Ankura CTIX FLASH Update – April 17, 2026

Malware Activity

When Trust Becomes the Attack Surface

Two (2) recent campaigns highlight a growing shift in cybercrime where attackers exploit trusted platforms and everyday user actions, rather than software flaws, to cause harm. In the first campaign, threat actors exploited the popular note‑taking app Obsidian by posing as venture capital investors and convincing finance and cryptocurrency professionals to enable a normally disabled plugin feature. That single action allowed malicious configurations to run silently inside a legitimate, signed application, bypassing traditional antivirus tools and installing hidden remote‑access malware. In a separate campaign dubbed Pushpaganda, attackers used AI‑generated news content and search optimization to push fake stories into Google’s Discover feed. Victims who clicked were p ressured into enabling browser notifications, which then delivered fake legal threats, scareware, and financial scams directly to their devices. Both campaigns