Phishing, EtherRAT, and AI code-audits: is the US facing a new cyber wave?

A cluster of cyber incidents and policy-adjacent moves is unfolding on July 6, 2026, with attackers and defenders both moving fast. One report describes a phishing campaign that impersonates more than 30 major brands—such as Adobe, Netflix, Coca-Cola, and OpenAI—using fake job interviews to steal Google account credentials from marketing professionals. A second report warns that threat actors are abusing Microsoft Teams voice calls by posing as corporate IT support staff, tricking employees into installing EtherRAT malware that can provide initial access to corporate networks. In parallel, an exclusive report says a US cyber agency is using Anthropic’s “Mythos” to audit government code, suggesting a shift toward AI-assisted security review of sensitive software. Geopolitically, the common thread is the contest over trust: credentials, identity, and code integrity are being targeted at scale while governments accelerate defensive tooling. The phishing and Teams-based social engineering show how attackers can exploit everyday enterprise workflows—job hunting, marketing operations, and remote support—to gain footholds that later enable espionage or disruption. The US move to use Anthropic’s Mythos for government code auditing indicates that Washington is treating AI systems as part of its cyber defense stack, potentially to reduce time-to-vulnerability discovery and to harden critical software supply chains. This benefits defenders by improving audit coverage, but it also raises the stakes for model governance, data handling, and the risk that adversaries may probe or mimic AI-assisted processes. Market and economic implications are likely to concentrate in enterprise software, identity and access management, and endpoint security spending. Credential theft and malware delivery can drive near-term demand for incident response, security monitoring, and user-awareness tooling, while increasing churn risk for cloud productivity suites and cyber risk pricing. EtherRAT infections and initial access attempts typically translate into higher costs for IT departments, potential downtime, and downstream impacts on insurers and cyber risk pricing; while the articles do not quantify losses, the operational cost can be material for affected firms. If AI-assisted code auditing expands, it may also influence procurement and vendor selection in government cybersecurity contracts, potentially affecting sentiment around AI security tooling and compliance services rather than broad macro indicators like FX or rates. What to watch next is whether these campaigns show convergence—e.g., the same infrastructure or lure themes across Google credential theft and Teams/EtherRAT delivery—and whether any public advisories or takedowns follow. Key indicators include spikes in Google account compromise reports tied to “job interview” lures, increases in Teams voice-call abuse detections, and telemetry showing EtherRAT installation attempts on corporate endpoints. On the defense side, monitoring will focus on how the US agency operationalizes Mythos for code auditing: what code domains are included, what data is retained, and whether outputs are integrated into existing secure development lifecycle controls. Trigger points for escalation would be confirmed breaches in high-value sectors (government contractors, telecom, or critical infrastructure) or evidence that AI-audit workflows are being targeted by adversarial prompt injection or supply-chain manipulation. A near-term timeline is likely measured in days for campaign iteration and in weeks for policy and procurement adjustments around AI-assisted cybersecurity.

Geopolitical Implications

• 01

  Non-state cyber operations are exploiting global enterprise platforms to gain low-friction access.

• 02

  AI-assisted government code auditing signals modernization but raises governance and adversarial-risk questions.

• 03

  Workforce development efforts aim to reduce the talent gap that sustains long-running intrusions.

Key Signals

• —Rising reports of Google credential theft tied to brand-impersonation job lures.
• —More detections of Teams voice-call impersonation leading to EtherRAT installs.
• —Operational details on how Mythos outputs are used in secure development lifecycle controls.
• —Any confirmed breaches in government-adjacent or critical infrastructure targets.