Our coverage: 21 reports since October 8, 2026. Latest: Attackers exploit Discord and Ngrok for CikaBika Bot command‑and‑control, October 18, 2026.
Darktrace notes the malware collects system data, captures screenshots, and the PowerShell script attempts to copy the Rust DLL into Microsoft Edge's installation folder and rename it dbghelp.dll.
The MALFEX campaign has used the package to deliver a loader that downloads encrypted shellcode from GitHub on Windows systems.
Complaints surfaced in three Reddit threads describing unauthorized audio and video capture.
Citizen Lab confirms AdFection as the first zero-click spyware delivery method via ads, linked to 45 infected Al Jazeera devices between 2024 and 2025
The spyware required no interaction from victims and was delivered through an israeli ad tech platform
Abdulrahman Alfozan, a 35‑year‑old Saudi engineer at OpenAI, was arrested last Friday on charges of intercepting communications after a hidden recording device was found in a San Francisco conference room
The operation, designated CL‑UNK‑1211, occurred between October 2025 and April 2026 and involved AI‑created payloads that held conversational comments and reasoning notes, showing LLM‑assisted code generation.
According to Security Affairs and TechCrunch, Alfozan is a 35‑year‑old Saudi national who joined OpenAI’s product team in July 2025.
According to Malwarebytes and 404 Media, the Los Angeles Police Department and the Miami-Dade Sheriff's Office have obtained access to the Raven tool for investigative work.
Flock operates more than 100,000 cameras that automatically read license plates across the United States.
OpenAI said it used its own internal AI models to analyze the device and identify the employee who placed it.
OpenAI terminated Alfozan’s employment after the device was found.