Threats Day Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories
Summary: Flashpoint analysis found more than 11.1 million devices were infected with infostealers last year, feeding over 3.3 billion stolen credentials, session cookies, and cloud tokens into illicit markets, with more than 30 infostealer strains for sale and Lumma, Acreed, Rhadamanthys, Vidar, and StealC the most prolific in 2025. A threat actor named "o1oo1" has sold a RAT called SilabRAT as malware-as-a-service for $5,000 a month since September 2025, using HVNC remote control and browser profile cloning to target credentials and cryptocurrency wallets.
What you should know: Over 3.3 billion stolen credentials and session cookies are already circulating, so identity data from an infostealer infection is a standing exposure, not a one-time incident. A $5,000-a-month RAT that clones browser profiles and fingerprints means an operator can inherit a trusted session without breaking anything.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026