Share on X

ZeroFox Weekly Intelligence Brief – April 25, 2026

ZeroFox’s Weekly Intelligence Briefing highlights the major developments and trends across the threat landscape, including digital, cyber, and physical threats. ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 6:00 AM (EST) on April 23, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Read the Brief

View the full report here

Group Claims Unauthorized Access to Anthropic’s Claude Mythos

What we know:

Anthropic is reportedly investigating claims of unauthorized access to its Claude Mythos model via a third-party vendor.
On a private Discord channel, a group claimed it accessed the restricted cybersecurity artificial intelligence (AI) tool, reportedly presenting screenshots and live demonstrations of the platform as evidence.

“Contagious Interview” Evolves into Self-Propagating Supply Chain Threat

What we know:

The North Korea-linked “Contagious Interview” campaign has evolved into a worm-like supply chain attack, wherein compromised developer repositories propagate malware via malicious Visual Studio Code task configurations.
Infected projects on platforms such as GitHub spread remote access trojans and payloads downstream, turning each new victim into a distributor across the software ecosystem.

Four Malware Families Hit Finance Sector

What we know:

Four new Android malware families—RecruitRat, SaferRat, Astrinox, and Massiv—are being deployed in separate campaigns to steal sensitive data from over 800 banking and cryptocurrency apps.
These campaigns use overlays, keylogging, and real-time one-time password (OTP) interception to steal credentials and bypass security.