Threats Day: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
Summary: A threat actor tracked as CL-CRI-1171 has run a pay-per-install marketplace for at least two years, pushing malware through gaming YouTube channels and an SEO-poisoning funnel that reached corporate endpoints, critical infrastructure, and government entities via a loader called OfferLoader. Palo Alto Networks Unit 42 reported three payloads delivered between July 2025 and April 2026, including a Chrome backdoor, a WebSocket tunneling RAT, and the cross-platform Insomnia RAT targeting Windows and macOS.
What you should know: The same operation that seeded gaming videos with malware links also reached critical infrastructure and government endpoints through trojanized software, meaning a single PPI broker now sells access across consumer and enterprise targets at once.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026