The weekly InfoStealers report for 12-19 October 2026 summarises stealer-log telemetry on compromised machines, credentials and sessions. The United States ranks 8 by country of infection with 438 machines. Gmail is the most affected email provider with 1,225,748 users, followed by Hotmail (90,554) and Yahoo (33,493). Sessions and saved c…
Symantec's Threat Hunter Team reports that new versions of the Aoki infostealer now target credential and session files used by AI coding assistants. Earlier versions focused on browser, cryptocurrency wallet and password manager data. Aoki is a relatively new and sparsely documented stealer, first observed earlier in 2026, and its AI-rel…
Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud.com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS paylo…
The Security Affairs Malware Newsletter Round 119 is a weekly digest of malware research published by Pierluigi Paganini. It lists reports on IronChain ransomware, the evolution of XWorm from infostealer to surveillance platform, and the Hirudo banking malware spread through fake updates and patched banking apps. It also covers PEERSTITCH…