Threats Day Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories
Summary: A weekly roundup details 23 deceptive Chrome extensions that override default search engines and route queries through monetization middleware across at least 8 brokers, affecting roughly 758,000 users. It also covers a fileless AppleScript infostealer delivered via ClickFix lures, a ClickFix campaign abusing Anthropic Claude's shared chat feature that drew over 2,000 victims with 67.2% in Asia-Pacific, and Cisco's update noting CVE-2026-20127 also affects Catalyst SD-WAN Validator, exploited as a zero-day since 2023 by UAT-8616.
What's compelling: The Claude shared-chat campaign turned a trusted domain into a malware delivery path for over 2,000 victims, and the operators controlling those 23 extensions' search traffic can inject phishing links or malicious downloads at any time without updating extension code. Meanwhile, CVE-2026-20127 has been exploited as a zero-day since 2023 by UAT-8616, and the flaw now reaches an additional Cisco SD-WAN component.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026