Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data. SafePal says the breach impacts customers who placed orders between March 2, 2025, and April 11, 2026, exposing their names, email addresses, shipping addresses, phone numbers, and purchase information. The company says the breach did not expose customers' wallet seed phrases, private keys, passwords, bank account information, payment card numbers, government-issued identification numbers, or other credentials. "No evidence has been found that the incident itself compromised access to SafePal wallets or funds," SafePal said in a security advisory published Sunday.
Large DDoS attacks disrupted Threema, causing severe communication outages. Threema On-Prem users were unaffected by the attacks. Threema suffered multiple large-scale DDoS attacks that disrupted its secure messaging service and caused severe communication issues. Organizations using Threema On-Prem were not affected, as their deployments run on their own infrastructure. Threema is a Swiss paid secure messaging service, similar to WhatsApp or Signal, focused heavily on privacy and security. “If the attack originates simultaneously from multiple (and potentially changing) sources, it is referred to as a “Distributed Denial of Service” (DDoS) attack. This makes the attack significantly more difficult to defend against because it is not possible to simply block a single source.” reads the report. “Because sophisticated attackers constantly change their methods, sources, and attack patterns during an attack, a cat-and-mouse game ensues, with both sides continuously reacting to the other’s most recent action.” Users began reporting Threema outages on Tuesday evening. The company initially blamed a network issue at its colocation provider, but later confirmed it was facing a series of DDoS attacks. The attacks caused intermittent disruptions into Wednesday, with users in several countries still reporting problems even after Threema’s status page showed the service as operational. The company said a series of large-scale DDoS attacks also targeted its colocation partner, Nine. Attack patterns kept changing, making mitigation difficult. The service was unavailable for about four hours Tuesday evening, followed by intermittent outages Wednesday morning. Normal operations were restored at 12:23 p.m. CEST. “It is not entirely clear whether Threema was the primary target or whether the attacks were directed at multiple targets. In any case, they continued over an extended period and their patterns were constantly adapted, making them difficult to defend against.” continues the report. “As a result of these attacks, Threema was unavailable on Tuesday between 7:30 p.m. and 11:30 p.m. CEST. The page providing information on the current system status was initially not updated due to a technical issue unrelated to the attack. We therefore temporarily took it offline until the problem was resolved.” Threema communicated the service disruptions progressively through social media, while Threema Work customers received updates by email. To strengthen its defenses, Threema deployed additional upstream DDoS protection on August 14, filtering malicious traffic before it reached its infrastructure. The company also plans to improve its status page with an incident history and RSS feed, giving users and administrators another way to receive independent service updates. “We will also expand the status page in the coming days. The update will include an incident history and an RSS feed that interested users and Threema Work administrators can subscribe to in order to receive system updates through an independent channel.” concludes the report. “We apologize for any inconvenience caused and appreciate your understanding.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, DDoS) “Business customers using Threema Work were informed via email on Wednesday morning about the unstable service conditions, and account managers provided information on the current situation in response to inquiries.” To avoid similar incidents, the Swiss company has implemented “specialized DDoS protection as an additional measure” to filter attack traffic upstream and reduce the load on its infrastructure. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Claude is experiencing a major outage, with users reporting login problems and degraded performance across several Anthropic services. The incident began on August 16, 2026, at around 21:58 UTC, and is affecting Claude.ai, Claude Code, and Claude Cowork. According to Anthropic’s status page, the company first said it was investigating an issue preventing some users from authenticating to Claude.ai, Claude Code, and Claude Cowork. A few minutes later, Anthropic reported a broader service disruption involving degraded performance on Claude.ai and platform.claude.com. For users, the outage can result in problems signing in, Claude failing to load, requests not completing, or other errors when using the affected services. Anthropic’s status page currently classifies Claude.ai, Claude Code, and Claude Cowork as experiencing a major outage. Claude Console and the Claude API are currently listed as operational.
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM ShieldBreak – August 2026 disclosure Kimwolf v7: An Evolution of the Kimwolf Botnet CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection Concept Drift Detection and Adaptive Retraining of Malware Classification Models A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models C-GUARD: Context-Adaptive Conformal Gating for Improving Robustness Against Evasive Windows PE Malware An Explainable Deep Learning Pipeline for Malware Family Classification: GAF Image Encoding and API-Grounded LLM Interpretation APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Multiple distributed denial-of-service (DDoS) attacks targeted the Threema secure messaging service earlier this week, causing severe disruptions to communications. Organizations using Threema On-Prem did not experience any issues because they rely on their own infrastructure. In a post-mortem report on Friday, the end-to-end encrypted instant messaging service said that the attacks were difficult to defend against because the threat actor constantly changed patterns. Threema is a paid messaging application developed by the Swiss technology company of the same name, with a heavy focus on security and privacy. The service relies on its own server infrastructure in various locations in Switzerland and promises “no ads, no profiling, no hidden data analyses.” On Tuesday around 6 PM UTC, users started to report service interruptions. The company responded about an hour later, saying that based on the information available at the time, the cause was “a network outage on our colocation partner’s side.”
Mustang Panda upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making the backdoor harder to detect. HoneyMyte, also known as Mustang Panda, has pushed its CoolClient backdoor another step deeper into Windows. Kaspersky’s latest analysis shows a new variant that can deploy a signed kernel-mode driver as a Windows service, communicate with it through IOCTL requests, and use it to hide processes, files and registry entries from inspection. That distinction matters. CoolClient was already a capable espionage tool, with keylogging, clipboard theft, credential harvesting, file management, system reconnaissance and a plugin architecture, but the new driver changes how difficult the implant can be to see and remove. Kaspersky observed the updated variant in intrusions across Pakistan, Mongolia and Myanmar, while the wider victim set also includes Russia and confirmed government entities. CoolClient first appeared publicly in 2022 through Sophos research, followed by Trend Micro analysis in 2023. Kaspersky documented another evolution in 2025, when the malware gained clipboard theft and HTTP traffic interception for credential harvesting. The latest version keeps those capabilities and adds something more fundamental: kernel-level control. “The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified.” reads Kaspersky’s report. “The overall design is comparable to the kernel-mode enhancements previously observed in ToneShell, but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor to communicate directly with the driver.” In the Myanmar campaign described by Kaspersky, Mustang Panda first used PlugX as the post-compromise implant and then deployed CoolClient. Before launching the malware, the actor added exclusions to Microsoft Defender for a fake Windows Defender directory and the executable used as the DLL sideloader. The deception is straightforward. The attackers created a fake Microsoft\Windows Defender installation directory, copied the CoolClient components there and renamed a legitimate Sangfor executable, normally Sang.exe, to defender.exe. That trusted executable then loads the malicious libngs.dll through DLL sideloading. Persistence starts early as well. A scheduled task launches defender.exe with SYSTEM privileges at startup, while CoolClient can also create an AutoRun entry and install itself as a Windows service. The malware checks for security software, including several 360 Total Security processes, before taking the service installation route. The user-mode chain has several stages. libngs.dll acts as the first-stage loader, loadcert.ini handles the second stage, cert.ini provides the final backdoor, and time.ini stores configuration data. The names have changed from earlier variants, but the basic architecture remains familiar. libngs.dll also tries to look like the legitimate DLL it replaces. It exports dummy functions that call OutputDebugStringA and then terminate, while the actual malicious code sits inside DllMain. The loader decrypts loadcert.ini and loads it directly into memory. CoolClient prepares the system by establishing persistence, bypassing UAC and injecting its payload into synchost.exe. It then uses an RPC-based technique and parent-process spoofing to gain elevated privileges without relying on a visible administrator prompt. Once privileged, it extracts the compressed msagent.sys driver, installs it as a Windows service and loads it into the kernel. Through IOCTL requests, CoolClient registers itself as trusted, provides its C2 address and defines the files, registry keys and processes to protect. The driver can then block security tools from accessing or terminating protected components, making the malware harder to detect and remove. The driver reads its configuration from \REGISTRY\MACHINE\SYSTEM\RNG. The configuration identifies directories, files, registry keys and values to hide or protect, as well as processes that should be ignored or protected. “To support kernel module hiding, the driver resolves the address of the non-exported kernel variable PsLoadedModuleList at runtime using MmGetSystemRoutineAddress.” continues the report. “This global linked list maintains information about all loaded kernel modules and drivers, allowing the rootkit to enumerate and manipulate module entries.” For process hiding, the driver dynamically locates ActiveProcessLinks inside the Windows EPROCESS structure instead of depending on a fixed offset. That matters because Windows changes internal structures between versions. Once it finds the correct field, the rootkit can unlink a process from the active process list and later restore it. The driver also registers object, process and image-load callbacks. These mechanisms let it track processes and restrict access to protected ones, including the CoolClient code running inside synchost.exe. A process that tries to open a protected process or thread can receive reduced access rights, blocking operations such as termination or code injection. Files get similar treatment through a Windows filesystem minifilter. The driver maintains protected path lists and checks filesystem activity against them, denying access to matching files and directories. Registry protection works in much the same way: protected keys and values disappear from enumeration results, while direct attempts to open, modify or delete them can return STATUS_ACCESS_DENIED. The driver contains 33 IOCTL handlers, although the analyzed CoolClient sample normally uses only three. The unused handlers reveal just how much more the driver can do: hide kernel modules, inject shellcode, terminate processes, remove PPL protection, manipulate registry values, hide processes and modules, disable kernel notification callbacks, load another kernel driver and even write to an arbitrary kernel address. That’s an important distinction between capability and observed behavior. Kaspersky didn’t see the sample invoke all of those functions during normal execution, but their presence shows that msagent.sys isn’t a narrowly designed hiding component. It provides a broader kernel-level toolkit that CoolClient can potentially use when needed. The rootkit doesn’t stop at processes, files and registry entries. It also hooks the Windows Nsiproxy driver to filter network information returned to user mode. CoolClient supplies its C2 IPv4 address to msagent.sys, and the driver removes matching entries before applications receive the network information. For a defender, that creates an unpleasant problem. A tool looking at network information from user mode may simply fail to see the address associated with the malware’s command-and-control infrastructure. The connection still exists, but the rootkit can interfere with what security software and analysts are allowed to observe. The driver can also hide kernel modules by manipulating PsLoadedModuleList. When it finds a matching module, it removes the corresponding entry from the kernel’s linked list, preventing the module from appearing in standard enumeration routines. This is where the new CoolClient variant becomes materially different from a conventional backdoor. An implant running entirely in user mode can still be powerful, but defenders have many opportunities to inspect processes, files, handles and network activity. A kernel component that actively filters those views changes the detection problem. The driver uses a digital signature linked to Nanjing Ranyi Technology Co., Ltd., with a certificate valid from 2013 to 2014. Kaspersky also found older malicious drivers using the same certificate, but no direct link to CoolClient. PDB strings mention a “Nanjing Laboratory” and “Zhang Xuejie Yunnan m,” but researchers found no evidence tying them to a specific developer or threat actor. These clues alone do not prove Chinese involvement. The stronger attribution comes from the wider operation, which matches HoneyMyte activity through CoolClient, PlugX and the deployment techniques observed. HoneyMyte continues to use PlugX to gain an initial foothold before deploying CoolClient as a secondary backdoor, but the latest version adds kernel-level capabilities. By loading msagent.sys, the malware can hide processes, files and registry entries while blocking security tools from accessing or terminating protected components. This complicates incident response: finding Sang.exe, defender.exe or libngs.dll is no longer enough. Investigators must also examine drivers, services, registry changes and unusual network activity. The driver includes additional functions for manipulating kernel components, even if they were not observed in use. For defenders, CoolClient is no longer just a backdoor to hunt in user space—it can change what Windows itself reveals. “The latest CoolClient variant represents a significant evolution of the malware. Rather than operating solely as a user-mode backdoor with plugin support, it now deploys and communicates with a kernel-mode driver that extends its capabilities beyond earlier versions.” concludes the report. “Through this driver, CoolClient can hide and protect processes, files, and registry objects, as well as filter selected network information, making detection and analysis considerably more difficult.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CoolClient)
A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. A notable capability is copying the victim's Chromium profile, including its authentication state, and loading it into a hidden, headless browser on the infected system. This allows the hacker to access victims' authenticated sessions while preserving the identifiers associated with the browser, host, and network. AmnesiaStealer can collect data in 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes and documents, and keychain data. The malware is currently distributed through ClickFix campaigns that use a fake GitHub download page to drop a password-protected ZIP archive.
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Crooks Are Buying Your Expired Domains and Using Them to Deliver MalwareSAP Commerce Cloud CVE-2026-58231 Exploited in the WildmacOS Screen Sharing Flaw Exploited to Deploy Monero MinersGeoServer Zero-Day Is Already Being Probed. That’s the ProblemApple warned hundreds of users of mercenary spyware attacksAmnesiaStealer Gives Attackers Live Control of Victims’ macOS BrowsersChess.com Leak Exposes 7.3 Million Users – Evidence Points to ScrapingUS Authorizes Private Cyber Firms to Hack Transnational Criminal NetworksAdobe Commerce CVE-2026-71362 Comes Under Attack Shortly After Public DisclosureU.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalogSharePoint CVE-2026-55040 Comes Under Attack Following Public ExploitStorm-1175 Replaces Medusa With New StormEncryptor RansomwareNorth Korean Lazarus Group Uses Windows Zero-Day in Operation Dream JobCEVA Logistics Cyberattack Disrupts European Warehouses and ShipmentsChina-Linked Hackers Use AI Agents in Autonomous Attack on TaiwanKimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and EthereumShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet PatchMicrosoft Patch Tuesday for August 2026 Fixed a Zero-Day and Wormable RCEZoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code ExecutionExfilSquad Targets New Victims, Shares Data via TorrentsIran-Linked Hackers Target More US Water Infrastructure in New Jersey and AlabamaThe inconvenient truth about AI pentesting: someone has to check all the workCisco Warns of Seven ClamAV Flaws, Two With Public PoCsGym Booking Task Turns Into Real-World AI CyberattackU.S. Defense Manufacturer IEH Hit by Phishing Attack, Exposing Potentially Export-Controlled DataWebmail CSS Attacks Expose a New Risk for AI-Powered Email Tools International Press – Newsletter Cybercrime ExfilSquad Targets New Victims, Shares Data via Torrents Israeli population registry for sale, but the data is old Before Fraud Transacts ExfilSquad Targets New Victims, Shares Data via Torrents Fake CAPTCHA, Real Business: Traffic Distribution for Hire 7.3M chess.com records leaked, and the data is real Drop Something? Don’t Worry, Someone Caught it Malware ShieldBreak – August 2026 disclosure Kimwolf v7: An Evolution of the Kimwolf Botnet AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection Hacking Chinese Model Kimi K3 Breaks UK AI Safety Institute Benchmark Evaluations AI assistant hacks gym website in first known Australian autonomous cyber attack Zoomsday Attackers Exploit SharePoint Authentication Bypass After Public PoC Release Hackers exploit macOS Screen Sharing flaw to deploy Monero miner It’s a pre-auth, stupid! A root remote command execution on macOS with M5 in 2026? Intelligence and Information Warfare Follow-Up Analysis of the 29 December 2025 Energy Sector Incident New Jersey, Alabama Join States Targeted in Water Cyberattacks Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM China-linked hackers hit Taiwan in unprecedented ‘autonomous’ AI cyber attack State Sponsored Hackers Use Fake Job Offers to Deliver New Zero Day Exploit Social engineering performed by UAC-0145: compromising in the employment process Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring How Tehran’s Use of Cyber Operations in the U.S.-Iran Conflict Has Evolved Cybersecurity How a small Israeli startup was linked to rogue AI hacks at OpenAI, Anthropic and Meta Responding to the next frontier of critical cyber capabilities Facebook is paying controversial creators to produce rage-bait content Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC The August 2026 Security Update Review Cyberattack on logistics giant CEVA delivers customer data into the wrong hands About Apple threat notifications and protecting against mercenary spyware If Apple sends you a push notification alerting you to a spyware attack, take it seriously AI isn’t changing how companies work. It’s changing what a company is Swarms of OpenAI systems set up their own chatrooms to discuss and carry out hacks, company reveals Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Acronis uncovered PATCHCORD, a stealthy backdoor targeting Afghan telecom and South Asian infrastructure via fake VPN tools and Google Sheets C2. Researchers at Acronis just documented an espionage operation that reads like it was built by someone with genuinely good taste in disguises. Their Threat Research Unit report tracks a previously undocumented backdoor called PATCHCORD, hitting Afghan telecom providers and South Asian critical infrastructure through fake VPN installers and management tools branded to look exactly like the real thing. “Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools.” reads the Acronis’s report. “Infrastructure pivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD’s capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India’s National Informatics Centre (NIC).” The delivery method leans hard into specificity. One installer impersonated Afghan Telecom down to matching the company name, product fields, and even the URL of the real support portal customers actually use, the kind of detail that only comes from someone who studied the target closely rather than mass-producing generic lures. Click through it, and a 64-bit Windows implant quietly installs itself while a real browser session opens normally in the background, so nothing looks wrong to the person who just got infected. PATCHCORD’s persistence trick is worth pausing on because it’s genuinely sneaky. Instead of the usual registry-only approach, it hijacks the actual shortcut files for Edge, Chrome, and Firefox, backing up the originals and rewriting them to launch the malware first, silently starting the real browser afterward so the shortcut still works exactly as expected. “PATCHCORD establishes persistence by hijacking browser shortcuts. Before modifying shortcuts, the implant checks whether it is running with elevated privileges and then attempts to hijack shortcuts for Microsoft Edge, Google Chrome and Mozilla Firefox.Browser identifier and executable-name mapping.” continues the report. “The implant searches for shortcuts associated with Microsoft Edge, Google Chrome and Mozilla Firefox before attempting to hijack them.” Every time someone clicks their browser icon, the malware runs invisibly in the background before the browser they wanted even opens. Once installed, PATCHCORD checks in with its command server and waits for instructions, supporting five core capabilities: adjusting how often it phones home, listing running processes, executing shellcode entirely in memory, running arbitrary commands through a hidden shell, and controlling its own browser-hijacking persistence remotely. The in-memory shellcode execution is the standout feature here, since the payload never touches disk at any point, which keeps forensic evidence to a minimum for anyone investigating after the fact. Pivoting off the infrastructure led researchers to a second, more evolved implant they’re calling SHEETCORD, written in Go and delivered through a domain impersonating India’s National Informatics Centre. “The Go-based malware combines functionality previously observed in the SHEETCREEP RAT with several capabilities introduced in PATCHCORD, suggesting an evolution of the operator’s tooling.SHEETCORD executing shell command function.” states Acronis. “The implant implements a remote command execution capability main.executeShellCommand similar to PATCHCORD. However, instead of invoking cmd.exe /c, it executes commands through powershell -Command with script block wrapping, suggesting an evolution of the operator’s tooling.” This one drops the traditional web server entirely and instead uses the Google Sheets API for command and control, creating a dedicated spreadsheet tab for each victim to send and receive instructions. Hiding malicious traffic inside a service as mundane as Google Sheets is a clever way to blend in with normal corporate network traffic that nobody thinks twice about. The researchers also found a third malware family, HACKERAI C2 Agent, that uses GitHub Gists for the same purpose and shows clear signs of having been built with AI coding assistance. Acronis pointed to leftover debug messages, AI-style code comments, and a redundant double-XOR routine using the same key twice as tells. “The implant contains code comments and implementation patterns consistent with AI-assisted code generation. Together, these observations suggest that the malware was developed, at least in part, using LLM-assisted coding tools.” the researchers state. Threat actors are actually using generative AI in practice, not only for some dramatic autonomous hacking campaign, but just as an ordinary coding shortcut. What really opened the investigation up was an exposed staging server the operator left unsecured. It contained the operator’s entire toolkit laid bare: SuperShell, a Chinese-language command-and-control framework, multiple remote access trojan frameworks, credential-harvesting tools, exploit code for a known OpenSSH vulnerability, and files that appear to follow an iOS call history database format, hinting the group may have also pulled data off mobile devices. Finding a threat actor’s actual staging server is rare, and it’s the kind of mistake that turns a hard-to-attribute campaign into a much clearer picture very quickly. Acronis links this activity to APT36, also known as Transparent Tribe, a threat group with a documented history of targeting Indian government and defense organizations, though the researchers rate the connection at moderate rather than full confidence. The reasoning holds up: matching credential-harvesting tools previously seen in confirmed APT36 campaigns, a shared C2 framework independently attributed to the same group by other researchers, and a Google Sheets technique closely resembling an earlier documented campaign already linked to the same actor. None of these signals alone would be conclusive, but stacked together they paint a consistent picture rather than a coincidence. The infrastructure was still live at the time of publication, with domains steadily rotating while the underlying server stayed the same for months. If your organization touches Afghan telecom operations, Indian government systems, or South Asian energy infrastructure, this is exactly the kind of report worth forwarding to whoever handles phishing awareness training, because the lures here are good enough that “just don’t click suspicious links” isn’t much of a defense on its own. “The PATCHCORD campaign demonstrates an evolving espionage operation targeting telecom, government, defense, and critical infrastructure organizations across South Asia. The discovery of PATCHCORD, SHEETCORD, and HACKERAI C2 Agent highlights the operator’s continued evolution, from a custom C/C++ backdoor to Go-based implants that abuse legitimate cloud services, including Google Sheets and GitHub Gists, for command-and-control.” concludes the report. “The exposed staging server and related infrastructure provided valuable insight into the operator’s tooling, campaign development, and operational practices, enabling the identification of additional infrastructure and previously undocumented malware.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, PATCHCORD)
Attackers are buying expired domains to exploit their reputation, traffic and DNS history, using them for malware delivery, scams and C2 infrastructure. Every day, roughly 65,000 domain names that once belonged to someone else get re-registered by a new owner. Infoblox Threat Intel calls these dropcatch domains, and in the first half of 2026 they accounted for nearly 20% of all new domain registrations, meaning one in five “new” domains has a prior life. Some end up with legitimate investors or researchers. Others end up with attackers who have figured out that a domain with history is worth more than a blank slate. “These domains can be particularly interesting, even dangerous, because they inherit reputation and sometimes connections from their previous life. For example, a domain that was originally registered 10 years ago, later dropped, and then acquired by someone else may still carry signals associated with its long history.” reads the report published by Infoblox. “Researchers, security products, and reputation-based algorithms may view it more favorably than a genuinely brand-new registration. Threat actors know this and take advantage of it.” Among gTLDs, the average is 50,400 per day, with 15 TLDs accounting for about 92% of all dropcatch activity. .net and .xyz have the highest rates, with nearly 30% of new registrations previously registered, while .com reaches 24.5%. Determining who buys these domains and how they are used remains difficult due to WHOIS privacy, transfers, parking, and auctions. The inherited value isn’t just a better reputation score. Expired domains also come with residual web traffic from old backlinks, email still arriving for the previous owner, cached search results, and in some cases lingering DNS records that point to infrastructure no longer under the original owner’s control. One in every five new domains has all of that already baked in before the new registrant does anything. Infoblox tracked one threat actor it calls Sable Squirrel, which has spent nearly $7 million acquiring expired domains to build a criminal operation spanning illegal sports streaming, gambling promotion, and malware infrastructure. The actor controls more than 10,000 domains and runs streaming platforms under brands like Xoilac, Cakhia, and 90phut that direct Vietnamese, Korean, Japanese, and Australian users toward betting sites, while a subset of those same streaming domains double as command-and-control servers for malware including Quasar RAT, AsyncRAT, DCRat, and Remcos RAT. Among the expired domains Sable Squirrel has acquired are healthymagination.com, originally a General Electric health initiative, and rezilion.com, a cybersecurity company whose assets were sold to GitLab in 2024. The actor bought the reputation of a defunct infosec firm and pointed it at malware infrastructure — which is either darkly ironic or exactly what you’d do if you understood how security tools evaluate domain age. “For threat actors specifically, the inherited reputation isn’t the only thing valuable about acquiring a dropped domain. They also come with a variety of lingering connections: email intended for the original domain holder (see watchTowr Labs’ The Perils of Expired Domains: We’re Reading Your Email), cached search results, inherited web traffic, and in some cases, a ready-made platform for code injection on already compromised sites.” continues the report. “Lingering DNS records can also create opportunities for threat actors. We previously discussed dangling CNAME attacks in our blog post, Who Knew Domain Hijacking Is So Easy?.” Once Sable Squirrel re-registers a domain, it moves fast: 24% go live the same day, 76% within seven days, 94% within two weeks. The whole point is to start capturing traffic before security systems have updated their assessments. Infoblox is also tracking three scavenger actors, Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel, that operate differently: rather than buying domains wholesale for a planned operation, they acquire expired domains that were previously compromised by other attackers and simply inherit the existing infection traffic. Shady Squirrel, assessed to be Russian-speaking and active since at least July 2023, feeds that traffic to SocGholish and tech support scam networks. SocGholish reportedly regained access to thousands of compromised sites by teaming up with Shady Squirrel days after its own infrastructure was disrupted by law enforcement. The practical lesson for defenders is uncomfortable: domain age and reputation are inputs worth questioning, not trusting, because an old domain in new hands is only as trustworthy as whoever currently holds it. “This is just one story of how threat actors use dropcatch domains to further their schemes. We’ll cover many more in the next two parts of this research: Part 2, $7 Million in Expired Domains Fuel a Streaming Empire with a Malware Secret, where we examine Sable Squirrel, a threat actor that has spent millions of dollars acquiring dropped domains, and Part 3, Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows, where we explore actors that scavenge expired malicious domains and inherit traffic from previously compromised websites.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Expired domains)
Confirm this action.
Leaving now will discard your changes.