Two (2) advanced malware campaigns tracked as Soco404 and Koske have emerged as significant threats to cloud environments, exploiting misconfigurations and software vulnerabilities to deploy cryptocurrency miners across Linux and Windows systems. Soco404, identified by Wiz, uses fake 404 pages on Google Sites to deliver platform-specific payloads targeting PostgreSQL, Apache Tomcat, Struts, and Confluence servers. It employs diverse post-exploitation tools like PowerShell, certutil, and wget to maintain persistence, escalate privileges, and evade detection through log tampering and service disruption. Meanwhile, Aqua Security has uncovered Koske, a Linux-based malware strain believed to be partially developed using large language models (LLMs). Distributed via misconfigured JupyterLab instances, Koske delivers payloads hidden within polyglot JPEG images—visually benign panda pictures that conceal malicious shellcode. It installs rootkits and optimized miners for eighteen (18) cryptocurrencies, dynamically adjusts system settings to maintain command-and-control (C2) connectivity, and exhibits AI-influenced traits such as modular code, well-commented scripting, and adaptive logic. Aqua warns that this represents a critical shift in threat actor capabilities, as AI-generated malware complicates attribution, enhances stealth, and sets the stage for real-time, behaviorally adaptive attacks. CTIX analysts will continue to report on the latest malware strains, campaigns, and attack methodologies.