Gen Digital found the chain while working a live UNC3569 intrusion. Tencent's April 2026 fix closed the link handler and left the bundled Chromium 80 in place, with its sandbox still switched off in the code.
Perspective Coverage
3 publishers
- Builder
- Builder 40%
- Operator
- Operator 50%
- Investor
- Investor 10%
Reality
- Evidence68
- Adoption72
- Hype gap+20
- Incentives40
- Confidence70
Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
6 publishers
- Builder
- Builder 28%
- Operator
- Operator 62%
- Investor
- Investor 10%
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+10
- Incentives45
- Confidence60
Chainalysis says writes of malware instructions to public blockchains have climbed from about 2.06 a day to 11.1 since July 2025, with groups tied to North Korea and Iran behind most of the increase. Its research lead could not confirm AI models helped.
Reality
- Evidence42
- Adoption48
- Hype gap+30
- Incentives68
- Confidence40
Group-IB says it found Tortoiseshell infrastructure on British IPs, plus Belgium, Saudi Arabia and the UAE. It also says the server names alone do not prove who was being targeted.
Perspective Coverage
3 publishers
- Builder
- Builder 38%
- Operator
- Operator 50%
- Investor
- Investor 12%
Reality
- Evidence64
- Adoption42
- Hype gap+16
- Incentives66
- Confidence61
Anthropic says an AI agent did 80% to 90% of the work in a campaign against roughly 30 companies. CrowdStrike puts average breakout time at 29 minutes. Verification cadence is now the control.
Reality
- Evidence34
- Adoption48
- Hype gap+30
- Incentives68
- Confidence38