The Infostealer Week. Three Credential-Stealing Families Led the Surge — and One of Them Targets macOS.
The commodity-malware economy owned the week. Three infostealer families produced the single largest category of attributed indicators — 2,946 Spyware-category IOCs, more than a third of the week’s total. Two of the three are Windows browser-credential stealers; the third is a macOS-native stealer that lifts Keychain secrets, browser cookies and session tokens off Apple endpoints. Browser-credential theft and session-cookie theft were two of the week’s top-five MITRE techniques.
Phishing-kit output more than doubled week-over-week (846 → 1,754 IOCs, +107%) as three kit operators deployed in parallel. Ransomware collapsed in the opposite direction — 211 IOCs down to 36 (-83%), with only a handful of operators active. Named-adversary diversity rose 14% to 72 families, and distinct MITRE techniques rose to 29. The week’s shape is a mature, fragmented, credential-harvesting economy running at full tempo while the ransomware tier takes a breath.
Read time · 24 minutes · Data window · 26 October – 1 November 2026 · Empirical basis · high-confidence attributed indicators aggregated to 8,320 distinct records across 72 named adversaries
Executive Summary · What Changed This Week
Infostealers were the story — and the macOS angle is the part to brief upward. Three infostealer families produced 2,946 Spyware-category indicators this week, the single dominant category. Two are Windows-based browser-credential stealers running the classic cookie-plus-saved-password harvest. The third is a macOS-native stealer — it targets the Apple Keychain, browser session cookies and wallet files on Mac endpoints. The MITRE evidence confirms the pattern: Steal Web Session Cookie (T1539), Credentials from Web Browsers (T1555.003) and Credentials from Password Stores / Keychain (T1555.001) all landed in the week’s top techniques.
Phishing doubled while ransomware collapsed. Phishing-kit output rose 107% week-over-week (846 → 1,754 IOCs) across three kit operators deploying in parallel — a credential-harvesting front that pairs naturally with the infostealer surge. Ransomware ran the opposite way, collapsing 83% (211 → 36 IOCs) to a handful of low-volume operators. A crypto-targeting sub-theme ran underneath: a malicious-browser-extension campaign stood up wallet-brand lookalike subdomains (Coinbase, Exodus, Phantom, Bitget lures) and a third-party-script supply-chain campaign targeted a prediction-market platform.
Three actions before your next executive brief:
- Treat session cookies as credentials, not convenience. This week’s stealers lift session cookies to bypass MFA entirely — a stolen session token is a logged-in session. Shorten session lifetimes for high-value apps, bind sessions to device posture, and alert on session-token reuse from a new IP/device. Sigma-01 covers browser-credential-store access.
- Extend EDR + detection coverage to macOS, not just Windows. The macOS stealer this week reads the login Keychain and browser cookie stores. Programs that treat Macs as low-risk “creative team” endpoints are uncovered against the exact family driving a third of the week’s volume. Sigma-02 covers macOS Keychain and browser-store access.
- Pre-brief the crypto / finance teams. The wallet-brand lookalike extensions (Coinbase / Exodus / Phantom / Bitget themes) and the prediction-market supply-chain script are direct-financial-loss campaigns. Anyone handling crypto or treasury operations is in scope. Sigma-03 covers the wallet-lookalike-domain pattern.
The two anchoring numbers for a CISO update: 2,946 infostealer indicators (the dominant category — including a macOS-native family), and phishing output doubling week-over-week while ransomware collapsed 83%. The shape of the week is a mature credential-harvesting economy at full tempo.
What a CISO needs to see behind the infostealer surge
An infostealer is not a nuisance — it is the first move in someone else’s kill chain. The three families that dominated this week do one thing: they harvest credentials, session cookies, saved passwords, and wallet secrets from an endpoint and exfiltrate them in seconds. The infection that looks like a low-severity “adware” hit on Monday becomes the valid-account initial-access broker’s inventory on Tuesday, and the ransomware affiliate’s entry point three weeks later. The ransomware tier collapsed 83% this week precisely because the credential-harvesting tier is doing the groundwork — the economy front-loaded on access collection.
The detail that should keep a CISO awake is session-cookie theft. Two of this week’s top-five techniques are Steal Web Session Cookie (T1539) and Credentials from Web Browsers (T1555.003). A stolen session cookie is a logged-in session — it sails straight past multi-factor authentication because the authentication already happened. An organisation that has invested heavily in MFA and feels protected is, against this week’s dominant threat, protected only until one employee runs one infostealer. The cookie is exfiltrated, replayed from the adversary’s infrastructure, and the session is theirs. MFA fatigue attacks are loud; cookie replay is silent.
And this week the Macs are in scope. One of the three lead families is a macOS-native stealer that reads the login Keychain, Safari and Chromium cookie stores, and local wallet files. Most enterprise detection programs are Windows-first — macOS endpoints are treated as low-risk, often EDR-light, frequently owned by executives, designers and developers with privileged access. That is exactly the population a credential stealer wants. A third of this week’s attributed volume came from infostealers, and the macOS family is one of the three carrying it. A Windows-only detection posture is blind to it.
The structural reality to brief upward. Ransomware operator-count is a lagging indicator; infostealer and phishing-kit volume is a leading one. This week’s 2,946 infostealer indicators and doubled phishing output are the raw material for the ransomware and account-takeover incidents of late November and December. The right board-level framing: our exposure this quarter is not measured by this week’s ransomware count — it is measured by how many of our credentials and session tokens are being harvested right now, on both our Windows and our Mac fleet.
Six statistics your CISO update can quote directly
- “Infostealers were the dominant threat this week — three families produced 2,946 attributed indicators, over a third of the total.” Credential and session-cookie theft is the ecosystem’s primary activity right now.
- “One of the three lead infostealer families is macOS-native — it targets the Apple Keychain and browser cookies.” Our macOS fleet is directly in scope, not a bystander.
- “Phishing-kit output doubled week-over-week — up 107%, from 846 to 1,754 indicators.” Three kit operators deployed in parallel. This pairs with the infostealer surge as a credential-harvesting front.
- “Ransomware collapsed 83% — from 211 indicators to 36.” The ransomware tier is quiet because the access-collection tier is loud. This is front-loading, not de-escalation.
- “Session-cookie theft and browser-credential theft were two of the week’s top-five MITRE techniques.” Stolen cookies bypass MFA entirely — a logged-in session needs no second factor.
- “Named adversary diversity rose 14% to 72 families; distinct MITRE techniques rose to 29.” A fragmented, mature commodity-malware economy operating at full tempo.
Weekly SOC Metrics · What Your Team Needs to Know Before Monday
Analyst-queue implications: the week is DOMAIN + URL + HASH heavy (3,167 domain, 2,039 URL, 1,998 hash) — characteristic of commodity-malware and phishing-kit deployment rather than network-C2 infrastructure. Hash-tier volume reflects the infostealer payload surge and should go to EDR first. The phishing-kit doubling pushes domain and URL analyst load up materially; prioritise web-gateway and DNS-resolver enrichment capacity this week. Credential-theft categories (Spyware 2,946 + Phishing 1,754) together are 56% of the week’s volume.
Coverage priority for the week: (1) extend credential-store and Keychain access detection to macOS endpoints (Sigma-02) — the macOS stealer is one of three lead families, (2) deploy session-cookie-theft and browser-credential-store detection on Windows (Sigma-01) and alert on session-token reuse from new IP/device, (3) ship wallet-brand lookalike-domain detection (Sigma-03) for the crypto-drainer extension campaign. Hold ransomware precursor-cascade coverage (Sigma-04) unchanged — the tier is quiet but the credential-harvest front-loading feeds it in 3-5 weeks.
01 · This Week at a Glance
Seven-day intelligence window (26 October – 1 November 2026). Aggregated only — no victim identifiers, no confidential infrastructure, no raw records exposed in prose. IOCs rendered defanged in Section 19.
Three anchoring numbers this week: 2,946 infostealer indicators (the dominant category — three families, one macOS-native), phishing output doubling to 1,754 IOCs (+107% WoW — three kit operators in parallel), and ransomware collapsing to 36 IOCs (-83% WoW). The pattern: the credential-harvesting tier is running at full tempo while the ransomware tier takes a breath — classic access-collection front-loading.
02 · Five Headlines Worth Reading Before Monday
Three infostealer families produced 2,946 indicators — the dominant category, including a macOS-native stealer
The Spyware category produced 2,946 attributed indicators this week — over a third of the total, the single largest category by volume. Three families carried it: two Windows browser-credential stealers (together ~1,590 IOCs) and one macOS-native stealer (~1,336 IOCs) that targets the login Keychain, Safari and Chromium cookie stores, and local wallet files. The MITRE evidence is unambiguous — Steal Web Session Cookie (T1539, 2,733 events), Credentials from Web Browsers (T1555.003, 2,704 events) and Credentials from Password Stores / Keychain (T1555.001, 1,336 events) are all top-tier this week.
Phishing-kit output doubled week-over-week — 846 → 1,754 indicators, three operators in parallel
The Phishing category produced 1,754 attributed indicators this week, up 107% from the prior week’s 846. Three phishing-kit operators (together ~1,693 IOCs in the Phishing-Kit adversary type) deployed in parallel, with the leading operator producing 975 indicators and two others contributing 545 and 173. The IOC distribution is domain- and URL-heavy — characteristic of credential-capture landing-page infrastructure rather than payload delivery.
A crypto-drainer campaign stood up wallet-brand lookalike infrastructure — Coinbase, Exodus, Phantom, Bitget lures
A malicious-browser-extension campaign deployed wallet-brand lookalike subdomains under a single malicious parent domain, impersonating major cryptocurrency wallet and exchange brands (Coinbase, Exodus, Phantom, Bitget, Jupiter themes). The extensions are designed to drain wallet funds by intercepting transactions and harvesting seed phrases. A separate third-party-script supply-chain campaign targeted a prediction-market platform — injecting a wallet-draining script via a compromised dependency.
<wallet-brand>.<malicious-parent>) is a structural detection opportunity — the subdomain embeds a recognised wallet brand while the registrable parent is adversary-controlled. The supply-chain vector is more insidious: a legitimate platform’s own page served the malicious script, so the user saw a trusted origin.Ransomware collapsed 83% — 211 indicators down to 36 — while access-collection ran hot
The Ransomware-as-a-service category produced just 36 attributed indicators this week, down 83% from the prior week’s 211. Only a small number of operators were active, each at low IOC volume. The collapse is not an anomaly in isolation — it coincides with the credential-harvesting tiers (infostealer + phishing) running at elevated volume.
Named-adversary diversity rose to 72 families — fake-IT-support and fake-verification scam campaigns surfaced
Seventy-two named adversaries were active this week, up 14% from the prior week’s 63, across 9 distinct adversary types and 29 distinct MITRE techniques. Among the newer entries were social-engineering scam campaigns — a fake IT-support campaign impersonating a collaboration-platform helpdesk, and fake browser-verification pages (the “prove you are human” lure that delivers a clipboard-paste PowerShell payload). A commodity RAT and a small-footprint ransomware family also appeared.
03 · The Cluster Footprint · Top 40 Anonymised Clusters
Every named adversary this week is anonymised into cluster labels (C01–C40). Identifiers rotate weekly; no cluster label carries over from prior weeks. Ranking is by attributed-IOC volume.
| Cluster | Adversary Type | Category | IOCs | IOC Types | First Seen | Last Seen |
|---|---|---|---|---|---|---|
| Cluster C01 | Malware | Malware-Activity | 1,379 | 5 | 2026-10-26 | 2026-11-01 |
| Cluster C02 | Malware | Spyware | 1,366 | 4 | 2026-10-26 | 2026-11-01 |
| Cluster C03 | Malware | Spyware | 1,336 | 3 | 2026-10-27 | 2026-11-01 |
| Cluster C04 | Phishing Kit | Phishing | 975 | 2 | 2026-10-26 | 2026-10-31 |
| Cluster C05 | Malware | Malware-Activity | 563 | 2 | 2026-10-27 | 2026-11-01 |
| Cluster C06 | Phishing Kit | Phishing | 545 | 3 | 2026-10-26 | 2026-10-30 |
| Cluster C07 | Malware campaign | Malicious-Infrastructure | 395 | 1 | 2026-10-28 | 2026-10-28 |
| Cluster C08 | Malware | Spyware | 227 | 2 | 2026-10-27 | 2026-10-30 |
| Cluster C09 | C2 | C&C Server | 203 | 1 | 2026-10-26 | 2026-11-01 |
| Cluster C10 | Phishing Kit | Phishing | 173 | 1 | 2026-10-28 | 2026-10-28 |
| Cluster C11 | Malware campaign | Supply Chain | 118 | 2 | 2026-10-27 | 2026-10-29 |
| Cluster C12 | Threat Actor | APT | 117 | 3 | 2026-10-26 | 2026-10-30 |
| Cluster C13 | Malware campaign | Malware-Activity | 94 | 3 | 2026-10-28 | 2026-10-31 |
| Cluster C14 | Threat Actor | APT | 56 | 5 | 2026-10-26 | 2026-10-30 |
| Cluster C15 | Malware campaign | RAT | 50 | 3 | 2026-10-27 | 2026-10-30 |
| Cluster C16 | Malware campaign | Malware-Activity | 49 | 1 | 2026-10-29 | 2026-10-29 |
| Cluster C17 | Malware | Vulnerability | 40 | 2 | 2026-10-28 | 2026-10-30 |
| Cluster C18 | Phishing Campaign | Phishing | 36 | 3 | 2026-10-26 | 2026-10-26 |
| Cluster C19 | Malware campaign | Malware-Activity | 32 | 1 | 2026-10-30 | 2026-10-30 |
| Cluster C20 | SCAN | Vulnerability | 29 | 2 | 2026-10-26 | 2026-10-26 |
| Cluster C21 | Malware | Malware-Activity | 29 | 4 | 2026-10-27 | 2026-10-31 |
| Cluster C22 | Ransomware | Ransomware-as-a-service | 29 | 3 | 2026-10-27 | 2026-10-29 |
| Cluster C23 | Malware campaign | Malware-Activity | 26 | 3 | 2026-10-28 | 2026-10-28 |
| Cluster C24 | Malware campaign | Malware-Activity | 26 | 3 | 2026-10-29 | 2026-10-29 |
| Cluster C25 | Malware campaign | Malware-Activity | 24 | 2 | 2026-10-29 | 2026-10-30 |
| Cluster C26 | Malware | Malware-Activity | 21 | 3 | 2026-10-27 | 2026-10-28 |
| Cluster C27 | Malware | Botnet | 21 | 3 | 2026-10-26 | 2026-10-29 |
| Cluster C28 | C2 | C&C Server | 20 | 1 | 2026-10-26 | 2026-10-31 |
| Cluster C29 | C2 | Framework | 19 | 1 | 2026-10-27 | 2026-10-27 |
| Cluster C30 | Malware campaign | Malware-Activity | 17 | 1 | 2026-10-30 | 2026-10-30 |
| Cluster C31 | Malware | Backdoor | 14 | 2 | 2026-10-28 | 2026-10-29 |
| Cluster C32 | Phishing Campaign | Phishing | 13 | 2 | 2026-10-29 | 2026-10-30 |
| Cluster C33 | Malware campaign | Malicious-Infrastructure | 12 | 1 | 2026-10-30 | 2026-10-30 |
| Cluster C34 | Malware | RAT | 11 | 3 | 2026-10-28 | 2026-10-28 |
| Cluster C35 | C2 | C&C Server | 10 | 1 | 2026-10-27 | 2026-10-31 |
| Cluster C36 | Malware campaign | Supply Chain | 9 | 2 | 2026-10-29 | 2026-10-29 |
| Cluster C37 | Malware | Backdoor | 8 | 1 | 2026-10-30 | 2026-10-30 |
| Cluster C38 | Phishing Campaign | Phishing | 8 | 2 | 2026-10-28 | 2026-10-28 |
| Cluster C39 | Malware | Malware-Activity | 7 | 2 | 2026-10-30 | 2026-10-31 |
| Cluster C40 | Malware campaign | Malware-Activity | 7 | 1 | 2026-10-31 | 2026-10-31 |
Interpretation notes:
- Cluster C01 (Malware / Malware-Activity, 1,379 IOCs) — the week’s largest cluster, a commodity-malware family spanning five IOC types across the full week. Broad multi-vector distribution.
- Clusters C02 and C03 (Malware / Spyware, 1,366 + 1,336 IOCs) — two of the three lead infostealer families. C02 is a Windows browser-credential stealer; C03 is the macOS-native Keychain/cookie stealer. Together they anchor the Spyware category.
- Clusters C04, C06, C10 (Phishing Kit, 975 + 545 + 173 IOCs) — the three phishing-kit operators that doubled the Phishing category week-over-week. Parallel deployment across the week.
- Cluster C08 (Malware / Spyware, 227 IOCs) — the third lead infostealer family, Windows-based.
- Cluster C09 (C2, 203 IOCs) — a remote-management-agent-abuse C2 operator running the full week. The largest C2-category cluster.
- Clusters C11 and C36 (Malware campaign / Supply Chain, 118 + 9 IOCs) — the prediction-market third-party-script wallet-draining campaign. Supply-chain delivery via compromised dependency.
- Clusters C12 and C14 (Threat Actor / APT, 117 + 56 IOCs) — the two APT-attributed clusters this week, both multi-IOC-type. Lower volume than the commodity tier but higher cost-of-discovery.
- Cluster C22 (Ransomware, 29 IOCs) — the week’s leading ransomware operator, a small-footprint family. The ransomware tier’s collapse to 36 total IOCs is visible here — even the top operator is below many commodity-malware clusters.
04 · Deep Dive · Headline 01 · The Infostealer Surge
Three families · 2,946 indicators · browser credentials, session cookies, and a macOS Keychain
The Spyware category produced 2,946 attributed indicators this week — the single dominant category, over a third of the total 8,320. Three families carried it. Two are Windows browser-credential stealers running the classic harvest: saved passwords from browser credential stores, autofill data, session cookies, and cryptocurrency-wallet browser extensions. The third is a macOS-native stealer that reads the login Keychain, Safari and Chromium cookie databases, and local wallet files.
The session-cookie problem — why MFA does not save you here
The defining technique of this week’s infostealer surge is Steal Web Session Cookie (T1539), with 2,733 events — a top-five technique. The reason this matters more than saved-password theft is that a session cookie represents an already-authenticated session. When a user logs into an application with a password and a second factor, the application issues a session token (stored as a browser cookie) so the user does not re-authenticate on every request. An infostealer that exfiltrates that cookie hands the adversary a logged-in session. The adversary imports the cookie into their own browser and is the user — no password prompt, no MFA challenge, because the authentication already happened on the victim’s machine.
This is why an organisation with strong MFA can still be fully exposed to this week’s threat. MFA protects the login event. It does not protect the session that follows. Cookie theft bypasses the login event entirely. The countermeasures are session-lifetime reduction (shorter-lived tokens force re-authentication), device-bound sessions (the token only works from the device that created it), and session-reuse anomaly detection (the same token appearing from a new IP or device is the signal).
The macOS blind spot
One of the three lead families — roughly 1,336 of the 2,946 Spyware indicators — is macOS-native. It targets the login Keychain (via Credentials from Password Stores, T1555.001, 1,336 events), browser cookie stores, and local cryptocurrency-wallet files. Most enterprise detection programs are Windows-first. macOS endpoints are frequently EDR-light or EDR-absent, treated as low-risk, and disproportionately owned by executives, designers, and developers — a population with privileged access and high-value sessions. A credential stealer could not ask for a better target set. A Windows-only detection posture is structurally blind to a family driving a large share of this week’s dominant category.
Why the infostealer surge is a pre-ransomware event
Credential harvest is the access pipeline
Infostealers do not monetise themselves. The credentials, cookies and tokens they harvest flow into initial-access-broker inventories and are sold or used for account takeover, business-email compromise, and ransomware initial access. The ransomware tier’s 83% collapse this week sits directly on top of the infostealer surge — the economy is collecting access, not yet deploying encryption. A high infostealer week is the leading edge of the account-takeover and ransomware incidents that land 3-5 weeks later.
Operational takeaway: treat infostealer detections as pre-incident, not low-severity. Every harvested session cookie is a bypassed MFA control and a future account takeover. Instrument both Windows and macOS.
05 · Deep Dive · Headline 02 · The Phishing-Kit Doubling
Three operators · 1,754 indicators · +107% week-over-week · credential-capture at the front door
The Phishing category produced 1,754 attributed indicators this week, up 107% from the prior week’s 846. Three phishing-kit operators drove it: a leading operator at 975 IOCs, and two others at 545 and 173. The IOC distribution is domain- and URL-heavy — the signature of credential-capture landing-page infrastructure rather than payload delivery. The dominant technique is Web Portal Capture (T1056.003, 975 events) — capturing credentials as they are typed into a fake login portal.
Why phishing and infostealers surged together
This is not a coincidence of the calendar. Infostealers and phishing kits are two collection methods for the same product: credentials. An infostealer takes credentials off an already-compromised endpoint. A phishing kit captures them at the point of entry, before any compromise, by presenting a convincing fake login page and harvesting what the user types. Both feed the same downstream economy — account takeover, business-email compromise, initial-access brokerage, and eventual ransomware. A week where both surge is a week where the ecosystem is heavily invested in credential collection.
The kit-deployment signature
Phishing-kit operators run on a build-and-deploy cycle. A kit is a packaged attack toolkit — HTML templates imitating target brands, backend credential-harvesting scripts, infrastructure-provisioning automation, and target-selection logic. A deployment event produces a burst of new domains (the phishing infrastructure), corresponding URL IOCs (specific attack-page URLs), and sometimes hash IOCs for backend scripts, usually within a short window. Three operators deploying in the same week, at a combined 1,693 Phishing-Kit-adversary-type IOCs, is a high-tempo credential-capture push.
Multi-layer coverage is the requirement
Domain + URL + user-awareness all have to fire
Phishing-kit defence is a multi-layer problem. The domain layer (DNS resolver / proxy) blocks resolution of the phishing infrastructure. The URL layer (secure web gateway / email security) blocks the specific attack-page URLs. The human layer (user awareness) is the backstop when fresh infrastructure outruns the blocklists — and against newly-registered phishing domains, it frequently does. Programs that ingest only at one layer have partial coverage. This week’s three-operator deployment is the integration test: if your coverage ingested the week’s phishing domain and URL IOCs across resolver, gateway and email-security within 48 hours, you have working multi-layer defence.
Operational takeaway: the phishing-kit doubling pairs with the infostealer surge as one credential-harvesting story. Treat them as a single coverage priority this week, not two unrelated items.
06 · Deep Dive · Headline 03 · The Crypto-Drainer Campaigns
Wallet-brand lookalike extensions and a prediction-market supply-chain script
Two distinct crypto-targeting campaigns ran this week, both aimed at direct financial theft rather than credential-collection-for-later. The first is a malicious-browser-extension campaign that stood up wallet-brand lookalike subdomains under a single adversary-controlled parent domain — impersonating major cryptocurrency wallet and exchange brands. The second is a third-party-script supply-chain campaign that injected a wallet-draining script into a prediction-market platform via a compromised dependency.
The wallet-lookalike subdomain pattern
The extension campaign uses a structural pattern worth encoding as detection content: <wallet-brand>.<malicious-parent>. The subdomain carries a recognised wallet or exchange brand name while the registrable parent domain is adversary-controlled. The lures impersonate well-known wallet and exchange brands to harvest seed phrases and intercept transactions. The malicious browser extensions, once installed, monitor for wallet activity and drain funds by substituting destination addresses or capturing recovery phrases. Because the brand name sits in the subdomain, naive brand-matching that only checks the registrable domain misses it — the detection has to inspect the full hostname.
The supply-chain vector is the more dangerous one
The prediction-market campaign is more insidious than the extension campaign because the victim saw a trusted origin. The malicious wallet-draining script was served from the legitimate platform’s own pages via a compromised third-party dependency — so the user’s browser loaded it from a domain they trusted, with a valid certificate, inside a session they had deliberately started. There was no phishing lure to spot and no suspicious domain to notice. The compromise was upstream, in the platform’s own supply chain. This is the pattern enterprise security teams find hardest to defend: the attack arrives through a trusted channel.
Coverage for both vectors
Hostname inspection plus third-party-script governance
For the extension campaign, ship detection that inspects the full hostname for embedded wallet/exchange brand tokens where the registrable parent is not the brand’s authoritative domain (Sigma-03). For the supply-chain vector, the control is third-party-script governance — maintain an inventory of external scripts on payment and crypto-adjacent web properties, enforce Subresource Integrity (SRI) so a modified script fails to load, and monitor for unexpected changes to loaded script hashes. Pre-brief crypto, treasury and finance teams that direct wallet-draining campaigns are active this week.
Operational takeaway: crypto-drainer campaigns cause immediate, irreversible financial loss. The wallet-lookalike pattern is detectable in the hostname; the supply-chain vector needs SRI and script governance.
07 · Deep Dive · Headline 04 · The Ransomware Lull in Context
36 indicators · -83% week-over-week · why a quiet ransomware week is not a safe one
The Ransomware-as-a-service category produced 36 attributed indicators this week, down 83% from the prior week’s 211. Only a handful of operators were active, each at low volume — the week’s leading ransomware cluster sits at 29 IOCs, below dozens of commodity-malware and phishing clusters. On the surface this reads as a good week for the ransomware threat. The data underneath says otherwise.
The access-collection / deployment rhythm
The ransomware economy runs on a pipeline: credentials and access are collected first (by infostealers, phishing kits, and initial-access brokers), then monetised later (by ransomware affiliates who buy or use that access to enter and encrypt environments). These two phases do not happen in the same week for the same victim. There is a lag — typically 3-5 weeks between a credential being harvested and that credential being used for ransomware initial access. A week that is heavy on credential collection and light on ransomware deployment is not a safe week; it is the front half of the pipeline filling up.
This week is exactly that shape. Infostealers produced 2,946 indicators and phishing doubled to 1,754 — the collection tiers ran hot. Ransomware collapsed to 36 — the deployment tier ran cold. The access being harvested right now is the ransomware initial access of late November and December.
Why operator-count is a lagging indicator
Ransomware operator-count and IOC-volume are lagging indicators of risk because they measure the deployment phase — the end of the kill chain, after access has already been obtained and monetised. By the time ransomware IOC-volume rises, the initial access was collected weeks earlier. Leading indicators — infostealer volume, phishing-kit volume, initial-access-broker activity — tell you what the ransomware volume will be in a month. This week’s leading indicators are elevated.
Monitoring posture
Do not reallocate ransomware-IR capacity on one low week
The temptation after an 83% ransomware drop is to reallocate IR and detection capacity to the loud categories. Resist it. Hold ransomware precursor-cascade detection (Sigma-04) in production unchanged. The credential-harvest surge this week is the pipeline feeding the ransomware incidents that land in 3-5 weeks. A program that stands down on the quiet week is under-prepared for the loud one that follows.
Operational takeaway: ransomware volume is a lagging indicator. This week’s infostealer and phishing surges are the leading indicators — the ransomware risk is rising even as the ransomware count falls.
08 · Deep Dive · Headline 05 · The Social-Engineering Meta
72 families · fake IT-support, fake verification pages, clipboard-paste execution
Seventy-two named adversaries were active this week across 9 adversary types — a 14% rise in family diversity and a signal of a fragmented, mature commodity economy. Among the notable entries were social-engineering scam campaigns that represent the current initial-access meta: a fake IT-support campaign impersonating a collaboration-platform helpdesk, and fake browser-verification pages (the “prove you are human” lure).
The clipboard-paste execution technique
The fake-verification lure is worth understanding in detail because it has become one of the most effective initial-access techniques of 2026. The user visits a compromised or malicious page and is presented with what looks like a routine human-verification step — a CAPTCHA-style box asking them to “verify you are human.” The instructions tell the user to press a keyboard shortcut (often Windows+R to open the Run dialog), paste what is already on their clipboard, and press Enter. The page has silently copied a malicious command (typically a PowerShell or JavaScript one-liner) to the clipboard. The user, believing they are completing a verification step, executes the adversary’s command on their own machine with their own hands.
This technique defeats many technical controls because the user performs the execution. There is no malicious attachment to scan, no drive-by exploit to block — the user is socially engineered into running the payload directly. It maps to User Execution (T1204.002, 2,986 events this week) and the scripting-interpreter techniques (T1059.001 PowerShell, T1059.007 JavaScript). The payload it delivers is frequently an infostealer — which ties this headline directly back to Headline 01.
The fake-IT-support vector
The fake-IT-support campaign impersonates a collaboration-platform helpdesk, contacting users (often via the platform’s own chat or a spoofed call) and walking them through steps that grant the adversary remote access or install a remote-management agent. One of this week’s C2 clusters is a remote-management-agent-abuse operator (203 IOCs) — legitimate remote-support software repurposed as adversary C2. The social-engineering front and the remote-access-tooling back end are two halves of the same operation.
Coverage response
Technique coverage plus targeted user awareness
Seventy-two families cannot be covered family-by-family. Cover the techniques: User Execution, the scripting interpreters, Drive-by Compromise. For the clipboard-paste lure specifically, the highest-value control is targeted user awareness — users who have seen the “paste this to verify” lure described do not fall for it. Brief them explicitly. For the fake-IT-support vector, detection of unexpected remote-management-agent installation (and a policy that IT never asks users to install remote-access tools via chat) closes the gap.
Operational takeaway: the social-engineering meta exploits trust in routine IT prompts. Technique-based detection plus specific user awareness of the clipboard-paste lure is the counter.
09 · Adversary-Type Breakdown
// WHERE THIS WEEK’S ATTRIBUTED IOCs LIVE · adversary-type volume
Malware dominates at 5,074 IOCs — and within it the three infostealer families (Spyware category, 2,946 IOCs) are the single largest sub-story. Phishing Kit at 1,693 is the week’s clear second tier, having doubled week-over-week. The credential-harvesting adversary types (Malware-with-infostealers + Phishing Kit + Phishing Campaign) together are the overwhelming majority of the week’s volume. Ransomware sits at the bottom at 36 IOCs — the lagging-indicator tier, quiet while collection runs hot.
10 · IOC Type × Adversary Diversity
| IOC Type | Count | Read |
|---|---|---|
| DOMAIN | 3,167 | Phishing-kit landing pages + infostealer C2 + wallet-lookalike subdomains · the week’s largest IOC tier |
| URL | 2,039 | Phishing attack-page URLs + payload-delivery URLs (CDN-abuse staging) + wallet-drainer endpoints |
| HASH | 1,998 | Infostealer payload signatures + RAT + malicious-extension samples · EDR-ingest priority |
| IP | 1,069 | Infostealer + RAT C2 nodes + remote-management-agent-abuse infrastructure |
| OTHERS | 31 | Long-tail · process names, registry keys, behavioural artefacts |
| 16 | Targeted spearphishing recipient and sender indicators |
The week is domain- and URL-heavy (3,167 + 2,039 = 5,206 of 8,320), the signature of credential-capture and commodity-malware delivery infrastructure rather than network-C2. The hash tier (1,998) reflects the infostealer and malicious-extension payload surge and is the highest-value EDR-ingest set this week. The credential-harvesting story is visible in the IOC-type mix: phishing landing pages and infostealer delivery dominate over the IP-heavy signature of botnet or persistent-C2 weeks.
11 · Category-Level Attribution
| Category | IOCs |
|---|---|
| Spyware (infostealer) | 2,946 |
| Malware-Activity | 2,399 |
| Phishing | 1,754 |
| Malicious-Infrastructure | 575 |
| C&C Server | 259 |
| APT | 134 |
| Botnet | 57 |
| RAT | 50 |
| Vulnerability | 50 |
| Ransomware-as-a-service | 36 |
| Backdoor | 18 |
| Framework | 8 |
| Supply Chain | 4 |
| Loader | 3 |
Category breadth confirms the week’s structural shape. Spyware (2,946) is the single dominant category — the infostealer surge. Phishing (1,754) is the doubled second tier. Together with Malware-Activity (2,399, which includes commodity-malware delivery), the credential-harvesting and commodity-malware categories own the week. Ransomware-as-a-service sits at 36 IOCs — the lagging-indicator tier. The Supply Chain category (4 IOCs) is small by volume but high by impact: the prediction-market wallet-drainer script.
12 · ATT&CK Pressure Roll-Up
Twenty-nine distinct MITRE ATT&CK techniques observed — up 16% from the prior week. The composition is a textbook infostealer week: three of the top-six techniques are credential- and session-theft techniques, which is the clearest MITRE confirmation of the week’s narrative.
| Technique | Name | Events | Tactic |
|---|---|---|---|
| T1105 | Ingress Tool Transfer | 5,246 | Command & Control |
| T1071.001 | Application Layer Protocol · Web | 3,818 | Command & Control |
| T1204.002 | User Execution · Malicious File | 2,986 | Execution |
| T1041 | Exfiltration Over C2 Channel | 2,949 | Exfiltration |
| T1539 | Steal Web Session Cookie | 2,733 | Credential Access |
| T1555.003 | Credentials from Web Browsers | 2,704 | Credential Access |
| T1005 | Data from Local System | 2,637 | Collection |
| T1027 | Obfuscated Files or Information | 2,588 | Defense Evasion |
| T1059.001 | PowerShell | 1,644 | Execution |
| T1189 | Drive-by Compromise | 1,571 | Initial Access |
| T1059.007 | JavaScript | 1,538 | Execution |
| T1071.004 | Application Layer Protocol · DNS | 1,379 | Command & Control |
| T1555.001 | Credentials from Password Stores · Keychain | 1,336 | Credential Access |
| T1566.001 | Spearphishing Attachment | 1,055 | Initial Access |
| T1056.003 | Input Capture · Web Portal Capture | 975 | Collection |
The credential-access cluster is the signature of the week: T1539 Steal Web Session Cookie (2,733 events) and T1555.003 Credentials from Web Browsers (2,704) are the Windows infostealer signature, while T1555.001 Credentials from Password Stores / Keychain (1,336) is the macOS stealer reading the Apple login Keychain. T1056.003 Web Portal Capture (975) is the phishing-kit credential-form harvest. T1204.002 User Execution (2,986) reflects the social-engineering lures — including the clipboard-paste verification technique — that deliver the stealers.
13 · Cross-Week Trend Analysis · Weeks 40 – 44
| Metric | W40 | W41 | W42 | W43 | W44 |
|---|---|---|---|---|---|
| Attributed high-conf IOCs | 4,812 | ~6,100 | ~7,600 | 8,975 | 8,320 |
| Named adversaries | 51 | ~58 | ~61 | 63 | 72 |
| Distinct MITRE TTPs | 19 | ~22 | ~24 | 25 | 29 |
| High-severity IOCs | ~3,100 | ~5,200 | ~6,900 | 7,814 | 6,248 |
| Spyware / infostealer IOCs | — | ~1,400 | ~2,100 | 2,883 | 2,946 |
| Phishing IOCs (total) | 783 | ~700 | ~820 | 846 | 1,754 |
| Ransomware IOCs (total) | 27 | ~90 | ~160 | 211 | 36 |
Five-week narrative in three sentences: Weeks 40-43 built a steady escalation — rising IOC volume, rising adversary diversity, and a sustained climb in the infostealer (Spyware) tier that reached ~2,900 IOCs by Week 43. Week 44 holds the infostealer tier at its elevated plateau (2,946) while doubling phishing output (846 → 1,754) and collapsing ransomware (211 → 36). The ecosystem pivoted hard toward credential collection and away from encryption deployment.
Directional signals to watch in Week 45: whether the infostealer tier stays on its elevated plateau or climbs further, whether phishing holds its doubled volume or reverts, and whether the ransomware collapse is a one-week lull or the start of a multi-week trough. The leading-indicator reading (high infostealer + doubled phishing) points to elevated account-takeover and ransomware risk 3-5 weeks out, regardless of this week’s low ransomware count.
14 · Real-World Defensive Lessons From the Week
Lesson 1 · Session cookies are credentials — protect the session, not just the login
This week’s dominant threat steals session cookies (T1539, 2,733 events) to bypass MFA entirely. A stolen cookie is a logged-in session; the authentication already happened. Organisations that treat MFA as the finish line are exposed. Shorten session lifetimes for high-value apps, bind sessions to device posture, and alert on session-token reuse from a new IP or device.
Operational takeaway: MFA protects the login event; cookie theft bypasses it. Session-lifetime and session-binding controls are the counter.
Lesson 2 · A Windows-only detection posture is blind to a third of this week’s threat
One of the three lead infostealer families is macOS-native, targeting the login Keychain and browser cookie stores. macOS endpoints are frequently EDR-light and owned by high-access users. Credential-store and Keychain-access detection has to extend to macOS (Sigma-02), not just Windows.
Operational takeaway: the Mac fleet is a first-class target for credential theft, not a low-risk bystander. Instrument it.
Lesson 3 · A quiet ransomware week sitting on a loud infostealer week is a leading indicator, not an all-clear
Ransomware collapsed 83% while infostealers and phishing surged. The economy is collecting access, not yet deploying encryption. Credential-harvest volume leads ransomware volume by roughly 3-5 weeks. Do not reallocate ransomware-IR capacity on a single low week — hold Sigma-04 in production.
Operational takeaway: ransomware volume is lagging; infostealer and phishing volume is leading. Read the leading indicators.
Lesson 4 · Seventy-two families cannot be covered family-by-family — cover the techniques
Family-specific detection content ages faster than operators enter the market. Technique-based content (T1204.002 User Execution, T1189 Drive-by, T1539 Session Cookie Theft, T1555.003 Browser Credentials, T1059 scripting) catches the output regardless of which family deploys it. Programs covering ~15 techniques structurally cover the 72 families and the next 72.
Operational takeaway: family-based detection complements technique-based detection; it does not replace it.
Lesson 5 · The clipboard-paste lure is defeated by awareness, not just technology
The fake-verification lure socially-engineers the user into pasting and running a malicious command themselves — defeating many technical controls because the user performs the execution. Users who have seen the “paste this to verify” pattern described do not fall for it. Targeted user awareness of this specific lure is one of the highest-ROI controls this week.
Operational takeaway: against user-executed social engineering, specific awareness beats generic training. Describe the exact lure.
15 · Predictive Intelligence · What to Expect in Week 45
Data-driven forecast for 2 – 8 November 2026
Confidence high · The infostealer tier stays on its elevated plateau. Spyware-category volume has climbed across Weeks 41-44 and now sits near 2,950 IOCs. The commodity-infostealer economy shows no sign of contracting. Week 45 base case: 2,500-3,200 Spyware IOCs, with the three lead families (two Windows, one macOS) continuing to anchor the category. A drop below 2,000 would signal a genuine reversion; a climb above 3,500 would signal further escalation.
Confidence high · Account-takeover incidents tied to this week’s harvested sessions begin to surface. The session cookies and credentials harvested this week flow into account-takeover and business-email-compromise operations over the following 2-4 weeks. Expect early-stage ATO indicators — anomalous session reuse, impossible-travel logins, mailbox-rule creation — to rise in Weeks 45-47 for organisations whose users were infected this week.
Confidence medium-high · Phishing-kit volume partially reverts from its doubled peak. The 107% week-over-week phishing jump is likely a multi-operator deployment spike rather than a new baseline. Week 45 base case: 900-1,400 Phishing IOCs — elevated versus the pre-spike baseline but below this week’s 1,754. Sustained volume above 1,600 would indicate the doubling is structural.
Confidence medium · Ransomware begins to recover from its lull. The 83% collapse is more likely a one-to-two-week trough than a lasting decline, given the elevated credential-harvest feeding the pipeline. Week 45 base case: 80-220 Ransomware IOCs — a partial recovery toward the Week-43 level. A sustained sub-50 reading would be a genuine multi-week ransomware trough.
Three specific things to watch for in Week 45
- macOS infostealer continuation — whether the macOS-native family sustains its volume or was a one-week spike. Continuation would confirm a durable macOS-targeting trend worth a dedicated detection investment.
- Account-takeover early indicators — anomalous session reuse and impossible-travel logins rising in environments whose users were infected this week.
- Crypto-drainer campaign expansion — additional wallet-brand lookalike subdomains or new supply-chain-script victims would indicate the crypto-targeting campaigns are scaling.
What would surprise us
A sudden infostealer collapse in Week 45 would be surprising given the sustained climb and would suggest a major operator takedown. Ransomware remaining below 50 IOCs for a third consecutive week would indicate a structural ecosystem shift worth deeper investigation. A new macOS-native infostealer family emerging alongside the current one would signal that macOS targeting is becoming a crowded, competitive market rather than a single-operator anomaly.
16 · Risk Register Language for Enterprise Risk Management
Ready-to-Paste ERM Register Entries
Threat intelligence documented three infostealer families producing 2,946 attributed indicators in the Week-44 (26 October – 1 November 2026) window — the dominant threat category. Two families target Windows browser-credential and session-cookie stores; one is macOS-native, targeting the login Keychain and browser cookie databases. Session-cookie theft (MITRE T1539) bypasses multi-factor authentication because a stolen session token is an already-authenticated session. Harvested credentials and sessions flow into account-takeover and ransomware initial-access operations over the following 2-4 weeks. Risk owner: CISO / Head of Identity joint. Treatment plan: shorten session lifetimes for high-value applications; bind sessions to device posture; alert on session-token reuse from new IP/device; extend credential-store and Keychain-access EDR detection to the macOS fleet; treat infostealer detections as pre-incident, not low-severity.
Threat intelligence observed two crypto-targeting campaigns in the Week-44 window aimed at direct financial theft. A malicious-browser-extension campaign deployed wallet-brand lookalike subdomains (impersonating major cryptocurrency wallet and exchange brands) to harvest seed phrases and intercept transactions. A separate third-party-script supply-chain campaign injected a wallet-draining script into a prediction-market platform via a compromised dependency — delivered from a trusted origin with a valid certificate. Risk owner: Head of Security Architecture / Head of Finance-Systems joint. Treatment plan: deploy wallet-brand lookalike-hostname detection; pre-brief crypto, treasury and finance teams; inventory third-party scripts on payment and crypto-adjacent web properties; enforce Subresource Integrity (SRI) and monitor loaded-script hashes for unexpected change.
If an account-takeover or ransomware event in your environment traces to a Week-44 credential harvest, the after-action will note the following. (a) Threat intelligence dated 1 November 2026 explicitly warned that cross-platform infostealers were the dominant threat and that session-cookie theft bypasses MFA. (b) The recommended defender posture (session-lifetime reduction, session-device binding, session-reuse anomaly detection, macOS credential-store coverage) was named in the advisory. (c) The 2-4 week harvest-to-monetisation timeline linking credential theft to downstream account-takeover and ransomware was documented and dated.
If the organisation deprioritised infostealer detections as low-severity “adware” during Week 44, the after-action will additionally note that the advisory explicitly framed infostealer activity as a pre-incident event feeding account-takeover and ransomware, not a nuisance. Board-level questions in that scenario are not about the technical outcome; they are about why the explicit warning in the advisory was not acted upon, and why the macOS fleet was left uninstrumented.
17 · Four Production-Ready Sigma Rules
title: Non-Browser Process Reading Browser Credential and Cookie Stores
id: hfl-2026-044-01
status: experimental
description: Detects a process that is not the owning browser opening browser credential databases or cookie stores - the core infostealer behaviour. Covers T1555.003 and T1539, the week's top credential-access techniques.
logsource:
category: file_access
product: windows
detection:
selection_stores:
TargetFilename|endswith:
- '\Login Data'
- '\Network\Cookies'
- '\Cookies'
- '\Web Data'
- '\logins.json'
- '\key4.db'
- '\cookies.sqlite'
filter_browser:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
- '\opera.exe'
condition: selection_stores and not filter_browser
fields: [Image, TargetFilename, ParentImage, User]
level: high
tags: [attack.credential_access, attack.t1555_003, attack.t1539]
title: Suspicious macOS Keychain and Browser Cookie Store Access
id: hfl-2026-044-02
status: experimental
description: Detects non-standard process access to the macOS login Keychain and browser cookie stores - the macOS-native infostealer behaviour observed this week. Covers T1555.001 (Keychain) and T1539 (session cookies).
logsource:
category: file_access
product: macos
detection:
selection_keychain:
TargetFilename|contains:
- '/Library/Keychains/login.keychain-db'
- '/Library/Keychains/login.keychain'
selection_cookies:
TargetFilename|contains:
- '/Library/Cookies/Cookies.binarycookies'
- '/Library/Application Support/Google/Chrome/Default/Cookies'
- '/Library/Application Support/Firefox/Profiles/'
filter_good:
Image|contains:
- '/Applications/Safari.app/'
- '/Applications/Google Chrome.app/'
- '/usr/libexec/securityd'
condition: (selection_keychain or selection_cookies) and not filter_good
fields: [Image, TargetFilename, ProcessCommandLine, User]
level: high
tags: [attack.credential_access, attack.t1555_001, attack.t1539]
title: Resolution of Wallet-Brand Lookalike Hostname
id: hfl-2026-044-03
status: experimental
description: Detects DNS resolution or HTTP request to a hostname embedding a cryptocurrency wallet or exchange brand token where the registrable parent domain is not the brand's authoritative domain. Covers the week's crypto-drainer extension campaign.
logsource:
category: dns
detection:
selection_brand:
QueryName|contains:
- 'coinbase'
- 'exodus'
- 'phantom'
- 'bitget'
- 'metamask'
- 'ledger'
- 'trezor'
- 'jupiter'
filter_authoritative:
QueryName|endswith:
- '.coinbase.com'
- '.exodus.com'
- '.phantom.app'
- '.bitget.com'
- '.metamask.io'
- '.ledger.com'
- '.trezor.io'
condition: selection_brand and not filter_authoritative
fields: [QueryName, src_host, answer]
level: high
tags: [attack.resource_development, attack.t1583_001, attack.t1584]
title: Ransomware Precursor Cascade - Shadow-Copy Delete + Defender Disable + Boot Config Tamper
id: hfl-2026-044-04
status: production
description: Canonical ransomware pre-encryption cascade. Hold in production through the credential-harvest front-loading window - the harvested access feeds ransomware in 3-5 weeks despite this week's low ransomware count.
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: '\vssadmin.exe'
CommandLine|contains:
- 'delete shadows'
- 'resize shadowstorage'
selection_defender_off:
CommandLine|contains:
- 'Set-MpPreference -DisableRealtimeMonitoring'
- 'Set-MpPreference -DisableBehaviorMonitoring'
selection_bcdedit:
Image|endswith: '\bcdedit.exe'
CommandLine|contains:
- 'safeboot'
- 'bootstatuspolicy ignoreallfailures'
timeframe: 10m
condition: selection_vssadmin or selection_defender_off or selection_bcdedit
fields: [Image, CommandLine, ParentImage, User]
level: critical
tags: [attack.impact, attack.t1486, attack.t1490, attack.defense_evasion, attack.t1562_001]
18 · The 60-Minute Ops Plan
What to do this week — before Wednesday
- MINUTES 0-12 · Ship Sigma-01 + Sigma-02 browser/Keychain credential-store detection across Windows AND macOS endpoints. Non-browser process access to credential and cookie stores is the core infostealer behaviour this week. Verify a test alert fires on each platform. The macOS rule is the gap most programs have.
- MINUTES 12-22 · Turn on session-token reuse anomaly detection for your highest-value applications (email, SSO/IdP, finance systems). Alert when the same session token appears from a new IP or device. Stolen session cookies bypass MFA — this is the control that catches cookie replay.
- MINUTES 22-32 · Import this week’s hash-tier IOC set (Section 19) into EDR across both platforms — the infostealer and malicious-extension payload surge makes the endpoint hash set the highest-value coverage addition. Ensure macOS EDR ingests the macOS-family samples.
- MINUTES 32-42 · Ship Sigma-03 wallet-brand lookalike-hostname detection and pre-brief crypto, treasury and finance teams. The wallet-drainer extension campaign causes immediate, irreversible financial loss. Review third-party scripts on payment/crypto-adjacent web properties for the supply-chain vector.
- MINUTES 42-52 · Send a targeted user-awareness note on the clipboard-paste verification lure — describe the exact “press Win+R, paste, press Enter to verify you are human” pattern. Users who have seen it described do not fall for it. This is the highest-ROI control against the social-engineering meta delivering the stealers.
- MINUTES 52-60 · Executive brief prep · the infostealer narrative — Section 13 cross-week trend table (W40-W44) is the strategic slide. Combined with the Section 04 infostealer deep dive and the leading-vs-lagging-indicator framing (credential harvest up, ransomware down = risk rising), this is the right board-level message. Add the two Section 16 risk-register entries. Schedule within 48 hours.
See this week’s threat surface inside the operator console
HuntIntel exposes the same corpus this advisory is built from — continuously updated. Per-cluster fingerprint, infostealer family tracking across Windows and macOS, session-cookie-theft campaign feed, wallet-lookalike domain monitor, phishing-kit deployment timeline, sector heatmap, country attribution atlas.
19 · Top IOCs per Indicator Type
Operator-grade extractions for the 26 October – 1 November window · high-severity attributed indicators only · filtered to clear adversary-controlled infrastructure (legitimate-company and victim domains excluded). Rendered defanged per standard IOC-publishing practice (re-fang on import: [.] → .; hxxp → http).
hxxp/hxxps replacement. This is a curated sample; the full attributed corpus is in the HuntIntel console.IP addresses · high-severity · adversary-controlled
// Infostealer + RAT C2 · remote-management-agent-abuse · malicious-extension infrastructure
| # | Indicator | Category | Severity |
|---|---|---|---|
| 1 | 143.244.140.188 |
Malicious-Infrastructure | HIGH |
| 2 | 211.75.64.189 |
Malware-Activity | HIGH |
| 3 | 203.159.253.220 |
Malware-Activity | HIGH |
| 4 | 49.229.69.162 |
Malware-Activity | HIGH |
| 5 | 77.110.114.115 |
Malware-Activity | HIGH |
| 6 | 45.88.186.191 |
Malware-Activity | HIGH |
| 7 | 45.92.1.127 |
Malware-Activity | HIGH |
| 8 | 31.77.220.100 |
Malware-Activity | HIGH |
| 9 | 13.143.144.177 |
Malware-Activity | HIGH |
| 10 | 172.67.155.198 |
Malicious-Infrastructure | HIGH |
| 11 | 104.21.34.69 |
Malicious-Infrastructure | HIGH |
| 12 | 104.18.14.219 |
Loader | HIGH |
| 13 | 160.119.69.4 |
C&C Server | HIGH |
Domains · high-severity · defanged
// Wallet-brand lookalike subdomains (crypto-drainer extensions) · malicious-infrastructure
| # | Indicator (defanged) | Category | Severity |
|---|---|---|---|
| 1 | aber[.]ir |
Malicious-Infrastructure | HIGH |
| 2 | jupiter[.]bonto[.]io |
Malicious-Infrastructure | HIGH |
| 3 | bitget[.]bonto[.]io |
Malicious-Infrastructure | HIGH |
| 4 | coinbase[.]bonto[.]io |
Malicious-Infrastructure | HIGH |
| 5 | exodus[.]bonto[.]io |
Malicious-Infrastructure | HIGH |
| 6 | phantom[.]bonto[.]io |
Malicious-Infrastructure | HIGH |
File hashes · high-severity
// Infostealer + RAT payload samples · malicious browser-extension samples · C2 implants
| # | Hash (SHA-256 / SHA-1) | Category | Severity |
|---|---|---|---|
| 1 | 4887afc0a574e9419a9695ef083460f58e4ef9a1c40793523ce112251273bdf9 |
C&C Server | HIGH |
| 2 | d791dd0ff3228ed29a8d7333d4567be829159c5632ea347780992006f91c5295 |
C&C Server | HIGH |
| 3 | 7d16381a9de823943b5a0987dbd0f26edf22052b |
C&C Server | HIGH |
| 4 | 57ae80bcc2028621086781da603110b8d6abddb840f4ba0f3395e40c8b1cbf74 |
Malware-Activity | HIGH |
| 5 | 7020fbd08fdde0a2c1a9c11ec11bdf3be9a6f3b58a78fbfe907fccc11eb404ca |
Malware-Activity | HIGH |
| 6 | db0e4f1afc7d9036c4561a582af57dbe0f0826b03b266c2cb99d2fb07fc5c242 |
Malware-Activity | HIGH |
| 7 | 8da000dac095000fb4167db27aaf2810ac13a1e0815736ead22d93fefa5bb90e |
Malware-Activity | HIGH |
| 8 | e514e981d7db3f74c878d7eab9ed6d1aaa3c37cd9cd239f86abcc2df6d2711ee |
Malware-Activity | HIGH |
| 9 | e688bff5df32f209b4ebb882985e3ad19ddee68666405c39ff523307068a8611 |
Malicious-Infrastructure | HIGH |
| 10 | 311c49974f28d33947b8b74d78b48f51855eacac182d519a4fe1daa6af7f30e9 |
Malicious-Infrastructure | HIGH |
| 11 | 999bccd41188a238a50d05b5aca8e35af45d107f32d7443389313816f0cb226a |
Malicious-Infrastructure | HIGH |
| 12 | fd7b138f4fba003db332a4eee833e84491bf7ffec5a3d91f7451d7b95aabcf6a |
Malicious-Infrastructure | HIGH |
URLs · high-severity · defanged
// Wallet-drainer endpoints · payload-delivery URLs (CDN-abuse staging)
| # | Indicator (defanged) | Category | Severity |
|---|---|---|---|
| 1 | hxxps[://]bitget[.]bonto[.]io/ |
Malicious-Infrastructure | HIGH |
| 2 | hxxps[://]jupiter[.]bonto[.]io/ |
Malicious-Infrastructure | HIGH |
| 3 | hxxps[://]phantom[.]bonto[.]io/ |
Malicious-Infrastructure | HIGH |
| 4 | hxxps[://]phantom[.]bonto[.]io/config |
Malicious-Infrastructure | HIGH |
| 5 | hxxps[://]cdn[.]filestackcontent[.]com/B7hA66RuGnT1LRjBp2Ax |
Malware-Activity | HIGH |
| 6 | hxxps[://]cdn[.]filestackcontent[.]com/OjJYVfNcSaCemmakSzPg |
Malware-Activity | HIGH |
| 7 | hxxps[://]cdn[.]filestackcontent[.]com/dXsER20oSBCJeqtF4yq7 |
Malware-Activity | HIGH |
| 8 | hxxps[://]cdn[.]filestackcontent[.]com/3LI5K6STzaI8VOvBgmga |
Malware-Activity | HIGH |
Full-corpus access: the 8,320 unique attributed IOCs surfaced this week are available in the HuntIntel operator console under the Adversary Intel Search view. Filter by adversary_type, category, first_seen date range, and severity band; export as STIX, MISP, or CSV. Open the operator console →
20 · Frequently Asked Questions
We have MFA everywhere — are we protected from this week’s infostealers?
Not fully. This week’s dominant stealers harvest session cookies (T1539, 2,733 events). A session cookie is an already-authenticated session — when the adversary replays it, the login already happened, so MFA is never challenged. MFA protects the login event; cookie theft bypasses it. The controls that help are shorter session lifetimes, device-bound sessions, and session-reuse anomaly detection.
Why does the macOS angle matter so much this week?
One of the three lead infostealer families is macOS-native — it reads the login Keychain, browser cookie stores, and local wallet files. Most enterprise detection is Windows-first, so Macs are often EDR-light and treated as low-risk, despite being owned by high-access users (executives, developers, designers). A Windows-only posture is blind to a family driving a large share of the week’s dominant category. Sigma-02 extends coverage to macOS.
Ransomware dropped 83% — is the ransomware threat receding?
No — this is front-loading, not de-escalation. The ecosystem is collecting access (via infostealers and phishing) this week rather than deploying encryption. Credential-harvest volume leads ransomware volume by roughly 3-5 weeks. A quiet ransomware week sitting on a loud infostealer week is a leading indicator that ransomware risk is rising, not falling. Hold Sigma-04 in production.
What is the clipboard-paste / “verify you are human” lure?
A malicious or compromised page shows a fake verification step instructing the user to press a keyboard shortcut (often Win+R), paste, and press Enter. The page has silently copied a malicious PowerShell or JavaScript command to the clipboard. The user executes the adversary’s command themselves, believing they are completing a CAPTCHA. It maps to User Execution (T1204.002). The counter is specific user awareness — describe the exact lure.
How do we detect the crypto-drainer wallet-lookalike campaign?
The campaign uses the pattern <wallet-brand>.<malicious-parent> — a recognised wallet/exchange brand in the subdomain, with an adversary-controlled registrable parent. Detection has to inspect the full hostname, not just the registrable domain (Sigma-03). The separate supply-chain vector (malicious script on a trusted platform) needs third-party-script inventory and Subresource Integrity enforcement instead.
Seventy-two families is high — should coverage expand?
Technique-based coverage (T1204.002 User Execution, T1189 Drive-by, T1539 + T1555.003 credential theft, T1059 scripting) covers the 72 families inherently. Family-specific coverage expands slower than operators enter the market. Prioritise technique content; expand family-specific content only for the top 3-5 observed families each week.
How do the anonymised Cluster IDs relate across weeks?
Cluster IDs rotate weekly. Week 44’s C-series does not map to any prior week’s identifiers. No cluster label carries over unless explicitly stated. Treat C01, C02, C03 as fresh identifiers for this week only.
What’s on the HuntIntel platform that this document does not show?
Live infostealer family tracking across Windows and macOS. Session-cookie-theft campaign feed. Wallet-lookalike domain monitor. Phishing-kit deployment timelines. Actor migration timelines. Sector heatmaps. Country attribution atlas. Full CVE-exploitation attribution. Custom TaHiTI-abstract templates. This document is a weekly snapshot; HuntIntel is the continuous surface.
21 · Close
Week 44 is the infostealer week. Three credential-stealing families — two Windows, one macOS-native — produced 2,946 indicators, the dominant category and over a third of the week’s total. Phishing-kit output doubled to 1,754 IOCs as three operators deployed in parallel. A crypto-drainer sub-theme ran underneath: wallet-brand lookalike extensions and a prediction-market supply-chain script. Ransomware collapsed 83% to 36 IOCs. The strategic signal to communicate upward is that credential-harvest volume is a leading indicator — the ransomware tier is quiet because the access-collection tier is loud, and that harvested access is next month’s incidents.
Detection engineers: ship Sigma-01 and Sigma-02 browser/Keychain credential-store detection across BOTH Windows and macOS before Wednesday. Turn on session-token reuse anomaly detection. Ship Sigma-03 wallet-lookalike-hostname detection. Hold Sigma-04 ransomware precursor cascade in production unchanged.
CTI / hunt leads: draft a hunt for session-cookie-reuse anomalies across high-value applications. Draft a continuation hunt for the crypto-drainer campaign expansion across Weeks 45-46.
CISOs / risk officers: the infostealer-surge narrative is boardroom-ready material. Section 13’s cross-week trend table (W40-W44) is the strategic slide. Communicate the leading-vs-lagging framing: credential harvest is up and ransomware is down, which means risk is rising even as the ransomware count falls. Extend credential-theft detection to the macOS fleet. Add R-2026-CY-INFOSTEALER-CREDENTIAL-HARVEST and R-2026-CY-CRYPTO-DRAINER-CAMPAIGN from Section 16 to the Q4 enterprise risk register.
Next week’s Week-45 briefing publishes on Sunday. Predictive framing is in Section 15. Bookmark huntintel.hackforlab.com for continuous intelligence between briefings.
Cite this document as: HackForLab CTI Research. “Weekly Threat Advisory · October 26 – November 1, 2026.” huntintel.hackforlab.com.
