Notifications
Clear all
Topic starter
02/08/2026 12:00 pm
TL;DR: Active threats across ransomware, browser exploitation, and infostealers are being rounded up in Anomali’s Cyber Watch, including LockBit 5.0 campaigns, Chrome zero-day CVE-2026-2441, and malware targeting OpenClaw configuration files to capture tokens, keys, and user context. The pattern is clear: exposed credentials, weak browser hygiene, and unmanaged AI-adjacent identity data keep widening attack paths.
NHIMG editorial — based on content published by Anomali: Cyber Watch on LockBit 5.0, Chrome zero-day CVE-2026-2441, and OpenClaw infostealer activity
By the numbers:
- Since December 2025, 60 victims have appeared on the group's data leak site, primarily U.S. private sector organizations.
- Google rated CVE-2026-2441 high severity with a CVSS score of 8.8.
Questions worth separating out
Q: What breaks when browser exploits reach identity sessions and cloud consoles?
A: A browser exploit can do more than run code in a sandbox.
Q: Why do compromised tokens and keys matter so much in NHI and AI tooling?
A: Tokens and keys are the practical proof of trust in NHI and AI workflows.
Q: How should teams reduce ransomware blast radius in virtualised environments?
A: Teams should separate hypervisor administration, backup systems, and recovery paths from normal endpoint operations.
Practitioner guidance
- Harden browser restart enforcement Verify that Chrome and other managed browsers are not just updated but fully restarted after patching, especially on endpoints used for cloud consoles, SSO portals, and admin tooling.
- Inventory identity artefacts on endpoints and AI tools Map where access tokens, pairing keys, API keys, and assistant configuration files are stored locally, then move them out of unmanaged file paths wherever possible.
- Segment virtual infrastructure from endpoint trust Assume ransomware targeting ESXi or similar platforms will attempt to widen impact quickly, and separate backup, monitoring, and administrative access for hypervisors from general endpoint workflows.
What's in the full analysis
Anomali's full article covers the operational detail this post intentionally leaves for the source:
- The specific threat intelligence links and external references behind each campaign summary, useful if you need to validate IOC and attribution context.
- The full analyst commentary on LockBit 5.0, including the ESXi-specific behaviour and the monitoring signals defenders should prioritise.
- The browser zero-day details around CVE-2026-2441, including update timing and restart requirements for affected endpoints.
- The OpenClaw infostealer analysis with the exact files targeted and the identity artefacts that were captured.
LockBit 5.0 and Chrome zero-day activity: what should teams act on?
Explore further
02/08/2026 1:07 pm
Identity exposure now begins long before explicit account takeover. Browser exploits, infostealers, and ransomware all increasingly intersect with identity data that sits in sessions, tokens, device files, and AI assistant configuration stores. That means the control surface is no longer just passwords and MFA prompts. Practitioners need to treat access-bearing artefacts as operational assets with defined ownership, revocation paths, and monitoring expectations.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who is accountable when an AI assistant overshares sensitive content?
A: Accountability sits with the team that owns the policy, the attribute feeds, and the enforcement points, because ABAC only works when all three are managed together. If any one of them is missing, the organisation has not built a defensible control path, even if the model itself appears constrained.
👉 Read our full editorial: LockBit 5.0, Chrome zero-day and infostealers expose identity gaps
