Netskope researchers detail a Windows malware operation that injects a Vidar-class stealer into browsers, drains cryptocurrency exchange accounts, and swaps copied wallet addresses. They estimate at least 350–430 paying victims and about $100,000 in proceeds.
Researchers analyzed a tech-support-scam kit delivered through Google Ads that uses anti-analysis checks and fake Windows or macOS alerts to pressure victims into calling scammers. It affected at least 619 organizations in two weeks.
Netskope reports an EtherHiding campaign using BSC testnet contracts to deliver malware through more than 5,400 compromised sites. A newer variant forges a WebRTC answer to open a covert C2 channel without signaling traffic.
Netskope found a Python NodeStealer variant with keylogging, clipboard monitoring, screenshots, expanded credential theft, and two Telegram C2 bots. It queries more than 20 Facebook Graph API endpoints; researchers suspect some additions were AI-assisted.
Netskope details a WordPress compromise campaign that uses persistent Service Workers, an on-chain payload, and a ClickFix lure to deliver Amatera, which steals credentials and system data.
A practitioner guide explains how eight malware families across EVM, Solana, and TON use blockchain dead drops to retrieve C2 pointers, and how defenders can investigate RPC calls and identify suspicious process activity.
Netskope says a re-listed Chrome extension added affiliate redirects on updates and uninstalls in version 1.7.3.0. Earlier versions reportedly stole AI conversations; as of August 25, 2026, version 1.7.4 remained available with 200,000 users.
Netskope analyzed 28 malicious npm package versions across four namespaces. Their stealer collected developer and CI/CD credentials, then sent encrypted data to a C2 domain resolved at runtime through an Ethereum contract.
Netskope traced more than 12,700 FakeCaptcha PDFs on Webflow’s CDN to an active traffic-distribution network that filters visitors and routes them to malware, ad landers, or a premium-SMS scam.
Netskope details a campaign using cloned AI and developer repositories to deliver infostealers through a two-stage SmartLoader chain, with C2 addresses resolved from the Polygon blockchain.
Netskope’s AI report, covering June 2025–July 2026, identifies rising downstream data-access risks from MCP, agentic coding tools as potential execution vectors, and weaponized AI supply-chain threats.
Netskope detected and blocked more than 28,000 World Cup-themed threats across 1,000+ organizations. At the peak, users attempting to access malicious content were nearly six times the pre-tournament average.