net.webclient

Title/body text match only.

• InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise

  InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise Targeting multiple industries worldwide, the InstallFix campaign uses fake Claude AI installer pages to trick users into running malware that collects system information, disables security features, achie

• GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use

  GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use Introduction In the final quarter of 2025, Google Threat Intelligence Group (GTIG) observed threat actors increasingly integrating artificial intelligence (AI) to acceler

• DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

  DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy Key Points The Gentlemen RaaS The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around mid‑2025. The operators advertise their services across multiple underground f

• Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud

  Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud In this blog entry, researchers from the TrendAI™ MDR team discuss how they mapped the full end-to-end operation of SHADOW-WATER-063’s Banana RAT banking malware by analyzing server-side artifacts and victi

All reports →