘cybercrime-as-a-service’ models and identifying over 6 million victim credentials used for further cyberattacks.