⚡ Weekly Recap: Hyper-V Malware, Malicious AI Bots, RDP Exploits, WhatsApp Lockdown and More

In the weekly recap, The Hacker News highlights that Curly COMrades, a threat actor aligned with Russia’s geopolitical aims, was observed abusing Microsoft’s Hyper-V hypervisor to hide an Alpine Linux VM and deploy payloads, a technique first noted in July 2025 that enables malware to run outside the host OS and evade detection, according to Bitdefender.

The article also covers a surge of RDP-related intrusions, with a Go-based ransomware called Cephalus breaching organisations by stealing credentials on non-M MFA-protected RDP accounts and then disabling security tools to enhance encryption success. On user protections, WhatsApp is set to roll out enhanced protections for high-risk accounts, offering features such as restricted media from unknown senders and extra verification measures.

The piece also reports a cybercrime merger, describing Scattered Spider, LAPSUS$, and ShinyHunters as forming a coordinated alliance to share tactics across 16 Telegram channels since August 2025. Additionally, the recap notes actors deploying malicious AI bots that impersonate legitimate agents to bypass detection and facilitate large-scale account takeovers, along with other trends threatening Linux, Windows, and Android ecosystems.