Intelligence Insights: August 2026

ClearFake ranked number one on the threat list for the fourth consecutive month, utilizing JavaScript injection into compromised websites to deliver malware via drive-by download and fake CAPTCHA lures. The threat landscape saw shifts in July 2026 with familiar threats reappearing, notable departures, and new entries. JustAskJacky returned in a tie for fourth by masquerading as PDF readers, which is its first appearance on the top ten since March 2026. Amber Albatross tied for sixth by progressing through stages to a PyInstaller EXE with stealer capabilities, a debut since March 2026. Atomic Stealer and NetSupport Manager fell out of the top ten for the first time since August 2025 and September 2024, respectively. Four new threats debuted on the list: GraphSpy in a tie for fourth, Phexia in a tie for sixth, CastleRAT in a tie for tenth, and EtherRAT in a tie for tenth.

The recurring presence of methods like drive-by downloads, fake CAPTCHA lures, and living-off-the-land techniques exemplified by ClearFake suggests an ongoing focus on exploiting user trust and automated interaction points to facilitate initial compromise. The emergence of new threats like GraphSpy signals a shift toward targeting the identity infrastructure itself, specifically abusing authentication tokens within enterprise systems for reconnaissance rather than purely exfiltrating data. Simultaneously, the rise of blockchain-based dead drop resolution employed by Phexia and EtherRAT indicates an evolutionary step in C2 communication, moving away from easily detectable static domains to ephemeral, distributed ledger technology for operational security. This pattern suggests adversaries are developing methods that increase resilience against traditional network-based blocking and signature detection by leveraging public infrastructure ubiquity. The cost of this evolution is placed on the defenders' ability to monitor and block interactions with these increasingly abstract C2 channels. What systems are in place to assess the risk associated with allowing applications to interact with external blockchain services for operational data retrieval, and how does the focus on ephemeral C2 infrastructure alter the calculus for network perimeter defense?