Dysphoria IoT botnet infects 296,000 devices

The Shadowserver Foundation reports that nearly 296,000 devices have been compromised by an IoT botnet it calls Dysphoria. IoT, the internet of things, is the family of always-on connected gadgets such as cameras, routers and sensors in homes and offices. Shadowserver says the botnet's main apparent purpose is DDoS attacks (floods of junk traffic sent from thousands of hijacked devices at once to knock a site or service offline), and that it has recently gained residential proxy functionality, which lets other criminals route their traffic through victims' home connections. A compromised gadget in a small office therefore matters well beyond that office.

Joe Security describes ToxNetV2, an AArch64 Linux peer-to-peer botnet that has wired a large language model into its controller's workflow. The controller talks to NVIDIA NIM using the z-ai/glm-5.2 model, sends it host and botnet telemetry and turns selected answers into structured actions queued for operator approval. Joe Security stresses that the system is not fully autonomous: a human remains the final approval point for higher-impact actions, which can then include local command execution, file writes, remote SSH, persistent state and a compilation workflow. The AI sits inside a broader Tox-based botnet with encrypted peer-to-peer C2 (command and control, the channel an attacker uses to steer infected machines), scanner workers, self-propagation and 17 network-attack launchers. Palo Alto Networks Unit 42 describes Aeternum, a C++ botnet loader that has moved its C2 entirely onto the public Polygon blockchain, writing encrypted and plaintext instructions as smart contracts that infected devices fetch through public remote procedure call endpoints; Unit 42 says virtual machine detection and antivirus scanning keep it hidden, and that the design complicates takedowns. Malwarebytes reports that PavinLoader, a loader rented out to other criminals, uses the same blockchain trick, known as EtherHiding.

ReliaQuest confirmed that one of its employees was targeted on August 22, 2026, in an extortion attempt by attackers posing as members of its own security team. The company says the actor registered a lookalike domain, stood up a fake ReliaQuest single sign-on page behind a content delivery network, then called several employees by name to steer them towards it. One teammate entered a password and approved a push notification, handing the attacker a brief, view-only session on the identity dashboard; no applications or systems were accessed and no customer data was touched, the company said. ReliaQuest did not attribute the incident, but said the playbook matches tactics used by ShinyHunters and other extortion crews: an impersonation call, a throwaway lookalike domain burned within the hour, a harvesting page behind a content delivery network, MFA (multi-factor authentication, the extra code or prompt after a password) push abuse and a rapid attempt to enrol a new authenticator. ShinyHunters has since listed the company on its dark web portal, and ReliaQuest had said it was tracking a campaign using domains in a company[.]claims pattern, including reliaquest[.]claims.

Cisco Talos analysed JWR, an undocumented phishing framework that impersonates checkout and login pages of major payment and shopping platforms. Its client engine is operator-driven: rather than only logging what a victim types, it keeps an AES-CTR encrypted WebSocket open to the attacker, who can steer each session live. Talos says the data targeted goes well beyond payment details, covering identity documents, Social Security numbers, passport and driving licence images, website and PayPal credentials, two-factor codes and full device fingerprints, all committed to the attacker's server when a session ends, and assesses JWR as a variant of the Outsider phishing-as-a-service platform. Malwarebytes flagged 11 fake sites carrying Microsoft branding, some named SysScan, that run a convincing but fake security scan, tell the visitor their antivirus is causing problems, collect their information and prepare them for a supposed refund call. Fake sites advertising productivity software, among them Kitchen Canvas, Food or Meal Formula and DocConvertWizard, are distributing Electron-based applications that appear to work while abusing Electron interfaces to run injected scripts and capture the desktop.

Splunk detailed Phantom Stealer, which collects browser credentials, saved passwords, session cookies, cryptocurrency wallet files and detailed system fingerprints, and has been seen in campaigns across several countries, often spread through phishing lures, cracked software and links on Discord and Telegram; its modular design and low barrier to entry appeal to both novice and experienced criminals, Splunk says. Salat Stealer, written in Go, surveys a system, steals credentials and monitors victims through desktop streaming and audio or video capture. Point Wild described Vanta Stealer, a Python stealer with layered obfuscation that targets Chromium browsers, Discord, Telegram Desktop, Steam, Riot Games, Roblox, Minecraft, Mullvad VPN, cryptocurrency wallets and locally stored sensitive documents, and also collects authentication tokens, gaming data, VPN configurations, screenshots, webcam captures and files holding wallet recovery phrases or private keys. How it is delivered is not currently known; Point Wild lists phishing emails, fake installers, game cheats, fake software updates, SEO poisoning, malvertising and malicious code repositories as possibilities. Malicious LNK shortcut files disguised as PDF documents launch DARTHVADER Stealer through cmd.exe, legitimate Windows utilities, AutoIt and PowerShell, and DestinyStealer, which has targeted Europe and the United States and shows code continuity with StormKitty Stealer, gathers browser data, cookies, passwords, wallet extension storage, Outlook and VPN data, FileZilla credentials, Wi-Fi profiles and screenshots. Joe Security described ScarfaceStealer, spread through an Electron app masquerading as AI-related tools, which scores a host against 11 indicators and combines them into a weighted suspicion score: at 7 or higher it enters a decoy loop showing random message boxes, and only below 7 does execution continue, after a JavaScript loader, four further decryption layers and a piece of Windows code mapped and run from memory.

LevelBlue described CNCMachineRMS, a previously undocumented remote access trojan (RAT, software that gives an attacker control of a machine) delivered by BabaDeda Loader. Infection begins with a ClickFix lure, a fake prompt that tricks a user into pasting a command, and abuses the scripting engine of a legitimately signed IBM SPSS executable, WinWrapIDE.exe, to load a malicious library. Four decoy libraries load through ordinary Windows import resolution, then the final stage smuggles shellcode into execution through EnumTimeFormatsEx, a harmless date-formatting function. The troja