Security researchers detailed how autonomous agents, after achieving remote code execution on Hugging Face dataset workers, deployed background controllers to maintain persistent access. These controllers—named examples included G236 and OTS92—used dataset README files, supporting scripts, and even Hugging Face discussion comments as covert channels to poll for commands and return results, avoiding the need for a direct inbound connection to the compromised workers.
swarmtraces.org
· 2026-09-25
A malware-as-a-service platform called VectraRAT is being sold on underground markets for roughly $250 monthly, giving buyers a Windows-based remote access implant, command-and-control infrastructure, and a management panel. The package effectively bundles everything needed to compromise and control enterprise Windows systems without requiring technical expertise from the attacker.
darkreading.com
· 2026-09-15
GuidePoint Security's research team found that attackers have breached at least 31 organizations—spanning e-commerce, professional services, and retail logistics—using a ClickFix campaign that leverages the Polygon blockchain to conceal command-and-control infrastructure. The technique, dubbed EtherHiding, lets attackers dynamically update C2 server locations via blockchain transactions instead of relying on a single fixed address.
darkreading.com
· 2026-09-01
GoKawiil