Ankura CTIX FLASH Update – April 28, 2026

Malware Activity

When Trust and Infrastructure Become the Attack Surface

Deepfake voice fraud and persistent firewall malware highlight how modern cyberattacks are increasingly designed to bypass traditional security controls by targeting trust and core infrastructure instead. Attackers are now convincingly impersonating executives using AI‑generated voices and video, pressuring employees into approving high‑value transactions through what appears to be ordinary conversations. At the same time, advanced malware like Firestarter shows that even well‑patched security devices can remain compromised, quietly giving attackers long‑term access to sensitive networks. These threats succeed because they exploit assumptions: that a familiar voice can be trusted, or that applying updates automatically makes systems safe. In both cases, attackers carefully study their targets, from org charts and approval workflows to the inner workings of network hardware. The result is that organizations with