Termite ransomware breaches linked to ClickFix CastleRAT attacks
2026-03-08T13:23:35Z•89f9f056e6b148d36b2ae6a5703023815ad849feabe8b00e54fa66e3055400d1
AI-assisted attacksCISACastleRATChinese APTClickFixCoruna exploit kitDonutLoaderGitHub abuseInstallFixJavaScript wormMicrosoft AIOpenClawTriZettoUAT-9244Velvet TempestWikipediadata breachhealthcare breachiOS vulnerabilitiesinfostealerransomwaretelecom targetingweb wormwordPress vulnerabilityzero-day exploitation
What happened
A range of active threats and incidents were reported: ransomware group Velvet Tempest is using ClickFix social-engineering and legitimate Windows tools to deploy DonutLoader and CastleRAT; a new InstallFix/ClickFix social-engineering wave is pushing infostealers and proxy malware via fake install guides; a fake OpenClaw GitHub campaign and Bing AI promotion distributed info-stealers. Large breaches and compromises include a TriZetto/Cognizant breach exposing ~3.4M patients, an FBI investigation into a breach affecting surveillance/wiretap systems, and multiple exploited vulnerabilities (noted
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 89f9f056e6b148d36b2ae6a5703023815ad849feabe8b00e54fa66e3055400d1
- Enrichment time
- 2026-03-08T13:23:35Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.