Fire Ant TacTap and BridgeAgent malware activity on IOS XR and Linux hosts
Malware Activity
Summary
Hide ▲
Show ▼
The Fire Ant toolset added TacTap credential collection and a BridgeAgent Linux backdoor to its router-focused intrusion set, extending persistent access across Cisco IOS XR and Linux management hosts and increasing the risk of credential theft and packet capture.
Related Happenings
XCSSET v40 macOS malware activity via compromised Xcode projects
Malware Activity
H score30
First: 04.08.2026 22:03
Last: 04.08.2026 22:03
Sources 1
About this happening:
XCSSET v40 has resurfaced on macOS through compromised Xcode projects and GitHub repositories, putting thousands of users at risk of credential theft and data...
XCSSET v40 macOS malware activity via compromised Xcode projects
Malware ActivityAbout this happening: XCSSET v40 has resurfaced on macOS through compromised Xcode projects and GitHub repositories, putting thousands of users at risk of credential theft and data...
SHub Reaper macOS infostealer variant
Malware Activity
H score23
First: 19.05.2026 00:42
Last: 19.05.2026 00:42
Sources 1
About this happening:
The SHub Reaper macOS infostealer now uses AppleScript and a fake Apple security update lure to infect Macs, raising the risk of credential theft and remote access. It...
SHub Reaper macOS infostealer variant
Malware ActivityAbout this happening: The SHub Reaper macOS infostealer now uses AppleScript and a fake Apple security update lure to infect Macs, raising the risk of credential theft and remote access. It...
AVRecon malware for Linux powering SocksEscort proxy network
Malware Activity
H score19
First: 12.03.2026 18:19
Last: 12.03.2026 18:19
Sources 1
About this happening:
The AVRecon malware for Linux powered the SocksEscort proxy network, turning compromised Linux-based SOHO routers into traffic-routing nodes at scale. It was believed...
AVRecon malware for Linux powering SocksEscort proxy network
Malware ActivityAbout this happening: The AVRecon malware for Linux powered the SocksEscort proxy network, turning compromised Linux-based SOHO routers into traffic-routing nodes at scale. It was believed...
PromptSpy Android malware with Gemini-assisted persistence
Malware Activity
H score22
First: 19.02.2026 19:52
Last: 19.02.2026 19:52
Sources 1
About this happening:
PromptSpy is Android malware that uses Gemini in its execution flow to analyze the current screen and generate instructions for navigating the interface, helping the m...
PromptSpy Android malware with Gemini-assisted persistence
Malware ActivityAbout this happening: PromptSpy is Android malware that uses Gemini in its execution flow to analyze the current screen and generate instructions for navigating the interface, helping the m...
Atomic MacOS Stealer (AMOS) distribution through AI-app lures, SEO poisoning, and supply-chain abuse
Malware Activity
H score31
First: 12.02.2026 16:25
Last: 12.02.2026 16:25
Sources 1
About this happening:
Atomic MacOS Stealer (AMOS) is being distributed to macOS users through AI platform trust abuse, including Claude Artifacts, claude.ai/share links, and shared...
Atomic MacOS Stealer (AMOS) distribution through AI-app lures, SEO poisoning, and supply-chain abuse
Malware ActivityAbout this happening: Atomic MacOS Stealer (AMOS) is being distributed to macOS users through AI platform trust abuse, including Claude Artifacts, claude.ai/share links, and shared...
Timeline
-
31.08.2026 12:04 3 articles · 13d ago
Fire Ant extends into Cisco IOS XR routers and TACACS servers
Initial DisclosureSygnia disclosed a 2026 intrusion in which Fire Ant extended a long-running campaign beyond VMware hypervisors into Cisco IOS XR routers, TACACS servers, and Linux management hosts, using compromised routers to capture packet data, harvest credentials, and suppress logging and telemetry while deploying TacTap on TACACS systems and BridgeAgent on a tunnel-connected Linux host. The firm assessed overlap with UNC3886 reporting but did not make a conclusive attribution.
Show sources
- China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs — thehackernews.com — 31.08.2026 12:04
- China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs — thehackernews.com — 31.08.2026 12:04
- Chinese Fire Ant hackers turn Cisco routers into spying platforms — www.bleepingcomputer.com — 31.08.2026 17:52