Ankura CTIX FLASH Update – March 10, 2026

Malware Activity

Exploiting Internet Infrastructure and Advanced Hacking Techniques

Cybercriminals are increasingly exploiting core internet functions, such as the ".arpa" domain and IPv6 reverse DNS features, to conduct stealthy and sophisticated phishing attacks. These attackers hijack DNS zones by controlling large IPv6 address blocks and creating fake but convincing hostnames that appear legitimate, often using trusted providers to mask their activities. This tactic leverages the inherent trust in reverse DNS lookups to bypass security filters, making it harder for traditional defenses to detect malicious links, which are often designed to be temporary. Meanwhile, a notorious hacking group known as Velvet Tempest is employing advanced social engineering methods, such as the ClickFix technique, to infiltrate organizations. They trick users into executing malicious commands via online ads, then use these to establish backdoors, steal credentials, and deploy