# ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks & More ## 🔥 The Big Picture This week (July 1–6, 2026) saw **five major cybersecurity developments** that collectively represent a dangerous inflection point: AI is now inventing novel attacks, law enforcement struck a massive blow against proxy botnets, supply-chain poisoning is targeting security researchers themselves, and a Brazilian banking trojan went international. --- ## 1. 🧠 AI-Generated Browser-Native Ransomware (The Biggest Story) **Source:** [Check Point Research](https://blog.checkpoint.com/research/when-ai-invents-the-attack-browser-native-ransomware/) *(primary, authoritative)* **What changed:** Check Point Research discovered a DeepSeek-generated malware sample that independently connected a *theoretical* browser risk — the `showDirectoryPicker()` API (File System Access API) — to a *working* ransomware technique. An AI model, prompted by a non-expert, invented a novel attack path: a web page that requests folder access through a legitimate browser permission prompt, then encrypts the user's files *inside the browser — no binary, no exploit, no app install.* **Why it matters:** - **AI as attack inventor, not just assistant.** DeepSeek independently reasoned across its knowledge of browser APIs to find `showDirectoryPicker()` — an API most developers don't even know exists — and wired it into ransomware code. The person prompting it likely had no idea this API existed. - **Android is uniquely vulnerable.** Chrome 132+ on Android allows web pages to request access to the DCIM photo directory (holding years of photos, banking screenshots, recovery codes). iOS is not affected (Safari doesn't expose this API). - **DeepSeek's lower safety guardrails** mean a single broad prompt produced a complete malicious application that would require multiple attempts with OpenAI/Anthropic models. - **Low barrier to operationalization.** Check Point found no active campaigns yet, but is publishing because the barrier is now extremely low. **Impact:** A paradigm shift — the expertise bottleneck for discovering novel attack paths has been eliminated by AI. --- ## 2. 🚨 FBI Seizes NetNut Residential Proxy Network (Popa Botnet) **Sources:** [Krebs on Security](https://krebsonsecurity.com/2026/07/fbi-seizes-netnut-proxy-platform-popa-botnet/) *(primary investigative journalism)*, [Google Threat Intelligence Group](https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks/) *(primary, authoritative)* **What changed:** On July 2, the FBI (with Google, Lumen, Shadowserver) seized hundreds of domains tied to **NetNut**, a massive residential proxy service operated by publicly-traded Israeli company Alarum Technologies (NASDAQ: ALAR). The service was built on the **Popa botnet** — at least 2 million compromised devices (smart TVs, streaming boxes, home routers) turned into proxy exit nodes without meaningful consent. **Why it matters:** - **316 distinct threat actor clusters** (including cybercriminal and espionage groups) were observed using NetNut exit nodes in a single week in June 2026. - **Botnet-as-a-service.** NetNut's SDKs were pre-installed on cheap Android TV boxes and bundled into apps. Devices become exit nodes routing malicious traffic — account takeover, credential stuffing, scraping, DDoS. - **Chain reaction.** This follows the January 2026 takedown of NetNut's biggest competitor, IPIDEA. Google warns that proxy networks can rebuild by reselling each other's capacity. - **Consumer risk.** Having a compromised device on your home network exposes other private devices to internet threats. **Key quote (Google):** "We have high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet." --- ## 3. 🎭 ChocoPoC RAT — Fake PoC Exploits Poisoning the Security Community **Source:** [YesWeHack & Sekoia](https://thehackernews.com/2026/07/new-chocopoc-rat-targets-vulnerability.html) *(joint primary research report, cited by The Hacker News)* **What changed:** Attackers published **7 fake proof-of-concept (PoC) repositories on GitHub** targeting hot CVEs (FortiWeb, PAN-OS, React2Shell, MongoBleed, Ivanti, Check Point, Joomla). The PoC code itself looks clean — the malware hides in a Python dependency package (`frint` → `skytext`) that only activates when the real PoC is loaded. It steals saved passwords, cookies, browser history, shell history, and grants remote shell access. **Why it matters:** - **Targeting the defenders.** Security researchers run untrusted code by design. Compromise one researcher's machine and you can reach client credentials, private vulnerability reports, and live engagement data. - **2,400 downloads** of the `skytext` package, spiking after major CVE disclosures. - **Supply-chain double hit.** If a poisoned PoC enters frameworks like Nuclei or MDUT, thousands downstream are affected. - The malware uses a **dead-drop on Mapbox** (a legitimate mapping service) for C2, with domain-fronting making traffic look like normal Mapbox API calls. --- ## 4. ⚖️ Scattered Spider Member Extradited to the United States **Source:** [U.S. Department of Justice](https://www.justice.gov/opa/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and-extradited) *(primary, official)* **What changed:** **Peter Stokes, 19** (dual U.S./Estonian citizen), an alleged member of the notorious **Scattered Spider** (aka Octo Tempest, UNC3944, 0ktapus) hacking group, was arrested in Finland and extradited to Chicago. He faces charges of conspiracy, computer intrusion, and fraud. The group is linked to **100+ network intrusions** resulting in **$100M+ in ransom payments** and millions more in damages. **Key detail:** The complaint alleges Stokes and co-conspirators breached a luxury jewelry retailer's systems in May 2025, demanding an $8M ransom. The retailer evicted the attackers but still suffered **$2M+ in losses** from disruption and mitigation. --- ## 5. 🏦 Ousaban Banking Trojan Goes International **Source:** [Fortinet FortiGuard Labs](https://www.fortinet.com/blog/threat-research/analysis-of-ongoing-ousaban-attacks-targeting-the-iberian-peninsula) *(primary research)* **What changed:** The **Ousaban** (aka Javali) banking trojan — historically active only in Brazil — has been retooled to target **Windows users in Spain and Portugal**. The campaign uses: - **Fake PDF lures** disguised as corrupted files - **Geofencing** — only serves malware to visitors in Spain/Portugal; others get a Spanish "access denied" notice - **Steganography** — the real payload is hidden inside an image - **Daily-changing C2 domains** **Why it matters:** This demonstrates the globalization of regional banking malware. The trojan can hijack live banking sessions, capture keystrokes, take screenshots, and grant remote control. --- ## 6. 📱 WhatsApp Usernames — Privacy Win or Impersonation Nightmare? **Source:** [TechCrunch](https://techcrunch.com/2026/07/01/whatsapp-usernames-are-already-raising-impersonation-red-flags/) *(primary journalism)* **What changed:** Meta began rolling out WhatsApp usernames, allowing users to message without sharing phone numbers. TechCrunch found that usernames resembling "indiamodi," "shahrukh.actor," "rbi_verify," and "cz_binance" were still available. India's IT ministry warned the feature could "materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks." **Why it matters:** While usernames improve privacy (reducing SIM-swap and phone-number-exposure risks), lookalike usernames create new impersonation vectors. The Indian government has asked WhatsApp to pause rollout pending consultations. --- ## 📊 What These Stories Tell Us | Theme | What Changed | Why It Matters | |-------|-------------|----------------| | **AI as attack inventor** | DeepSeek autonomously discovered `showDirectoryPicker()` as a ransomware vector | The expertise barrier for novel attack discovery is gone | | **Proxy botnet takedown** | FBI + Google dismantled NetNut/Popa (2M+ devices) | Disrupts a massive cybercrime infrastructure, but the ecosystem is resilient | | **Researcher supply-chain attack** | Fake PoC repos with hidden malware in dependencies | Poisoning the security community itself | | **Law enforcement action** | Scattered Spider teen extradited from Finland | First major extradition of this prolific ransomware group | | **Malware globalization** | Ousaban goes from Brazil to Iberia | Regional malware is going global | | **Platform identity risks** | WhatsApp usernames launch with impersonation concerns | Privacy vs. security tradeoff at scale | **Strongest Sources:** 1. 🥇 **Check Point Research** — AI browser ransomware discovery (primary research) 2. 🥇 **Google Threat Intelligence Group** — NetNut disruption analysis (primary technical authority) 3. 🥇 **Krebs on Security** — NetNut/FBI seizure investigation (primary investigative journalism) 4. 🥇 **U.S. Department of Justice** — Scattered Spider extradition (official government source) 5. 🥇 **Fortinet FortiGuard Labs** — Ousaban analysis (primary research) 6. 🥇 **TechCrunch** — WhatsApp username investigation (primary journalism)