MicroScan and FishHub tool activity used for scanning, phishing, and exfiltration
Malware Activity
Summary
Hide ▲
Show ▼
MicroScan and FishHub were used to support vulnerability scanning, spear-phishing, and data exfiltration, expanding intrusion reach against critical infrastructure and other organizations worldwide. The tools were tied to a broader Flax Typhoon operation and infrastructure later disrupted by domain seizures. The activity also included follow-on malware delivery and unauthorized access to already compromised networks.
Related Happenings
FBI seizes Flax Typhoon hacking-tool domains
Law Enforcement
H score67
First: 09.10.2026 00:42
Last: 09.10.2026 00:42
Sources 1
How related:
The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide.
About this happening:
The FBI seized seven domains tied to Flax Typhoon's MicroScan and FishHub hacking tools, disrupting infrastructure used in breaches against critical infrastructure...
FBI seizes Flax Typhoon hacking-tool domains
Law EnforcementHow related: The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide.
About this happening: The FBI seized seven domains tied to Flax Typhoon's MicroScan and FishHub hacking tools, disrupting infrastructure used in breaches against critical infrastructure...
SocGholish malware downloader hijacking WordPress sites
Malware Activity
H score57
First: 18.06.2026 16:25
Last: 18.06.2026 16:25
Sources 1
About this happening:
SocGholish is a long-running JavaScript-based malware downloader also tracked as FakeUpdates that hijacks compromised WordPress sites to push fake browser update...
SocGholish malware downloader hijacking WordPress sites
Malware ActivityAbout this happening: SocGholish is a long-running JavaScript-based malware downloader also tracked as FakeUpdates that hijacks compromised WordPress sites to push fake browser update...
Chinese threat actor campaigns against Taiwanese critical infrastructure in 2025
Campaign
H score38
First: 07.01.2026 16:00
Last: 07.01.2026 16:00
Sources 1
How related:
The seized domains now display FBI seizure notices identifying the Flax Typhoon hacking group and Integrity Technology Group.
About this happening:
Chinese cyber threat actors intensified campaigns against Taiwanese critical infrastructure in 2025, pressuring energy, healthcare, communications, admin...
Chinese threat actor campaigns against Taiwanese critical infrastructure in 2025
CampaignHow related: The seized domains now display FBI seizure notices identifying the Flax Typhoon hacking group and Integrity Technology Group.
About this happening: Chinese cyber threat actors intensified campaigns against Taiwanese critical infrastructure in 2025, pressuring energy, healthcare, communications, admin...
Latest development: 09.10.2026 00:42
The FBI seized c0cc.cc, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net, and 98aiblog.com to disrupt Flax Typhoon and China-based Integrity Technology Group infrastructure supporting MicroScan and FishHub. The joint FBI-CISA-NSA advisory said MicroScan was used for vulnerability scanning, FishHub delivered additional malware and enabled data theft, and investigators found stolen data and files from more than 20 organizations, including six universities in Taiwan.
Timeline
-
09.10.2026 00:42 2 articles · 1h ago
FBI seizes seven domains used to run MicroScan and FishHub
Initial DisclosureThe FBI seized seven domains used by Flax Typhoon and China-based Integrity Technology Group to operate MicroScan and FishHub, and the FBI, CISA, NSA, and international partners issued a joint cybersecurity advisory describing how the tools and infrastructure were used to compromise organizations and steal sensitive information.
Show sources
- FBI disrupts Chinese hacking tools used to breach critical infrastructure — www.bleepingcomputer.com — 09.10.2026 00:42
- FBI disrupts Chinese hacking tools used to breach critical infrastructure — www.bleepingcomputer.com — 09.10.2026 00:42