Intelligence Insights: January 2026
JustAskJacky’s journey continues and Remcos debuts in this month’s edition of Intelligence Insights
Highlights from December
JustAskJacky, a family of malicious NodeJS applications that masquerade as a helpful AI or utility tool while conducting reconnaissance and executing arbitrary commands in memory in the background, remained in first on our top 10 most prevalent threat list for the third month running. That said, the overall volume of JustAskJacky that we’ve seen has dropped considerably in those months; December activity was one fifth the volume we observed in October 2025. At Red Canary we track the whole family of tools under the name JustAskJacky, but we’ve seen more than a dozen different lure names including AllManualsReader, AskBettyHow, ManualReaderPro, OpenMyManual, and others.
In a tie for third this month is Atomic Stealer, an information stealer designed to target data within web browsers and locally stored files on macOS systems, with the goal of accessing sensitive information including credentials, payment card data, keychain details, and cryptocurrency wallets. Atomic Stealer has been in the top 10 list for the last five months, and jumped into third after tying for seventh in December 2025.
Scarlet Goldfinch shared the tie for third, which is the highest Scarlet Goldfinch has ranked on our list since June 2025. Also known as FakeSG, Scarlet Goldfinch is Red Canary’s name for an activity cluster that uses compromised web sites to trick users into executing malicious code. In December, as in most of 2025, we saw Scarlet Goldfinch leverage paste and run as an initial execution technique to deliver its payloads.
Both of Scarlet Goldfinch’s December 2025 payloads made the top 10 list this month, tied for eighth: