eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Abuse of Claude’s Content-Sharing Features for Malware Distribution
Bottom Line: Threat actors are abusing Claude's legitimate shared chat and artifact features to display ClickFix pages, tricking users into executing malicious commands and downloading malware.
On October 26th, 2026, Gen Digital published research on two malware campaigns that abused content-sharing features available on Anthropic's Claude platform. The attackers used Claude’s legitimate content-sharing features, Shared Chat and public Artifacts, to publish convincing fake “Download Claude” pages hosted on the real claude.ai domain. The campaigns were promoted through paid Google advertisements, allowing the malicious pages to appear prominently in search results for users seeking to download Claude software.
For macOS victims, the fake page presented a “Quick install via Terminal” dialog instructing users to copy and paste a command into Terminal. Once executed, a loader script retrieved a second-stage script, which in turn downloaded and ran an AppleScript-based Atomic macOS Stealer (AMOS) payload. Before stealing any data, the malware displays a fake macOS “Full Disk Access required” prompt and adds a line to the shell startup file if access is denied, waiting until it is eventually granted. Once granted, it shows a fake native-looking macOS System Preferences password prompt that will not dismiss until the user enters their actual, correct password, capturing it in cleartext. The stealer then harvests browser passwords and session cookies, Keychain decryption keys, browser-extension and desktop cryptocurrency wallets, and sensitive files packaging everything into a ZIP file for exfiltration before deleting its own traces. If Ledger Live, Ledger Wallet, or Trezor Suite are detected on the host, the malware additionally downloads and installs a trojanized replacement of that application over the legitimate copy.
Researchers also identified a separate campaign targeting Windows users that employed the same overall methodology. Here, the ClickFix lure instructs victims to paste content into the Windows Run dialog, executing a malicious PowerShell command. It retrieves a obfuscated .NET payload staged on a GitHub Pages subdomain. The resulting payload injects its code into a legitimate Windows process to hide from task managers, fingerprints installed antivirus products, captures periodic desktop screenshots and active window titles, and maintains a persistent connection to attacker infrastructure for ongoing remote command execution. It also searches for desktop cryptocurrency wallet applications and browser wallet extensions.
eSentire Threat Intelligence Analysis:
The techniques outlined by Gen Digital are not new, with similar campaigns having previously been reported on by both Trend Micro and Zscaler earlier in 2026. The continued use of malvertising to redirect users to malicious Claude pages demonstrates the potential effectiveness of the tactic when paired with ClickFix, at deploying malicious payloads. These attacks demonstrate that threat actors are abusing the trust that users place into Claude, likely amplified by pages being hosted on the legitimate Claude domain. Abuse of the Claude platform follows similar trends where threat actors have leveraged legitimate cloud storage, code repositories, and document sharing platforms to host malicious content.
Not only are attackers abusing the trust placed in AI platforms, but they are also leveraging the popularity of these tools to deliver malicious content via malvertising. Threat actors are leveraging paid search ads to push these malicious pages to the top of search results, so when users go looking to download AI tools, they are presented with these ads. This is not a novel technique, and will continue to be used in the future for popular applications and tools. To protect against these techniques, users should be educated on ClickFix, and on looking for warning labels on these types of pages, which can be used to identify user-generated or unverified content. Organizations should also provide users with a repository where approved tools can be safely downloaded from.
The PRC-Linked Silent Train Covert Network
Bottom Line: The Chinese APT group, Volt Typhoon, is using a covert, short-lived relay network of hijacked devices to compromise organizations and target downstream customers.
On October 28th, 2026, Lumen’s Black Lotus Labs published research describing “Silent Train,” a covert operational framework used by Volt Typhoon, a People’s Republic of China (PRC) state-sponsored threat actor. Silent Train was first observed in November 2023. Lumen distinguishes Silent Train from botnets, general-purpose proxy networks, and Operational Relay Box (ORB) networks, describing it instead as a layered, multi-hop relay system reserved specifically for the sensitive phases of an operation, including exploitation, credential access, data exfiltration, and ongoing engagement with already-compromised victims.
Volt Typhoon built its relay network by hijacking more than 27 different types of devices, ranging from ordinary home routers and modems to larger business networking and IT management equipment, as well as rented servers overseas used to disguise where the traffic was really coming from. Lumen found that some of these devices had no previously known security flaws. This suggests that Volt Typhoon used undisclosed vulnerabilities to compromise these devices.
To reach a target, the attackers route their connection through a chain of four to six hijacked devices. By traversing multiple compromised devices, threat actors obfuscate their location and device details, while also bypass geo-blocking and IP-reputation detections. Use of the network allows threat actors to maintain disposable infrastructure, that blends into standard victim traffic, as compromised devices match the victim's location.
Volt Typhoon’s underlying objective is to compromise organizations that can provide access to larger downstream networks, like endpoint and network management systems, software-defined wide area network (SD-WAN) orchestrators, and out-of-band management tools. These platforms already have administrative reach over many downstream devices and customer environments; compromising a single platform can grant access to downstream assets. In observed cases, Volt Typhoon using this access to harvest credentials and maintain trusted, persistent access into downstream customer environments, and identified log tampering and in-memory web shells in some intrusions. Targeted sectors include telecommunications providers, U.S. government networks, defense industrial base, satellite and mission-critical communications providers, Managed Service Providers (MSPs) and IT firms, universities, and critical infrastructure spanning water, energy, transportation, maritime, rail, aviation, and emergency services.
Lumen identified multiple zero-day exploits tied to the Silent Train framework. These include CVE-2025-8875 and CVE-2025-8876 in N-able N-central, CVE-2026-20127 in Cisco Catalyst SD-WAN, and CVE-2026-16812 in VeloCloud Orchestrator. Other known targeted platforms include Fortinet, Ivanti, F5, Check Point, Palo Alto Networks, ManageEngine, ServiceNow, and ArcGIS products.
eSentire Threat Intelligence Analysis:
By utilizing Silent Train, Volt Typhoon can obtain broad access to an organization’s customers or partners without the lateral movement activity that would typically generate detectable telemetry, making this a highly notable threat. Silent Train has likely been an effective tool for Chinese APT groups, as it has operated since late 2023, without being publicly reported on until now.
Volt Typhoon is a sophisticated threat actor with a history of targeting western organizations. In February 2024, CISA, the FBI, and the NSA, joined by international partner agencies, issued a warning that Volt Typhoon had been embedding itself inside U.S. power, water, transportation, and communications systems, in some cases for at least five years, without deploying obvious malware. That same winter, then-FBI Director Christopher Wray told a Congressional committee that the FBI had run a court-authorized operation to shut down a network of hijacked home and office routers, known as the “KV Botnet,” that Volt Typhoon was using to hide its activity. He warned that the group appeared to be positioning itself to “wreak havoc” on American infrastructure if a future conflict with China were to occur. This latest report suggests that, despite those earlier actions against the group's infrastructure, Volt Typhoon has continued to rebuild and evolve its hidden infrastructure.
Organizations should prioritize hardening and reducing the internet-facing footprint of network, endpoint, SD-WAN, and out-of-band management platforms, including reviewing their permissions and downstream trust relationships. Internet-facing administrative interfaces should be inventoried and minimized, with access restricted through VPNs, access control policies, or dedicated management networks. eSentire’s Threat Intelligence team continues to track Volt Typhoon and Silent Train related information for further developments and detection opportunities.
Help Desk Vishing Targets Canadian Firms
Bottom Line: The Canadian Centre for Cyber Security (CCCS) has released an advisory on an ongoing Vishing campaign impacting Canadian organizations, specifically those in the legal and finance industry.
On October 28th, 2026, the Canadian Center for Cyber Security (CCCS) published an advisory, warning Canadian organizations of an ongoing voice phishing (vishing) campaign, leading to data theft and extortion. CCCS states that throughout 2026, targets of the campaign have “shifted across sectors”, but since July 2026, have been “increasingly targeting finance and legal organizations”.
The campaign leverages IT support or help desk impersonation, where attackers call users via their personal phones, office phones, or Microsoft Teams. Threat actors use lures involving urgent passkey migration, Multi-Factor Authentication (MFA) enrollment, or password changes to direct victims to organization-branded Adversary-in-the-Middle (AiTM) sign-in pages. Credentials and MFA tokens entered on the landing page are relayed to the legitimate identity provider, granting the attackers access to an authenticated session and provide the users stolen credentials.
Once access is obtained, the attackers register new MFA methods or devices to maintain persistent access, and delete notifications relating to password changes, MFA enrollments, and other security notifications. Automated scripts are used to access and exfiltrate data from Microsoft 365 and connected Software-as-a-Service (SaaS) applications, such as SharePoint and OneDrive. Following data theft, the threat actors send extortion demands to the victim.
eSentire Threat Intelligence Analysis:
Although CCCS states that the identified tradecraft and infrastructure are “consistent with publicly reported operations by a financially motivated threat actor”, no specific threat actor is called out; only reporting from Google on UNC6671 and BlackFile are referenced. According to Google, BlackFile was a data extortion brand that UNC6671 operated under. However, in mid-2026, BlackFile retired its brand and diversified under the Redact, Pink, Helix, and Falcon “extortion fronts”. Despite the diversification and complicated attribution between UNC6671 and the various brands, the tradecraft used across these operations continue to involve vishing, impersonation, and data extortion.
CCCS highlights the focus shift of the identified campaign to firms in the legal and financial services fields. These sectors are often targeted by financially motivated attackers due to the type of data that they hold. These files could include information on mergers and acquisitions, litigation strategies, intellectual property, regulatory matters, financial records, payment details, and Personally Identifiable Information (PII). Due to the highly sensitive nature, threat actors may perceive this data as holding higher monetary value, or that these types of organizations are more willing to pay ransom demands to prevent stolen data exposure, and possible ramifications as a result.
Throughout 2026, eSentire's Threat Response Unit (TRU) has observed a significant increase in IT support impersonation attacks. When comparing the number of attacks from 2025 to 2026, eSentire identified twenty times more cases in 2026 when compared to the same period in 2025. The increase in these attacks can likely be attributed to their success rates, where eSentire observed a 72% success ratio in 2025. Based on observed instances, eSentire's Threat Intelligence team assesses with high confidence that IT support impersonation attacks will continue to persist, and evolve, into 2027. To protect against this threat, organizations should educate users on these tactics, and instruct employees to independently verify unexpected IT calls, regardless of caller ID or urgency; CCCS notes that threat actors have ended calls when victims attempted to conduct verification.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
