Sophos Counter Threat Unit researchers identified an underground advertisement for Luciferus on August 24, 2026, and found that its "uncensored" AI service returned Python remote-access-trojan code ...
On September 15, CrowdStrike published research on PhantomRaven, a JavaScript information stealer it says was distributed through malicious npm packages by a financially motivated bug bounty hunter.