Cybersecurity teams are tracking a more capable strain of Salat Stealer, a Windows-focused malware family that has moved beyond routine credential theft into full remote access, surveillance and stealthy command-and-control activity. The Go-based tool, also tracked as WEB_RAT, combines the functions of an infostealer and a Remote Access Trojan. Its operators can harvest browser passwords, cookies, Telegram sessions, cryptocurrency wallet data and system details, while also opening […]
Cybersecurity investigators have linked a deceptive ransomware-style intrusion to MuddyWater, a state-sponsored hacking group associated with Tehran’s intelligence apparatus, after forensic evidence showed the operation was built around espionage rather than financial extortion. The campaign, observed in early 2026, was presented to victims as an attack by an affiliate of the Chaos ransomware-as-a-service ecosystem. Yet the intrusion lacked a defining feature of ransomware: there was no file […]
Omani government networks have been hit by a wide-ranging espionage campaign attributed to Iran-linked operators, with evidence pointing to the theft of judicial records, identity data, staff credentials and internal system files from multiple state entities. The operation centred on the Ministry of Justice and Legal Affairs, where attackers used a custom ASP. NET webshell to maintain access, issue commands and extract data. Exposed attacker infrastructure showed […]
A newly documented Linux remote access trojan has sharpened concerns over software supply-chain security after researchers found it was built to steal developer and DevOps credentials that could be used to compromise trusted code repositories, cloud systems and package registries. The malware, known as Quasar Linux or QLNX, combines remote access functions with a rootkit, a Pluggable Authentication Module backdoor, keylogging and credential-harvesting features. Its design suggests […]
Cybersecurity vendor Trellix has confirmed unauthorised access to part of its source-code repository, raising fresh questions over the protection of development environments inside companies trusted to defend enterprises and public-sector networks. The privately held company said it had brought in external forensic specialists after identifying the intrusion and had notified law enforcement. Trellix said its investigation had so far found no evidence that its source-code release […]
Small US defence suppliers are being outmatched by nation-state hackers using poorly monitored network edges to gain long-term access before attacks become visible, new cyber threat analysis has warned. Team Cymru senior threat intelligence adviser Stephen Campbell said smaller companies inside the US Defense Industrial Base face a structural disadvantage because many hold sensitive contract, technical and personnel data but lack the network-level visibility available to major […]
Malicious code inserted into four SAP-related npm packages exposed developer workstations and automated build systems to credential theft, marking a sharp escalation in attacks against open-source software supply chains used by enterprise technology teams. The compromised packages were published on April 29, 2026, and affected components tied to SAP’s Cloud Application Programming Model and Multi-Target Application build workflows. The malicious versions identified were @cap-js/sqlite 2.2.2, @cap-js/postgres 2.2.2, […]
Palo Alto Networks has agreed to acquire Portkey, a Bengaluru-founded AI infrastructure startup, as the cybersecurity group pushes further into securing autonomous software agents now moving from pilot projects into business-critical systems. The Santa Clara-based company said the deal is expected to close in its fourth quarter of fiscal 2026, subject to customary conditions. Financial terms were not disclosed, though market estimates place Portkey’s potential valuation at […]
Microsoft detected about 8.3 billion email-based phishing threats in the first quarter of 2026, exposing a sharp shift in attacker behaviour as criminal groups moved deeper into QR codes, fake CAPTCHA pages, phishing-as-a-service kits and file-based payloads to bypass conventional email defences. The volume eased from about 2.9 billion threats in January to 2.6 billion in March, but the decline in headline numbers masked a more […]
A publicly released exploit for a critical cPanel and WebHost Manager flaw has intensified pressure on hosting companies and website operators after monitoring groups reported tens of thousands of likely compromised internet-facing systems. The vulnerability, tracked as CVE-2026-41940, allows unauthenticated attackers to bypass login controls and obtain administrative access to affected cPanel & WHM environments. The weakness carries a CVSS severity score of 9.8, placing it among […]
More than 30,000 Facebook accounts have been compromised in a large phishing operation that exploited trusted internet services to make fraudulent messages appear legitimate, sharpening concerns over how cybercriminals are turning mainstream cloud tools into delivery channels for account theft. Cybersecurity researchers have identified the campaign as AccountDumpling, a Vietnamese-linked operation aimed largely at Facebook Business users, page administrators and account operators. The attackers used Google […]
A new botnet campaign is turning poorly secured Jenkins servers into attack nodes aimed at online game infrastructure, including Valve Source Engine servers used for titles such as Counter-Strike and Team Fortress 2. The activity shows how a single exposed continuous integration system can be repurposed to generate UDP, TCP and application-layer floods against multiplayer platforms. Cybersecurity researchers observed the activity on March 18, 2026, after a […]
Attackers are shifting credential theft campaigns towards QR codes, fake CAPTCHA pages and ClickFix-style prompts, turning familiar security checks into tools for large-scale account compromise. Fresh threat telemetry for the first quarter of 2026 shows email-based phishing remains vast in scale, with about 8.3 billion threats detected between January and March. Although monthly volumes eased from 2.9 billion in January to 2.6 billion in March, the composition […]
MCP’s rapid rise as the preferred bridge between AI assistants and external tools is running into a harder test inside production software teams: whether convenience justifies the security, reliability and governance risks now surfacing around the protocol. Model Context Protocol, introduced by Anthropic in November 2024 and later moved into broader open governance under the Linux Foundation’s Agentic AI Foundation, was designed to solve a real engineering […]
Google has issued an urgent Chrome security update after fixing 30 vulnerabilities, including four critical memory-related flaws that could expose users to attacks through compromised or malicious web pages. The update moves Chrome’s stable desktop channel to version 147.0.7727.137 or 147.0.7727.138, depending on platform, and is being rolled out across Windows, macOS and Linux. Users have been advised to restart the browser after the update is installed, […]
A fake video meeting can now be enough to breach a Web3 company, with North Korea-linked BlueNoroff hackers using bogus Zoom calls, clipboard tricks and fileless PowerShell malware to steal credentials from cryptocurrency targets across multiple countries. The campaign marks a sharper turn in social engineering against the digital assets sector, where attackers are no longer relying only on malicious attachments or crude phishing pages. Instead, they […]
A malicious npm dependency slipped into an AI-assisted crypto trading project has exposed how automated coding tools can be manipulated into importing software that steals credentials, wallet data and source code. The campaign, named PromptMink by security researchers, centres on the npm package @validate-sdk/v2, which presents itself as a utility for hashing, validation, encoding, decoding and random generation. Its actual function is to harvest secrets from infected […]
A hardcoded API key embedded in ClickUp’s public website exposed 959 corporate and government email addresses and more than 3,000 internal feature flags for over a year, intensifying scrutiny of security controls at widely used software-as-a-service platforms. The exposure was tied to a production JavaScript bundle that loaded before authentication, allowing anyone inspecting the page source to extract a third-party SDK token and send an unauthenticated request […]
North Korean state-linked hackers have intensified attacks on cryptocurrency companies by combining fake video meetings, AI-generated identities and “ClickFix” infection tactics to compromise executives, founders and staff with access to wallets, exchanges and investment infrastructure. A large spear-phishing operation attributed with high confidence to BlueNoroff, the financially motivated arm of the Lazarus Group, targeted a North American Web3 company through a manipulated calendar invitation that led to […]
Hugging Face’s LeRobot robotics framework is facing scrutiny after disclosure of a critical remote code execution vulnerability that could allow unauthenticated attackers to run arbitrary commands on affected systems through exposed inference services. The flaw, tracked as CVE-2026-25874, affects LeRobot versions up to 0.5.1 and carries a critical CVSS 4.0 score of 9.3. The issue centres on unsafe deserialisation in the framework’s asynchronous inference pipeline, where Python’s […]
Agentic Mobile Protocol (AMP) is the world’s first agentic payment framework designed for mobile interfaces, including digital wallets, super apps, and wearable devices.
Fully open-sourced, the protocol enables LLMs, platforms and merchants’ seamless agentic connection to 4.4 billion digital wallet users worldwide through simple and secure integration.
KUALA LUMPUR, MALAYSIA – Media OutReach Newswire – 28 April 2026 – Ant International is introducing the Agentic Mobile Protocol (AMP) for the agentic commerce industry to enable secure, AIOps-native agentic payment connection to mobile services including digital wallets, banking apps, super apps, and mobile portals from phones to wearable devices.
Ant International launches Agentic Mobile Protocol (AMP), the world’s first agentic payment framework designed for mobile interfaces, including digital wallets, super apps, and wearable devices.
“We are deeply grateful for partners, acquirers and developers who contributed to this project. An agentic protocol for mobile commerce that ensures superior efficiency and security results will be key for businesses large and small expanding into the world’s fastest growing markets. We look forward to expanding our multi-layered partnerships to enable real-world successes of AI commerce,” said Jiang-Ming Yang, Chief Innovation Officer, Ant International.
Wallets and mobile payment key driver for agentic commerce
The global agentic commerce market could reach around USD 28 billion by 2030 with a 46% CAGR as the industry fast-forwards from pilot AI agent programs to full-scale autonomous transaction systems[1]. The number of global digital wallet users reached 4.4 billion in 2025, and is expected to exceed 6 billion – over 75% of the global population – by 2030[2].
While the new payment rails are positioned to become a primary interface for AI commerce, current AI payments protocols are designed largely for card rails. Merchants and digital wallets need to be able to offer smooth payment experience, authenticate trusted agents and verify credentials without disruption, as well as seamlessly handle post-checkout settlement and transaction management tasks in a mobile- and AI-native environment.
With the Agentic Mobile Protocol, merchants – LLMs, AI platforms, merchants with self-developed agents, and agent builders – and digital wallets can embed agentic payment functionality directly into their workflows, eliminating the need for system overhauls.
Ant International has open-sourced the AMP to help establish a universal, auditable standard to ensure that AI agents can transact securely and seamlessly across any global platform.
The AMP framework features:
A superior agentic checkout experience through:
Faster agent integration: reducing the number of steps required to link a payment agent to a digital wallet by 50% compared to traditional card-binding methods.
Money-back guarantee: every agent-initiated transaction is backed by a money-back guarantee mechanism for payment partners in cases of account takeovers.
Cross-device compatibility: payment agents can work on mobile interfaces across smartphones, smartwatches, AR glasses and in-car systems, a capability absent in card-based systems.
A more efficient and secure trust architecture for agent delegation to ensure secure and precise delegation of payment authority to AI agents — whether it is ordering coffee, booking a ride, or planning a trip – with full visibility and the ability to revoke or modify tasks at any time.
A high-frequency agent-to-agent (A2A) settlement mechanism enables automated, ultra-small transactions between AI agents. It’s capable of handling nano-transactions as small as $0.000001 between agents with real-time accounting and clearing. A2A settlement is crucial to agentic economy, which requires the capacity to process high-frequency, sub-cent agent transactions that traditional payment rails cannot support.
A full-spectrum Know Your Agent (KYA) framework establishes an agent’s digital identity and certifies its authorised capabilities. The proprietary Agent Trust Rating mechanism offers an additional layer of protection, a dynamic risk-management tool that determines whether an agent is trustworthy and controls the level of autonomy.
A 40 member-strong wallet ecosystem in cross-sector coordination
Ant International is working with wallet partners of Alipay+, the company’s global wallet gateway, to implement the AMP. Alipay+ now connects over 40 digital wallet partners, covering 1.8 billion user accounts and 150 million merchants globally.
Building on this payment partnership network that spans wallets, acquirers, super apps and cards, Ant International is among the first partners of Mastercard and Visa to pilot card-based transaction capabilities for AI agents, while collaborating with Google on its protocols for agentic commerce and payments.
The issuer is solely responsible for the content of this announcement.
About Ant International
Ant International is a leading global digital payment, digitisation and financial technology provider. Through collaboration across the private and public sectors, our unified techfin platform supports financial institutions and merchants of all sizes to achieve inclusive growth through a comprehensive range of cutting-edge digital payment and financial services solutions. To learn more, please visit https://www.ant-intl.com/
Retail and hospitality companies are facing a widening extortion campaign by BlackFile, a financially motivated hacking group using voice calls, fake helpdesk scripts and spoofed caller identities to steal credentials and force ransom negotiations. The group has been linked to attacks that began surfacing in January 2026, with sustained targeting of customer-facing businesses from February. Its activity has been tracked under several names, including CL-CRI-1116, UNC6671 and […]
OpenClaw has issued security updates for three vulnerabilities in its autonomous AI agent framework, warning administrators that older npm package versions could expose systems to policy bypasses, unauthorised configuration changes and API credential leakage. The flaws affect versions released before 2026.4.20, with one issue limited to versions between 2026.4.5 and 2026.4.20. The patched version tightens how the framework handles trusted operator settings, bundled tools and workspace environment […]
Fake software downloads promoted through YouTube are being used to infect corporate employees with Vidar, an information-stealing malware that harvests passwords, browser data, session cookies and cryptocurrency wallet files before stolen credentials are traded through Russian-language cybercrime markets. The campaign shows how threat actors are shifting from noisy phishing emails to search-driven lures that exploit ordinary workplace behaviour. Employees looking for software tutorials, installers or utilities on […]
https://www.ant-intl.com/
