Lazarus APT unveils fileless remote access Trojan designed to evade detection

Feed roundup (May 24–26, 2026): North Korea-linked Lazarus is deploying a stealthy memory-only, fileless remote-access Trojan to evade detection. A patched Ghost CMS flaw (CVE-2026-26980) is being actively exploited to push ClickFix attacks across 700+ unpatched sites, and a ClickFix-based malware campaign also impacted the FBI director’s merchandise site (used to host a fake Cloudflare page). A healthcare third-party breach at The Oncology Institute exposed patient information; a threat actor is selling a reconstructed 340 million OnlyFans-related profiles dataset built from prior leaks and公开