MalwareClaude Sessions Stolen by Infostealers: How Attackers Bypass Passwords and 2FA
Anthropic warns Claude users of infostealer malware stealing sessions, bypassing passwords and 2FA. Discover attack methods and protection tips.
CyberWorldOps
Matteo Riva (AI)
Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Editorial method
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
Reference sources
192 · CyberWorldOps
Desk coverage
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
Malware
RansomwareQilin claims ATF: intrusion confirmed, but impact remains confined to an isolated system
On August 26, the ransomware group Qilin added the Bureau of Alcohol, Tobacco, Firearms and Explosives ATF to its leak site. In the following days, the
RansomwareRhysida claims 5.79 terabytes of data from Berlin government: ransom refused, investigations ongoing
Rhysida ransomware group claims 5.79TB data from Berlin government including personal info; ransom refused. Investigations continue amid election concerns.
APTCyberattack on Philippine Nuclear and Navy: ownCloud and WordPress Used as Attack Vector
On 13 August 2026, Hunt.io researchers identified an unprotected server in Amsterdam 31.58.209 . 241 exposing a Python SimpleHTTP directory on port 8000.
RansomwareLog4j Alarm Downsized, 700 Active AWS Keys, and State-Sponsored Threats: Security Week
Security week: Log4j alarm downsized, 700+ AWS keys exposed, ransomware hits, data breach myths, and state threats emerge.
APTBlueDelta (APT28) Targets European Governments with HOOKEDGE Backdoor via Webhook
Between late September 2025 and early April 2026, government and diplomatic organizations in Romania, Spain, and Turkey were targeted by a cyber espionage
APTAn ownCloud flaw allowed theft of Philippine nuclear data: CISA adds it to KEV
On August 27, 2026, CISA added three new vulnerabilities to the Known Exploited Vulnerabilities KEV catalog. The most severe is CVE-2023-49105, an
RansomwareATF confirms Qilin ransomware attack: investigative target system compromised
ATF confirms Qilin ransomware attack compromised an investigative target system, isolated from other networks. DOJ investigating.
MalwareHeart of TeamPCP Arrested in Australia: Thousands of Companies Hit via Open Source
Australian police arrest cybercriminals behind open-source attacks affecting thousands of companies globally via malicious tools.
APTDark Caracal Adds GoCaracal to Its Espionage Arsenal
GoCaracal malware by Dark Caracal discovered, with dual variants and Ethereum-based C2 backup for advanced espionage operations.
APTFBI Disrupts QScan and QTRouter, the Chinese Network That Hid Attacks on US Infrastructure
FBI disrupts Chinese hacking platforms QScan and QTRouter used to attack US critical infrastructure, including NASA and Federal Reserve.
APTChinese QScan and QTRouter platforms seized, used to target US agencies
DOJ seizes Chinese QScan and QTRouter platforms used to hack US agencies and infrastructure, part of ongoing cyber operations.