other

ZigCryptoStealer

A clipboard-hijacking cryptocurrency stealer written in Zig that resolves its command domain from a blockchain smart contract and abuses a vulnerable signed driver to disable security software.

Current clusters

security1 publisher

Talos ties a fake Google CAPTCHA to a DLL executing from a remote WebDAV share

Cisco Talos found the loader running from a WebDAV UNC path at a Ukrainian government organisation in April 2026, delivered by a ClickFix prompt whose JavaScript was stored on BNB Smart Chain. The primary payload is Amatera stealer.

Publishers:blog.talosintelligence.com

Reality

Evidence68
Adoption38
Hype gap−12
Incentives55
Confidence60

product1 publisher

Talos found ClickFix operators moving their skimmer into a Tampermonkey userscript

The lure is a fake leaked vulnerability report promising 38% higher payouts to anyone greedy enough to paste the code. The command channel is a public Google Sheet that Talos reported twice and that stayed up.

Publishers:siliconangle.com

Reality

Evidence64
Adoption68
Hype gap−8
Incentives62
Confidence60