ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories

This ThreatsDay Bulletin summarizes multiple active cyber threats observed in October 2026, including malicious VS Code themes and extensions that deliver obfuscated downloaders, supply-chain compromises of npm and RubyGems packages that harvest credentials and spawn backdoors/worms, ongoing malware campaigns (VulcanRAT, BraZetsu) with traced C2 infrastructure, ransomware affiliate theft and data publication, phishing campaigns abusing legitimate services (Power BI, WhatsApp) to deliver RATs and RMM tools, a file-upload vulnerability used to install web shells, systemic weaknesses (predictable session cookies, limited PQC support in medical devices), exposed attacker tooling on a public server, and law-enforcement actions against scam operations and alleged ransomware actors.