Malware Activity
Emerging Malware Threats Highlight Growing Risks to macOS and Linux Systems
Security researchers have identified two (2) sophisticated new malware threats that highlight the growing danger of social engineering and unpatched internet-facing systems. The first, AmnesiaStealer, targets macOS users through fake GitHub pages and deceptive ClickFix attacks, tricking victims into running malicious Terminal commands. Beyond stealing passwords, browser data, cryptocurrency wallet information, Apple Notes, documents, Safari cookies, and keychain credentials, it introduces a particularly alarming capability that allows attackers to remotely control a victim’s authenticated browser session in real time. Meanwhile, Evooo1Bot, an advanced Linux-based botnet derived from Mirai, exploits known vulnerabilities in routers, firewalls, cameras, and other edge devices to turn them into proxy servers for malicious activities. It also supports credential theft, brute-force attacks, remote command execution, file transfers, and large-scale DDoS operations while using encryption and anti-analysis techniques to avoid detection. Together, these threats reinforce the importance of strong cyber hygiene, including avoiding untrusted commands, staying alert to social engineering tactics, promptly applying security patches, removing default credentials, limiting remote access, and replacing unsupported hardware. CTIX analysts will continue to report on the latest malware strains and attack methodologies.
- BleepingComputer: New AmnesiaStealer macOS Malware Hijacks Browser Sessions Via Remote Control article
- SecurityWeek: AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions article
- BleepingComputer: New Evooo1Bot Linux Botnet Turns Routers into Traffic Relay Nodes article
- TheHackerNews: Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices into SOCKS5 Proxies article
Threat Actor Activity
Hackers are Turning Expired Domains into High-Trust Infrastructure for Scams and Malware
Threat actors are increasingly buying expired “dropcatch” domains to hijack their inherited reputation, backlinks, and residual traffic for scams, gambling, and malware. Infoblox estimates that in early 2026 roughly 65,000 dropcatch domains were re-registered daily across generic top-level domains (gTLDs) and country code top-level domains (ccTLDs), meaning these registrations accounted for about one (1) in five (5) new daily domain registrations, with .net and .xyz leading the activity. These domains, often acquired via services like DropCatch, GoDaddy, and Namecheap, may still receive email, search traffic, and DNS queries intended for their previous owners, making them attractive and less suspicious to reputation-based defenses. A major actor dubbed Sable Squirrel has spent nearly $7 million amassing over 10,000 such domains to run illegal sports streaming and online betting brands (e.g., Xoilac, Cakhia) and to host command-and-control (C2) infrastructure for malware families like Quasar RAT, AsyncRAT, NanoCore, and Remcos. Other “scavenger” groups (Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel) control thousands more domains, reselling hijacked traffic to ad networks, tech support scams, initial access brokers, and zero click ad platforms. Many of the dropcatch domains are weaponized within days for malicious activities, underscoring the speed at which threat actors can operationalize infrastructure and be effective in accomplishing their goals.
Vulnerabilities
Critical macOS Screen Sharing Flaw Exploited for Root Access and Cryptomining
Apple macOS users are being targeted through a critical authentication bypass vulnerability in the built-in Screen Sharing service that can allow network-based attackers to gain unauthorized remote access without valid credentials. The Netherlands’ National Cyber Security Centre (NCSC) confirmed active exploitation across multiple systems where TCP port 5900 was exposed to the internet, with attackers obtaining root access and deploying Monero cryptocurrency miners. Apple addressed the flaw, tracked as CVE-2026-65400 (CVSS 9.8), in an emergency August 6 update for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, improving state management to enforce proper credential validation. The vulnerability comes amid the discovery of several additional flaws in macOS Screen Sharing, including related logic and authentication issues that researchers say can enable highly reliable pre-authentication compromise with minimal prerequisites. Researchers also demonstrated that working exploits for the Screen Sharing flaws could be developed with AI assistance in just hours, highlighting how quickly newly disclosed vulnerabilities can be weaponized once technical details become available. The timing, scale, and full objectives of the current attacks remain unclear, including whether activity extends beyond cryptomining. CTIX analysts recommend that organizations and users should immediately patch affected Macs, disable Screen Sharing where it is unnecessary, and prevent direct internet exposure of port 5900 to prevent exploitation.
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
