Unknown
A new malware campaign leverages search engine optimization to surface counterfeit GitHub repositories mimicking LastPass Authenticator and other well-known software. The repositories distribute a previously undocumented information stealer identified as Rapuncel, which targets credentials and other sensitive data from compromised systems.
Recent reporting indicates that information stealer malware such as Lumma Stealer and Vidar are being used to harvest reusable session tokens and API credentials from compromised endpoints. These tokens, once extracted, can be replayed by attackers to gain illicit access to artificial intelligence platform accounts from Google, Anthropic, and other providers. The technique allows bypass of multi-factor authentication protections by reusing valid session identifiers rather than performing credential-based login. The scope of affected accounts and the precise mechanics of the token replay process remain under investigation.
A recent advisory from Flare, reported by BleepingComputer, highlights that infostealer malware can exfiltrate more than just passwords. Stolen browser cookies, session tokens, and authenticated sessions may allow attackers to bypass multi-factor authentication and gain unauthorized access to organizational accounts. The guidance emphasizes the need for defenders to prioritize compromised identities, assess whether stolen access is still usable, and implement credential rotation and session invalidation procedures before account takeover occurs.
GitGuardian researchers have identified a new variant of the Shai-Hulud infostealer worm that has expanded its credential scanning capability from 189 to 469 locations. The variant targets developer environments, CI/CD tooling, cloud configurations, and AI tool configurations, significantly broadening the attack surface for credential theft. The findings were published in early August 2026 and covered by The Hacker News on September 3, 2026.
Researchers have detailed a new Python-based Windows malware framework called BraZetsu that transforms compromised hosts into commercial marketplace inventory. The framework is designed to empower Initial Access Brokers (IABs) by providing a comprehensive toolkit for monetizing system access beyond standard infostealer capabilities. Disclosure was reported by The Hacker News on September 3, 2026.
A threat actor has been using various infostealer malware variants to collect session information from Anthropic Claude users. The stolen session data is being used to hijack active accounts without requiring passwords, affecting an unspecified number of users globally. Anthropic has not reported a platform breach, but the attacks leverage stolen credentials and tokens to bypass authentication.
Anthropic has issued a warning that infostealer malware on end-user workstations is stealing active Claude login sessions. Attackers are leveraging these stolen sessions to gain unauthorized access to Claude accounts and consume user usage quotas without needing re-authentication. The advisory highlights that session tokens or credentials extracted by the malware enable session hijacking, impacting users of the Claude AI platform.
Threat actors have adopted a ClickFix-style campaign tactic using a tool identified as WordlistLoader to deliver the Amatera infostealer. The malware disguises its payload as ordinary text, evading initial detection and relying on social engineering to execute on target systems.
Threat actors compromised the maintainer account of the widely used Rust crate arrayref on crates.io, injecting malware that executed during compilation. The malicious code functioned as an infostealer, targeting developer systems and potentially exposing credentials and sensitive data. The incident highlights the ongoing risk of supply chain attacks targeting development dependencies.