{"id":2139,"date":"2026-10-15T20:18:04","date_gmt":"2026-10-15T20:18:04","guid":{"rendered":"https:\/\/cybercolombia.co\/index.php\/2026\/10\/15\/adobe-rce-dns-wallet-theft-nvidia-container-escape-self-healing-backdoor-23-more-cyberdefensa-mx\/"},"modified":"2026-10-15T20:18:04","modified_gmt":"2026-10-15T20:18:04","slug":"adobe-rce-dns-wallet-theft-nvidia-container-escape-self-healing-backdoor-23-more-cyberdefensa-mx","status":"publish","type":"post","link":"https:\/\/cybercolombia.co\/index.php\/2026\/10\/15\/adobe-rce-dns-wallet-theft-nvidia-container-escape-self-healing-backdoor-23-more-cyberdefensa-mx\/","title":{"rendered":"Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More \u2013 CYBERDEFENSA.MX"},"content":{"rendered":"
\n

Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that\u2019s an actual feature. And somehow, it fits right in with this week\u2019s security stories.<\/p>\n

The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and some flaws are so simple you wonder how nobody spotted them sooner.<\/p>\n

There\u2019s a lot more hiding in the details, including a few twists you probably wouldn\u2019t expect. Here\u2019s what made the list this week.<\/p>\n

\n <\/p>\n

The threats change every week. Subscribe, and we\u2019ll alert you<\/span> when each new ThreatsDay Bulletin is out.<\/p>\n<\/div>\n

\n
\n
    \n
  1. \n <\/p>\n
    \n Active ransomware exploitation<\/span><\/p>\n

    \n Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an <\/a>authentication bypass vulnerability<\/a> in PAN-OS GlobalProtect and Prisma Access. The vulnerability, disclosed in May 2026, has since come under active exploitation. \u00abBecause this access originates through an organization\u2019s own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft, or ransomware deployment is underway,\u00bb ReliaQuest said<\/a>. \u00abOrganizations should immediately upgrade affected deployments, disable authentication override cookies where they are not required, terminate all active GlobalProtect sessions after patching, and investigate unexpected connections, including sessions using hostnames such as \u2018kali.\u2019 Patching alone may not remove access established before remediation.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  2. \n <\/p>\n
    \n Hybrid warfare escalates across Europe<\/span><\/p>\n

    \n Russia is assessed to have escalated its use of hybrid, asymmetric warfare across Europe following its full-scale invasion of Ukraine in February 2022. \u00abThey do not involve troops moving across a country\u2019s border or a state\u2019s military dropping bombs on an adversary\u2019s capital city,\u00bb Recorded Future said<\/a>. \u00abInstead, they are a complex kit of psychological, cyber, and physical tactics meant to achieve several key aims: (1) Test the enemy\u2019s defensive capabilities, as Russia evaluates whether to escalate aggression into a formal, kinetic conflict, (2) Degrade the enemy\u2019s critical infrastructure, and (3) Sow an environment of fear in the enemy\u2019s government and population to degrade the enemy\u2019s ability to respond.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  3. \n <\/p>\n
    \n DNS-powered wallet theft<\/span><\/p>\n

    \n Infoblox has analyzed a cryptocurrency wallet-drainer kit, self-branded as Noir, that makes use of DNS TXT records to locate its hosted pool, which currently runs on Cloudflare Pages. It\u2019s delivered by means of a loader that queries the TXT record through public DoH services to learn which backend pool is active. \u00abThe drainer does not need a seed phrase, password, or private key,\u00bb Infoblox said<\/a>. \u00abIt tailors content to the user after receiving initial read permissions, developing a plan for the specific wallet. Then it obtains spending permissions that can look less alarming than a direct transfer and performs the theft from attacker-controlled infrastructure.\u00bb It\u2019s suspected that the malware was created and maintained with AI assistance.\n <\/p>\n<\/div>\n

    \"\"<\/a><\/div>\n<\/li>\n
  4. \n <\/p>\n
    \n Discord-based remote access threat<\/span><\/p>\n

    \n A Rust-based remote access trojan dubbed CikaBika Bot has been observed being delivered via a document-themed lure containing a malicious LNK file and a PDF with an embedded payload. \u00abThe malware uses a Nim loader, PowerShell UAC bypass, and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity,\u00bb Darktrace said<\/a>. The malware also supports screenshot capture and file transfers.\n <\/p>\n<\/div>\n<\/li>\n

  5. \n <\/p>\n
    \n RAT combines theft and intimidation<\/span><\/p>\n

    \n A Windows remote access trojan (RAT) called KGB RAT is being marketed on underground forums since late 2025 as being fully undetectable. It features a built-in crypter, HVNC, credential theft, ransomware, and an unusual set of psychological harassment capabilities, per Group-IB. \u00abKGB RAT is, in practice, a full-featured malware package that gives attackers silent and persistent control over infected Windows machines,\u00bb it said<\/a>. \u00abWhat sets it apart from comparable RAT families is not only its technical breadth \u2014 combining credential theft, keylogging, hidden desktop takeover, and ransomware in a single builder \u2014 but also a dedicated set of psychological harassment features, including screamer functions, jump scares, and forced blue screens of death. These \u2018fun settings,\u2019 as the developers themselves describe them, signal a threat actor profile comfortable weaponizing victim anxiety alongside data theft.\u00bb A public disclosure<\/a> referencing a KGB RAT server at version 0.1 dates to late January 2022, indicating the developer had been building and testing the malware for years before bringing it to market.\n <\/p>\n<\/div>\n<\/li>\n

  6. \n <\/p>\n
    \n Stealthy live-screen surveillance<\/span><\/p>\n

    \n A multi-stage infection chain on Windows has been observed deriving a previously undocumented .NET RAT with live screen surveillance capability. It\u2019s been codenamed BotHelper RAT. \u00abThe first stage is a native x64 stager that fingerprints the host computer name, logged-on user, processor configuration, and installed memory, then connects to easyllms.xyz over HTTPS and retrieves a file named payload.bin from a path guarded by a long hexadecimal identifier, disabling TLS certificate validation beforehand,\u00bb Point Wild said<\/a>. \u00abThe second stage is BotHelper RAT. It copies itself to a hidden location, registers a scheduled task to relaunch every 30 minutes, patches the Antimalware Scan Interface, and registers with the same host that delivered it before polling a set of PHP endpoints for tasking.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  7. \n <\/p>\n
    \n New Android anti-scam defenses<\/span><\/p>\n

    \n Google said it\u2019s rolling out<\/a> multi-layered protections across Google Messages and third-party messaging apps to protect Android users against mobile scams. This includes enhanced Scam Detection with Private AI Compute, link safety checks with Gemini Nano, and redesigned warnings before tapping unfamiliar links. Google also said it\u2019s bringing Scam Detection in chat notifications to warn users about suspicious messages directly from their notification shade to other Android devices in partnership with device makers. Other security improvements include automatic screen-share privacy to hide sensitive information in native apps, Chrome, and Android WebView, blocking apps from quietly enabling call forwarding in the background, and real-time verification for bank calls in collaboration with Banco do Brasil, Ita\u00fa Unibanco, and other leading banks. \u00abAndroid checks incoming calls in real time to verify whether the bank actually initiated the call,\u00bb Google said. \u00abIf an incoming caller claiming to represent a bank fails this verification check, Android hangs up the call and immediately alerts you.\u00bb Since launching this feature in June 2026, Android has blocked more than 3 million spoofed calls from Banco do Brasil and Ita\u00fa Unibanco alone.\n <\/p>\n<\/div>\n<\/li>\n

  8. \n <\/p>\n
    \n AI model theft defenses strengthened<\/span><\/p>\n

    \n Anthropic has disclosed<\/a> that new measures like preserved thinking<\/a>, two-stage classifiers, and charging for requests that are blocked by our safeguards before Claude responds in its Fable 5.1 and Opus 5.5 models have reduced data harvesting through distillation attacks by about 90% to 99%.\n <\/p>\n<\/div>\n<\/li>\n

  9. \n <\/p>\n
    \n Enterprise browser security controls<\/span><\/p>\n

    \n Mozilla has launched<\/a> Firefox Enterprise, a browser iteration \u00abbuilt for organizations with strict security, governance, and compliance requirements.\u00bb Mozilla added, \u00abIT and security teams get more control over their data, IT infrastructure and browser environment \u2014 helping strengthen technological independence and operational resilience.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  10. \n <\/p>\n
    \n Self-healing WordPress backdoor<\/span><\/p>\n

    \n Wordfence has detailed an unusual malware that\u2019s installed<\/a> as a must-use WordPress plugin and makes use of \u00abseveral self-healing mechanisms in place in order to survive removal. It also makes use of EtherHiding, a technique that hides the location of the attacker\u2019s servers behind a smart contract on the Ethereum blockchain, making the command channel resilient to takedown.\u00bb The malware is capable of establishing administrator access, hiding the rogue administrator account, harvesting administrator passwords, remote site modification, data exfiltration, and spreading to other WordPress installations on the file system.\n <\/p>\n<\/div>\n<\/li>\n

  11. \n <\/p>\n
    \n Stolen credentials expose GitHub data<\/span><\/p>\n

    \n Meta said it\u2019s notifying about 1,500 people, most of them its own employees in the U.S., after unknown threat actors broke into some of the company\u2019s GitHub repositories. The intrusion, detected a few weeks ago, involved the use of an employee\u2019s stolen credentials. The access has since been shut down, according to SecurityWeek<\/a>.\n <\/p>\n<\/div>\n<\/li>\n

  12. \n <\/p>\n
    \n XWorm expands surveillance capabilities<\/span><\/p>\n

    \n The malware known as XWorm has transitioned from an infostealer to a full-blown surveillance platform. The malware\u2019s plugin count has expanded from 35 to 46. The latest versions detected since July 2025 are V6.4, V6.5 \u00abXWorm Reborn,\u00bb V7.2, and V7.4. \u00abThe Maps plugin provides victims\u2019 GPS location without triggering a user prompt,\u00bb Netskope said<\/a>. \u00abThe Microphone plugin streams live audio from the victim\u2019s device. HBrowser gives operators interactive control of authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  13. \n <\/p>\n
    \n Higher rewards for memory-safety bugs<\/span><\/p>\n

    \n Google has announced<\/a> that it\u2019s raising bug bounty rewards for some Chrome vulnerabilities, with a focus on memory safety issues. While the company lowered standard payout amounts for some vulnerabilities in April, such as a base reward of $500 for memory safety issues, it has now quadrupled base rates for memory safety flaws to $2,000. Vulnerabilities in Chrome\u2019s browser, GPU, and network processes can now earn researchers up to $20,000.\n <\/p>\n<\/div>\n<\/li>\n

  14. \n <\/p>\n
    \n Post-quantum readiness warning<\/span><\/p>\n

    \n Microsoft is urging organizations to prepare their certificate systems for post-quantum authentication, stating that public key infrastructure (PKI), hardware security modules (HSMs), and security appliances need testing before deployment. \u00abOrganizations should begin now by inventorying certificate dependencies, assessing vendor roadmaps, identifying long-lived infrastructure, and creating non-production test environments,\u00bb Microsoft said<\/a>. \u00abEarly testing can surface compatibility and process gaps before post-quantum authentication is required at scale.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  15. \n <\/p>\n
    \n AI tool credentials at risk<\/span><\/p>\n

    \n A new malware-as-a-service (MaaS) infostealer written in Rust comes with its own loader and a built-in cryptocurrency clipper. \u00abWarden Stealer is one of the first infostealers targeting configuration files and local data belonging to AI assistants and agentic coding tools,\u00bb Gen Digital said<\/a>. \u00abIts builds are heavily obfuscated, morphed, and regularly updated to evade detection.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  16. \n <\/p>\n
    \n Advanced browser data theft<\/span><\/p>\n

    \n Newer versions of CastleStealer can \u00abbypass app-bound encryption in Chromium-based browsers, execute commands remotely, and exfiltrate stolen information in small encrypted transmissions rather than a single large archive,\u00bb according to Flashpoint<\/a>. The C#-based stealer was first discovered in April 2026.\n <\/p>\n<\/div>\n<\/li>\n

  17. \n <\/p>\n
    \n AI developer credentials targeted<\/span><\/p>\n

    \n The infostealer known as Aoki<\/a> (aka Aokigahara) is targeting credential and session files used by AI coding assistants, including Claude, OpenAI\u2019s Codex, Cursor, Codeium, and Gemini. The stealer was first seen earlier this year. \u00abAPI keys and Open Authorization (OAuth) or session tokens allow malicious activity to be carried out under a legitimate developer\u2019s identity and API quota,\u00bb the Symantec Threat Hunter team said<\/a>. \u00abThey can also expose connected repositories, cloud services and CI\/CD pipelines linked to that account, and may bypass safeguards that assume requests originate from a trusted user.\u00bb In a report published last month, Google-owned Wiz said AI service provider API keys are a hot commodity. \u00abThese AI credentials are highly lucrative; allowing attackers to freely run their own workloads or resell the access as part of the illicit LLM resale market,\u00bb it said<\/a>. \u00abIn addition, these keys can potentially grant access to historical chat logs that may contain sensitive corporate data, but we\u2019re not aware of public occurrences of this scenario.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  18. \n <\/p>\n
    \n Customizable MaaS infostealer<\/span><\/p>\n

    \n K7 Labs has detailed a Python-based builder that is sold under a MaaS model and is used to embed an infostealer payload. \u00abRather than operating as a standalone stealer script, the builder follows a MaaS-style model,\u00bb it said<\/a>. \u00abIt allows operators to generate customized Windows executables using Nuitka or PyInstaller, with webhook configuration integrated into the build process.\u00bb The stealer capabilities include anti-analysis techniques, persistence, credential harvesting, and data exfiltration.\n <\/p>\n<\/div>\n<\/li>\n

  19. \n <\/p>\n
    \n Cloud credential theft risk<\/span><\/p>\n

    \n An SSRF vulnerability (GHSA-2phj-cp9f-qq6w<\/a>, CVSS score: 8.5) in Harbor, the CNCF open-source container registry, can be abused by a registered user to steal cloud credentials. \u00abAny registered user who can create a project can point a webhook at the cloud metadata endpoint and walk away with the server\u2019s IAM credentials,\u00bb OX Security said<\/a>.\n <\/p>\n<\/div>\n<\/li>\n

  20. \n <\/p>\n
    \n Unauthenticated RCE chain<\/span><\/p>\n

    \n A set of high-impact vulnerabilities<\/a> in Adobe Experience Manager (AEM) can be abused to achieve unauthenticated remote code execution (RCE). The chain combines four flaws: Unauthenticated DAM bulk import, stored cross-site scripting (XSS), unsafe XML parsing, and Groovy execution via \/bin\/asynccommand. The flaws affect only the cloud version of AEM and have been patched.\n <\/p>\n<\/div>\n<\/li>\n

  21. \n <\/p>\n
    \n Critical unauthenticated RCE<\/span><\/p>\n

    \n Samsung has patched<\/a> a critical security flaw (CVE-2026-110392, CVSS score: 9.8) in QA-Board that allows unauthenticated RCE. Samsung\u2019s QA-Board is an experiment-tracking tool that\u2019s used to organize, visualize, compare, and share research runs, specifically for algorithm and performance tuning. The problem stems from a case of improper neutralization of user-controlled data that could result in shell command injection. The vulnerability was flagged by Claude Opus 5.5.\n <\/p>\n<\/div>\n<\/li>\n

  22. \n <\/p>\n
    \n Linux root and container escape<\/span><\/p>\n

    \n Security researcher Ziyi Guo has disclosed details of a critical Linux security vulnerability in NVIDIA\u2019s GPU Display Driver for Linux (CVE-2026-47595<\/a>, CVSS score: 7.5, aka Bad UVM) that could allow an unprivileged user can write to read-only memory by taking advantage of the fact that the memory\u2019s permissions are not preserved. The vulnerability could be exploited to achieve code execution, escalation of privileges, denial-of-service, information disclosure, data tampering, and even a container escape. \u00abBy injecting our exploit code into nvidia-persistenced, we first force the hijacked process to execute a UVM-based local privilege escalation (LPE),\u00bb the researcher said<\/a>. \u00abOnce the privilege barrier is crossed, we trigger the subsequent operations, ultimately granting us the ability to execute commands on the host with full root access.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  23. \n <\/p>\n
    \n Active command injection attacks<\/span><\/p>\n

    \n A command injection vulnerability in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931<\/a>, CVSS score: 8.5) has come under active exploitation in the wild. The flaw affects customers using version 2.20 or later with statistics enabled, which is turned on by default. Successful exploitation could allow an attacker<\/a> to execute arbitrary OS commands with root or SYSTEM privileges on affected systems. It\u2019s currently not known how the flaw is being exploited, by whom, and who is being targeted.\n <\/p>\n<\/div>\n<\/li>\n

  24. \n <\/p>\n
    \n Critical unpatched SQL injection<\/span><\/p>\n

    \n Rapid7 has disclosed details of a critical SQL Injection vulnerability in Channel Software WebAlliance eCommerce (CVE-2026-108065, CVSS score: 9.8). \u00abThe exploit allows a malicious actor to read sensitive data from the database, or, if the database user has high privileges, run system commands on the database server,\u00bb Rapid7 said<\/a>. \u00abThe SQL Injection exploit can be leveraged to view sensitive information in the database, such as user PII and passwords. If logged in with DB admin privileges, the vulnerability can be exploited to run system commands on the server running the database.\u00bb\n <\/p>\n<\/div>\n<\/li>\n

  25. \n <\/p>\n
    \n Four code execution flaws patched<\/span><\/p>\n

    \n NSD has released patches<\/a> for four security flaws (CVE-2026-101341, CVE-2026-101339, CVE-2026-101338, and CVE-2026-101337) that could be exploited to achieve execution of arbitrary commands. The vulnerabilities, credited to Qifan Zhang from Palo Alto Networks and Gaurang Maheta, have been patched in NSD 4.15.3 or newer.\n <\/p>\n<\/div>\n<\/li>\n

  26. \n <\/p>\n
    \n Potential VM-to-host escape<\/span><\/p>\n

    \n The Xen project has published<\/a> details of CVE-2026-79610, a race condition in Xen\u2019s grant-table mechanism that could be abused to compromise the security of a virtual machine host and allow an unprivileged guest to elevate its privileges to that of the host. All Xen versions from 4.0 onwards are vulnerable. The issue has been addressed in xsa517.patch. As mitigation, it\u2019s advised to use the \u00abgnttab=max-ver:1\u00bb hypervisor command line option or the \u00abmax_grant_version=1\u00bb guest configuration option for guests. The project maintainers credited Anthropic\u2019s Claude Opus with the discovery and Teddy Astie of Vates for diagnosing it as a security issue.\n <\/p>\n<\/div>\n<\/li>\n

  27. \n <\/p>\n
    \n SYSTEM-level remote code execution<\/span><\/p>\n

    \n A Windows security vulnerability in MyReport Updater 2.1.1 can permit an attacker to seize control of a machine, including remotely, without authentication. \u00abAn attacker with standard user privileges can set an arbitrary reference server,\u00bb Quarkslab said<\/a>. \u00abIf MyReportUpdaterService can contact this server over gRPC on TCP port 9095, the attacker can write files into a chosen directory with NT AUTHORITY\\SYSTEM privileges. The attacker can use this file-write access to place a DLL that will be loaded by a privileged process. The DLL code is then executed with high privileges. This vulnerability gives full control of the Citrix server. It can also affect other machines where the vulnerable MyReport solution is installed.\u00bb\n <\/p>\n<\/div>\n<\/li>\n<\/ol>\n<\/section>\n<\/div>\n

    If there\u2019s one thing this week\u2019s stories make clear, it\u2019s that attackers don\u2019t always need a clever trick. Sometimes a stolen login, a forgotten setting, or one small mistake is enough. And even when the bug gets fixed, the trouble it caused might still be sitting there.<\/p>\n

    The lesson is pretty simple: don\u2019t just check what\u2019s broken. Check who got in, what they touched, and whether they can come back. Keep an eye on the things everyone assumes are safe. Those are often the ones nobody looks at until something goes wrong. That\u2019s it for this edition. See you next week, hopefully with fewer surprises.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that\u2019s an actual feature. And somehow, it fits right in with this week\u2019s security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong […]<\/p>\n","protected":false},"author":1,"featured_media":2140,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25,5],"tags":[1682,492,4250,24,1639,2001,3782,779,4251,4185,1540],"class_list":["post-2139","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-noticias","category-trending","tag-adobe","tag-backdoor","tag-container","tag-cyberdefensa-mx","tag-dns","tag-escape","tag-nvidia","tag-rce","tag-selfhealing","tag-theft","tag-wallet"],"_links":{"self":[{"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/posts\/2139","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/comments?post=2139"}],"version-history":[{"count":0,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/posts\/2139\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/media\/2140"}],"wp:attachment":[{"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/media?parent=2139"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/categories?post=2139"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercolombia.co\/index.php\/wp-json\/wp\/v2\/tags?post=2139"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}