ThreatsDay is once again a reminder that cybercriminals keep getting more creative—often by making malicious activity feel ordinary. Fake login flows, “useful” productivity apps, and AI-powered bot workflows all point to the same advantage: attackers find places where trust is cheap and friction is low.
This roundup covers the major developments reported over the week, including a large IoT botnet impacting hundreds of thousands of devices, campaigns that aim at identity and credentials, and a steady stream of new loaders, remote access trojans, and information stealers.
Why this ThreatsDay matters
A recurring theme is the shift from “simple” attacks toward operator-controlled experiences. Instead of relying only on static pages or one-time payload drops, several campaigns use live session steering, multi-stage delivery chains, and automated evasion checks.
That means defenders face two challenges at once: detecting the initial lure and preventing the follow-on behavior once the attacker has a foothold.
Nearly 296,000 devices in an IoT botnet
One of the headline items is the discovery of a botnet known as Dysphoria. The Shadowserver Foundation reported that nearly 296,000 devices were compromised, with the botnet primarily targeting Internet of Things systems.
Its main function appears to be participation in DDoS attacks. In addition, the botnet recently added residential proxy functionality, which can broaden its ability to mask origin and route traffic through compromised endpoints.
From a defensive perspective, this kind of scale usually implies widespread scanning and weak device security defaults, making device inventory and hardening priorities more urgent.
More botnet resilience: public blockchain command-and-control
Another botnet development described by Unit 42 involves Aeternum, a loader whose command-and-control (C2) has shifted entirely to the public Polygon blockchain.
Rather than depending on traditional centralized servers or domains, operators can write encrypted and plaintext instructions using smart contracts. Infected devices then continuously query public RPC endpoints to retrieve and execute on-chain commands.
This architecture is designed to be difficult to dismantle using conventional takedown methods, and it comes with evasion layers such as virtual machine detection and antivirus scanning.
AI gets woven into botnet workflows
Threat actors are also experimenting with AI beyond “marketing use.” Joe Security described an AArch64 Linux peer-to-peer botnet called ToxNetV2 that integrates a large language model into the controller’s operational workflow.
The controller collects host and botnet telemetry, sends context to an NVIDIA NIM interface using a model referenced as z-ai/glm-5.2, parses selected responses into structured actions, and then queues those actions for operator approval.
While the system is not fully autonomous or self-modifying, the reported pipeline can lead to impactful steps after approval—such as local command execution, file writes, remote SSH, persistence changes, and even compilation workflows.
Phishing evolves: live session steering and broad data collection
Several items show phishing maturing into more interactive, operator-driven systems. Cisco Talos described an undocumented phishing framework internally branded JWR, which can impersonate checkout and login pages across major payment and shopping platforms.
Instead of passively recording submissions, the framework keeps a WebSocket channel open, allowing the threat actor to steer a victim’s session in real time. Talos also reported that targets can include identity documents, government ID images, credit and account credentials, 2FA codes, and device fingerprints.
In another social angle, ReliaQuest confirmed an employee was targeted through an impersonation attempt using a lookalike domain and a fake single sign-on (SSO) page. The attacker used phone-based MFA push approval during the interaction and gained a brief view-only session on an identity dashboard. The company said no applications or systems were accessed and no customer data was touched.
Trojanized productivity apps and “fake productivity” lures
Not all lures look like classic phishing. Researchers reported that fake websites promoting productivity software can lead users to download Electron-based applications that function deceptively.
These apps—named under different brands such as PDF conversion tools—were described as able to dynamically execute injected scripts and access desktop capture functionality through Electron APIs. The implication is clear: the download masquerades as legitimate work, while the malware enables surveillance or further compromise after installation.
Information stealers keep multiplying
Credential theft remains a constant in the ThreatsDay list. Splunk described Phantom Stealer, which can collect browser credentials, saved passwords, session cookies, cryptocurrency wallet files, and detailed system fingerprints.
Splunk also noted Phantom Stealer is modular and has been seen in multiple campaigns using phishing lures, cracked software, and malicious links promoted via communities such as Discord and Telegram.
A second emerging stealer family, Salat Stealer, was described as written in Go and capable of system reconnaissance, credential theft, and monitoring activity through desktop streaming and audio/video capture.
Other reports included a Python-based stealer called Vanta Stealer targeting a broad range of browsers, messaging and gaming platforms, VPN configurations, screenshots and webcam captures, and documents related to wallet recovery phrases or private keys. The delivery mechanism was not confirmed, but potential vectors mentioned included phishing emails, fake installers, “game cheat” style lures, SEO poisoning, malvertising, and malicious repositories.
New RATs, loaders, and multi-stage chains
Remote access trojans (RATs) and multi-stage loader chains also featured prominently. LevelBlue reported that a ClickFix lure can lead to a multi-step infection where a legitimately signed IBM SPSS IDE executable is used to load a malicious DLL, followed by additional decoy DLL behavior and shellcode handling via a benign date-formatting API.
The resulting Trojan provides operators with interactive shell capability, file management, screen capture, local account backdoor functionality, multiple persistence mechanisms, and a set of typed commands for downloading and running further payloads.
Zscaler also described a new C++ malware family called Abyssos supporting credential theft, file exfiltration, and remote access through VNC. It uses a custom TCP protocol and can download additional modules from the C2 server to extend capabilities.
Scams targeting security tools
Another recurring pattern involves social engineering around security software. Malwarebytes reported a campaign using a set of fake websites that claim to verify antivirus performance. The sites present Microsoft-themed branding and names resembling familiar security tooling.
In the described flow, victims receive a “convincing-looking but fake security scan,” are told their antivirus is causing problems, and are then pushed toward information collection and “refund call” style engagement. The final instruction in the scam is typically to uninstall antivirus immediately to “fix compatibility issues.”
Sandbox evasion and execution gating
Evasion continues to show up in stealer campaigns as well. Joe Security described ScarfaceStealer propagating via an Electron-based application masquerading as AI-related tools.
The malware performs environment checks and computes a weighted suspicion score based on 11 indicators. If the score reaches a threshold, it enters a decoy loop that displays repeated message boxes. Execution continues only when the score stays below the cutoff. Additional loaders then apply multiple decryption layers, map an embedded PE in memory, and include anti-sandbox logic that relies on that scoring mechanism.
Defensive takeaway: patch windows and hardening priorities
Beyond new malware, the bulletin also reinforces operational realities for defenders. The report notes that exploit timelines are tightening, which increases the importance of timely patching, reducing exposed attack surfaces, and applying compensating controls when fixes are not yet available.
In device environments, the guidance is especially strong: for systems relying on disk encryption, ensure boot and security configurations are correct and review disposal or loss procedures—because attackers often look for paths around assumptions.
Conclusion
This ThreatsDay roundup shows a clear picture of how attackers operate today: large-scale infrastructure (including the IoT botnet hitting nearly 296,000 devices), more resilient C2 strategies, and phishing and malware delivery that feels helpful until the moment it doesn’t.
For organizations, the best response is not a single control. It’s a layered approach—device hardening, identity protections that resist impersonation and MFA abuse, rapid patching, and monitoring designed to catch both the lure and the follow-on behavior.
Source: https://thehackernews.com/2026/08/threatsday-296k-iot-botnet-100-water.html
