[REVISION HISTORY]

Phishing and cyber scam escalation

Updated 22 times since CLSTR started tracking revisions of this situation.

What changed

2026-09-12 05:12 UTC → 2026-09-15 06:21 UTC · added ~~removed~~

The cyber-threat landscape continues to evolve through the integration of artificial intelligence and the exploitation of seasonal digital activity. AI-powered phishing has reportedly increased by 341% over a six-month period, with attackers utilizing AI-generated content to enhance credibility. This technological shift has reduced the average time between initial system access and lateral movement to 29 minutes. Notably, 82% of 2025 detections did not involve traditional malware, as attackers increasingly use valid credentials and legitimate administrative tools. Recent developments show a shift toward more autonomous threats. The Google Threat Intelligence Group (GTIG) documented the use of agentic AI, including an autonomous multi-agent framework that compromised cloud infrastructure to manage 23,800 sensitive data records in under six hours. Furthermore, researchers identified a new generation of phishing where malicious websites are generated directly within a user's browser using AI. In vulnerability research, OpenAI reported that its GPT-6 Astra model demonstrated the ability to independently identify zero-day exploits in test environments. Threat actors are further automating attack lifecycles using multi-agent AI frameworks for tasks such as vulnerability scanning and credential harvesting. Anthropic reported that the Russian threat actor Midnight Blizzard utilized Claude AI to automate operations targeting military and diplomatic organizations across Ukraine, Europe, and the United States. Technical exploitation is ~~also~~ advancing through specialized ~~kits.~~ kits and social engineering. The ‘BlueMoon’ exploit kit leverages a patch-gap window to chain three V8 vulnerabilities (CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880) to achieve SYSTEM-level access on Windows systems. This ~~kit has been~~ kit, adopted by espionage-motivated ~~clusters, including~~ clusters like TA412 (APT31), ~~and~~ utilizes a malicious extension named GemStone—masquerading as Google Gemini—to perform keystroke logging and credential theft. ~~Social engineering tactics are~~ New distribution methods have also ~~expanding. Scammers are weaponizing copyright reporting mechanisms on platforms~~ emerged. BlueVoyant reported attackers using social engineering via Microsoft Teams to trick users into granting remote access through tools like ~~Instagram~~ Quick Assist, utilizing DLL sideloading via manipulated zlib.dll files to ~~file false claims against creators,~~ trigger the FireClient backdoor. Additionally, Barracuda Networks identified a novel phishing technique that bypasses web filters by generating fake login pages using ~~Telegram to demand payments. In India, creators have approached~~ Blob URLs directly in the ~~Delhi High Court regarding these blackmail tactics.~~ victim's browser memory, making them invisible to standard URL blocklists.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.