This week's ThreatsDay bulletin from The Hacker News covers more than two dozen items, including active ransomware exploitation, a DNS-based crypto wallet drainer, and multiple new remote access trojans. The stories are largely unrelated, but together they illustrate the range of tactics now in use, from VPN access abuse to psychological harassment built into malware.
One of the most urgent items is the active exploitation of CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access, by the Qilin and Settra ransomware groups. ReliaQuest warns that because the access comes through an organization's own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft or ransomware deployment. The firm recommends patching, disabling authentication override cookies, terminating active GlobalProtect sessions, and investigating unexpected connections.
Separately, Infoblox analyzed a wallet-drainer kit called Noir that uses DNS TXT records to locate its backend pool, delivered via a loader that queries the TXT record through public DoH services. The drainer can operate without a seed phrase, password, or private key, instead tailoring content to the user after receiving read permissions and then obtaining spending permissions. The source suspects the malware was created with AI assistance.
The roundup also includes several new RATs. KGB RAT, marketed on underground forums, combines credential theft, keylogging, hidden desktop takeover, and ransomware with psychological harassment features such as jump scares and forced blue screens of death. Another, BotHelper RAT, enables live screen surveillance and patches the Antimalware Scan Interface. A third, CikaBika Bot, uses Discord for command-and-control and ngrok for data exfiltration.