As reported by Security Affairs in their Malware Newsletter Round 113, the current threat landscape is undergoing a structural shift. The collection of research highlights spans infostealers targeting AI platform sessions, AI-assisted malware construction, ML detector evasion research, and continued nation-state RAT campaigns — a convergence that demands attention from defenders at every level.

Threat Alert: As reported by Security Affairs in their Malware Newsletter Round 113, the current threat landscape is undergoing a structural shift.

The AI Layer Is Now Both Target and Tool

Two stories in this roundup stand out for their strategic implications. First, infostealer malware is being used to harvest Claude login session tokens, enabling account takeover without credential reuse. Second, the Gryxa toolkit appears to be AI-built and — more concerningly — designed to observe how defenders remove it, learning from remediation to improve persistence.

The Claude session theft is not a one-off curiosity. As organizations integrate LLM-based assistants into workflows, those sessions carry access to proprietary prompts, internal data, connected integrations, and API surfaces. A stolen session cookie is as valuable as a cloud root token if the platform is wired into production systems.

Gryxa's anti-removal observation behavior represents a maturation in adversarial ML. Rather than simply evading detection, the malware adapts to the human analyst's response. This is behavioral defense-infection — and it should reshape how we think about incident response runbooks that assume static adversary tooling.

RATs and Delivery Innovation

Multiple campaigns in this newsletter illustrate that remote access trojans continue to be the workhorse payload for both cybercriminal and nation-state operators:

RATs and Delivery Innovation
ValleyRAT continues its evolution, now masquerading as adware — a delivery vector that bypasses user suspicion because it appears to be legitimate advertising software.
StreamRAT demonstrates the meta-ad-to-device-takeover pipeline, leveraging social media advertising infrastructure for initial access.
Mirage Kitten targets aviation and FinTech in the Middle East and Africa, showing that regional threat actors are expanding sector scope.
DPRK-linked actors deploy Ted backdoor and curlRAT against South Korean media and automotive sectors, reinforcing that Pyongyang's economic espionage remains relentless.

The common thread: initial access is increasingly through social engineering platforms users already trust — ads, package registries, app stores, and government-site SEO manipulation. Perimeter controls and endpoint prevention alone are insufficient when the delivery channel is a legitimate platform.

ML Detection Under Attack

Research on PhantomCall and REPLICANT highlights a growing body of work on evading ML-based malware detectors through function call graph perturbation and learned evasion policies. This is not theoretical — it means that the next generation of malware will be purpose-built to defeat the ML classifiers that many EDR vendors rely on.

Defenders who assume their ML-backed endpoint tools will catch novel malware are operating on an increasingly fragile assumption. Adversaries are already training against your detection model.

Shield53 Recommendations

  • Inventory AI session surfaces: Identify which employees use Claude, ChatGPT, Copilot, or similar platforms with enterprise or SSO-backed accounts. Enforce session timeout policies and consider session-bound MFA where the platform supports it.
  • Monitor for infostealer exposure: Subscribe to dark web credential leak monitoring and treat session token leaks with the same urgency as password breaches — force re-authentication on affected accounts immediately.
  • Layer detection, don't trust ML alone: Combine ML-based EDR with behavior analytics, fileless attack indicators, and network anomaly detection. Assume the ML model will eventually be bypassed.
  • Harden software supply chains: The Packagist theme and SEO-poisoned government site stories reinforce that package registries, CDN-served installers, and search results are all attack surfaces. Implement allowlists and signature verification for development dependencies.
  • Brief your IR team on adaptive malware: Run tabletop exercises assuming the adversary has observed your prior remediation steps. Vary your response patterns and document decoy artifacts to detect reconnaissance behavior.
  • Track DPRK and Chinese APT sector targeting: If your organization is in media, automotive, aviation, FinTech, or education in APAC or MEA, elevate threat hunting priorities for RAT families named in this round.

The throughline of this newsletter is that attackers are learning faster than defenders are adapting — not because defenders lack capability, but because the attack surface is expanding into AI platforms, trusted distribution channels, and ML detection itself. The organizations that treat this as a structural shift rather than a campaign cycle will be the ones still standing in twelve months.