Global – October 31, 2026 -- The China-nexus adversary VAPOR PANDA used the agentic framework ARTEX to target more than 200 organizations worldwide, according to CrowdStrike OverWatch. The campaign paired the Chinese-developed DeepSeek large language model (LLM) with a second commercial LLM to run intrusions against multiple high-value targets in parallel. CrowdStrike calls it an escalation in China-nexus use of AI agents, from single intrusions to simultaneous engagements directed by one human operator.

Italy – October 19, 2026 -- A newer wave of the NFCShare Android banking trojan, active since 14 May 2026, ships APKs with malformed ZIP paths that can break automated extraction tools, D3 Labs researchers reported.

Europe – October 19, 2026 -- A new macOS infostealer dubbed ClickLock Stealer has targeted at least 100 victims across 33 countries since May 2026, with more than 50% of them in Europe, according to Group-IB Threat Intelligence.

Global – October 12, 2026 -- Incidents involving fake CAPTCHA lures rose 563% in 2025, according to the CrowdStrike 2026 Global Threat Report, as adversaries including STARDUST CHOLLIMA and VOODOO BEAR adopted the social engineering technique known as ClickFix.

ClickFix turns the victim into the execution mechanism

The attack shows a fake error, CAPTCHA or system message and tells the user to copy a command into the Windows Run dialog, PowerShell or Terminal. In some variants, malicious JavaScript places the command on the clipboard directly.

South Korea – October 12, 2026 -- CrowdStrike Intelligence has linked a late-September to early-October 2026 campaign against South Korean financial organizations, which resulted in exfiltrated data, to attacker servers that exposed Claude Code session histories, ARTEX configuration files and Claude memory files.