186 TypoSquatted AI Domains Deliver ClickFix Lures, Net Guard Malware, and Search Hijacking Extensions

Europol and Partners Seize 257 Domains and 235 Servers in Major Operation Endgame Strike Against Gootloader, CastleRAT, and StealC

Europol and law enforcement agencies from nine countries have dismantled key infrastructure belonging to the Gootloader, CastleRAT, and StealC malware operations as part of Operation Endgame. The coordinated action resulted in the seizure of 257 domains and 235 servers while identifying 6.4 million victim datasets stolen from infected systems. Gootloader has been active since 2020 as a malware loader, StealC functions as an infostealer targeting credentials and cryptocurrency wallets, and CastleRAT is a remote access trojan first observed last year. Authorities noted that the stolen credentials were being sold for use in further attacks including ransomware deployments. Victim data will be shared through platforms such as HaveIBeenPwned to notify affected users, with specific advice issued to WordPress administrators. This marks the latest phase in a series of Operation Endgame actions that previously disrupted SocGholish, Amadey, Rhadamanthys, and multiple other malware families.

Threat Actors Deploy SCKit Malware Toolkit Through Compromised ConnectWise ScreenConnect Panels

A threat actor compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers in a coordinated campaign reported by Huntress. The attacks began on November 11 when unauthorized access to cloud-hosted ScreenConnect panels was used to execute commands on managed endpoints. At least six managed service providers and 288 hosts across 48 organizations were affected, with all compromised hosts hit within a 90-minute window. Attackers deployed rogue ScreenConnect clients along with the SCKit malware toolkit, which establishes persistent backdoor access, intercepts session cookies, and attempts self-replication by infecting technician workstations. The campaign exploited an authentication flaw in the third-party RMM+ extension for ScreenConnect versions 1.0.31 and 1.0.32, where an unconfigured access key defaulted to blank. ConnectWise responded by disabling five related extensions across approximately 400 environments, and both Huntress and ConnectWise released indicators of compromise.

Threat Actors Abuse Legitimate GSocket Tool for Stealthy Persistent Access on Linux Servers

Multiple threat actors have been observed abusing the open-source GSocket remote access tool to maintain long-term access to compromised Linux servers, even after initial vulnerabilities are patched. The tool enables attackers to bypass firewalls and NAT by routing traffic through the Global Socket Relay Network, where both the compromised host and the attacker initiate outbound connections. Microsoft Defender for Endpoint telemetry recorded a 356.2% increase in GSocket-related detections between March and August, with 87.1% of incidents targeting web applications and hosting environments. Attackers disguise GSocket as kernel threads and establish persistence via cron jobs, systemd services, and shell startup files. In some cases, they attempted to exploit the Dirty Frag Linux kernel vulnerability CVE-2026-43284 to escalate privileges. Most affected organizations belong to the education, research, technology, manufacturing, and government sectors. Defenders are advised to remove GSocket artifacts, restrict outbound traffic, and audit persistence mechanisms.