October 18, 2026

Unit 42 considers these artifacts as clues of AI-assisted development.

The public report does not say whether an AI agent also carried out the operation.

CL-UNK-1211's activity extended from October 2025 to April 2026 and is not attributed to any known group.

A Trojan in Go, named SysGoRAT, supports Linux and Windows and communicates via WebSocket.

In this experiment by Fred Heiding and his colleagues, 54% of recipients clicked.

The study compared four types of emails with 101 participants divided among the four groups.

The target profiles were accurate in 88% of cases, according to the authors.

The profitability gain of up to 50 times higher comes from an economic model, not from measured criminal gains.