CTM360 reports that more than 4,000 malicious Google Groups and 3,500 Google-hosted URLs are being used in an active malware campaign targeting global organizations.

The attackers abuse Google’s trusted ecosystem to distribute credential-stealing malware and establish persistent access on compromised devices.

The activity is global, with attackers embedding organization names and industry-relevant keywords into posts to increase credibility and drive downloads.

Read the full report here: https://www.ctm360.com/reports/ninja-browser-lumma-infostealer

How the campaign works

The attack chain begins with social engineering inside Google Groups. Threat actors infiltrate industry-related forums and post technical discussions that appear legitimate, covering topics such as network issues, authentication errors, or software configurations

Within these threads, attackers embed download links disguised as: “Download {Organization_Name} for Windows 10”

To evade detection, they use URL shorteners or Google-hosted redirectors via Docs and Drive. The redirector is designed to detect the victim’s operating system and deliver different payloads depending on whether the target is using Windows or Linux

 

Windows Infection Flow: Lumma Info-Stealer

For Windows users, the campaign delivers a password-protected compressed archive hosted on a malicious file-sharing infrastructure

Oversized archive to evade detection

The decompressed archive size is approximately 950MB, though the actual malicious payload is only around 33MB. CTM360 researchers found that the executable was padded with null bytes — a technique designed to exceed antivirus file-size scanning thresholds and disrupt static analysis engines.

AutoIt-based reconstruction

Once executed, the malware:

• Reassembles segmented binary files.

• Launches an AutoIt-compiled executable.

Advertisement

• Decrypts and executes a memory-resident payload.

The behavior matches Lumma Stealer, a commercially sold infostealer frequently used in credential-harvesting campaigns

Observed behavior includes:

• Browser credential exfiltration.

• Session cookie harvesting.

• Shell-based command execution.

Advertisement

• HTTP POST requests to C2 infrastructure (e.g., healgeni[.]live).

• Use of multipart/form-data POST requests to mask exfiltrated content.

CTM360 identified multiple associated IP addresses and SHA-256 hashes linked to the Lumma-stealer payload.

Linux Infection Flow: Trojanized “Ninja Browser”

Linux users are redirected to download a trojanized Chromium-based browser branded as “Ninja Browser.”

The software presents itself as a privacy-focused browser with built-in anonymity features.

However, CTM360’s analysis reveals that it silently installs malicious extensions without user consent and implements hidden persistence mechanisms that enable future compromise by the threat actor.

Malicious extension behavior

A built-in extension named “NinjaBrowserMonetisation” was observed to:

• Track users via unique identifiers

• Inject scripts into web sessions

• Load remote content

• Manipulate browser tabs and cookies

Advertisement

• Store data externally

The extension contains heavily obfuscated JavaScript using XOR and Base56-like encoding

While not immediately activating all embedded domains, the infrastructure suggests future payload deployment capability.

Silent persistence mechanism

CTM360 also identified scheduled tasks configured to:

• Poll attacker-controlled servers daily

• Silently install updates without user interaction

Advertisement

• Maintain long-term persistence

Additionally, researchers observed that the browser defaults to a Russian-based search engine named “X-Finder” and redirects to another suspicious AI-themed search page

The infrastructure appears tied to domains such as:

• ninja-browser[.]com

• nb-download[.]com

Advertisement

• nbdownload[.]space

Campaign Infrastructure & Indicators of Compromise

CTM360 linked the activity to infrastructure, including:

IPs:

• 152.42.139[.]18

• 89.111.170[.]100

C2 domain:

Multiple SHA-256 hashes and domains associated with credential harvesting and info-stealer distribution were identified and are available in the report.

Risks to organizations

Lumma Stealer risks:

Ninja Browser risks:

• Silent credential harvesting

• Remote command execution

• Backdoor-like persistence

Advertisement

• Automatic malicious updates without user consent

Because the campaign abuses Google-hosted services, the attack bypasses traditional trust-based filtering mechanisms and increases user confidence in malicious content.

Defensive recommendations

CTM360 advises organizations to:

• Inspect shortened URLs and Google Docs/Drive redirect chains.

• Block the IoCs at firewall and EDR levels.

Advertisement

• Educate users against downloading software from public forums/sources without verification.

• Monitor scheduled task creation on endpoints.

• Audit browser extension installations.

The campaign highlights a broader trend: attackers are increasingly weaponizing trusted SaaS platforms as delivery infrastructure to evade detection.

About the Research

The findings were published in CTM360’s February 2026 threat intelligence report, “Ninja Browser & Lumma Infostealer Delivered via Weaponized Google Services”

CTM360 continues to monitor this activity and track related infrastructure.

Read the full report here: https://www.ctm360.com/reports/ninja-browser-lumma-infostealer

Detect Cyber Threats 24/7 with CTM360

Monitor, analyze, and promptly mitigate risks across your external digital landscape with the CTM360.

Join our Community Edition

Sponsored and written by CTM360.

In the scramble for the interface, Glean is betting on something less visible: becoming the intelligence layer beneath it. 

Seven years ago, Glean set out to be the Google for enterprise — an AI-powered search tool designed to index and search across a company’s SaaS tool library, from Slack to Jira, Google Drive to Salesforce. Today, the company’s strategy has shifted from building a better enterprise chatbot to becoming the connective tissue between models and enterprise systems.

“The layer we built initially – a good search product – required us to deeply understand people and how they work and what their preferences are,” Jain told TechCrunch on last week’s episode of Equity, which we recorded at Web Summit Qatar. “All of that is now becoming foundational in terms of building high quality agents.”

He says that while large language models are powerful, they’re also generic. 

“The AI models themselves don’t really understand anything about your business,” Jain said. “They don’t know who the different people are, they don’t know what kind of work you do, what kind of products you build. So you have to connect the reasoning and generative power of the models with the context inside your company.”

Glean’s pitch is that it already maps that context and can sit between the model and the enterprise data. 

The Glean Assistant is often the entry point for customers — a familiar chat interface powered by a mix of leading proprietary (ie, ChatGPT, Gemini, Claude) and open-source models, grounded in the company’s internal data. But what keeps customers, Jain argues, is everything underneath it. 

First is model access. Rather than forcing companies to commit to a single LLM provider, Glean acts as the abstraction layer, allowing enterprises to switch between or combine models as capabilities evolve. That’s why Jain says he doesn’t see OpenAI, Anthropic, or Google as competition, but rather as partners. 

“Our product gets better because we’re able to leverage the innovation that they are making in the market,” Jain said. 

Second are the connectors. Glean integrates deeply with systems like Slack, Jira, Salesforce, and Google Drive to map how information flows across them and enable agents to act inside those tools. 

And third, and perhaps most important, is governance. 

“You need to build a permissions-aware governance layer and retrieval layer that is able to bring the right information, but knowing who’s asking that question so that it filters the information based on their access rights,” Jain said. 

In large organizations, that layer can be the difference between piloting AI solutions and deploying them at scale. Enterprises can’t simply load all their internal data into a model and create a wrapper to sort out the solutions later, says Jain. 

Also critical is ensuring the models don’t hallucinate. Jain says its system verifies model outputs against source documents, generates line-by-line citations, and ensures that responses respect existing access rights. 

The question is whether that middle layer survives as platform giants push deeper into the stack. Microsoft and Google already control much of the enterprise workflow surface area, and they’re hungry for more. If Copilot or Gemini can access the same internal systems with the same permissions, does a standalone intelligence layer still matter?

Jain argues enterprises don’t want to be locked into a single model or productivity suite and would rather opt for a neutral infrastructure layer rather than a vertically integrated assistant.

Investors have bought into that thesis. Glean raised a $150 million Series F in June 2025, nearly doubling its valuation to $7.2 billion. Unlike the frontier AI labs, Glean doesn’t need massive compute budgets.

“We have a very healthy, fast-growing business,” Jain said.

Apple’s next major iPhone update may quietly deliver one of the most practical upgrades users have been asking for: better battery life. While much of the spotlight this year is expected to shine on artificial intelligence, iOS 27 is shaping up to be just as much about cleaning house as it is about adding flashy new features, as revealed by Mark Gurman in the latest edition of Bloomberg Power On Newsletter.

A smarter, leaner iPhone experience

When Apple rolls out its operating system updates this fall, it will be juggling two major priorities. The first is the integration of AI across the platform, led by a revamped, chatbot-style Siri designed to compete more aggressively with generative AI offerings from rivals. The second – and arguably more foundational – is an internal overhaul of iOS itself.

Over the years, iOS has grown increasingly complex, layered with legacy code and feature additions that have made the system heavier under the hood. With iOS 27, Apple is attempting a reset of sorts. The effort has been compared to the company’s Snow Leopard era on the Mac, when it focused less on new features and more on refining performance and stability.

Engineers are removing scraps of old code

They are rewriting existing features and subtly upgrading apps to improve efficiency. The goal is a snappier, more responsive operating system. Apple is also planning minor interface tweaks, though they won’t be as dramatic as last year’s “Liquid Glass” redesign.

The project, internally code-named “Rave,” is also expected to bring efficiency improvements that could translate into better battery life. Rather than relying on bigger batteries or new hardware, Apple is aiming to squeeze more endurance out of existing devices through smarter code. If successful, these optimizations could reduce background activity, improve power management and extend daily usage time.

Battery life remains one of the biggest pain points for smartphone users. Even incremental gains can make a noticeable difference – whether it’s making it through a full workday without reaching for a charger or squeezing in extra streaming time during travel.

Importantly, these improvements would benefit a wide range of existing iPhone users, not just those upgrading to new hardware. Software-level optimizations can extend the practical lifespan of devices, something that aligns with Apple’s broader messaging around sustainability and long-term support.

At the same time, Apple’s AI push risks increasing system demands. More advanced on-device processing and contextual awareness features could strain performance and battery if not carefully managed. By cleaning up the operating system in parallel, Apple appears to be preparing a stronger foundation for heavier AI workloads.

The timing of iOS 27’s overhaul is also strategic

Apple is reportedly preparing to debut new device categories, including a touch-screen MacBook Pro and its first foldable iPhone. A leaner, more stable operating system will be critical to ensuring those products deliver a smooth experience from day one.

Beyond performance, Apple needs iOS 27 to help restore confidence in its AI roadmap. The company has been playing catch-up in the generative AI race, and delivering a more intelligent yet reliable operating system will be key to regaining ground.

Whether Apple markets battery gains as a headline feature or treats them as a quiet bonus remains unclear. But if iOS 27 succeeds in trimming excess code while enhancing AI capabilities, users may find their iPhones not only smarter – but longer-lasting, too.

India has 100 million weekly active ChatGPT users, making the country one of OpenAI’s largest markets globally, CEO Sam Altman said ahead of a government-hosted AI summit.

On Sunday, Altman outlined ChatGPT’s growing adoption in India in an article published in the Indian English daily Times of India, as OpenAI prepares to formally participate in the five-day India AI Impact Summit in New Delhi, beginning Monday. Altman is attending the event alongside senior executives from several of the world’s leading AI companies.

The growth comes as OpenAI, like other leading AI firms, looks to India’s young population and its more than a billion internet users to fuel global expansion. The ChatGPT maker opened a New Delhi office in August 2025 after months of groundwork in the country, and has adjusted its approach for India’s price-sensitive market, including rolling out a sub-$5 ChatGPT Go tier that was later made free for a year for Indian users.

In the article, Altman said India is ChatGPT’s second-largest user base after the United States, highlighting the South Asian nation’s growing weight in OpenAI’s global strategy. The disclosure comes as ChatGPT’s overall usage has surged worldwide, with the platform reaching 800 million weekly active users as of October 2025 and reported to be approaching 900 million.

Altman also highlighted the role of students in driving adoption, saying India has the largest number of student users of ChatGPT globally.

Indian students have become a key growth segment for leading AI companies more broadly, as rivals race to embed their tools in classrooms and learning workflows. Google has similarly targeted the market, offering Indian students a free one-year subscription to its AI Pro plan in September 2025. Separately, India accounts for the highest global usage of Gemini for learning, Chris Phillips, Google’s vice president and general manager for education, said last month.

“With its focus on access, practical Al literacy, and the infrastructure that supports widespread adoption, India is well positioned to broaden who benefits from the technology and to help shape how democratic AI is adopted at scale,” Altman wrote.

ChatGPT’s rapid growth also highlights a broader challenge for AI companies in India: translating widespread adoption into sustained economic impact. Indian government initiatives such as the IndiaAI Mission — a national program aimed at expanding computing capacity, supporting startups and accelerating AI adoption in public services — seek to address those gaps. However, the country’s price-sensitive market and infrastructure constraints have made monetization and large-scale deployment more complex than in developed economies.

“Given India’s size, it also risks forfeiting a vital opportunity to advance democratic AI in emerging markets around the world,” Altman wrote, warning that uneven access and adoption could concentrate AI’s economic gains in too few hands.

Altman also signaled that OpenAI plans to deepen its engagement with the Indian government, writing that the company would soon announce new partnerships aimed at expanding access to AI across the country. He did not provide details, but said the focus would be on widening reach and enabling more people to put AI tools to practical use.

The India AI Impact Summit is expected to draw a wide cross-section of global technology and political leaders, including Anthropic CEO Dario Amodei, Sundar Pichai of Google, and senior Indian business figures such as Mukesh Ambani and Nandan Nilekani. Political leaders including Emmanuel Macron, Sheikh Khaled bin Mohamed bin Zayed Al Nahyan, and Luiz Inácio Lula da Silva are also expected to attend, spotlighting India’s ambition to position itself as a central player in global AI debates.

For global AI firms, including OpenAI, the summit underscores how India’s vast user base is translating into growing influence over how the technology evolves.

OpenAI did not respond to a request for comment.

• Google has made a small but useful tweak to Android Auto
• Driving status can now be ascertained via Bluetooth
• This reduces the chances of mistakenly muting notifications

If you’re a regular Android Auto user, you may have noticed that there are a rather complicated set of rules around notifications being automatically blocked while you’re driving – but it seems Google has now sorted out one of the most frustrating issues.

As spotted by Android Authority, the option to have Do Not Disturb automatically enabled in Android Auto when motion is detected seems to have been tweaked. This setting was known for accidentally muting alerts on the phones of passengers as well as drivers.