Flaws

admin Noticias, Trending Banking Critical CYBERDEFENSA.MX firewall Flaws PDF Rented Stories Theft token Trojans weaponized

Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories – CYBERDEFENSA.MX

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn’t.

There’s a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using AI to speed things up. Others are leaving their own attack files exposed. Not exactly careful work.

Different stories, familiar weak spots. Here’s what showed up this week.

The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

PHP2Shell attacks persist

WordPress security company Wordefence said it’s not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619) as of October 28, 2026. «We continue to see PHP2Shell-related requests across the more than 5 million sites we protect,» it said. «Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident response teams have not handled a WordPress compromise attributed to these vulnerabilities.»

40,573 secrets exposed

Hudson Rock’s investigation into the FortiBleed credential harvesting campaign has uncovered 975 newly identified domains and 40,573 exposed secrets, including 37,076 local-user records and 1,576 Active Directory LDAP bind records. The data comes from newly obtained 1,703 FortiGate source files associated with 1,689 host identifiers. «The configuration material dates to around February 2026, earlier than the likely May/June material examined in the first investigation,» Hudson Rock said. The latest discovery has been codenamed FortiBleed 2.0.

Institutional DNS hijacked

Threat actors have used domain shadowing to place illegal gambling content beneath legitimate school and government domains in two unrelated operations. «In both cases, an unauthorized party appears to have gained access to DNS administration and created records that the original domain owners may not have noticed,» Infoblox said. «Because the resulting hostnames sat within established institutional namespaces, they provided especially useful infrastructure for search-engine optimization (SEO) and traffic acquisition.» One cluster, linked to a threat actor called Hidden Hawk, has been found to add individual CNAME records that mapped institutional hostnames to gambling pages hosted largely on Cloudflare Pages. The second campaign exploiting an Indian government domain «delegated entire subzones to third-party authoritative nameservers and used a wildcard, allowing many hostnames to be managed outside the victim’s DNS environment.» Put differently, the unauthorized DNS access creates new institutional hostnames, which resolve to infrastructure serving illegal gambling doorway pages. The pages also leverage the established reputation of school and government namespaces to ensure that the malicious URLs show up prominently in search engine results.

AI banking credential warning

Bank of America is reminding customers not to share banking credentials with AI agents. In an email blast to customers titled «Protecting your finances in the AI World,» the financial institution urged customers to never share their username and password with another person or an outside service, «including an AI-enabled tool or agent that offers to act on your behalf.»

Android tightens contact access

Google has announced that an upcoming Android release will no longer be able to directly write to contacts with the WRITE_CONTACTS permission. «Instead, you can use the standard contact intents (ACTION_INSERT, ACTION_EDIT, and ACTION_INSERT_OR_EDIT),» Google said. «Currently, if your app needs to save even one contact, you might be requesting WRITE_CONTACTS. But that permission grants broad access, allowing an app to make widespread changes to contacts across the device in the background, even without user interaction. Most apps don’t need such broad permission.»

Critical Fortinet fixes released

Fortinet has released a «coordinated set of security updates for FortiOS, FortiManager, and FortiAnalyzer» to address critical and high-severity flaws that were flagged using an AI-assisted vulnerability discovery approach. Details of the issues are being kept under wraps until November 10, 2026. With Fortinet devices becoming a favorite target for attackers, it’s essential that users move quickly to apply the fixes.

Zero-permission token theft

Details have emerged about a now-patched flaw in Microsoft Authenticator (CVE-2026-80097 aka AuthMask) that could be exploited by installing and running a malicious application on an affected Android device and convincing the user to complete an authentication flow in the app by claiming to be a trusted app and getting the corresponding tokens. The flaw could be exploited to take over work accounts without requiring additional permissions. «Successful exploitation could allow the attacker to obtain authentication tokens and access resources as the affected user,» Microsoft said. According to Enclave, «an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app’s tokens. The setup is a device with Authenticator installed and one work account signed into it.»

32 fake AI bots hunt secrets

Attackers are disguising themselves as AI agents to steal credentials. Cequence said it has tracked a single actor running AI agent impersonation at scale by posing as about 32 different AI bots, including ChatGPT, Claude, and Perplexity, while searching for passwords, API keys, and cloud credentials. «The malicious scanner runs from a major cloud provider and rotates through about 32 AI bot identities, spanning crawlers and assistants from OpenAI, Anthropic, Meta, Perplexity, and others,» Will Glazier said. «It ignores web pages and requests files that commonly store secrets, including .env configuration files, cloud credential files, private SSH keys, and server environment data, working from a list of roughly 90 file paths. Each address sends a short burst of 50 to 190 requests in about eight seconds and then moves on. The scanner works through targets one at a time, around the clock, and first sends random nonsense paths to find websites that answer every request, a common scanning technique. It hit organizations in financial services, retail, telecommunications, energy, and software, and stayed active from at least late September through late October.»

China-linked network intrusion

The U.S. Embassy in Fiji has revealed that hackers linked to China broke into a regional organization based in Suva between July and August 2026. «Hackers with links to China maintained access to the organization’s network over several days,» it said. The embassy did not name the threat actor. Nor did it disclose what data the attackers may have accessed.

Camera software weaponized

Attackers have been breaking into enterprise networks via camera management software, according to new research from security firm Huntress, which observed multiple incidents in September and October 2026 and traced them back to a compromised application. Source code artifacts point to a Korean company selling analog and IP cameras and digital and network video recorders. The activity abuses the legitimate «WpcMon.exe» binary to sideload DLLs that establish outbound connections to a remote server. «This activity demonstrates how attackers can blend malicious code with trusted Windows components to evade detection,» Huntress said.

68 GB government data breach

In a major operational security blunder, an unknown threat actor stole 68 GB from a Philippine government agency, maintained a detailed log of the transfer, then left that log open on the internet at 13.163.205[.]35:80. «The copy finished in under 24 minutes on September 6, 2026,» Hunt.io said. «The transfer log records 27 SQL Server backups whose filenames correspond to the case-management systems of a Philippine overseas-employment and migrant-worker administration. Beside the log sat the operator’s toolkit, a rebranded GodPotato build, a PowerShell stager, two payloads and a full Impacket environment.»

AI model data exfiltration concerns

Canadian AI company Cohere has claimed that it caught Alibaba’s Qwen3.8-Flash-Next model unsuccessfully attempting to send data to China from its evaluation sandbox as part of a prompt instructing the LLM to detect malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution. «Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing,» Cohere said. «We cannot answer whether this is deliberate or a leftover glitch from training.» Cohere has also released a dataset containing the model trace and corresponding raw token IDs in connection with the behavior. «The exact output is not guaranteed all the time, and many trials may be required to reproduce the behavior,» Cohere said, adding «there are similarly unexpected URLs that the model also tends to output, most containing aliyunc.» However, the findings have also led to social media chatter that the company is resorting to geopolitical fearmongering and that they are an attempt to clamp down on open-weights models.

Post-quantum migration roadmap

The U.S. National Institute of Standards and Technology (NIST) has released guidelines that detail the timelines for transitioning away from quantum-vulnerable algorithms to quantum-resistant standards. «The report describes different use cases and says why one migration might take longer than another,» said NIST mathematician Dustin Moody, who heads the PQC standardization project. «We understand there’s not one strategy that fits all use cases, and we want to help people handle their migration while staying abreast of what’s changing.»

AI-powered ransomware operation exposed

SOCRadar has uncovered the live workspace (i.e., open directory) of a threat actor tied to the n0n ransomware group, which exposed the operation’s full workflow as of September 2026. The directory at 185.157.161[.]148 includes an AI coding agent configured with about 150 models to produce hundreds of attack scripts, with more than $7,216 in usage costs. «Entry points included a credential stuffing campaign against 305 FortiGate SSL-VPN devices, exposed AWS keys, weak RDP/WinRM credentials, and compromised hosting management portals,» SOCRadar said. At least 23 organizations across 14 countries are said to have been identified in the workspace, including a U.S. sports retailer, a cloud provider, a teachers’ union, a Venezuelan ISP, an Argentine ministry and a pharmaceutical subsidiary.

Government AI access restricted

The Swedish government has barred employees from accessing browser-based versions of ChatGPT or Claude on their work computers over security concerns relating to the processing of sensitive data. «Officials were concerned that entering sensitive information into these models without an agreement setting out how to protect and secure the data could lead to it being fed into the model and stored for training,» Euro News reported.

42 repositories hijacked

JFrog and SafeDep have uncovered a campaign in which threat actors hijacked third-party 42 GitHub repositories across 11 owners to deploy payload blobs large enough «to evade the GitHub search and API paths normally used to find this kind of compromise.» JFrog said, «The repositories contain execution hooks for AI coding assistants and IDEs, plus 12.9 to 13.7 MB polymorphic wrappers that all decode to the same hidden CI-publisher payload.» The activity is assessed to be related to a Miasma-family npm worm propagated under various packages ending with «testmetest.» According to SafeDep, the worm «shares code with Miasma ‘Phantom Gyp’ from June 2026 and adds the token-revocation wiper from Mini Shai-Hulud. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token.» Unsuspecting developers who installed the packages had their data stolen and repositories compromised with malicious code to produce further malicious testmetest releases and run shellpanel workflows targeting cPanel systems through CVE-2026-41940, overlapping with a prior campaign detailed by Socket in July 2026.

Android banking malware-as-a-service

A new Android malware operation called MR ROBOT is targeting customers of Indian banks and transforming banking fraud into a subscription business, with cybercriminals renting customized banking trojans to steal OTPs, card details, UPI PINs and credentials while secretly forwarding calls to bypass security checks. «It is not a single-actor campaign but a rented crimeware platform: a master operator leases access to affiliates, who use a Telegram bot (‘APK Shield) and a web control panel (v7.0) to build personalized banking trojans on demand and distribute them through fake Play-Store-style pages and messaging-app lures,» CloudSEK said. The kit impersonates around 36 lure apps, including banks, utility providers, and government services. One affiliate is estimated to have intercepted 5407 text messages from 153 infected devices.

MDM platforms abused for remote access

Threat actors are abusing legitimate mobile device management (MDM) platforms, like Hexnode and Rippling, by using social engineering to enroll devices or install management agents, per Huntress. «Once established, MDM provides a trusted, privileged path for malicious activity, such as deploying rogue RMM tools and maintaining remote access,» it said.

Critical Gotenberg RCE exploited

Threat actors are exploiting CVE-2026-42589 (CVSS score: 9.8), a critical remote code execution flaw in Gotenberg, to deliver a Go-based reverse shell called «cache_base.» The flaw was patched in May 2026. According to VulnCheck, the activity originated from a residential Japanese IP address in early October 2026. «The execution flow is straightforward: acquire a lock, collect host information, connect to C2, register the victim, and open a shell,» VulnCheck said. Over the past 30 days, the vulnerability has recorded 1,358 exploitation events from 128 unique source IP addresses.

Discord discussions go public

Discord has announced it will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation, starting mid-December 2026. «Discussions in Discoverable Servers will soon be easier to find when you search the web, so you can find the answer you’re looking for and step straight into the conversation on Discord,» it said. The changes apply only to Discoverable Servers and do not extend to private servers and direct messages.

800+ ransomware victims claimed

The Gentlemen ransomware operation has claimed more than 800 victims across multiple regions and sectors, with most attacks targeting organizations in the U.S. and Europe. «The group supports multiple platforms, with ransomware variants targeting Windows, Linux, NAS, and BSD systems, allowing its affiliates to target a broad range of enterprise environments,» Acronis said. «The group’s operations include the use of EDR-killing tools. In a recent incident, a custom dropper was observed deploying vulnerable Safetica ProcessMonitorDriver [CVE-2025-70795] and Lenovo BootRepair.sys drivers to terminate security processes.»

AI model loading RCE risk

Pillar Security has disclosed an arbitrary-code-execution vulnerability in Unsloth’s core model-loading path (CVE-2026-93348, CVSS score: 8.6). It has been fixed in unsloth_zoo 2026.8.14. «An attacker-controlled model configuration could cause Python code to execute during loading,» researcher Ariel Fogel said. «The affected code ran inside the model-loading process, with access to whatever that process could read, modify, or authenticate to. In an AI development environment, that can include proprietary datasets, model artifacts, Hugging Face tokens, and cloud credentials. Exploitation required an affected loading path to process an attacker-controlled configuration.»

Unauthenticated root-level RCE

XBOW said it identified an unauthenticated, critical-severity remote code execution bug in a public web application belonging to the U.S. Election Assistance Commission (EAC). «The vulnerable application was a resource/logistics calculator, not a voting machine or voter registration system,» XBOW researcher Ariel Walter Garcia said. «The flaw allowed an unauthenticated attacker to execute code as root inside the backend container, with access to locally protected resources and outbound network connectivity, a privileged foothold reachable via a crafted unauthenticated web request.»

Session-hijacking RAT emerges

A new remote access trojan called DarkCore comes with a dedicated browser that could let attackers access Gmail, WhatsApp, and MediaFire accounts using stolen sessions, while giving the impression that the activity is originating from the victim’s own IP address. DarkCore was first advertised on cybercrime forums in August 2026. «The seller describes a browser that reuses those sessions to access work mailboxes, instant messaging apps, cloud storage and other services through the infected machine’s IP address,» BlackFog said. «The purpose is to make the access look like legitimate activity from the user.»

AI-powered malware framework

Cisco Talos has disclosed details of a new AI-integrated command-and-control (C2) framework called NIK C2. The implant features surveillance, theft, lateral movement, and evasion capabilities, including credential dumping, RDP session hijacking, process hollowing, and a C2-driven screen lock ransomware module. «NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim’s keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI model to analyze the harvested data, all within the compromised session,» Talos said. «In this framework, the actor has abused the OpenAI Chat Completions application programming interface (API), which is an HTTP endpoint that enables ChatGPT-style conversations programmatically. In addition to the features that enable theft, an actor can also deploy desktop screen-locking ransomware via the NIK C2 implant onto the victim machine, leading to a ransom demand in Bitcoin or USDT cryptocurrencies.» Three different versions of the malware have been identified to date since August 12, 2026. Talos said NIK C2 alters adversary tradecraft by collapsing collection and exploitation into a single continuous session.

Malicious PDF delivers backdoor

A phishing email using a FedEx tax invoice lure and containing a ZIP archive with a PDF has been observed triggering a multi-stage infection process to deliver a previously undocumented variant of the Sirius Backdoor. «The PDF abuses /OpenAction and /Launch objects to trigger an embedded Base64-encoded PowerShell command upon opening,» Trellix said. «Execution relies on social engineering to trick the user into approving the PDF reader’s security confirmation prompt. The PowerShell stager decrypts and reflectively loads a .NET assembly in memory. This loader performs process hollowing into legitimate Windows processes such as msbuild.exe, svchost.exe, etc., allowing the malware to operate under trusted process contexts.» The final payload is SIRIUS, a Microsoft Visual C++ based backdoor with extended remote access capabilities.

AI reshapes ransomware economics

A new analysis from Flare has revealed that threat actors are building a mixed AI toolkit, combining commercial models with local, open-weight, and jailbroken alternatives, as well as leaning on stolen AI credentials to shift costs to victims. «Where AI can help is with understanding systems, writing tools and troubleshooting. The threat actor still needs access, decisions and a way to obtain payment,» Flare said. «If AI helps an affiliate write a working data-export script without hiring a specialist, the affiliate may avoid that specialist’s fee and the wait for their help. AI makes expertise cheaper to obtain only when the cost of using and checking its work is lower than the cost of the specialist help it replaces.»

Emerging data-extortion threat

A recently observed cyber-extortion actor named ScarlettGroup is publicly advertising alleged data compromises and uses negotiation deadlines and threatened disclosures to pressure targeted organizations. The group’s dark web site listing includes victims from technology, education, government, and entertainment sectors. «ScarlettGroup demonstrates characteristics associated with financially motivated data-extortion operations, including public victim claims, deadline-based pressure, and underground forum activity,» Foresiet said. «Its dedicated leak-site infrastructure and structured disclosure mechanism indicate an organized approach to promoting alleged compromises and exerting reputational pressure.»

Infostealers evolve into RATs

Following its disruption in June 2026 as part of Operation Endgame, StealC has returned four months later as Stadia. «This time it’s not a stealer: it’s a full remote access trojan,» Varonis said. «The RAT’s features include hidden desktop control, a live command shell, a file explorer, a process manager and an in-memory loader, with StealC’s stealer welded on as one module among six. The actor behind Stadia is working hard to win back original StealC customers: every former StealC customer is offered a free month on the top ($900) tier.» The development comes as Moonlock Lab revealed that the Icarus macOS stealer has similarly evolved from a smash-and-grab crypto and data stealer to a malware with remote-access capabilities. The new iteration is called ICMacOS. «The stealer is actively advertised on cybercrime forums by a Russian-speaking actor operating under the handle GlowComa, with feature updates regularly announced via Telegram,» SOCRadar said. «GlowComa promotes ICMacOS alongside Icarus ClickFix, a companion panel designed to deliver payloads using malicious copy-and-paste terminal commands. The infection chain relies on initial dropper scripts to detect the host architecture and harvest administrator passwords using fake system dialogs before delivering the primary payload.» Another macOS-focused stealer is Aokigahara, which goes beyond browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications to also target AI applications and development tools. «The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools,» Check Point said. «Stolen AI credentials could offer opportunities for monetization. Usable credentials or session tokens could enable unauthorized access to paid AI services or the resale of compromised accounts.»

That’s the week’s mess. Some attacks were clever, some were painfully simple, and a few attackers made life easier for the people investigating them. The common problem? Too much trust in things nobody was watching closely.

AI is adding new tricks, but the old ones aren’t going anywhere. Stolen credentials, weak access controls, and forgotten bugs still get plenty of work done. New tools, familiar mistakes.

The useful part is knowing where those mistakes keep showing up. That’s usually where the next problem starts.

10 SEP 2026

admin Noticias, Trending 119K Android BrowserBuilt CYBERDEFENSA.MX Flaws Phishing Scam Shops Stories

200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories – CYBERDEFENSA.MX

A lot of this week’s security news has the same awkward answer to one question: “Why was that allowed to work?”

An extension asks for access and takes too much. A trusted service becomes part of a phishing chain. An old bug still gets results. An exposed system stays exposed. A package looks useful right up until it isn’t. Different stories, same basic problem: the path in was often already there.

Nothing here needed magic. Mostly access, trust, weak edges, and someone willing to keep poking. That’s the week.

The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

Malicious extensions steal crypto data

A set of four malicious Google Chrome and Mozilla Firefox extensions has been found to target Axiom Trade and Padre users to steal session tokens and wallet data. The extensions are J7Tracker (Chrome), VREO (Chrome and Firefox), and Orbit Tracker (Firefox). While the first three contain the same Axiom and Padre collection module, the fourth implements a different collector but targets the same data, while retaining some artifacts from J7Tracker. «The module is byte-identical across all three analyzed extensions. It automatically retrieves authenticated user information, wallet-related bundle data, Firebase access tokens, and application state, then sends the information to threat actor-controlled Vercel deployments,» Socket said. The same Chrome publisher has been traced back to two earlier extensions, GhostApe and GhostApe Color, impersonating the MockApe trading add-on.

AI agents automate cyber intrusions

A Chinese-speaking operator has been observed using Anthropic Claude Code, Alibaba Qwen, and DeepSeek to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S. Some of the targets included Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Da Nang, Vietnam. The attacker is said to have used SecFlow, an AI orchestration framework, to convert «campaign objectives into tasks for specialized AI agents» and supply them with tools, target information, shared storage, and network routes, Hunt.io said, adding the tool «split reconnaissance, exploitation, collection, and reporting among specialist workers.» Some of the vulnerabilities exploited by the threat actor are Shellshock, Spring4Shell, Ghostcat, Shiro deserialization, Log4Shell, Grafana and Nexus path traversals, and a Nacos authentication bypass. The exploitation is followed by the deployment of web shells, which are generated through a dedicated GLUTTON capability, and used to facilitate follow-on actions, like reconnaissance, privilege escalation, credential theft, and custom implant deployment. One such backdoor is SecBox, a Go-based remote-access and network-pivot framework. Details of the campaign first came to light in July 2026.

Shadow AI exposes sensitive data

The U.K.’s National Cyber Security Center (NCSC) has warned that employees using unapproved AI tools can expose sensitive corporate data and create security risks that organizations may struggle to detect and manage. «Providing shadow AI access to company or customer data likely increases the risk of data breaches, intellectual property loss and failure to meet regulatory requirements,» NCSC said. «Employees who transfer sensitive or proprietary information to consumer AI services will likely reduce the organization’s visibility and control over that information. AI agents are complex pieces of software that can have critical security vulnerabilities. If an attacker successfully exploits a vulnerability, they can gain access to the same data, services, and privileges that the agent has legitimate access to.»

Fake M&A deals drive wire fraud

Attackers are masquerading as executives and tricking targets in legal teams into moving conversations to WhatsApp and personal email with an aim to initiate international wire transfers using forged acquisition documents as part of a merger and acquisition scam. «The attackers presented the acquisition as a tightly controlled transaction coordinated by a reputable adviser, with only a small group involved and an announcement approaching fast,» Gen Digital said. «The organizations and professions varied. The targets included senior people in private equity, industrial finance, sales, mining and energy. For each of them, an acquisition or strategic investment narrative would have been credible enough to justify initial engagement. Despite the different branding, the documents followed substantially the same sequence of sections and reused the same legal language. They all imposed confidentiality, directed communications towards WhatsApp and personal email, and introduced a short period between the NDA date and the supposed public announcement.»

Windows adds privacy-preserving age checks

Microsoft is adding new age-awareness APIs called the Windows Age API to Windows 11 that will allow apps to determine whether a user is a child, teenager, or adult without exposing their exact date of birth. «Apps receive only the age-related signal needed for the experience and not sensitive personal data such as full date of birth,» Microsoft said. «By making age awareness available as a platform capability, Windows helps developers build safeguards into experiences from the start rather than placing the burden on children and families to manage protections app by app.»

119K domains power fake shops

A massive operation dubbed DoppelCart is using more than 119,000 domains to run a network of fake e-commerce shops that steal payment card details. The sites mimic legitimate businesses by copying product catalogs, descriptions, branding, and images, sometimes even loading assets directly from the real company’s servers. In all, the shops mimic 44,182 different brands, with a median of two clones for each. «Each copies a real brand’s photos and page text, then undercuts its prices,» Netby said. «Each also republishes the brand’s own support address, so the people who get charged complain to the brand, not the shop.»

Chrome accelerates security releases

Google has officially shifted to a two-week cadence for major Chrome milestones, with weekly security updates, in response to a shifting cybersecurity landscape in the AI era. The shift is driven by LLM-assisted vulnerability discovery approaches, which have increased the volume of patches and updates across the software ecosystem. «While this dramatic change in software security brought about by LLMs might be startling, an increase in bugs found and fixed is not a sign of failure,» Google said. «Every bug found and fixed is one less foothold for an attacker. But discovering and fixing a bug is only half the battle — we must also ship the fix and apply the update for users faster than adversaries can exploit the bug.» The idea, therefore, is to shrink the window between pushing a fix in a public codebase and getting that fix to end users before it can be exploited. A shorter release cycle would reduce the patch gap – the time frame between when a security vulnerability is known and when it gets addressed. Google moved to a four-week release cycle for Chrome in 2021, down from six weeks. Similar moves have been adopted by other browser makers like Microsoft, Mozilla, and Brave.

200 Android flaws patched

Google has released patches for 200 vulnerabilities as part of the September 2026 Android security updates. This includes a number of critical and high-severity vulnerabilities, including those that could allow attackers to remotely execute code without user interaction. One of the flaws worth highlighting is CVE-2026-28662, a critical Wi-Fi-related bug that could potentially allow an attacker to achieve remote code execution. «Most concerning from this list is CVE-2026-28662 because it’s a Wi-Fi-related memory corruption flaw,» Adam Boynton, enterprise strategy manager at Jamf, said. «If left unpatched, it could enable attackers to execute code remotely, without any additional privileges or user interaction, potentially allowing privilege escalation. This vulnerability will only continue to pose a risk if devices are left unpatched. It’s crucial that organizations issue the updates across their device fleet as soon as possible.»

Singpass scheme tied to 170 victims

Singapore police officials have arrested two male Chinese Malaysians, aged 25 and 47, for their alleged involvement in a coordinated scheme that compromised the Singpass accounts of Singapore citizens and work permit holders. «Investigations revealed that the two men were employees of a mobile phone shop located in Singapore,» authorities said. «They allegedly exploited opportunities arising from their work to access customers’ Singpass accounts. In one such occasion, when a customer was purchasing a new SIM card, one of the men allegedly offered to help update the mobile number linked to the customer’s Singpass account, before using this opportunity to create a LiquidPay account without the customer’s knowledge.» Investigations have uncovered over 170 Singapore citizens and foreign workers whose Singpass accounts were linked to the same activity. The fraudulent Singpass accounts were then used to register for more than 160 additional LiquidPay accounts.

Email breach fuels wallet phishing

Cryptocurrency hardware wallet maker Trezor has warned customers to be on the lookout for phishing attacks after its third-party email provider Brevo was breached. The incident impacted 120 Brevo accounts, including Trezor’s. «Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt,» it said. Do not click on any link. The incident affected our opt-in newsletter database, roughly 347,000 email addresses. These addresses might be potentially used for other phishing attacks in the future.» The Brevo account has been suspended to prevent the threat actors from abusing it to send phishing emails. The phishing email sent from the account contained a malicious link that instructed users to download an app that asked them to enter their wallet backup. The domain has since been taken down.

EtherRAT chain ends in ransomware

An attack campaign that installs EtherRAT via a malicious MSI installer masquerading as a Sysinternals tool has been found to deliver an AI-generated malware framework called TukTuk and GoTo Resolve. Using the access provided by the remote access software, the threat actor is said to have successfully exfiltrated data to a cloud service and deployed The Gentlemen ransomware. «TukTuk can use Arweave as a dead-drop resolver,» the DFIR Report said. «In this mode, the implant queries the Arweave blockchain for a specific Drive-Id, then retrieves an encrypted configuration blob. That blob contains the credential pool for all supported C2 transports. After execution of TukTuk, the threat actor began hands-on-keyboard activity, Kerberoasting operations, and credential discovery targeting administrative accounts. Next, the threat actor leveraged compromised service account credentials to deploy GoTo Resolve remote management tooling laterally across multiple systems, including servers and domain controllers.»

CISA refreshes insider threat guidance

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an updated version of its Insider Threat Mitigation Guide to highlight the «growing impact insider threats have on critical infrastructure, the dynamic and evolving operational landscape, and provide new use cases to help organizations address new challenges.» Some of the key updates relate to emerging workplace trends such as increased hybrid and remote work, the use of AI for manipulation and deception, access control, and visitor screening.

AI abuse leads to 15-year sentence

James Strahler II, 37, of Columbus, has been sentenced in the U.S. to 15 years in prison for using both real and AI-generated sexually explicit images and intimidating victims with threats of violence. «Strahler had installed more than 24 AI platforms and more than 100 AI web-based models on his phone,» the Justice Department said. «The defendant used telephone calls, voicemails, text messages and web postings to engage in a campaign of harassment against his victims. From December 2024 until June 2025, Strahler sent harassing messages to at least six adult female victims. These messages included nude images of the victims, both real and AI-generated. Strahler also posted online AI-generated obscenities he created of children.» The defendant is said to have created more than 700 images of both real victims and animated persons and posted them to a website dedicated to child sexual abuse. He was arrested in June 2025.

Bank takeover suspect extradited

Sergei Anatolyevich Filimonov, 36, a Russian national and web developer, has been extradited to the U.S. in connection with a transnational cyber-fraud conspiracy responsible for large-scale bank account takeover attacks. «Filimonov and his co-conspirators executed a sophisticated scheme involving spoofed domains that mimicked the websites of federally insured financial institutions,» the Justice Department said. «The conspirators purchased sponsored search-engine links to divert unsuspecting banking customers to fraudulent login pages, where victims entered their credentials. The conspirators used the stolen credentials to access bank accounts, review account balances, and initiate unauthorized wire transfers to steal bank account funds.» Filimonov is also accused of developing and maintaining online infrastructure supporting the operation, including interactive databases storing more than 5,000 stolen login credentials and software designed to harvest and transmit sensitive authentication data. One of the backend domains linked to the scheme was seized by U.S. authorities in December 2025. Filimonov has pleaded not guilty to the charges.

$245M crypto theft ringleader pleads guilty

Malone Lam (aka Anne Hathaway, $$$, and King Greavy), 22, a citizen of Singapore and recent resident of Miami, has pleaded guilty in the U.S. for their role as a «ringleader of an international cybercrime conspiracy» that used social engineering to steal and launder cryptocurrency valued at more than $245 million. «The criminal enterprise began no later than October 2023 and continued through at least May 2025,» the Justice Department said. «The scheme developed through connections made on online gaming platforms and was comprised of individuals based in California, Connecticut, New York, Florida, and abroad. The RICO conspiracy used social engineering and occasional home break-ins to obtain information that allowed the conspirators to drain their victims’ cryptocurrency wallets.» Lam is accused of organizing the enterprise, identifying target victims, and coordinating with different co-conspirators. The stolen assets were used to purchase nightclub services, luxury handbags, high-end watches and clothing, rental homes, private jet rentals, a team of private security guards, and a fleet of exotic cars.

Teams to obscure external QR codes

Microsoft said it will provide additional protection for QR codes shared by external users in team messages. «Images containing QR codes from external senders will be obscured by default and require users to reveal them before viewing or scanning,» the company said. «This helps reduce the risk of phishing and fraud by encouraging more deliberate interaction with QR code content.» The feature is expected to start rolling out next month.

Google services abused as phishing relay

A newly discovered phishing campaign has been observed routing «victims through a deliberate chain of legitimate Google services before landing them on credential harvesters or deploying remote access tools,» according to KnowBe4 Threat Lab. What’s unusual about the attack is that it abuses six distinct Google properties (Meet, Search, DoubleClick, Programmable Search Engine, Image Search, and Tag Manager) across a multi-hop redirection path to bypass email security filters. «The page pulls live company logos from Clearbit, real-time website screenshots from a third-party screenshot API, and uses Google’s public DNS to validate the victim’s corporate email domain,» it added. Recent phishing campaigns have also increasingly exploited .vu, Vanuatu’s country-code top-level domain, for setting up malicious infrastructure. KnowBe4 said it recorded a 159% increase in phishing sites, 1,660 unique domains, and over 28,000 malicious emails from April through July 2026. «Security vendors have historically seen almost no .vu traffic, so there is no TLD-level risk signal built into most threat feeds,» the company said. Another «iCloud Sign-In Alert» phishing attack has been found to detect the operating system and serve a remote access tool for Windows users and a credential harvesting page for Apple users. «Everyone else gets walked through a fake Microsoft login while a human operator watches the credentials arrive in Telegram in real time,» KnowBe4 said.

Smart TV privacy claims spark scrutiny

LG is drawing criticism over claims from YouTube channel Gamers Nexus that its smart TVs gather extensive information about users and their surroundings to fuel its advertising business. The channel crew said it observed the TV capturing IP addresses, location data, and the names, signal strengths, and channel numbers of nearby Wi-Fi networks. The consumer hardware also enumerated devices on the local network that were not paired with it, including smartphones, watches, routers, thermostats, air purifiers, server baseboard management controllers, and PCs. The move has been described as «an egregious invasion of privacy.» In a statement shared with The Register, the company said the allegations are not true. «LG TVs process voice data only when the voice button on the remote control is pressed and held, or when a wake word such as ‘Hi LG’ is recognized after the user has activated the Far-Field voice recognition feature,» the company said. Other than these instances, the TVs do not collect or record ambient conversations. If the wake word is not recognized, no voice data is transmitted to the server; wake word detection is processed locally on the device and immediately deleted. Additionally, to provide smart TV functionalities, LG TVs feature the ability to scan for and connect to nearby devices on the same network. This is a standard function commonly available on smart TVs and smart home devices.»

Malicious npm packages compromise wallets

A set of 13 malicious wallet packages have been discovered on the npm registry. According to InstallSafe, their names reference wallets, signing, analytics, Solana, Base, or mobile components. «Any computer that has this package installed or running should be considered fully compromised,» GitHub warns in an advisory. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Blob URLs hide phishing pages

Barracuda has disclosed details of a DocuSign-themed attack campaign that replaces the traditional phishing site with a phishing page generated inside the victim’s browser using blob URLs. «Victims are routed through legitimate Microsoft services, making the attack appear trustworthy and reducing common warning signs,» the cybersecurity company said. «Because the page exists only within that browser session, there is no persistent phishing URL for security tools to retrieve, analyze, or blocklist in advance. Because the visible navigation remains within trusted Microsoft services, users and automated scanners may be less likely to identify the activity as malicious.»

5,400 hacked sites fuel EtherHiding

More than 5,400 compromised websites have been used for carrying out EtherHiding attacks. «The compromised websites have little in common beyond being small businesses (clinics, plumbers, e-commerce shops) with no shared industry, region, or owner,» Netskope said. «These compromised sites include either an inline script or a spoofed package that calls the BSC testnet and downloads a ClickFix overlay as the next step of the attack, which instructs visitors to run a command on their PC.» Another variant of the attack has been found to open a covert WebRTC data channel for command-and-control (C2) instead of serving the ClickFix overlay and use it to receive and execute arbitrary JavaScript code.

Executive SSNs flood dark web markets

Rapid7 said it has identified 476 instances of compromised Social Security numbers (SSNs) across 395 unique corporate personnel since early 2026. «Over 73% of these exposures directly targeted top-level leadership, with C-suite executives comprising 44.6% of affected profiles and Presidents making up another 28.6%,» it said. «Unsurprisingly, given the geographical nature of SSNs, 95.6% of these leaks stemmed from U.S.-headquartered organizations, concentrated heavily in high-value sectors like Financials (over 25%) and Industrials (17%).» Marketplaces like Xilo, Bankom, and PeopleFinder together account for 81.5% of all executive SSN leaks present in its dataset, led by Xilo at 40.8%, Bankom at 21.8%, and PeopleFinder at 18.9%.

MCP tools expose high-impact attack paths

An analysis of 33,563 published MCP server builds containing 475,865 tools has found that 2 in 5 server builds include a tool that can access sensitive data or take consequential action and 1 in 13 server builds contain a code or command-execution primitive. «When an MCP host makes a tool available to a model, the tool’s description can enter the model’s context,» Island said. «After the tool is called, its returned text can enter that context too. The model may interpret either as guidance, not just documentation. An attacker may not need a malicious binary. A paragraph of natural language can be enough.» This makes the «instruction supply chain» a critical attack surface, allowing bad actors to embed covert instructions in tool descriptions and prompts that a model may read and trigger unintended actions without requiring malicious executable code. «Security teams need a control plane that governs a tool from discovery to execution: inspect its code and instructions, constrain its capabilities, verify configuration changes, and evaluate each action in runtime context,» Island said. «Approval cannot be a one-time package score; it must account for the tool version, the agent and user invoking it, the destination, the data in scope, and the action being attempted.»

MFA-bypassing PhaaS hits 40+ countries

Hundreds of organizations across more than 40 countries have been targeted by BigBear 2.0, a rebranded Evilginx2-based Microsoft 365 phishing-as-a-service (PhaaS) operation. The stolen records are tied to 461 organizations. CloudSEK, which was able to gain admin access to the threat actor panel, said the operation has «exfiltrated 5,137 credential records — including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies — affecting 3,331 unique victim IPs across 40+ countries.» The multi-user PhaaS panel has been leased to at least five affiliate operators so far. «The core technique employed is adversary-in-the-middle (AitM) phishing,» CloudSEK said. «Unlike classical phishing that only captures passwords, Evilginx2’s reverse proxy relays the entire session.»

FBI unveils first cyber strategy

The U.S. Federal Bureau of Investigation (FBI) has outlined its first-ever cyber strategy, stating it «will detect shifts in adversary intent and capability, disrupt their ability to profit or operate safely, expose their tradecraft and enablers, bring offenders to justice with domestic and international partners, and provide the evidence and intelligence that underpin sanctions, diplomatic action, and partner law enforcement actions.» The agency also aims to attribute malicious cyber activity with confidence, support victims following intrusions, share actionable intelligence, and partner with U.S. allies and the private sector to increase impact. Furthermore, the agency said it will «adopt agentic AI in ways that securely scale defense and disruption, and will implement AI-enabled tools to detect, divert, and deceive threat actors where operationally appropriate.»

The lesson this week is smaller than “patch faster.” Stop giving ordinary things unlimited trust. Extensions, packages, redirects, sessions, AI tools, exposed services — most of the trouble begins when something familiar is allowed to do too much.

Security still breaks at the boring handoffs: what gets access, what stays exposed, what gets inherited, and what nobody checks twice. Attackers do not need every door open. One lazy hinge is enough. That is probably the part worth remembering after the headlines disappear.

30 JUL 2026

admin Noticias, Trending AIPowered attacks Chrome CYBERDEFENSA.MX DNS Flaws Hacking Hijacking SonicWall Stories

AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories – CYBERDEFENSA.MX

A lot of security still comes down to trusting the wrong screen.

This week, that screen might be a login page, an install guide, a recruiter call, or a familiar service behaving slightly wrong. Behind it: reused credentials, exposed systems, quiet loaders, abused trust, and exploit paths that should have been harder.

Some defenses improved. The loose parts still got found first. Anyway, here’s the mess.

The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

Phishing delivers XWorm

A cybercrime group known as xplogs22 has been observed targeting Russia and other CIS countries with phishing emails that deliver Xworm. The group, per F6, is believed to have been active since November 2023. Prior attacks mounted by the threat actors leveraged Formbook and Snake Keylogger, before switching to XWorm around July 2025. In recent months, Russian customers of the banking sector have also been targeted by an Android trojan called LunaSpy as part of social engineering attacks. LunaSpy can capture camera streams, record audio and the screen, and collect sensitive data. The malware is disguised as an antivirus application to evade detection.

Custom ransomware targets Russia

The financially motivated extortion group known as Toy Ghouls (aka Bearlyfy and Labubu) has targeted organizations in the Russian Federation, primarily in the manufacturing, financial services, retail, and technology sectors, with a custom ransomware family called GenieLocker since March 2026. According to Kaspersky, the group previously relied on third-party encryptors like RedAlert, LockBit, and Babuk. «GenieLocker, apparently a custom design, upgrades their toolkit and reduces their reliance on third-party software,» Kaspersky said. In at least one case, initial access to the target environment was obtained via an OpenVPN connection originating from an external partner’s network, with the attackers likely exploiting the trusted relationship to breach the target, conduct reconnaissance, deliver additional tools for credential harvesting, and perform lateral movement via RDP and SSH to reach other Windows and Linux hosts. «During the impact phase, the attackers encrypted files on the compromised Windows machines with the PE version of the GenieLocker ransomware,» Kaspersky said. «On the compromised Linux and ESXi servers, they stopped active virtual machines and encrypted their disks using the ELF version of GenieLocker.» Details of the activity were first highlighted by F6 in March 2026.

Crypto-stealing payloads deployed

The malware loader known as CastleLoader, which has been previously used to deliver CastleStealer and a Python-based remote access trojan (RAT) via ClickFix-style lures, has now been used to distribute two payloads tied to the Needle Stealer framework: a Rust-based desktop wallet spoofer, and a Golang-based malicious browser extension installer. Arctic Wolf said it also identified a new shellcode loader variant spreading via digitally signed installers. The campaign has been codenamed Noidret. The introduction of these new tools is seen as an attempt to focus on cryptocurrency-specific targeting and establish browser-level persistence.

Fileless WebDAV execution

Speaking of ClickFix, CyberProof said it tracked a ClickFix variant that involves tricking victims into pasting a single command into the Windows Run dialog, which then communicates with a WebDAV endpoint and uses rundll32.exe to load a remote, non-DLL payload and call its first export by ordinal without having to leave any artifacts on disk. «The payload (gc.key, j.pm, or goog.ct) is a file served from the attacker WebDAV share and is not a standard DLL by extension,» CyberProof said. «It is invoked by rundll32.exe through ordinal #1, which runs its primary routine while keeping the export name off the command line.»

Fake Claude guide spreads malware

Victims searching Google for how to install Claude on a Mac are being served sponsored results that lead them to a weaponized claude.ai/share conversation dressed up as an Apple Support install guide. The «guide» instructs them to open Terminal and paste a single curl command, ultimately leading to execution of MacSync Stealer. «MacSync is a six-stage kill chain, not a smash-and-grab,» Huntress said. «The components are a thin zsh loader, a server-side AppleScript stealer that keeps the valuable logic off the endpoint and behind an api-key gate, a native Mach-O RAT for hands-on access, a separately signed helper built to steal a single TCC permission (Screen Recording), and a set of wallet-app trojans. Each stage sets up the ones that follow.»

Malware, intrusions, and influence ops

A Russian-speaking threat group is said to be behind an active campaign called Operation STANDOFF that combines commodity-malware distribution, a proxy-botnet that conscripts victims into relay infrastructure, targeted hands-on-keyboard intrusion of enterprise networks, and an AI-driven, multi-channel influence and engagement-manipulation capabilities under one roof. «The operation is materially more than a botnet,» VMRay Labs said. «It couples automated, scaled cybercrime with hands-on-keyboard, targeted intrusion and a coordinated influence capability, all on the same infrastructure and built by a common development team.» The influence apparatus uses networks of fake Telegram accounts and AI-generated personas to artificially boost the visibility of content, push commercial promotions, and drive traffic to gambling and fraud-adjacent services. The activity uses a pay-per-install (PPI) loader masquerading as software installers that delivers Raccoon Stealer, RedLine, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig cryptocurrency miner, while a second, targeted operations layer relies on a bespoke, multi-operator command-and-control console through which human operators conduct hands-on-keyboard intrusions of selected victims.

Fleet takeover flaw exposed

Security researcher Eaton Zveare has disclosed details of a vulnerability in My Eicher, a fleet management system developed by the Volvo Group and Eicher Motors for Indian commercial vehicle customers, that enabled the discovery of unauthenticated internal and. admin APIs that could be exploited to gain high-level access to systems and even enable account takeover. «Account takeover made it possible to gain control over a person’s (or company’s) entire fleet, which could consist of hundreds of vehicles,» Zveare said. Following responsible disclosure on November 3, 2025, the issue was addressed at some point by November 20.

AI agents automate exploitation

A Chinese-speaking threat actor has been carrying out an AI-enabled autonomous hacking campaign, targeting infrastructure using seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824). The actor, operating under the aliases knaithe and KnYuan, has leveraged DeepSeek, via the Hermes Agent framework, as their autonomous offensive operator, while orchestrating the operation through Telegram to enumerate targets, source exploit tools, and initiate attacks without human intervention. «Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making,» Unit 42 said. Additionally, the threat actor is said to have used Claude Code, Codex, and Qwen Code in a limited capacity. «When initial exploitation failed due to the target environment’s restrictive configurations, their Hermes Agent autonomously conducted searches for known critical-severity Common Vulnerabilities and Exposures (CVEs),» Unit 42 said. «It initially surveyed 10 product families, scanning GitHub for trending proofs of concept (PoCs) and prioritizing vulnerabilities by attack surface.»

Trusted access fuels cryptomining

Details have emerged about a covert Linux XMRig campaign that exploits trusted access, and weaponizes Pluggable Authentication Modules (PAM) to create a forensic smokescreen and deploy a highly customized XMRig botnet implant. «Initial access was achieved by exploiting a trusted third-party relationship, highlighting critical supply chain risks,» Group-IB said. «The threat actor escalated to root access, but weaponised the pam_rootok policy to seamlessly impersonate multiple low-privileged users to create a forensic smokescreen designed to confuse incident responders and establish a ‘hydra-like’ redundant persistence across unmonitored accounts.» The campaign is characterized by efforts to actively suppress system visibility by disabling logging services and removing authentication logs to blind standard file-based monitoring. The campaign was first observed in March 2026.

Fake recruiter delivers stealer

Threat actors are masquerading as recruiters and trucking victims into installing a malicious application disguised as an AI meeting tool called Relay. The malware targets both macOS and Windows users, and attempts to steal sensitive data including browser credentials, wallet-related information, Keychain data, and Telegram sessions, per SlowMist.

900,000 customers affected

Australian energy company Origin Energy said it completed the initial phase of its review into a security incident that took place earlier this month, finding that «the information of approximately 900,000 current and former customers was accessed.» The information accessed may include name, address, date of birth, phone number, last four digits of a credit card, or the BSB and last three digits of a bank account, and account details.

Healthcare SaaS accounts targeted

Health-ISAC is warning of an increase in successful attacks conducted by ShinyHunters. «The group appears to prioritize identity compromise and SaaS access over traditional ransomware deployment,» it said. «The operational pattern described in recent incident reporting aligns to a repeatable chain: vishing (voice social engineering) → helpdesk/MFA reset or device re-enrollment → Microsoft Entra (or Okta/Google) SSO account takeover → pivot into connected SaaS platforms → rapid data exfiltration for extortion leverage. Even when victim statements indicate limited operational impact, the described tradecraft is the key defensive lesson. SSO is the control plane, and ShinyHunters’ leverage is created through data theft at cloud scale.»

Supply chain defenses tightened

GitHub has laid out the various steps it has taken to harden the supply chain at various stages and combat attacks that target weaknesses in package repositories and CI/CD systems for malware propagation. Some of these include: (1) npm adding preventive account protection for high-impact accounts, (2) safer pull_request_target defaults for GitHub Actions checkout, (3) better controls over who and what triggers GitHub Actions workflows, (4) read-only Actions cache for untrusted triggers, (5) support for CircleCI in npm trusted publishing, (6) Action workflow network firewall, (7) staged publishing for npm, (8) default package cooldown for Dependabot version updates, (9) self-service credential revocation for incident response, and (10) expanded credential revocation API support.

Seven critical Chrome flaws fixed

In an update released on July 29, 2026, Google shipped patches to address 370 flaws in its Chrome browser, including seven that are rated critical in severity (from CVE-2026-17650 through CVE-2026-17656). Of these, 349 flaws were reported by Google itself, with the tech giant noting that the bugs were detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL. None of the patched vulnerabilities have been flagged as actively exploited. The fixes are available in versions 151.0.7922.71/.72 for Windows and Mac and 151.0.7922.71 for Linux. Google has addressed over 1,800 vulnerabilities in Chrome since the beginning of the year.

Edge devices need forensic visibility

The U.K. National Cyber Security Centre (NCSC) has urged network device manufacturers to help incident response teams by making it easier to gather evidence after a compromise. «Forensic observability is particularly important for edge devices such as firewalls, VPN gateways and other network appliances,» NCSC said. «These systems often sit at trust boundaries and are increasingly targeted by sophisticated threat actors. Forensic observability means giving defenders reliable ways to understand what a device is doing, what it has done and whether it can still be trusted after an incident. This includes telemetry, logging, configuration state, and the ability to collect forensic data from both memory and data at rest. Manufacturers should provide supported mechanisms for gathering the evidence needed to investigate incidents, assess impact, and restore trust in affected systems.»

Phishing pages built in real time

Barracuda has revealed that LogoKit has evolved from a standard phishing kit into a «real-time deception platform» capable of building customized phishing pages for each victim. «LogoKit has moved beyond static fake login pages, such as pre-built replicas of popular brands, to the creation and use of real-time, highly personalized phishing experiences,» it said. «The platform uses legitimate commercial web services to recreate a victim’s corporate login experience, making phishing attacks more convincing and harder to detect. Every victim effectively receives a uniquely branded phishing page, making generic indicators of compromise harder to identify.» This involves capturing a real-time screenshot of the victim’s legitimate website and building phishing pages tailored to them. LogoKit uses the commercial Thum.io service to «create full, legitimate website screenshots for the phishing background and Clearbit to add legitimate brand logos.» The attackers also rely on legitimate services, including Google Favicon, ImageKit and Microlink APIs, to dynamically load authentic logos and website imagery in real-time. LogoKit campaigns use phishing emails bearing warnings about passwords or delivery failures and timesheet updates to direct victims to the fake pages.

Exploitation accelerates in 2026

A new analysis from VulnCheck has revealed that despite a significant uptick in vulnerability discovery and disclosure, 23.43% of known exploited vulnerabilities (KEVs) showed evidence of exploitation on or before the day the CVE was published. «At the same time, vulnerabilities appear to be being exploited faster, with the median time from CVE publication to KEV falling from 120 days in 2025 to 80 days during the first half of 2026,» VulnCheck said. «Of 1,061 vulnerabilities attributed to AI-assisted discovery, only 14, or 1.3%, have been confirmed as exploited in the wild, roughly matching the overall exploitation rate of all vulnerabilities in the first six months of the year.» The top technology categories being targeted by exploitation activity include CMS systems, network edge devices, operating systems, server software, and AI infrastructure (e.g., Langflow, Majordomo, lollms, LiteLLM, and dify).

Credential stuffing hits SonicWall

An active, broad, and opportunistic credential stuffing campaign has been observed since July 25, 2026, resulting in successful unauthorized logins to SonicWall VPN and firewall accounts. To date, 92 unique user accounts across 30 organizations have been impacted. «The activity stems from five IPs and relies on infrastructure hosted on DigitalOcean to compromise numerous, seemingly unrelated organizations,» Huntress said. «Current telemetry indicates this is an automated credential validation attack, consistent with similar campaigns targeting SonicWall VPNs throughout 2025 and 2026.»

Threat actors get new names

Google Threat Intelligence Group (GTIG) said it will be rolling out a unified naming schema for tracking threat actors as part of its effort to standardize tracking across platforms and public reporting. «The new naming convention aligns with industry standard threat actor naming systems,» GTIG said. To that end, the new schema utilizes a cryptonym-based approach employing two-word combinations for each distinct threat actor, similar to those adopted by CrowdStrike (e.g., Mustang Panda) and Microsoft (e.g., Twill Typhoon). The first word is a term chosen to represent the specific actor, while the second word categorizes threat clusters by motivation, attribution, or activity type. Going forward, APT44 (aka Sandworm) will be referred to as Sandworm Relic, where Relic is the category name for threat actors of Russian origin. Similarly, those from China will be grouped under Castle, Iran under Ion, North Korea under Neptune, and cybercriminal gangs under Comet. GTIG said it will continue to use UNC (or uncategorized) for threat clusters that are still in the early stages of investigation.

Hidden desktop hijacks sessions

A new remote access trojan (RAT) called MedusaHVNC is being sold as malware-as-a-service (MaaS), per BlackFog. The malware embeds a hidden virtual network computing (HVNC) module that opens a browser on a separate Windows desktop that’s out of sight of the victim. «The browser still runs on the victim’s device, so it can load an existing profile, including cookies and session state,» BlackFog said. «This gives the operator access to live, logged-in sessions while the activity continues to come from the victim’s usual machine.» The seller lists Chrome, Edge, Brave, Firefox, and Telegram as supported applications. The malware uses a 5-stage infection chain. It begins when the legitimate «wscript.exe» binary executes a JavaScript launcher, which then sets off the subsequent steps, including dropping additional payloads and using AutoIT to decrypt and launch MedusaHVNC, which then communicates with an external server to exfiltrate data.

DNS hijack exposed credentials

CubePilot has announced an operational disruption stemming from a DNS hijacking attack. Unknown threat actors are said to have gained control of the cubepilot[.]org domain DNS settings on July 24, allowing them to intercept traffic intended for internal systems. The threat actors also obtained TLS certificates covering all cubepilot.org subdomains. «The certificates obtained by the attacker covered every cubepilot.org subdomain, so credentials entered on any of our services on 24 July may have been captured – the portal and the forum included,» CubePilot said. «If you used the same password anywhere else, change it there now.» CubePilot has since regained control of its domains and revoked the fraudulently issued certificates.

Spear-phishing delivers SpyGlace

The threat actor known as APT-C-60 has continued to target Japanese organizations with spear-phishing emails to deliver SpyGlace malware. «While several changes have been identified, such as a shift in infrastructure from Bitbucket to GitHub and updates to the malware itself, many characteristics remain consistent, including the abuse of legitimate services and the behavior of the malware,» JPCERT/CC said late last year. As of 2026, the spear-phishing emails contain a Proton Drive link to trick recipients into downloading a RAR archive containing a LNK file, which then deploys SpyGlace by downloading an intermediate payload from jsDelivr. «By using legitimate services, the threat actor may be attempting to make communications and downloads appear to be normal access,» JPCERT/CC said.

AI agent validates exploitable flaws

Google has launched a preview of CodeMender, an AI agent designed to scan codebases for security flaws, confirm they are exploitable and eliminate false positives, and generate fixes for developers to review. The tool supports C/C++, Go, Java, Python, Ruby, Rust, and TypeScript. «The agent goes beyond static code-pattern analysis by simulating an attack with exploit code it builds and runs in an isolated, customer-managed sandbox,» Google said. «The agent uses this proof-of-concept exploit to verify that the security flaw poses a legitimate risk. This critical verification phase allows your security practitioners and developers to prioritize validated risks by eliminating false positives.» CodeMender will add support for third-party frontier models later this year.

4,340 extremist URLs flagged

Europol said it supported an action targeting nihilistic violent extremist content online between June and July 2026 with an aim to disrupt The Com online ecosystem and restrict propaganda dissemination. The agency and its partners have flagged 4,340 «horrific» URLs linked to The Com for removal. Belgium, Finland, Hungary, Ireland, Luxembourg, Netherlands, Portugal, Spain, and Sweden participated in the effort. «Groups affiliated with The Com recruit members and groom victims on social media, messaging apps, and gaming platforms to engage in self-harm, animal torture, violent attacks, and the production of child sexual abuse material,» Europol said. «They distribute propaganda on accessible platforms to attract young individuals, funnelling potential members and victims into private forums and chat rooms where radicalisation and victimisation occur. Victims are typically coerced into remaining under the perpetrators’ influence through (s)extortion.» Members of the loose-knit collective also participate in cybercrime, extortion, doxxing, swatting, real-life shootings, stabbings, and other physical violence.

Fake games deliver Amatera

Fake downloads of games, mods, cracks, and software are being used to spread RenPy Loader (aka RenEngine Loader). «Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer,» Malwarebytes said. «RenPy Loader has also been observed delivering other malware, including Hijack Loader and Lumma Stealer, showing that the final payload can vary between campaigns.»

Most failures stay quiet until someone relies on them.

A login works. A partner is trusted. A tool behaves as expected. Then one assumption turns out to be doing all the security work.

That is the part worth checking before next week finds it first.

29 JUN 2026

admin Noticias, Trending Backdoor CYBERDEFENSA.MX Flaws Infostealers kernel Linux malware Tricks Turla

Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More – CYBERDEFENSA.MX

This week was a reminder that attackers do not always need big tricks. One small mistake, one old access path, one missed patch, and suddenly the door is open.

The noise is not all noise, either. Forums are talking, researchers are finding easy cracks, and defenders have more cleanup waiting.

Here’s the full Monday recap.

⚡ Threat of the Week

New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets — Cybersecurity researchers detailed a new variant of the Dirty Frag Linux kernel flaw. Called DirtyClone (aka CVE-2026-43503), it allows local users to gain root privileges via cloned packets. The exploit works successfully on Debian, Ubuntu, and Fedora systems with default namespace configurations. «Any local user on a server or device running a vulnerable kernel who holds or can acquire the CAP_NET_ADMIN capability (frequently obtainable via unprivileged user namespaces) [is exploitable],» JFrog said. «This poses the highest risk to multi-tenant cloud environments, Kubernetes clusters, and containerized workloads where user namespaces are enabled, or privileged containers are deployed.»

🔔 Top News

Critical PTC Windchill PDMlink and PTC FlexPLM Flaw Exploited — A critical remote code execution vulnerability impacting PTC Windchill PDMlink and PTC FlexPLM enterprise Product Data Management (PDM) and Product Lifecycle Management (PLM) software has come under active exploitation in the wild to deploy JSP web shells on susceptible systems. The vulnerability, tracked as CVE-2026-12569, is a case of improper input validation that could allow an attacker to execute arbitrary code by sending a malicious request to the network. Patches for the vulnerability have been released.

OpenAI Previews GPT-5.6 Sol, Terra, and Luna — OpenAI officially unveiled GPT-5.6 Sol, Terra, and Luna, with Sol described as the most capable model yet for cybersecurity. The models are being released in a staggered manner with approval from the U.S. government. The release came days after the company released an improved version of its GPT‑5.5‑Cyber model to trusted defenders as part of the Daybreak initiative and launched a new project called Patch the Planet in collaboration with Trail of Bits to help secure open-source projects. OpenAI has also warned about the dual-use nature of the technology, acknowledging that the same capability that helps a red teamer find a zero-day can also assist a bad actor in exploiting one, and that it will prioritize patching jailbreak techniques against the model. In addition, it has framed the effort as getting the tools in the hands of more defenders before attackers gain the same edge. Much of the concern surrounding the frontier models stems from the fact that artificial intelligence can now identify existing bugs within codebases and work towards creating exploits for them. While the automation of cybercrime is not new, these tools undoubtedly have the potential to further lower the barrier to entry for bad actors.

New Gaslight macOS Malware Discovered — A newly discovered macOS malware dubbed Gaslight is designed to confuse AI-assisted malware analysis tools through embedded prompt injection strings and fake debugging data within the executable. With cybersecurity researchers using AI-powered tools to assist with malware analysis and reverse engineering, the malware attempts to gaslight such tools into thinking there is some issue, potentially causing them to abort, truncate, or refuse an analysis of the artifact. Gaslight has been attributed with high confidence to a North Korean-linked threat actor. The malware itself is a Rust binary with backdoor and information-stealing functionality, enabling the operator to gain a persistent foothold over the infected host. The findings highlight how threat actors are experimenting with anti-analysis methods designed specifically to bypass AI-assisted security platforms.

Turla Uses STOCKSTAY Backdoor in Ukraine Attacks — The Russian state-sponsored threat actor known as Turla has leveraged a previously undocumented .NET backdoor called STOCKSTAY in attacks targeting government and military organizations in Ukraine, and entities that have an interest in Italian foreign policy. STOCKSTAY shares significant code and functional overlaps with Kazuar, a staple implant put to use by the adversary since 2017. Suspected development activity of malware dates back to December 2022.

Amadey, StealC Malware Operations Disrupted in Operation Endgame — A coordinated law enforcement operation, in partnership with private sector companies, dismantled criminal infrastructure powering Amadey and StealC. According to Europol, the operation led to the disruption of 326 servers and 142 domains, the identification of more than €41 million ($47 million) in cryptocurrency linked to criminal activity, and the recovery of approximately 27 million credentials stolen from over 385k compromised systems. Amadey and StealC are sold to cybercriminals under a malware-as-a-service (MaaS) model. Microsoft said criminals use Amadey to gain an initial foothold on victim devices to deploy additional malware, such as StealC, which then steals credentials, cryptocurrency wallets, and other sensitive information that can later be sold or leveraged in follow-on attacks. The two malware families were linked to more than 140,000 infected devices during the first two weeks of May 2026 alone. That said, no arrests were announced as part of the operation.

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-47729 aka Squidbleed (Squid), CVE-2026-12957 (Amazon Q Developer), CVE-2026-12569 (PTC Windchill PDMlink and PTC FlexPLM), CVE-2026-43503 aka DirtyClone, CVE-2026-46331 aka pedit COW (Linux Kernel), CVE-2026-30040, CVE-2026-30041 (FastStone Image Viewer), CVE-2026-45585 (Microsoft WinRE), CVE-2026-8461 aka PixelSmash (FFmpeg), CVE-2026-55200 (libssh2), CVE‑2026‑20971 (Samsung KNOX kernel), CVE-2026-10086, CVE-2026-10712, CVE-2026-12053 (GitLab CE and EE), CVE-2026-13028, CVE-2026-13032, CVE-2026-13033, CVE-2026-13038 (Google Chrome), CVE-2026-53605 (Reachy Mini Wireless image), CVE-2026-13136, CVE-2025-15660, CVE-2026-13135 (Synology MailPlus Server), CVE-2026-11374 (ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus and ADAudit Plus), and a critical Infoblox NIOS privilege escalation vulnerability (no CVE).

🎥 Cybersecurity Webinars

Stop AI-Driven Cyberattacks Before They Stop Your Business → Hackers are now using AI to launch cyberattacks at machine speed. If your defenses are built for human-speed threats, you are at risk. Join this webinar to get a step-by-step blueprint to fight back. Learn exactly how to block AI-driven attacks and protect your company before a crisis hits.

When AI Goes Rogue: How to Secure the New Cyber Attack Surface → As companies rush to adopt AI, hackers are turning these tools into a massive liability by hijacking AI agents and leaking trade secrets. Join this urgent webinar to see exactly how attackers weaponize AI against businesses. You’ll get a practical blueprint to lock down your setups, fix risky configurations, and stop your own tech from going rogue.

Building at Machine Speed: How to Secure AI Software Delivery → AI tools are generating code faster than security teams can review it, introducing hidden risks into software pipelines. Join this webinar to learn how to catch vulnerabilities and govern AI risk without slowing down development. You’ll get a practical roadmap to protect your software supply chain and scale AI engineering safely.

📰 Around the Cyber World

China’s New Zhipu AI Reportedly Matches Claude Mythos in Vulnerability Discovery — The Wall Street Journal reported that a new model released by China’s Zhipu AI, GLM-5.2, matches the performance of Anthropic Mythos when it comes to finding vulnerabilities, narrowing the gap between top U.S. models and those developed by Chinese companies. The ability of AI systems to autonomously find security defects in software has created new urgency to efforts that entail the use of models to quickly close them before they can be exploited by bad actors. There are also worries that these models, in the wrong hands, can become potential enablers of cyber warfare. The Trump administration has called for the creation of a framework that grants the federal government the ability to evaluate AI models’ capabilities and determine which qualify as «covered frontier models,» a designation for AI systems with advanced cyber capabilities.

Indirect Prompt Injection in Agentic Coding Tools — Mozilla’s Zero Day Investigative Network (0DIN) characterized indirect prompt injection as a «very real and serious attack vector that can result in catastrophic damage, much of which will be irreversible.» In the case of agentic IDEs and coding agents, they can request access to various tools, which, once approved, can pave the way for code execution, file system operations, and network calls. Specifically, an attacker can obtain code execution using a seemingly harmless repository by chaining trusted setup instructions, routine error handling, and automated agent behavior. The attacker-controlled repository does not even have to contain any malicious code. Instead, it’s fetched at runtime from a DNS TXT record by framing it as an essential step during the installation phase when a developer copies the repository link and instructs the agent to get it running. «In short, agentic coding tools have access to everything they need for this: private data, including environment variables, credentials, API keys, and local configuration files,» 0DIN said. «Untrusted content, such as repositories, documentation, and error messages from recently installed packages, can inject malicious models to steal this data.»

New KuinaExtractor Rust Infostealer Spotted — A new Rust-based information stealer called KuinaExtractor comes fitted with capabilities to harvest web browser data, crypto wallets and credentials for services such as Roblox, Steam and Discord. Said to be in active development since December 2025, the stealer also includes a Chrome app-bound encryption (ABE) bypass. In parallel, the malware developer worked on two short-lived projects known as KuinaCookieExtractor and Zenith C2 before they were abandoned. KuinaCookieExtractor goes beyond browser cookies to include Roblox and Steam sessions, Minecraft and FileZilla logins, Telegram tdata and Discord tokens, and exfiltrates over a Discord webhook rather than Telegram.

New LokiBot Campaign Surfaces After a Hiatus — A new email phishing campaign has been observed delivering LokiBot via a JavaScript attachment. Once launched, the script triggers the execution of a PowerShell loader that runs a .NET injector payload that deploys the LokiBot malware. LokiBot is capable of harvesting credentials from password managers like 1Password, Enpass, and KeePass, and contacts an external server to receive and execute commands.

Phishing Campaign Drops Malicious Chrome Extension — Invoice-themed email phishing lures written in Italian are being used to launch JavaScript attachments masquerading as PDF documents. «The most interesting part of this infection was not the initial JavaScript. The malware installed a malicious Google Chrome extension and paired it with a Native Messaging Host,» D3 Lab said. «This combination allowed code running inside Chrome to request PowerShell commands on the Windows system.»

Time as an Attack Surface — New research from NCC Group has argued the need for treating time as a «first‑class attack surface,» stating clock drift, time synchronisation failures, and deliberate oscillator manipulation can be exploited to undermine cryptography, authentication, industrial automation, and safety systems. «The risk is amplified by broader technological trends,» NCC Group’s Andy Davis said. «Cloud computing, containerisation, and virtual machines abstract time away from physical hardware, placing it under the control of hypervisors and orchestration layers. At the same time, Industrial Control Systems, IoT devices, and safety-critical platforms increasingly rely on low‑cost oscillators and commodity components that are vulnerable to environmental influence and physical manipulation. Systems that once relied on isolated, deterministic timing sources are now interconnected, synchronised, and exposed.»

Threat actors Exploit Xiongmai DVR Flaw to Deliver Proxy SDK — Threat actors have been exploiting CVE-2024-3765, a vulnerability in Xiongmai DVR, to deploy commercial residential proxy SDKs using a Mirai botnet-derived HTTP downloader. «All DDoS and scanning capability has been stripped,» the Nokia Deepfield Emergency Response Team (ERT) said. «What remains is a minimal HTTP client and an embedded userspace ELF loader – Mirai reduced to a delivery truck.» The main stager installed following a successful compromise deploys a proxy binary called PacketSDK, which is part of the IPIDEA residential proxy network disrupted by Google earlier this year. The stager also contains a remote code execution backdoor that polls an external server for updates every 2 minutes.

Nation-State Targeting of Water Systems — DomainTools warned that water and wastewater infrastructure have become strategic pressure points for state and state-aligned actors from China, Iran, and Russia. «The combination of chronic underinvestment and weak baseline operational technology (OT) security makes many of these critical systems easy to compromise,» the company said. «Such intrusions can have both physical and psychological impact, and disruptions often affect civilian life, public health, and trust in government.»

Anthropic Accuses Alibaba of Obtaining Illicit Access to Claude — Anthropic has accused the Chinese company Alibaba of what it described as the «largest campaign to illicitly extract Claude’s capabilities.» The attacks occurred between April 22 and June 5, 2026, when «operators afﬁliated with Alibaba and Alibaba Qwen, Alibaba’s AI lab,» allegedly generated «more than 28.8 million exchanges with Claude through almost 25,000 fraudulent accounts,» per Anthropic. The distillation campaign targeted its capabilities, such as agentic reasoning, software engineering, and long-horizon tasks, while evading detection using obfuscation techniques and proxy networks.

Linux Foundation Unveils Akrites and OSERA — The Linux Foundation has announced Akrites as a coordinated effort to address and disclose vulnerabilities in critical open-source software as AI accelerates both the scale and speed of vulnerability discovery. «The initiative provides a single, trusted place to coordinate, remediate, and disclose, with a shared SIRT [Security Incident Response Team] serving as a predictable partner for maintainers rather than a flood of uncoordinated reports,» the foundation said. The initiative also plans to work with critical infrastructure operators to help deploy fixes before in-the-wild exploitation. The Linux Foundation has also announced its intent to form an Open Source Enterprise Resiliency Alliance (OSERA) that aims to strengthen the open-source components that underpin the financial services sector through a vendor-neutral, upstream-aware approach. «OSERA complements the recently announced Akrites, the cross-industry effort enabling coordinated disclosure and upstreaming,» the foundation said. «As financial-services downstream complement to Akrites, OSERA will collaborate with Akrites in the upstreaming process and, together with the Open Source Security Foundation, to represent the voice of the industry in defining remediation standards.»

Microsoft Extends Windows 10 Consumer Extended Security Updates by a Year — Microsoft quietly extended the Extended Security Updates (ESU) program for Windows 10 consumers by a year, letting eligible users get updates through October 12, 2027. To enroll in the consumer Windows 10 ESU program, devices need to be running Windows 10, version 22H2 Home, Professional, Pro Education, or Workstations edition and cannot be offered for devices in kiosk mode or those that are joined to an Active Directory domain or Microsoft Entra and/or enrolled in a Mobile Device Management (MDM) solution.

Microsoft’s Secure Boot Certificates Have Expired — In related Microsoft news, the certificates that manage UEFI Secure Boot trust – namely, Microsoft Corporation KEK CA 2011, Microsoft UEFI CA 2011, and Microsoft UEFI CA 2011 — expired on June 24 and 27 2026. A third certificate, Microsoft Windows Production PCA 2011, will expire on October 19, 2026. «Many Windows PCs manufactured since 2024 already have the updated 2023 certificates,» Microsoft said. «For the remaining devices, Microsoft is delivering new Secure Boot certificates through Windows monthly updates, with partner original equipment manufacturers (OEMs) making firmware updates available to help ensure compatibility.» Google Cloud has also released guidance on how to update Compute Engine Shielded VM instances to trust the updated Microsoft Secure Boot certificates for UEFI Secure Boot. To apply Secure Boot certificate updates for Linux on Azure virtual machines, it’s recommended to follow the actions outlined by Microsoft here. Separately, Linux users are advised to update their shims to the latest versions signed by the new key. It’s important to note that devices that haven’t received the newer 2023 certificates will continue to function normally, and standard Windows updates will continue to install. However, these devices will no longer receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot-level vulnerabilities.

Fake OpenAI Organization Invites Used in New Poisoned Tenant Campaign — Phishing emails are being sent from threat actor-controlled ChatGPT tenants, inviting recipients to join an organization with the likely goal of harvesting sensitive information shared in the AI chatbot. «The emails came from OpenAI’s legitimate notification address (noreply@tm.openai.com), passed all standard email authentication checks, and referenced our company by name,» Push Security said. «They looked exactly like a routine organizational invitation because, technically, they were one.» The development comes as threat actors are abusing AI chatbot chat sharing functionality to distribute pages containing malicious instructions, turning them into malware delivery platforms. «The attacker has used ChatGPT’s code rendering feature to build a fully designed fake page that mimics a ChatGPT service disruption, redirecting victims to a convincing clone of ChatGPT’s download page that delivers a malicious executable,» Push Security noted. The activity has been codenamed LLMShare.

🔧 Cybersecurity Tools

Sulla → It is an open-source security tool by Praetorian that scans internal network SMB file shares to find exposed credentials and sensitive data. Operating as a fast, low-noise static binary, it maps Active Directory environments and uses multi-layered filtering with the Titus engine to perform in-memory analysis for cloud keys, passwords, and tokens. It outputs structured, real-time results to help security teams identify and remediate internal data exposure before it can be exploited.

Karna → It is a Web Application Firewall (WAF) module specifically engineered for the Kong Gateway to provide modern, scalable security for web applications. By integrating directly into the Kong ecosystem, it allows organizations to enforce fine-grained security policies and filter malicious traffic at the gateway layer, ensuring that protection is applied consistently across distributed services without adding significant latency.

Disclaimer: This is strictly for research and learning. It hasn’t been through a formal security audit, so don’t just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law.

Conclusion

This week, keep it simple. Break the small thing, find the forgotten access, wait for someone to say they meant to patch it.

No genius required. Just old mistakes with fresh damage. Shut the door. Check the locks.

25 MAY 2026

admin Noticias, Trending 0Days Botnets Chain Chaos CYBERDEFENSA.MX Defender Flaws Linux Router Supply

Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos – CYBERDEFENSA.MX

Monday recap. Same mess, new week.

A sketchy dev tool got people pwned, old bugs came back from the dead, and security products somehow needed protecting from themselves. A bunch of companies spent the week checking old boxes and forgotten servers they should’ve patched years ago. Good times.

Phishing crews are getting smarter too – less obvious scam junk, more targeted stuff that actually looks real. Meanwhile, botnets are grabbing anything exposed to the internet like it’s free candy. The Internet’s still a dumpster fire.

Let’s get into it.

⚡ Threat of the Week

GitHub Breached via Nx Console VS Code Extension—GitHub officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension. The attack is said to have allowed the threat actor, a cybercriminal group known as TeamPCP, to exfiltrate about 3,800 repositories. GitHub said it has taken steps to contain the incident and rotated critical secrets, adding it’s continuing to monitor the situation for follow-on activity. The Nx team revealed that the extension, nrwl.angular-console, was breached after one of its developers’ systems was hacked in the wake of the recent TanStack supply chain attack. Other companies that were impacted by the TanStack compromise include OpenAI, Mistral AI, and Grafana Labs. Grafana Labs was also the target of an extortion attempt, but the company said it refused to pay the hackers who had threatened to release the company’s codebase. The incidents are just some examples of the long tail of downstream victims emerging from the Mini Shai-Hulud campaign. This, coupled with TeamPCP’s public release of the Shai-Hulud code, marks a significant evolution in software supply chain threats, as it gives attackers a ready-made blueprint for fleshing out similar worms targeting open-source repositories and developer environments.

🔔 Top News

Microsoft Took Down Fox Tempest—Microsoft has cracked down on Fox Tempest, a cyber threat actor that fueled Rhysida ransomware attacks and other infections involving Oyster, Lumma Stealer, and Vidar. The group operates upstream in the malware and ransomware supply chain, acting as an enabler and providing tools for other threat actors to carry out attacks. This included a fraudulent code-signing service that let cybercriminals deploy malware «through the front door» without being detected. While bad actors have been known to resell code-signing certificates for at least a decade, Fox Tempest’s operation stood out because it provided a scalable service for extortion, phishing, SEO poisoning, or malware-laced advertising.

9-Year-Old Linux Kernel Flaw Enables Root Command Execution—A new vulnerability disclosed in the Linux kernel remained undetected for nine years. The vulnerability, tracked as CVE-2026-46333 (CVSS score: 5.5), is a case of improper privilege management that could permit an unprivileged local user to disclose sensitive files and execute arbitrary commands as root on default installations of several major distributions like Debian, Fedora, and Ubuntu. The issue was introduced in November 2016.

Microsoft Warned of Two Actively Exploited Defender Vulnerabilities—Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender have come under active exploitation in the wild. While CVE-2026-41091 could allow an attacker to gain SYSTEM privileges, CVE-2026-45498 relates to a case of denial-of-service. Although Microsoft has not formally confirmed, the vulnerability descriptions for CVE-2026-41091 and CVE-2026-45498 overlap with those of RedSun and UnDefend, two Defender zero-days that were disclosed by Chaotic Eclipse (aka Nightmare-Eclipse) last month.

Newly Disclosed Drupal Core Flaw Under Attack—A critical security flaw impacting Drupal Core has come under active exploitation within days of public disclosure. The vulnerability in question is CVE-2026-9082 (CVSS score: 6.5), an SQL injection vulnerability affecting all supported versions of Drupal Core. Drupal acknowledged that «exploit attempts are now being detected in the wild.» Thales-owned Imperva said it has observed over 15,000 attack attempts targeting almost 6,000 individual sites across 65 countries.

Claude Mythos AI Finds 10K High-Severity Flaws in Popular Software—Anthropic revealed that Project Glasswing has helped uncover more than 10,000 high- or critical-severity vulnerabilities across some of the most «systemically» important software across the world since the cybersecurity initiative went live last month. Of these vulnerabilities, 6,202 have been classified as high- or critical-severity flaws impacting more than 1,000 open-source projects. Subsequent analysis of these vulnerability candidates has identified that 1,726 are valid true positives. As many as 1,094 flaws are assessed to be either high- or critical-severity. In total, these efforts have led to 97 findings being patched upstream and 88 advisories being issued.

Cisco Patched CVSS 10.0 Secure Workload Flaw—Cisco rolled out updates for a maximum-severity security flaw impacting Secure Workload that could allow an unauthenticated, remote attacker to access sensitive data. Tracked as CVE-2026-20223 (CVSS score: 10.0), the vulnerability arises from insufficient validation and authentication when accessing REST API endpoints. «An attacker could exploit this vulnerability if they are able to send a crafted API request to an affected endpoint,» Cisco said. «A successful exploit could allow the attacker to read sensitive information and make configuration changes across tenant boundaries with the privileges of the Site Admin user.»

Microsoft Released Mitigations for YellowKey—Microsoft released a mitigation for a BitLocker bypass vulnerability named YellowKey following its public disclosure last week. The zero-day flaw, now tracked as CVE-2026-45585, carries a CVSS score of 6.8. It has been described as a BitLocker security feature bypass. The issue impacts Windows 11 version 26H1 for x64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows Server 2025, and Windows Server 2025 (Server Core installation). Microsoft noted that successful exploitation could permit an attacker with physical access to sidestep the BitLocker Device Encryption feature on the system storage device and gain access to encrypted data.

🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-48172 (LiteSpeed User-End cPanel Plugin), CVE-2026-34926 (Trend Micro Apex One), CVE-2026-20223 (Cisco Secure Workload), CVE-2026-41091, CVE-2026-45498, CVE-2026-45584 (Microsoft Defender), CVE-2026-46333 (Linux Kernel), CVE-2026-9082 (Drupal Core), CVE-2026-45585 (Microsoft Windows BitLocker), CVE-2026-2743 (SEPPMail), CVE-2026-7301, CVE-2026-7302, CVE-2026-7304 (SGLang), CVE-2026-29205 (cPanel), CVE-2026-8178 (Amazon Redshift JDBC driver), CVE-2026-8053 (MongoDB), CVE-2026-45829 aka ChromaToast (ChromaDB), CVE-2026-8153 (Universal Robots PolyScope 5), CVE-2026-3102 (ExifTool), CVE-2026-9110, CVE-2026-9111, from CVE-2026-8511 through CVE-2026-8522 (Google Chrome), CVE-2026-45434 (Apache OFBiz), CVE-2026-33000, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-34911 (UniFi OS), CVE-2026-45401 (Open WebUI), CVE-2026-9256, CVE‑2026‑8711 (F5 NGINX Plus and NGINX Open Source), CVE-2026-20239 (Splunk Enterprise and Splunk Cloud Platform), CVE-2026-46376 (FreePBX), CVE‑2026‑6637 (PostgreSQL), and CVE-2026-35194 (Apache Flink).

🎥 Cybersecurity Webinars

Learn How Attackers Use AI to Supercharge DDoS Efficiency (and How to Stop It) → Adversaries are weaponizing AI to exploit network blind spots, auto-generate evasion scripts, and bypass traditional defenses with surgical precision. This webinar bridges the gap between AI-driven exploitation and cloud resilience, offering data-driven insights into how attackers maximize DDoS success rates. Join us to move beyond theory, leverage AI for non-disruptive security testing (CTEM), and transition your team from reactive mitigation to automated, continuous resilience.

Beyond the Zero-Day: Hunting for Threats That Don’t Need an Exploit → Zero-day exploits are no longer the ultimate metric of cyber risk. Today, sophisticated adversaries bypass traditional defenses entirely by leveraging identity flaws, living-off-the-land techniques, and AI automation that don’t rely on unpatched software. This session moves beyond the zero-day obsession to expose how attackers operationalize modern post-compromise tactics—and how security teams can pivot from reactive patching to proactive, behavioral threat hunting.

📰 Around the Cyber World

Vulnerability Exploitation Overtakes Compromised Credentials in a Long Time —Vulnerability exploitation has overtaken compromised credentials for the first time in nearly two decades as the most common initial access vector for data breaches, per Verizon. Nearly a third (31%) of data breaches over the past year started with vulnerability exploitation, up from 20% in 2024. Credential abuse declined from 22% to 13%. What’s more, only 26% of critical vulnerabilities listed in the U.S. Cybersecurity Infrastructure and Security Agency Known Exploited Vulnerabilities (KEV) catalog were fully remediated by organizations in 2025, a drop from 38% the previous year. «The median time for full resolution went up to 43 days, almost two weeks more than the previous year’s 32 days,» the report said. «In the median case, organizations had 50% more critical vulnerabilities to patch in this year’s reporting dataset compared to the previous year.» Ransomware accounted for 48% of all breaches last year, up from 44% in 2024. But in a positive development, ransom payments have continued to decline, with the median payment sliding from $150,000 in 2024 to almost $140,000.

Attackers Go After India’s Education Ecosystem —Threat actors are abusing student data within India’s education ecosystem, spanning educational institutions, third-party vendors, and online services, for phishing, impersonation, social engineering, and financially motivated fraud operations. «Attackers commonly leverage exposed or misused student information to create highly convincing scams related to admissions, scholarships, internships, fee payments, and academic services,» CYFIRMA said. «In several instances, threat actors exploited trusted educational branding, fraudulent portals, and insider access to obtain credentials, financial information, or direct payments. Additionally, some cases indicated the misuse of student-linked bank accounts within broader fraud and mule account operations.»

RondoDox Adds ASUS Router Flaw to its Arsenal —The operators of the RondoDox botnet have incorporated CVE-2018-5999 (CVSS score: 9.8), a critical ASUS router flaw, to their arsenal, marking the first observation of in-the-wild exploitation of the vulnerability. The activity was first detected on May 17, 2026, against its honeypots. «The attack pattern: payloads that set the ateCommand_flag to 1, enabling the infosvr interface to accept arbitrary configuration changes,» VulnCheck CTO Jacob Baines said in a post on LinkedIn.

Fake Microsoft Teams Sites Deliver ValleyRAT —Fake Microsoft Teams distribution sites shared on X are being used to trick unsuspecting users into downloading a trojanized installer packaged as a ZIP archive, ultimately leading to the deployment of ValleyRAT, a malware associated with a Chinese cybercrime group called Silver Fox. «The delivered payload leverages a DLL sideloading chain via a legitimate executable (GameBox.exe) developed by Tencent, ultimately deploying a ValleyRAT variant,» K7 Labs said. «This malware campaign stands out for its clean execution chain, combining social engineering with staged payload delivery, in-memory decryption, and stealthy persistence mechanisms.»

Malicious Activity Targeting Malaysian Entities —An attacker-controlled infrastructure hosted on Microsoft Azure infrastructure in the Malaysia West region has been used to conduct a targeted intrusion campaign against multiple Malaysian organizations, per Oasis Security. «The operation demonstrates a high degree of operational planning, with the attacker developing purpose-built Python tooling for each target — covering internal network enumeration, database access, and external data exfiltration,» the company said. The infrastructure hosts target-specific Python scripts, webshell deployment tools, a Laravel remote code execution exploit chain, and source code for custom command-and-control (C2) components.

Texas Attorney General Sues Meta Over WhatsApp Encryption Claims —The Texas Attorney General has sued Meta over allegations that the company’s WhatsApp messenger doesn’t provide the end-to-end encryption (E2EE) it has long claimed. «Reports suggest that employees of WhatsApp have been able to access user communications,» the Office of the Texas Attorney General said. «Additional reporting and investigations indicate that message content can be pulled and viewed after the message has been sent. This is a complete and total misrepresentation of Meta’s privacy policies.» The lawsuit hinges on a report from Bloomberg from last month about how the U.S. Commerce Department’s Bureau of Industry and Security had abruptly closed an investigation into allegations that Meta could access encrypted WhatsApp messages. Preliminary findings from the department claimed that «there is no limit to the type of WhatsApp message that can be viewed by Meta.» Meta has called the allegations «baseless.»

FIOD Arrests Two in Connection with Stark Industries —The Netherlands Fiscal Intelligence and Investigation Service (FIOD) arrested two men and seized 800 servers in connection with a web hosting company that enabled cyber attacks, interference operations, and disinformation campaigns. The arrested individuals included a 57-year-old man from Amsterdam and a 39-year-old man from The Hague. Although the name of the company was not explicitly mentioned, it is assessed to be Stark Industries, which was sanctioned by the E.U. in May 2025. Following the sanctions, a significant chunk of the technical infrastructure was transferred to a Dutch-based entity known as THE.Hostingaka WorkTitans. «This new company actually acts as a cover for the sanctioned entities,» FIOD said. «The director and (indirect) sole shareholder of this company is the 57-year-old suspect.» A second unnamed Dutch company is said to have played a facilitating role. «This company, of which the 39-year-old is a suspected director and sole shareholder, ensures that the servers of the former new company are connected to the internet,» FIOD added.

UNG0002 Targets Chinese Educational Sector —The Chinese educational sector has become the target of a new campaign conducted by UNG0002 as part of a spear-phishing campaign codenamed Operation Dragon Whistle. «What makes this campaign particularly effective is the precision of its social engineering,» Seqrite Labs said. «The threat actor did not use a generic lure — they specifically identified that Changzhou University conducts mandatory annual fitness assessments where failure directly impacts graduation eligibility. This creates an environment of urgency and compliance that significantly increases the probability of victim engagement.» The emails have been found to distribute ZIP archives that ultimately lead to the deployment of Cobalt Strike Beacon.

Void Botnet Uses Ethereum Smart Contracts for C2 —A new botnet malware called Void Botnet uses Ethereum smart contracts for seizure-resistant command-and-control (C2). It’s a Rust-based malware that’s advertised on cybercrime forums by a developer operating under the handle TheVoidStl. «Based on the seller’s documentation and panel screenshots, Void Botnet is a Rust-native loader with two command-and-control modes in the same binary,» Qrator Labs said. «The first mode routes commands through Ethereum smart contracts: the operator writes instructions to a contract, and infected machines check it at regular intervals, picking up new tasks within three to five minutes. The second mode connects machines directly to the operator’s web panel, with tasks completing in under thirty seconds. The operator switches between them at any time by updating the contract.» The botnet works by writing commands to smart contracts, bots polling public RPC endpoints, and C2 infrastructure that is hard to take down.

Proton Debuts AI Access Tokens in Proton Pass —Proton Pass, a secure, end-to-end encrypted (E2EE) password manager, has added credential sharing through AI access tokens, allowing users to give AI agents access to items it’s permissioned to and monitor their activity. «AI access tokens are our newest secure sharing option to bring password management into the age of agentic AI,» Proton said. «Every time an AI agent uses an access token, this is logged, and a reason for the access must be provided. For extra security, you can also set an expiration for each token, from one hour to one year, after which it can no longer be used.»

DevilNFC and NFCMultiPay Android NFC Relay Malware Spotted —Two new Android NFC relay malware families named DevilNFC and NFCMultiPay have been observed targeting European and LATAM banking customers. «These two NFC relay toolkits are being developed and operated outside the Chinese-speaking MaaS ecosystem: DevilNFC carries an exclusively Spanish-speaking attribution, while NFCMultiPay’s developer fingerprint is Portuguese (Brazilian),» Cleafy said. «Local groups are no longer buying access to Chinese platforms; they are building their own.» It’s assessed that the malware families may have been developed with assistance using generative artificial intelligence (AI). Both malware families are designed to collect the victim’s card PIN. «DevilNFC further locks the victim inside the malicious interface via Kiosk Mode, preventing any escape while the relay completes,» the Italian company said. «DevilNFC employs an asymmetric architecture in which a single APK serves both roles in a relay attack: a passive reader on the victim’s device and a system-level card emulator on the attacker’s rooted device, achieved via a hooking framework that intercepts NFC traffic below the Android API layer.» DevilNFC overlaps with an NGate variant documented by ESET last month. The malicious apps are distributed via SMS or WhatsApp messages, directing victims to fake landing pages impersonating Google Play Store listings.

TAX#TRIDENT Uses Indian Income Tax Lures —A new campaign dubbed TAX#TRIDENT is using Indian Income Tax-themed lures to target Windows endpoints via three delivery paths. The campaign starts with fake tax assessment lures and then moves victims toward ZIP files, VBScript downloaders, or PHP-looking web endpoints that actually return script content,» Securonix said. «The first branch uses a ZIP file and a signed ClientSetup installer. Once executed, the installer creates a hidden client tree, adds service and driver persistence, and starts network communication. The second branch uses ‘Assessment_Order.vbs.’ The script shows a tax assessment decoy image, downloads the same ClientSetup payload, writes a new ‘YTSysConfig.ini,’ and runs the payload hidden. The third branch uses a PHP-looking endpoint that returns VBScript. That script downloads more stages from S3, disguises a VBS file as a PNG image, changes UAC prompt behavior, and silently installs a signed ManageEngine UEMS / Endpoint Central agent.»

CISA Launches KEV Nomination Form to Report Exploited Bugs —The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has introduced an online Nomination Form that lets researchers, vendors, and industry partners submit known exploited vulnerabilities (KEVs) directly so as to «quickly identify, validate, and share KEVs, critical threat information.»

Exploitation of Four-Faith Router Flaw —Attackers are exploiting CVE-2024-9643 (CVSS score: 9.8), a critical authentication bypass flaw in Four-Faith F3x36 industrial cellular routers, as part of a large-scale campaign since mid-May 2026 to turn fold compromised devices into botnets for further campaigns. CrowdSec said it has observed 139 attacking IP addresses through May 18, 2026. «Exploitation was first observed on April 20 and escalated to the point of being reclassified as mass exploitation on May 12, a strong signal that attackers are operationalizing this flaw at scale,» it added.

Chinese-Language PhaaS Ecosystem Detailed —An analysis of a dozen current phishing-as-a-service (PhaaS) offerings in the Chinese underground has found that they have shifted away from static password harvesting towards real-time interception and tokenization via live administration panels, allowing attackers to capture one-time passcodes (OTPs) and bypass multifactor authentication (MFA) instantly. The services, such as YY Lai Yu, primarily target non-Chinese entities, with advertisements regularly posted to Telegram rather than channels such as WeChat (Weixin) or Tencent QQ. A crucial aspect of these operations is their exploitation of digital wallet provisioning to monetize stolen payment details. Attackers have been found to leverage captured credentials and OTPs to provision the victim’s card into a digital wallet on an attacker-controlled device. Once tokenized, the card can be used for high-value transactions, contactless payments, and ATM withdrawals. «Instead of simply gaining account access, these operations focus on exploiting digital wallet provisioning to transform stolen payment data into tokenized assets within ecosystems,» Google said. «This shift—combined with the use of encrypted delivery channels like RCS and iMessage to bypass traditional carrier security filters on SMS messages—represents an emerging development where the goal is no longer just a login, but securing direct, unauthorized control over a victim’s financial accounts.»

🔧 Cybersecurity Tools

Bumblebee → It is an open-source security tool for macOS and Linux designed to find software supply-chain vulnerabilities on developer computers. It acts as a lightweight, read-only scanner that audits metadata files, manifests, and configurations rather than executing code. This allows it to safely check local language packages, web browser extensions, text editor add-ons, and AI tool configurations for known security exposures without running potentially malicious install scripts.

Claude-BugHunter → It is an open-source add-on that configures Anthropic’s Claude Code command-line tool into a specialized security assistant. It equips the AI with pre-built vulnerability patterns, attack techniques, and reporting templates, automating the process of finding and documenting security flaws during authorized testing.

Disclaimer: This is strictly for research and learning. It hasn’t been through a formal security audit, so don’t just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law.

Conclusion

Patch the easy stuff before it becomes a bigger problem next week. The old bugs everyone ignored? Attackers didn’t ignore them. They never do.

Right now, the internet feels held together with tape and luck. Every week, there’s a new mess, a new scam, or some old box getting dragged into a botnet. See you next Monday.

30 ABR 2026

admin Noticias, Trending 600K Blaster Busts CYBERDEFENSA.MX Flaws Hacks OpenEMR Roblox SMS Stories

SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories – CYBERDEFENSA.MX

The internet is noisy this week. We are seeing some wild new tactics, like people using fake cell towers to send scam texts, while some developers are accidentally downloading tools that peek into their private files during a simple install. It is definitely a busy time to be online.

Security is always a moving target. Millions of servers are currently sitting online without any passwords, and old software bugs are showing up in the most unexpected places. Even with the right fixes available, staying one step ahead is a full-time job for all of us.

Data is shifting in strange ways, too. Some browser tools are now legally selling user history for profit, and new kits are making it simpler for almost anyone to launch a campaign. You have to see these latest updates to believe them. Let’s look at the full list…

SMS blaster phishing crackdown

Canadian authorities have arrested three men for operating an SMS blaster device that masquerades as a cellular tower to send phishing texts to nearby phones. These tools trick devices into connecting to them by emitting signals that mimic a legitimate tower. «An SMS blaster works by mimicking a legitimate cellular tower. When nearby phones connect to it, users receive fraudulent text messages that appear to come from trusted organizations,» authorities said. «These messages often prompt recipients to click on links that lead to fake websites designed to capture personal information, including banking credentials and passwords.» The three men are facing 44 charges in connection with the crime. About tens of thousands of devices were connected to the blaster over several months, the official said. This is the first time that an SMS blaster has been spotted in the country.

npm brandsquat data theft

A new supply chain attack has leveraged an npm package impersonating TanStack to ship malicious versions that exfiltrate environment variables from developers’ machines during install. The package, named tanstack, is designed to «silently steal environment variable files, including .env, .env.local, and .env.production, from developers’ machines at install time, exfiltrating them to an attacker-controlled endpoint,» Socket said. The malicious package is maintained by a user named «sh20raj.» Versions 2.0.4 through 2.0.7 are confirmed malicious.

Extensions legally sell user data

In a new analysis, LayerX found that multiple networks of browser extensions collect user data and resell it for profit. Unlike malicious extensions that conceal their behavior by offering some harmless functionality, the identified 80 extensions explicitly inform users in their privacy policy that they collect and sell data of users who install their extensions. «A network of 24 media extensions that are installed on 800,000 users and collect viewing data and demographic information on major streaming platforms such as Netflix, Hulu, Disney+, Amazon Prime Video, HBO, Apple TV, and others,» LayerX said. «12 separate ad blockers with a combined install base of over 5.5 million users openly selling user data. Nearly 50 other extensions, with over 100,000 users in aggregate, that collected and resold users’ browsing data.»

Komari tool weaponized in attacks

Huntress has revealed that unknown threat actors used stolen VPN credentials to pivot into a Windows workstation belonging to an unspecified organization via Impacket’s smbexec.py, and dropped a SYSTEM-level backdoor using the Komari agent, a Go-based remote-control, monitoring, and management tool. The development marks the first publicly documented case of the tool being abused in a real-world intrusion. It also illustrates how bad actors are increasingly switching to publicly available and legitimate tools to conduct attacks. «Komari is not a telemetry tool that happens to be abusable – it is a bidirectional control channel by design. The agent opens a persistent WebSocket to its server and accepts three server-to-agent event types out of the box: exec (arbitrary command execution via PowerShell / sh), terminal (interactive PTY reverse shell in the operator’s browser), and ping (ICMP / TCP / HTTP probing),» Huntress said. «All three are enabled by default.» Whereas other tools like Velociraptor and SimpleHelp that have been abused by threat actors typically act as means to an end, Komari gives an operator arbitrary command execution, an interactive PTY reverse shell, and network probing by default, over a TLS-fronted WebSocket.

Next-gen phishing kits escalate

Threat actors have detailed two new phishing kits named Saiga 2FA and Phoenix System that have been linked to emails and SMS phishing attacks. According to Barracuda, Saiga 2FA goes beyond traditional adversary-in-the-middle (AitM) features by integrating tools like FM Scanner for extracting and analyzing mailbox content. «Saiga 2FA is an example of how phishing kits are evolving into application-level platforms,» the company said. «Unlike traditional phishing kits, Saiga integrates infrastructure, automation, and post-compromise capabilities into a unified system, supporting advanced and highly targeted campaigns.» Phoenix System, on the other hand, has been tied to over 2,500 phishing domains since January 2025, while relying on IP-based filtering and geofencing for precision targeting. It’s assessed to be the successor to the now-defunct Mouse System. «The campaigns are delivered via SMS, potentially leveraging fake Base Transceiver Stations (BTS) to bypass carrier-level filtering and allow threat actors to send messages that appear under the brand names of trusted organizations directly to victims,» Group-IB said. «The campaign has so far targeted more than 70 organizations across the financial services, telecommunications, and logistics sectors globally.»

Mass exposure of remote access servers

A new analysis from Forescout has found 1.8 million RDP and 1.6 million VNC servers are exposed on the internet. «China accounts for 22% of exposed RDP and 70% of exposed VNC servers; the U.S. accounts for 20% and 7%; Germany accounts for 8% and 2%,» the company said. «Of 91,000 RDP and 29,000 VNC servers mapped to specific industries, retail, services, and education lead RDP exposure; education, services, and healthcare lead VNC.» What’s more, 18% of exposed RDP servers run end-of-life Windows versions, more than 19,000 RDP servers remain vulnerable to BlueKeep (CVE-2019-0708), and nearly 60,000 VNC servers have authentication disabled. To make matters worse, more than 670 exposed VNC servers have authentication disabled and provide direct access to OT/ICS control panels.

China-linked influence op falters

A China-linked online influence campaign attempted to undermine April 26 elections for the Tibetan parliament-in-exile with little impact. The operation, part of Spamouflage, a long-running influence network linked to Beijing, has used a cluster of 90 Facebook profiles and 13 Instagram profiles to push criticism of the Tibetan government-in-exile and its leadership. «The network tries to drive wedges within the community,» DFRLab said. «The goal is to erode trust in the exile government, weaken its international voice, and raise doubts about whether it can credibly represent Tibetans without the Dalai Lama. However, virtually none of these posts seem to have attracted any organic engagement, possibly because all the identified assets are regular Facebook profiles with limited reach and not established pages.»

Unpatched RPC privilege escalation

An unpatched vulnerability can allow for local privilege escalation in Windows systems through the abuse of the Remote Procedure Call (RPC) architecture in the operating system. Called PhantomRPC, the flaw stems from an architectural weakness in how RPC handles connections to unavailable services. To exploit the flaw, an attacker with limited local access needs to first compromise a privileged service that runs under the Network Service identity, deploy a fake RPC server with the same RPC interface UUID and exposed endpoint name (i.e., TermService), listen to specific requests, and then impersonate the targeted service to escalate their privileges to SYSTEM. Kaspersky, which identified the weakness, said it discovered four PhantomRPC exploitation paths that could lead to privilege escalation. Following responsible disclosure in September 2025, Microsoft opted to not address the issue as it requires an attacker to first compromise the machine through some other means.

Vidar dominates infostealer market

The information stealer known as Vidar (now in its second iteration called Vidar Stealer 2.0) has vaulted to the top of the infostealer market since November 2025 in the aftermath of law enforcement takedowns of Lumma and Rhadamanthys. «Vidar profited from the generated chaos to rise to the top of the stealer ecosystem,» Intrinsec said. «We assess that this rise was made available due to the release of version 2.0 of the malware, and to the collaboration with ‘Cloud’ Telegram channels.» It’s advertised by a user named «Loadbaks» on underground forums. Recent campaigns have been observed distributing malware that has used bogus links shared via YouTube videos promoting fake software to direct users to Mediafire pages, which are used to deliver executables responsible for downloading and running the broad-spectrum credential harvester. The stolen credentials are then quickly monetized on underground marketplaces like Russian Market.

Critical flaws hit healthcare platform

Thirty-eight critical security vulnerabilities have been disclosed in OpenEMR, the world’s most widely used open-source electronic medical records platform. The vulnerabilities, now patched, range in severity from medium to critical and include missing or incorrect authorization checks, cross-site scripting (XSS), SQL injection, path traversal, and insufficient session expiration. These issues, which include two designated critical (CVE-2026-24908 and CVE-2026-23627), could have been exploited to access and tamper with patient and provider data, posing a serious health and regulatory risk to individuals and institutions. «In the most severe cases, SQL injection vulnerabilities combined with modest database privileges could have led to full database compromise, PHI exfiltration at scale, and remote code execution on the server,» AISLE said. OpenEMR is used by more than 100,000 medical providers, serving more than 200 million patients in 34 languages.

Swiss crackdown on Black Axe

A coordinated police operation in Switzerland has led to the arrest of 10 suspected members of the Black Axe criminal network, including the Black Axe «Regional Head» for the Southern European region. Most of those arrested are reported to be of Nigerian origin. The suspects are accused of numerous crimes, including romance scams, cyber fraud offences causing millions of Swiss francs in damages, and money laundering. «The criminal network is known for its involvement in a wide range of criminal activities, including cyber-enabled fraud, drug trafficking, human trafficking and prostitution, kidnapping, armed robbery, and fraudulent spiritual practices,» Europol said.

PyPI package hijacked via CI exploit

In yet another software supply chain attack, unknown threat actors pushed a malicious version of the popular «elementary-data» package on the Python Package Index (PyPI) to steal sensitive developer data and cryptocurrency wallets. According to StepSecurity, elementary-data version 0.23.3 was uploaded to PyPI on April 24, 2026, at 10:20 p.m. UTC. The attacker opened a pull request with malicious code and exploited a script-injection vulnerability in one of its GitHub Actions workflows to publish it as release 0.23.3. Specifically, it came embedded with a «elementary.pth» file that enabled the theft of developer credentials and secrets. «The attacker exploited a script injection vulnerability in one of the project’s own GitHub Actions workflows, then used the workflow’s GITHUB_TOKEN to forge a signed release commit and dispatch the legitimate publishing pipeline against it – without ever touching the master branch or opening a pull request,» the company said. The developers urged users who installed 0.23.3, or pulled and ran its Docker image, to assume compromise and rotate any credentials.

$230M crypto laundering sentence

22-year-old Evan Tangeman of Newport Beach, California, was sentenced to 70 months in prison for laundering funds stolen in a massive $230 million cryptocurrency heist as part of an elaborate social engineering scheme. «This criminal enterprise was built on greed so brazen it borders on the cartoonish. They stole millions, spent it on half-million-dollar nightclub tabs, Lamborghinis, and Rolexes,» said U.S. Attorney Jeanine Ferris Pirro. «But Evan Tangeman didn’t just launder the money that fueled that lifestyle. When his co-conspirators were arrested, he moved to destroy the evidence. That is consciousness of guilt, and this office and the court have treated that accordingly.» Tangeman pleaded guilty in December 2025. The criminal enterprise began no later than October 2023 and continued through at least May 2025.

Legacy TLS finally deprecated

Microsoft has announced plans to start blocking legacy TLS connections for POP and IMAP email clients in Exchange Online starting in July 2026. «We’re planning to fully deprecate support for legacy TLS versions (TLS 1.0 and TLS 1.1) for POP3 and IMAP4 connections to Exchange Online. These older TLS versions have been industry-deprecated for some time and are no longer considered secure,» the company said. «Several years ago, we started the move to block these older versions, but we did allow you to use them by opting in; we’re now removing support for them entirely. Our expectation is that only customers who have explicitly opted into using those legacy endpoints are impacted by the deprecation.»

Phishing via account flow abuse

Threat actors are abusing online trading platform Robinhood’s account creation process to send phishing emails that bypass spam filters. The emails, which originate from «noreply@robinhood[.]com,» warn of suspicious activity tied to their accounts and urge them to click to complete a security check by clicking on a link that directs to a phishing site. «This phishing attempt was made possible by an abuse of the account creation flow,» Robinhood said in an X post. «It was not a breach of our systems or customer accounts, and personal information and funds were not impacted. If you received this email, please delete it and do not click any suspicious links. If you have clicked a suspicious link or have any questions about your account, please contact us directly within the Robinhood app or website.» Reports on Reddit indicate that the attackers created new Robinhood accounts using modified versions of existing Gmail addresses via the so-called «dot trick.» The technique takes advantage of the fact that Gmail ignores periods inserted into or removed from a username, whereas Robinhood treats each variation as a distinct user, allowing the attackers to create a new account that points to an existing account.

Social media scams surge

The U.S. Federal Trade Commission (FTC) warned of a massive increase in losses from social media scams since 2020, exceeding $2.1 billion in 2025, including $794 million to scams that started on Facebook, more than on any other platform. «In 2025, nearly 30% of people who reported losing money to a scam said that it started on social media, with reported losses reaching a staggering $2.1 billion. Social media scams produced far more in losses – an eightfold increase since 2020 – than any other contact method used by scammers to reach consumers,» the FTC said. «Social media creates easy access to billions of people from anywhere in the world, making a scammer’s job easier at very little cost. Scammers may hack a user’s account, exploit what a user posts to figure out how to target them, or buy ads and use the same tools used by real businesses to target people by age, interests, or shopping habits.»

Billions of credentials exposed

KELA said it tracked 2.86 billion compromised credentials in 2025 globally. These included usernames, passwords, session tokens, cookies found in URL, login and password (ULP) lists, breached email repositories, and cybercrime marketplaces. At least 347 million were originally obtained by infostealers found on around 3.9 million infected machines.

arXiv papers leak sensitive data

An analysis of 2.7 million submissions to the arXiv preprint service — which also makes available the LaTeX sources and other files used to create them — has found that they include unnecessary files, expose metadata embedded in files (usernames, email addresses, hardware details, GPS information, software versions), and leak irrelevant content in files such as source code comments. This includes backups, hidden .nfs files, Git repositories (including editing histories), andconfiguration files containing API keys. «Apart from unused template files that put unnecessary storage burden on arXiv, we further discovered scripts, research data, and even entire Git repositories. Additionally, comments in LaTeX sources reveal, e.g., author conversations or todo items – for some of those comments, we are certain that the authors did not intend to disclose them publicly. Alarmingly, our findings also include URLs without any access restrictions to other resources (e.g., Google Docs), security tokens, and private keys,» the study said. While arXiv recommends Google’s arxiv_latex_cleaner to clean the LaTeX code, the researchers have released a tool called ALC-NG to comprehensively remove files, metadata, and comments that are not needed to compile a LaTeX paper.

Roblox account hacking ring busted

The Ukrainian police have arrested three individuals who hacked more than 610,000 Roblox gaming accounts and sold them for a profit of $225,000 on Russian websites. The suspects face up to 15 years in prison if convicted and have been placed in pretrial detention while the investigation is in progress. The scheme was allegedly masterminded by a 19-year-old resident of Drohobych, Lviv Oblast, who met his accomplices, aged 21 and 22, on gaming forums last year. From October 2025 to January 2026, the suspects are believed to have accessed more than 600,000 Roblox user accounts.

Iran-linked group targets troops

The Iran-linked threat actor Handala Hack has targeted U.S. troops in Bahrain in an influence campaign carried out via WhatsApp, according to Stars and Stripes. The messages, signed Handala and containing a link to the group’s website, claimed the service members were under surveillance and soon to be targeted with drones and missiles. «Your identities are fully known to our missile units, and every move you make is under our surveillance. Very soon, you will be targeted by our Shahed drones and Kheibar and Ghadeer missiles,» the message sent on April 28, 2026, read.

WordPress plugin backdoor uncovered

Anchor Hosting has revealed that a WordPress plugin named Quick Page/Post Redirect plugin, which has over 70,000 installs, was compromised with a backdoor that enables injecting arbitrary code into users’ sites. Plugin versions 5.2.1 and 5.2.2, released between 2020 and 2021, have been found to include a covert self-update mechanism that reaches out to a third-party domain, anadnet[.]com, to facilitate the execution of arbitrary code. It’s worth noting that the passive backdoor triggers only for logged-out users to hide its activity from site administrators. As of April 16, the plugin has been closed temporarily pending a full review.

Qinglong flaws abused for mining

Hackers are exploiting two authentication bypass vulnerabilities in Qinglong, an open-source timed task management platform with over 19,500 GitHub stars, to deploy cryptocurrency miners. The two flaws – CVE-2026-3965 and CVE-2026-4047 – enable authentication bypass that results in remote code execution. «While these vulnerabilities were formally reported on February 27, exploitation had already been underway for weeks,» Snyk said. «Starting around February 7-8, 2026, Qinglong users began opening issues about a hidden process called .fullgc consuming 85-100% of their CPU. The .fullgc filename may have been chosen to blend in with legitimate processes. In Java/JVM environments, ‘Full GC’ (Full Garbage Collection) is a known source of CPU spikes, which could delay an administrator’s investigation.» The issues have since been addressed in #PR 2941.

Trivy hack enabled repo breach

In a new update shared this week, Checkmarx said its investigation into the cybersecurity incident has revealed the TeamPCP attack affecting the Trivy scanner is the «likely vector that enabled the attackers to obtain credentials and to gain unauthorized access to our GitHub repositories.» This, in turn, allowed the attackers to interact with Checkmarx’s GitHub environment and publish malicious code to certain artifacts. The development comes as the company acknowledged that data stolen from the GitHub repository was published on the dark web by a cybercrime group known as LAPSUS$.

npm stealer tied to DPRK group

The North Korean threat actor known as Famous Chollima has been attributed to the npm package named js-logger-pack that comes embedded with a WebSocket stealer that’s triggered via a postinstall hook. «The payload is a long-running WebSocket agent that: installs the attacker’s RSA key into ~/.ssh/authorized_keys on Linux; exfiltrates Telegram Desktop tdata sessions; drains credentials from 27 crypto wallets and Chromium-family browsers; steals .npmrc, cloud provider tokens, and shell history; and runs a native keylogger on Windows, macOS, and Linux with autostart persistence on all three,» SafeDep said.

Security is a team sport. We keep seeing the same gaps because we focus on the new shiny toys while the basics, like simple passwords and old software versions, fall through the cracks. It is clear that just having a patch isn’t enough if nobody actually installs it.

The best lesson here is to stay curious and cautious. Whether it is a weird text from a «trusted» source or a new tool that seems too good to be true, taking a second to verify can save a lot of trouble later. Let’s keep learning and stay sharp until the next update!

26 FEB 2026

admin Noticias Chrome Claude Crash CYBERDEFENSA.MX Flaws Kali Linux LockBit Stories Traps WinRAR

Kali Linux + Claude, Chrome Crash Traps, WinRAR Flaws, LockBit & 15+ Stories – CYBERDEFENSA.MX

Nothing here looks dramatic at first glance. That’s the point. Many of this week’s threats begin with something ordinary, like an ad, a meeting invite, or a software update.

Behind the scenes, the tactics are sharper. Access happens faster. Control is established sooner. Cleanup becomes harder.

Here is a quick look at the signals worth paying attention to.

Belarus-linked Android spyware

ResidentBat is an Android spyware implant used by Belarusian authorities for surveillance operations against journalists and civil society. Once installed, it provides operators with access to call logs, microphone recordings, SMS, encrypted messenger traffic, screen captures, and locally stored files. The malware, although first documented in December 2025, is assessed to date back to 2021. According to Censys, ResidentBat-associated infrastructure is concentrated in Europe and Russia: the Netherlands (5 hosts), Germany (2 hosts), Switzerland (2 hosts), and Russia (1 host) in a recent Platform view, using a narrow port range (7000-7257) for control traffic.

Crypto phishing wave

Phishing campaigns are impersonating cryptocurrency brokerage services like Bitpanda to harvest sensitive data under the pretext of reconfirming their information or risk having their accounts blocked. «Attempting to get multiple forms of information and identification, the attackers used tactics that would seem legitimate to the everyday user,» Cofense said. «User information such as name verification, email, and password credentials, and location were all used in this attempt to harvest information under the guise of a multi-factor authentication process.»

Breakout times shrink

In its 2026 Global Threat Report, CrowdStrike said adversaries became faster than ever before in 2025. «The average e-crime breakout time — the period between initial access and lateral movement onto another system — dropped to 29 minutes, a 65% increase in speed from 2024,» the company said. One such intrusion undertaken by Luna Moth (aka Chatty Spider) targeting a law firm moved from initial access to data exfiltration in four minutes. Chief among the factors fueling this dramatic acceleration was the widespread abuse of legitimate credentials, which allowed attackers to blend into normal network traffic and bypass many traditional security controls. This was coupled with threat actors of varied motivations utilizing AI technology to accelerate and optimize their existing techniques. Some of the threat actors that have leveraged AI in their operations include Fancy Bear, Punk Spider (aka Akira), Blind Spider (aka Blind Eagle), Odyssey Spider (aka TA558), and an India-nexus hacking group called Frantic Tiger that has used Netlify and Cloudflare pages for credential-harvesting operations. The cybersecurity company said it observed an 89% increase in the number of attacks by AI-enabled adversaries compared to 2024 and a 42% year-over-year increase in zero-days exploited prior to public disclosure. In tandem, 67% of vulnerabilities exploited by China-nexus adversaries provided immediate system access, and 40% targeted edge devices that typically lack comprehensive monitoring. The vast majority of attacks, 82%, were free of malware — highlighting attackers’ enduring shift toward hands-on-keyboard operations and the abuse of legitimate tools and credentials.

4-minute lateral movement

In a similar report, ReliaQuest said the fastest intrusions reached lateral movement in just 4 minutes, an 85% acceleration from last year, with data exfiltration taking place in 6 minutes. The statistic is fueled by attackers increasingly weaving AI and automation into their tradecraft. «As attackers increasingly secure valid credentials with elevated privileges, the time to react has drastically dropped,» ReliaQuest said. «In 2025, the average breakout time (initial access to lateral movement) dropped to 34 minutes. In 47% of incidents, they secured high privileges before ever touching the network. This allows them to skip escalation, blend into traffic, and repurpose legitimate tools.»

ClickFix fuels Mac stealers

Mac users searching for popular software like Homebrew, 7-Zip, Notepad++, LibreOffice, and Final Cut Pro are the target of an active malvertising campaign powered by at least 35 hijacked Google advertiser accounts originating from countries including the U.S., Canada, Italy, Poland, Brazil, India, Saudi Arabia, Japan, China, Romania, Malta, Slovenia, Germany, the U.K., and the U.A.E. More than 200 malicious advertisements impersonating legitimate macOS software have been found. The end goal of these efforts is to direct users to fake pages that contain ClickFix-like instructions to deliver MacSync stealer. Another ClickFix campaign has been observed using fake CAPTCHA verification lures on bogus phishing pages to distribute stealer malware that can harvest data from web browsers, gaming apps like Steam, cryptocurrency wallets, and VPN apps. According to ReliaQuest data, a quarter of attacks used social engineering for initial access last year, with ClickFix responsible for delivering 59% of the top malware families.

Encryption debate resurfaces

Meta went ahead with a plan to encrypt the messaging services connected to its Facebook and Instagram apps despite internal warnings that it would hinder the social media giant’s ability to flag child-exploitation cases to law enforcement, Reuters reported. The internal chat exchange dated March 2019 was filed in connection with a lawsuit brought by the U.S. state of New Mexico, accusing it of exposing children and teens to sexual exploitation on its platforms and profiting from it. In response to the concerns raised, Meta said it worked on additional safety features before it launched encrypted messaging on Facebook and Instagram in 2023.

ActiveMQ flaw aids LockBit

Threat actors are exploiting a now-patched security flaw in internet-facing Apache ActiveMQ servers (CVE-2023-46604) to deploy LockBit ransomware. «Despite being evicted after the initial intrusion, they successfully breached the same server on a second occasion 18 days later,» The DFIR Report said. «After compromising the server, the threat actor used Metasploit, possibly along with Meterpreter, to perform post-exploitation activities. These activities included escalating privileges, accessing LSASS process memory, and moving laterally across the network. After regaining access following their eviction, the threat actor swiftly transitioned to deploying ransomware. They leveraged credentials extracted during their previous breach to deploy LockBit ransomware via RDP.» The ransomware is suspected to be crafted using the leaked LockBit builder.

Chrome crash-to-command trick

Two newly flagged Google Chrome extensions, Pixel Shield – Block Ads (ID: nlogodaofdghipmbdclajkkpheneldjd) and PageGuard – Phishing Protection (ID: mlaonedihngoginmmlaacpihnojcoocl), have been found to adopt the same playbook as CrashFix, where the browser is deliberately crashed, and the user is tricked into running a malicious command à la ClickFix. The most concerning aspect of this campaign is that the extensions actually work and offer the advertised functionality. «The original NexShield DoS created a billion chrome.runtime.connect() calls,» Annex Security’s John Tuckner said. «These variants use a different technique I’m calling the Promise Bomb because it crashes the browser by flooding Chrome’s message passing system with millions of unresolvable promises.» While the original NexShield used timer-based activation, the new variants have evolved to push notification-based command-and-control (C2), causing the denial-of-service to be triggered only when the C2 server sends a push notification containing a «newVersion» value ending in «2.» This, in turn, gives the attacker selective remote control over when the crashes happen.

WinRAR patch lag persists

Cybersecurity firm Stairwell said more than 80% of the IT networks it monitors run versions of WinRAR vulnerable to CVE-2025-8088, a vulnerability that has been widely exploited by cybercrime and cyber espionage groups. «This finding underscores a persistent challenge in enterprise security when widely deployed, trusted software that quietly falls out of date and becomes a high-value target for attackers,» Alex Hegyi said.

Crypto IV reuse risk

A new analysis from Trail of Bits has revealed that more than 723,000 open-source projects use cryptographic libraries with insecure defaults. The aes-js and pyaes libraries have been found to provide a default initialization vector (IV) in their AES-CTR API, leading to a large number of key/IV reuse bugs. «Reusing a key/IV pair leads to serious security issues: if you encrypt two messages in CTR mode or GCM with the same key and IV, then anybody with access to the ciphertexts can recover the XOR of the plaintexts, and that’s a very bad thing,» Trail of Bits said. While neither library has been updated in years, strongSwan has released an update to address the problem in strongMan (CVE-2026-25998).

AI audits smart contracts

OpenAI and Paradigm have jointly announced EVMbench, a benchmark that measures how well AI agents can detect, exploit, and patch high-severity smart contract vulnerabilities. «EVMbench draws on 120 curated vulnerabilities from 40 audits, with most sourced from open code audit competitions,» OpenAI said. «EVMbench is intended both as a measurement tool and as a call to action. As agents improve, it becomes increasingly important for developers and security researchers to incorporate AI-assisted auditing into their workflows.»

Fake FSB extortion plot

A Russian national has been accused of trying to extort money from the notorious Conti ransomware group by posing as an officer of Russia’s Federal Security Service (FSB), according to local media reports. RBC reported that the suspect, Ruslan Satuchin, posed as an FSB officer and demanded a large payment from Conti. Although an investigation was formally launched in September 2025, the incident allegedly began in September 2022 when Satuchin contacted one of the members of the hacker group and extorted them to avoid criminal liability. Once a prolific ransomware gang, Conti shut down its operations in mid-2022 after splintering into small groups.

Ad cloaking service exposed

Varonis has disclosed details of a newly identified cybercrime service known as 1Campaign that enables threat actors to run malicious Google Ads for extended periods of time while evading scrutiny. The cloaking platform «passes Google’s screening, filters out security researchers, and keeps phishing and crypto drainer pages online for as long as possible, funneling real users to attacker-controlled sites,» Varonis security researcher Daniel Kelley said. «It combines real-time visitor filtering, fraud scoring, geographic targeting, and a bot guard script generator into a single dashboard.» It’s developed and maintained by a threat actor named DuppyMeister for over three years, along with offering Telegram channels for support. Traffic linked to 1Campaign has been distributed across the U.S., Canada, the Netherlands, China, Germany, France, Japan, Hungary, and Albania.

Teams call drops macOS malware

A social engineering campaign has been observed using Microsoft Teams meetings to trick attendants into installing macOS malware. Daylight Security has assessed that the activity is consistent with an ongoing attack campaign orchestrated by North Korean threat actors under the name GhostCall. «During the call, the attacker claimed audio issues and coached the victim into running terminal commands that downloaded and executed malicious binaries,» Daylight researchers Kyle Henson and Oren Biderman said. «Analysts observed staged downloads and execution from macOS cache and temporary paths, Keychain credential access, and outbound connections to newly created attacker-controlled domains.»

RAMP fallout reshapes underground

Last month, law enforcement authorities from the U.S. seized the notorious RAMP cybercrime forum. The event has had a cascading impact, destabilising trust and accelerating fragmentation across the underground cybercrime ecosystem. There are also speculations that RAMP may have functioned as a honeypot or had been compromised long before its seizure. «Rather than consolidating around a single successor, ransomware actors are redistributing across both gated platforms like T1erOne and accessible forums such as Rehub,» Rapid7 said. «This shift reflects adaptation, not decline. Disruption fractures trust and redistributes coordination across multiple platforms.»

Anonymous Fénix members detained

Spanish authorities have announced the arrest of four members of the Anonymous Fénix group for their involvement in distributed denial-of-service (DDoS) attacks. The suspects, whose names were not disclosed, targeted the websites of government ministries, political parties, and public institutions. Two of the group leaders were arrested in May 2025. The first attacks occurred in April 2023. The group is said to have intensified its activities beginning in September 2024, recruiting volunteers to mount DDoS attacks against targets of interest.

Judicial spear-phish drops RAT

A spear-phishing campaign has been observed targeting Argentina’s judicial sector that delivers a ZIP archive containing a Windows shortcut that, when launched, displays a decoy PDF to the victims, while stealthily dropping a Rust-based remote access trojan (RAT). «The campaign leverages highly authentic judicial decoy documents to exploit trust in court communications, enabling successful delivery of a covert remote access trojan and facilitating long-term access to sensitive legal and institutional data,» Seqrite Labs said.

Typosquat spreads ValleyRAT

A persuasive lookalike website of Huorong Security antivirus («huoronga[.]com») has been used to deliver a RAT malware known as ValleyRAT. The campaign is the work of a Chinese cybercrime group called Silver Fox, which has a history of distributing trojanized versions of popular Chinese software and other popular programs through typosquatted domains to distribute trojanized installers responsible for deploying ValleyRAT. «Once it’s installed, attackers can monitor the victim, steal sensitive information, and remotely control the system,» Malwarebytes said.

Repo-squatting via Google Ads

Users searching for developer tools have become the target of an ongoing campaign dubbed GPUGate that uses a malicious installer to deliver Hijack Loader and Atomic Stealer. «The attacker creates a throwaway GitHub account and forks the official GitHub Desktop repository,» GMO Cybersecurity by Ierae said. «The attacker edits the download link in the README to point to their malicious installer and commits the change. Lastly, the attacker used sponsored ads for ‘GitHub Desktop’ to promote their commit, using an anchor in README.md to skip past GitHub’s cautions.» Victims who downloaded the malicious Windows installer would execute a multi-stage loader, while Mac victims received Atomic Stealer.

These stories may seem separate, but they point in the same direction. Speed is increasing. Deception is improving. And attackers are finding new ways to blend into everyday activity.

The warning signs are there for those who look closely. Small gaps, delayed patches, misplaced trust, and rushed clicks still make the biggest difference.

Staying aware of these shifts is no longer optional. The details change each week. The pressure does not.

Buscar
Categories

Análisis Forense

Ataques cibernéticos

Featured

Latest

Noticias

Popular

Sport

Sport2

Trending

Uncategorized

Latest Posts
Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories – CYBERDEFENSA.MX

Detectan el primer malware diseñado para las pantallas multimedia de los vehículos

Un ciberataque de hackers iraníes paraliza una central eléctrica británica durante cuatro días

Pillan a AliExpress ‘espiando’ los audios de sus usuarios

JabaROOT DZ publica un enlace para acceder a los datos de 70.000 supuestos agentes marroquíes

Calendar
noviembre 2026

L M X J V S D

1

2 3 4 5 6 7 8

9 10 11 12 13 14 15

16 17 18 19 20 21 22

23 24 25 26 27 28 29

30

« Oct

Breaking News

Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories – CYBERDEFENSA.MX

Detectan el primer malware diseñado para las pantallas multimedia de los vehículos

Un ciberataque de hackers iraníes paraliza una central eléctrica británica durante cuatro días

Pillan a AliExpress ‘espiando’ los audios de sus usuarios

JabaROOT DZ publica un enlace para acceder a los datos de 70.000 supuestos agentes marroquíes

Descubierta una campaña de phishing a gran escala dirigida contra más de 9.000 organizaciones en todo el mundo

This2Shell, That2Shell, Everything’s an RCE? Rogue AI, Supply Chain Chaos and More – CYBERDEFENSA.MX

Piratean la cuenta de HBO Max en Reddit para difundir malware

La IA ayudará mucho más a los ciberatacantes que a los ciberdefensores, según un alto mando británico

Hackean servicios del FBI y los atacantes aseguran tener los datos de todos sus empleados

Noticias, Trending
Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories – CYBERDEFENSA.MX

octubre 29, 2026

Uncategorized
Detectan el primer malware diseñado para las pantallas multimedia de los vehículos

octubre 26, 2026

Uncategorized
Un ciberataque de hackers iraníes paraliza una central eléctrica británica durante cuatro días

octubre 26, 2026

Uncategorized
Pillan a AliExpress ‘espiando’ los audios de sus usuarios

octubre 26, 2026

Uncategorized
JabaROOT DZ publica un enlace para acceder a los datos de 70.000 supuestos agentes marroquíes

octubre 26, 2026

Uncategorized
Descubierta una campaña de phishing a gran escala dirigida contra más de 9.000 organizaciones en todo el mundo

octubre 26, 2026

Noticias, Trending
This2Shell, That2Shell, Everything’s an RCE? Rogue AI, Supply Chain Chaos and More – CYBERDEFENSA.MX

octubre 26, 2026

Uncategorized
Piratean la cuenta de HBO Max en Reddit para difundir malware

octubre 22, 2026

Uncategorized
La IA ayudará mucho más a los ciberatacantes que a los ciberdefensores, según un alto mando británico

octubre 22, 2026

Uncategorized
Hackean servicios del FBI y los atacantes aseguran tener los datos de todos sus empleados

octubre 22, 2026

It is a long established fact that reader will be distracted by the readable content of a page when looking at its layout.

Categories

Análisis Forense

Ataques cibernéticos

Featured

Latest

Noticias

Popular

Sport

Sport2

Trending

Uncategorized

Latest Posts
Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories – CYBERDEFENSA.MX

Detectan el primer malware diseñado para las pantallas multimedia de los vehículos

Un ciberataque de hackers iraníes paraliza una central eléctrica británica durante cuatro días

Pillan a AliExpress ‘espiando’ los audios de sus usuarios

JabaROOT DZ publica un enlace para acceder a los datos de 70.000 supuestos agentes marroquíes

Calendar
noviembre 2026

L M X J V S D

1

2 3 4 5 6 7 8

9 10 11 12 13 14 15

16 17 18 19 20 21 22

23 24 25 26 27 28 29

30

« Oct

LIVE
NEWS

Download App

facebook

twitter

instagram

pinterest

youtube

envelope

Copyright © 2026 | Powered by News25 WordPress Theme

Or Check Our Popuplar Categories...

Tag Archives: Flaws

⚡ Threat of the Week

🔔 Top News

‎️‍🔥 Trending CVEs

🎥 Cybersecurity Webinars

📰 Around the Cyber World

🔧 Cybersecurity Tools

Conclusion