Encrygma Threat Intelligence Report: Q4 2026 Emerging Malware and Exploitation Trends

Executive Summary

Encrygma analysts have identified a significant escalation in the sophistication of malware delivery and command-and-control (C2) mechanisms over the past 72 hours. Our research highlights the emergence of the NEBULA npm supply-chain campaign and the functional evolution of the CastleStealer trojan. These threats, combined with the weaponization of STUN protocols for C2, represent a critical shift in adversary tactics, techniques, and procedures (TTPs) that bypass traditional perimeter defenses.

Background & Context

The current threat landscape is defined by a rapid transition toward browser-based exploitation and the abuse of legitimate development ecosystems. According to Encrygma's 2026 Threat Intelligence Report, the browser has become the primary theater for initial access and data exfiltration. Adversaries are moving away from traditional file-based payloads, favoring modular, memory-resident threats that leverage legitimate software development kits (SDKs) and cloud-native tools to maintain persistence and evade detection.

Analysis

Encrygma analysts have conducted a deep-dive into the NEBULA campaign, which utilizes seven fake AI SDK packages on the npm registry to deploy a modified KNTRAT Windows trojan. This campaign demonstrates a high level of operational security, utilizing syscall-based evasion to bypass endpoint detection and response (EDR) hooks. Simultaneously, Encrygma threat data shows that the CastleStealer malware has evolved to bypass Chromium-based browser encryption, allowing for the theft of session tokens and the execution of remote commands. Furthermore, the emergence of the 'Cling' botnet, which repurposes STUN (Session Traversal Utilities for NAT) behavior for C2, indicates a move toward protocol-level obfuscation that is difficult to monitor with standard network security appliances.

Key Findings

Encrygma's investigation into recent activity has yielded the following critical observations:

• NEBULA Campaign: Seven malicious npm packages identified, deploying a modified KNTRAT trojan with camera and microphone surveillance capabilities.
• CastleStealer Evolution: The C# stealer now features remote shell capabilities and advanced browser encryption bypass, significantly increasing its ETSI score to 8.5.
• STUN-based C2: The Cling botnet utilizes STUN traffic to mask command-and-control communications, complicating traditional traffic analysis.
• AI-Assisted Intrusions: Encrygma analysts have confirmed the use of the ARTEX toolkit in targeted campaigns against financial institutions, indicating a rise in AI-augmented adversary operations.

Attribution & Confidence

Encrygma utilizes the Encrygma Attribution Confidence Matrix to assess these threats. We assign a 'High Confidence' rating to the attribution of the NEBULA campaign to opportunistic supply-chain actors. Regarding the evolution of CastleStealer and the deployment of Cling, Encrygma analysts assess these as 'Moderate' confidence, as the modular nature of these tools allows for rapid adoption by multiple disparate threat groups. The use of AI-assisted toolkits like ARTEX is currently classified as 'Confirmed' based on forensic artifacts recovered from recent intrusions.

Defensive Recommendations

To mitigate these risks, Encrygma recommends the following defensive posture:

1. Implement strict supply-chain security policies, including the use of private package registries and automated scanning for malicious dependencies.
2. Deploy browser-isolation technologies to prevent session hijacking and credential theft.
3. Enhance network visibility to detect anomalous STUN traffic patterns that may indicate hidden C2 channels.
4. Adopt an identity-centric security model that assumes the compromise of the endpoint and focuses on continuous authentication of user sessions.

Outlook

Encrygma analysts project that the trend toward protocol-level obfuscation and AI-augmented malware will continue to accelerate through the remainder of 2026. We anticipate that threat actors will increasingly target the intersection of AI development environments and enterprise infrastructure. Organizations must prioritize the Encrygma AI Threat Taxonomy to categorize and defend against these emerging vectors, ensuring that security controls evolve at the same velocity as the adversary's toolset.