This week has seen significant events in the realm of cybersecurity, with a focus on recent attacks and the emergence of new threats.

  • The FBI has dismantled NightmareStresser, one of the oldest DDoS-for-hire services.
  • A new Android Trojan has been found that utilizes AI for autonomous control of infected smartphones.
  • Spain has recorded its first cyberattack executed by an AI agent.
  • Hackers compromised the official HBO Max account on Reddit to spread malware.

FBI Takes Down NightmareStresser, a Major DDoS Service

The FBI has seized the domains of NightmareStresser, a platform known for facilitating powerful DDoS attacks, as reported by the U.S. Department of Justice.

According to researchers from Searchlight Cyber, the service boasted over 566,000 registered users and operated 52 dedicated servers. Users could rent botnets from compromised routers and IoT devices to launch complex attacks at speeds of up to 200 Gbps.

Since 2022, NightmareStresser's capabilities have been involved in hundreds of thousands of attacks on websites globally, targeting schools, government portals, private businesses, and gaming platforms.

This operation is part of the ongoing PowerOFF initiative, which aims to combat DDoS-for-hire services since 2018. Previous targets of this campaign included the UK-based DigitalStress and the aggregator Dstat.cc, with arrests made in Poland and the U.S. of operators of similar platforms.

In December 2022, the U.S. Department of Justice attempted to block NightmareStresser's domain and arrested six suspects, but the service was able to resume operations.

New Android Trojan Uses AI for Autonomous Operation

Researchers at Zimperium have identified a sophisticated Android Trojan named RatHat, which is believed to be developed by Chinese hackers.

Its standout feature is integration with AI models that allow it to interact with the device's interface autonomously, eliminating the need for constant manual control by an operator.

The malware spreads beyond Google Play through phishing attempts, SMS campaigns, and advertisements.

Like many other Trojans, RatHat exploits accessibility services. However, this version can also enable "Developer Options" and "Wireless Debugging" independently, allowing it to access the local shell without a physical connection to the device.

Source: Zimperium.

Experts note that the Trojan has a dual resilience feature: it installs an agent in Go language that operates with local shell privileges. The machine and the application mutually monitor each other; if one component is removed by the user or antivirus, the other is immediately restored.

Instead of hard-coded scripts for clicks, RatHat captures the smartphone's interface tree in .xml format and sends it to a popular language model, the name of which remains undisclosed. The prompt was reportedly written in Chinese.

The AI assistant's responsibilities include:

  • screen analysis and text recognition;
  • calculating the exact coordinates of necessary buttons;
  • returning navigation instructions (e.g., SCROLL_DOWN), allowing the Trojan to adapt flexibly to various interfaces.

The primary goal of RatHat is financial. The Trojan overlays phishing windows on top of banking and cryptocurrency applications, intercepts SMS messages, copies URLs, and records PIN codes from the lock screen.

Spain Reports First AI-Agent-Driven Cyberattack

For the first time, corporate infrastructure in Spain has been compromised by an AI agent based on a well-known LLM, as reported by AEPD.

The agent autonomously detected vulnerabilities in the organization's core files and successfully logged into the system. Once inside, the script began to scan internal applications for further security issues.

At the final stage of the attack, the AI agent managed to alter user personal data and access financial documents.

AEPD has advised companies to reevaluate their risk management models. Algorithms operate at machine speed, meaning traditional "manual" response protocols are no longer sufficient, according to the agency. They believe that protection should be automated and focused on strict control of accounts and API keys.

Hackers Compromise HBO Max Reddit Account to Distribute Malware

Cybercriminals took control of the verified HBO Max account (u/hbomax) on Reddit and used it to widely disseminate malware. Over 48 hours, hackers launched 108 advertisements, according to researchers from Hudson Rock and ADAMnetworks.

Users who visited a fake site like hbomaxx.us were instructed to copy malicious code and paste it into the command line—an approach known as ClickFix. By executing the code manually, they circumvented built-in security mechanisms of the OS and browser.

Source: Hudson Rock.

The account compromise was part of a broader cross-platform campaign called PasteSwitch. The hackers' backend dynamically analyzed the victim's OS and loaded the appropriate script.

The malware arsenal included:

  • For macOS: The MacSync stealer (which steals OS passwords, browser data, Telegram, and Apple Notes), the AMOS component for persistence, and fake Ledger, Trezor, and Exodus cryptocurrency wallet apps to capture seed phrases;
  • For Windows: The Amatera malware operated directly in memory, bypassing protection. Additional viruses like AnimateClipper and ZigClipper were installed to replace cryptocurrency wallet addresses in the clipboard.

Following numerous user complaints, Reddit's administration suspended the infected ads and blocked the account for investigation in collaboration with security services. The initial vector for the HBO Max account hack remains unidentified.

Hackers and Agencies Exploit AI Model Claude for Scanning and Automating Cyberattacks

Anthropic released a report detailing the extensive misuse of Claude by hackers from December 2025 to August 2026. The AI was used as an autonomous engine for code scanning, malware development, and discovering zero-day vulnerabilities.

ShinyHunters

A member of this group, known as frkoo, created an automated pipeline using 10 AWS EC2 servers, downloading 1.8 million Android applications from various stores. Using the TruffleHog tool and Claude, he extracted hardcoded developer secret access keys from them.

Employing AI agents that performed almost all tasks autonomously, hackers spent only 34 hours gaining access to 2100 Azure AD authorization token sets belonging to over 40 corporate Microsoft clients.

The use of Claude allowed them to gain full administrative control over victim infrastructures in less than three hours.

Midnight Blizzard

This pro-Russian group utilized Claude to automate the entire cycle of cyber operations, from phishing (including ClickFix attacks, DNS spoofing in hotel Wi-Fi networks, and hacking WhatsApp) to malware development.

The hackers established a feedback loop: AI automatically rewrote and modified malware code every time it was detected by security systems.

GTG-10007

Chinese hackers employed Claude as an orchestrator to coordinate attacks on 50 organizations worldwide, including government bodies in the Middle East, Europe, and Southeast Asia.

The AI system autonomously scanned protective software, enabling it to discover several previously unknown zero-day vulnerabilities in popular security solutions and write working exploits for them.

Following these incidents, Anthropic stated that it had blocked the accounts of all identified groups, reported victim data to law enforcement, and significantly tightened Claude's internal security measures.

Three Cyber Groups Target Businesses in Russia with Complex Infection Chains

Three hacker groups—NightEagle, Hacking Cat, and Toy Ghouls—have targeted the Russian corporate sector, according to separate security reports from Kaspersky Lab.

These criminals employ intricate multi-stage attacks that combine stolen credentials, custom backdoors, and malware to encrypt and destroy infrastructure.

Key threats and tactics include:

  • NightEagle (APT-Q-95): Active since 2023, they infiltrate corporate networks through compromised VPN access. Their primary tool is the modular backdoor GhostContainer, which operates on Microsoft Exchange servers. The malware disguises itself as a server component, providing complete control over the infected system. For lateral movement and domain controller capture, NightEagle exploits Active Directory vulnerabilities, including the critical BlueKeep flaw (CVE-2019-0708);
  • Hacking Cat: A pro-Ukrainian hacktivist group that has shifted tactics from website defacement to destructive attacks. They exploit vulnerabilities in Exchange servers to deploy the Go-written Trojan Gorilla RAT for remote access. The hackers use a multi-platform encryptor named Monkey—some versions of which do not save the decryption key, effectively becoming a wiper for irreversible data destruction. Hacking Cat coordinates attacks with the Cyber Anarchy Squad and Ukrainian Cyber Alliance, spreading the ClearWater virus and the wiper Nemo. They disputed Kaspersky Lab's findings on their Telegram channel, claiming they do not own the tools;
  • Toy Ghouls (Bearlyfy/Feral Wolf): A financially motivated group that has turned away from leaked software (Babuk, LockBit) in favor of their own encryptor GenieLocker and a unique backdoor called Bird Agent. A key feature of this malware is its use of unconventional channels for communication with the command server. One version utilizes the HiveMQ message broker, while another is managed through the secure corporate messenger Element (based on the Matrix protocol). The backdoor's configuration is tightly bound to the registry of the specific infected machine, complicating analysis.

Experts believe that the hackers' shift away from public hacking tools in favor of sophisticated instruments and unconventional communication channels indicates plans for long-term evasion of corporate security systems.

Also on ForkLog:

  • White hat hackers compromised OpenAI using Claude.
  • Hackers demanded $3 million in Monero from Revolut for client data.
  • A hacker utilized an AI stealer to claim rewards for discovered vulnerabilities.
  • An MEV bot intercepted a withdrawal of $7.73 million from a Safe wallet.
  • 404 Media reported that hundreds of OpenAI contractors read ChatGPT user conversations.
  • The EU has mandated reporting vulnerabilities in cryptocurrency wallets within 24 hours.

Weekend Reading Suggestions

In the latest "Cryptorium" cards, we explore how Shor's algorithm works, why it poses a threat to Bitcoin, and what developers and regulators are doing to prepare for "Q-Day."