A Microsoft 365 RejectDirectSend bypass lets attackers spoof internal emails. Learn how this RejectDirectSend bypass works and how to protect your tenant.
PoisonedRefresh rootkit injects PHP web shells into F5 BIG-IP APM Apache memory, leaving no disk artifacts.
SophosLabs published a detailed technical analysis on September 8, 2026, of a Linux implant, dubbed PoisonedRefresh by ESET, they found in compromised F5 BIG-IP Access Policy Manager environments. Sophos tracks it as Linux/Agnt-IC. F5 has confirmed exploitation of the underlying vulnerability and links the activity to a cluster it tracks internally as c05d5254.
“The malware targets deployments featuring Apache, libphp, APR module loading, BIG-IP APM webtop components, and BIG-IP upgrade workflows, suggesting it was developed for specific environments. F5 associates the related c05d5254 activity with BIG-IP APM systems affected by CVE-2025-53521, an exploited unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server.” reads the report published by SophosLabs. “If you believe you are, or have been, using affected BIG-IP APM versions, follow F5’s remediation and compromise-assessment guidance before applying generic Apache or PHP hardening recommendations.”
The short version: the web shell is real and works as expected, but the implementation removes almost every artifact defenders normally use to find it.
The initial access vector is CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM when an access policy is configured on a virtual server. The Shadowserver Foundation observed 795 internet-exposed endpoints vulnerable to this CVE at the time of disclosure. The vulnerability was previously classified as a denial-of-service issue before F5 confirmed it as an RCE.
PoisonedRefresh is the second-stage payload. The first stage, which Sophos found hidden inside a modified Linux umount binary, infects /usr/sbin/httpd, modifies SELinux configuration, and embeds itself in BIG-IP upgrade images to survive device updates. Whatever the first stage does to gain persistence, the second stage is what gives the attacker operational capability.
The second-stage malware is a standalone Linux ELF binary that includes its own loader instead of relying on the normal Linux loader. When it starts, it intercepts libc_start_main, the function that normally starts Apache. This lets the malware run its own setup before Apache begins normal work, before logging systems fully start, and before some security tools can monitor the process.
“The second-stage sample hides key operational strings with RC4, gains execution before the host application main() function is invoked by intercepting __libc_start_main, targets Apache’s PHP module by hooking the Apache Portable Runtime (APR) module loader (apr_dso_load), and injects a PHP web shell into memory. It does the latter by manipulating mmap behavior inside libphp at runtime – so that only the infected process sees the malicious content and nothing ever touches the disk.” continues the report. “Alongside this web‑based access, the implant also creates a local UNIX domain socket and can redirect a connection into /bin/bash, enabling interactive access without opening a TCP listening port.”
The malware then waits instead of immediately changing the Apache process. It hooks apr_dso_load, the Apache function that loads shared libraries, and waits for Apache to load the PHP module (libphp). Once PHP loads, the malware checks /proc/self/maps to find where libphp sits in memory.
It then temporarily changes the memory permissions and redirects calls to file functions such as open, close, and mmap. After making the changes, it restores the original protections. From that point on, the malware can control how PHP handles files inside the Apache process.
The web shell delivery is where the analysis is most distinctive. The implant watches for PHP opening any of three specific BIG-IP APM webtop script files: apm_css.php3, full_wt.php3, and webtop_popup_css.php3. These are legitimate files that exist on the device. When PHP opens one and then maps it into memory, the implant intercepts that mmap() call and returns a modified view: the original script content preceded by the embedded PHP web shell. The on-disk file is never changed. The running process sees different content than what ls or a file integrity scanner would report.
The injected web shell reads raw data from php://input and looks for a special prefix, BSOHAzPB. It then decrypts the rest with a stream cipher using the key wSLjN1beuR and executes the result. To make its traffic look normal, it responds with HTTP status 201 and sets the content type to text/css. This makes the response look like a successful CSS file request on a BIG-IP APM device.
The implant also creates a local UNIX socket at /run/bigtlog.pipe. After a short authentication step using the token Kzwd6jM5, it connects the shell’s input, output, and error streams to the socket and starts /bin/bash. This gives the attacker an interactive shell without opening a TCP port, making the activity harder for network monitoring tools to detect.
The malware uses Apache’s apr_time_now function as a delayed trigger. It waits until the server has fully started before launching the socket worker, reducing the risk of disrupting Apache during startup.
The binary also encrypts its operational strings with RC4 using the hardcoded key TrswBWIl90Z5e38n. It decrypts them only when needed. As a result, static analysis mainly reveals function names and gives little information about what the malware is actually designed to do.
“Web shell detection mechanisms should include runtime behavior and memory inspection, not just file scanning.” continues the report. “For this class of threat, it is entirely possible for the on‑disk PHP file to appear benign, while the in‑memory mapping contains malicious code.”
Sophos recommends checking several indicators that could point to this malware. These include unusual mmap() or mprotect() calls shortly after libphp loads inside Apache worker processes, access to /proc/self/maps followed by changes to memory permissions, and the presence of the local socket /run/bigtlog.pipe.
Teams should also look for HTTP 201 responses with Content-Type: text/css when they do not match legitimate CSS or other asset requests. Other signs include unexpected changes to SELinux settings or modified BIG-IP upgrade images.
The SHA-256 hash of the analyzed sample is 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9.
F5 has published remediation and compromise assessment guidance for CVE-2025-53521 and should be the first stop for affected BIG-IP APM operators, before applying any generic Apache or PHP hardening.
“This implant demonstrates how modern Linux malware can deliver familiar attacker capabilities through sophisticated delivery mechanisms.” concludes the report. “While the embedded PHP ultimately behaves like a traditional web shell, the surrounding infrastructure is considerably more advanced: custom ELF loading, early startup interception, APR-aware module monitoring, relocation patching, and memory-only payload delivery.”
The researcher Chaotic Eclipse released ShieldCrash, a PoC exploit for a Microsoft Defender Zero-Day vulnerability.
Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Microsoft Defender. The researcher named the exploit ShieldCrash, it triggers an arbitrary file read as SYSTEM.
The researcher claims that Microsoft has not fully fixed the ShieldBreak vulnerability (CVE-2026-69414). According to the researcher, Microsoft closed several ways to exploit the flaw but missed a specific condition that still allows the same attack.
The researcher published a proof of concept (PoC) that can read arbitrary files with SYSTEM privileges, the highest level of access on Windows. He says all supported Windows versions remain vulnerable, even after the September 2026 security updates.
“Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak. While Microsoft fixed several things to prevent re-exploiting the issue, they missed a spot where ShieldBreak can still be exploited.” Chaotic Eclipse wrote. “This PoC demonstrates an arbitrary file read as SYSTEM with September 2026, all supported windows versions are affected.”
The researcher described the PoC as a basic version for now. They may later develop it into a full SYSTEM-level exploit, but for now they published only enough code to show that Microsoft’s patch does not completely block ShieldBreak.
Microsoft recently updated the Malware Protection Engine to fix CVE-2026-69414. Version 1.1.26080.3 includes the fix, which requires no user action and does not affect systems with Microsoft Defender disabled. Microsoft recommends keeping malware definitions and the engine updated automatically.
“Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as “ShieldBreak ” reads Microsoft’s advisory. “In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner. For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.”
Last week, Chaotic Eclipse released a new zero-day exploit targeting Nvidia. The researcher named the exploit GreenSection, it triggers a Memory Corruption flaw.
Recently, Chaotic Eclipse released exploits targeting other anti-malware and defense solutions. Chaotic Eclipse released a zero-day exploit targeting Kaspersky Endpoint Security he named HardBreacher, which triggers a privilege escalation flaw. The researcher pointed out that the PoC is unstable and may require repeated attempts, but when successful, it creates a DLL in System32 with full user permissions. The researcher also claims taking control of Kaspersky’s UI process can disrupt the antivirus and interfere with file-access controls, potentially leaving the system in an unstable state.
Nightmare Eclipse says the Kaspersky Endpoint Security zero-day allows privilege escalation on a fully patched Windows 11 25H2 system running Kaspersky Endpoint v14.0.0.504.
The researcher also released a zero-day exploit targeting GenDigital Avast Antivirus, named PrettyPrague. The exploit triggers a privilege escalation flaw.
The researcher claims to have found another zero-day in an antimalware product, this time targeting Avast Antivirus. The PoC exploits a flaw in Avast Sandbox to dump the Windows SAM database and gain a SYSTEM-level shell. It reportedly works even on fully patched Avast Antivirus and Windows 11 25H2. The researcher also suspects the flaw may affect other Gen Digital products, including AVG and Norton.
According to the researcher, FalconFlank abuses Falcon’s “Microsoft Office file malicious macro removal” feature. The function is part of Falcon’s remediation capabilities and operates with high privileges. The researcher claims that this behavior can be abused to escalate privileges from a low-privileged local user to a more powerful context.
Chaotic Eclipse, also known as Nightmare Eclipse, is a researcher known for publicly releasing PoC exploits for zero-day vulnerabilities, often after criticizing vendors’ handling of vulnerability reports. His releases have mainly targeted Microsoft products, including Windows and Microsoft Defender, with some later exploited in the wild. Among the most notable are the Undefend and RedSun Defender zero-days.
His work has fueled debate over responsible disclosure and the risks of publishing working exploits.
September 2026 Patch Tuesday fixes a record 974 CVEs including 2 exploited zero-days, 20 wormable bugs, and a critical Exchange RCE via Visio email.
Microsoft’s September 2026 Patch Tuesday set a new record. Depending on how researchers count external and Chromium bugs, Microsoft fixed between 966 and 997 CVEs in this update. The company also fixed another 204 vulnerabilities earlier in September across Azure, Entra ID, Edge, and other services. This means the total number of September fixes is already much higher than the headline figure.
“It’s a new record release from Microsoft, but, again, that seems to be the new normal. As always, counting this beast is tricky, but I see 972 new CVEs rolling out from Redmond this month.” reads the report published by ZDI. “On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate. On the other hand, AI-assisted vulnerability discovery shows no signs of slowing down. However, we have not seen a correlating spike in active exploits – yet.”
The number of addressed issues skyrockets due to the use of AI for code auditing in the monthly counts, it has been climbing steadily through 2026. What hasn’t arrived yet, and ZDI notes the absence explicitly, is a corresponding spike in active exploits, though 58 of this month’s fixes are rated by Microsoft as more likely to be exploited.
The two vulnerabilities already under attack both allow attackers to gain higher privileges. CVE-2026-85880 (CVSS score of 7.8) is a heap buffer overflow in Windows Advanced Local Procedure Call (ALPC). It lets a local attacker gain SYSTEM-level privileges, and the researchers note it is only the second ALPC zero-day Microsoft has patched since January 2023.
CVE-2026-81963 (CVSS score of 7.8) flaw resides in the Windows Update Stack. It lets an attacker follow a malicious link and escalate privileges. It is the first Update Stack vulnerability that Microsoft has confirmed attackers actively exploiting. Both flaws require local access and user-level privileges, so attackers would likely use them after gaining an initial foothold and then use them to gain higher privileges.
The Exchange Server situation this month is more pressing than either zero-day. CVE-2026-55007 is a remote code execution vulnerability that deserves immediate attention.
“An unauthenticated attacker could send a specially crafted Visio attachment to an affected Exchange server. The server could process the attachment during content indexing, and successful exploitation could allow the attacker to execute code on the server. User interaction is not required.” reads the advisory. “Successful exploitation requires the target system to be under sustained low-memory (memory pressure) conditions, which are not commonly present in normal operation. This makes the vulnerability difficult to reliably trigger, as the attacker must first induce or wait for a constrained memory state before exploitation becomes possible.”
Microsoft rates the exploit as unreliable, but an attacker trying repeatedly only needs to succeed once. A second Exchange bug, CVE-2026-69380 (CVSS 8.1), is also a priority: it lets a low-privileged authenticated attacker impersonate any user in the organization and hijack every mailbox. If your Exchange servers face the internet, test and deploy these patches immediately.
Remote Desktop Services adds another urgent item: CVE-2026-69525 (CVSS score of 9.8) is a use-after-free bug that lets an unauthenticated in-network attacker execute arbitrary code. Microsoft specifies an “in-network” requirement, but the CVSS network vector score suggests any network path could be relevant. RDP is everywhere in enterprise environments, and that CVSS score combined with the unauthenticated attack path makes this one worth treating as urgent regardless of the technical qualifier.
Microsoft also fixed 20 wormable vulnerabilities. These flaws let remote, unauthenticated attackers execute code without any user interaction, creating the kind of conditions that can help malware spread from system to system. The affected components include DHCP Server, Active Directory, Windows DNS Server, SMB Client, Netlogon, NFS, RRAS, IP Helper, Message Queuing, and others. One DNS flaw, CVE-2026-69730, has a CVSS score of 9.8. ZDI calls it a “SigRed’s spiritual successor,” referring to the critical DNS flaw exploited in 2020. Fixing 20 wormable bugs in one Patch Tuesday is an unusually high number.
Microsoft also patched 17 SharePoint flaws, including four that allow remote code execution, and more than 60 SQL Server vulnerabilities. One SQL Server flaw affects SQL Copilot in SQL Server Management Studio. Microsoft also fixed an Android Microsoft Authenticator flaw that can let a malicious app gain valid access tokens after the user completes an authentication step. Teams should prioritize these fixes based on their own environments, but they should not ignore any of them.
The full list of vulnerabilities addressed by Microsoft this month is available here.
Crypto exchange network Liquid Network lost $320 million overnight, then got most of it back after the hackers demanded a bug fix instead of a ransom
Bitcoin’s Liquid Network, a sidechain built by Blockstream and used by dozens of exchanges to move funds faster and more privately than the main Bitcoin blockchain allows, got drained of roughly 4,000 of the 4,200 Bitcoin sitting in its federation wallet on September 6.
The attackers, who described themselves as white-hat hackers, have since returned 3,400 of those crypto coins, worth around $262.6 million, while keeping roughly 598 BTC, close to $47 million, for themselves.
Update: 3,400 BTC of the roughly 4,000 BTC withdrawn on September 6 has been returned to the @Liquid_BTC Federation wallet. The return followed confirmation from @Blockstream that the affected bridge nodes have been patched. Approximately 598 BTC remains outstanding, and…
The size of the initial theft makes this much more serious than another crypto hack. The attacker took nearly 95% of the wallet’s Bitcoin in a single transaction, leaving the fund behind Liquid’s L-BTC token with only about 197 BTC.
This wasn’t a partial breach. The attacker drained almost the entire collateral pool that should back every L-BTC token with an equal amount of real Bitcoin.
How the money actually left is the more technically interesting part. According to Bitrue’s breakdown of the exploit, the attackers didn’t steal a private key or compromise any authorization credentials at all. A software bug in Elements, the open-source code powering Liquid Network, apparently let more L-BTC exist than the system’s real Bitcoin reserves should have allowed, and that unbacked token was then redeemed for genuine BTC through SideSwap’s authorized peg-out mechanism. Liquid itself confirmed the specific access point directly, stating plainly that the funds moved through SideSwap’s authorization key, and that key itself was never compromised.
What happened next is where this stops looking like an ordinary crypto heist. Rather than demanding a ransom payment or threatening to dump the stolen coins, the attackers negotiated entirely in public, writing messages directly into Bitcoin transactions using the OP_RETURN field, a way to embed small amounts of arbitrary data on-chain.
The discussion between @Blockstream and the white-hat hacker (WHH) regarding the ~4000 BTC from @Liquid_BTC is happening in public. It seems to be their preference over email. As it's hard to follow the chain of messages in OP_RETURN, here's a summary with links.
Their opening demand, relayed through Liquid’s own channels, was refreshingly blunt: fix the underlying vulnerability first, confirm every node is patched, and only then would they send the money back.
Blockstream appears to have met that condition. After the team confirmed that the affected bridge nodes had received the security patches, the attackers returned 3,400 BTC to the federation wallet. They first checked that they had the correct return address. They then kept the remaining 598 BTC, effectively rewarding themselves for the bug discovery. Former Blockstream executive Samson Mow provided updates during the incident but warned that the recovery is not over. The network remains paused while federation members complete more security work, resolve a chain split caused by the freeze, and restore confidence that L-BTC has full Bitcoin backing before they restart the network.
Whether “white hat” is the right label here is a genuinely contested question, and not just semantically. Security specialist Alena Vránová pushed back hard against the framing on social media, arguing that exploiting a vulnerability, draining $320 million, and demanding a fix before returning the money still meets the legal definition of extortion, potentially carrying felony charges and prison sentences up to 20 years in the US. Calling yourself ethical after the fact doesn’t retroactively make unauthorized access to someone else’s wallet legal, whatever bug you’re fixing on the way out.
If you attacked @Liquid_BTC fix it fast I'd reckon to avoid serious trouble.
If you exploit vuln, steal 4k BTC and demand a fix for ransom, that's EXTORTION.
This can mean felony charges and long prison time. In the U.S. up to 20 years, and computer-fraud charges can add more. https://t.co/aekesa5K0n
The incident also creates a long-term trust problem that a security patch cannot fix. Galoy founder Nicolas Burtey argued that, even if the funds return in full, the attack has already damaged trust in Liquid. Who will trust Liquid with their money after this? The federated system promises one-to-one Bitcoin backing for every L-BTC token, but this attack showed that guarantee can fail. Recovering most of the funds does not erase that failure.
Researchers built a WeChat worm that spreads through incoming calls without user action. Tencent has blocked the exploit.
Researchers at Calif created a WeChat worm that can take over an account through an incoming call, even if the victim never answers or touches the phone.
The attack works only when the caller already appears in the victim’s WeChat contacts. Calif reported the flaw to Tencent in July, and Tencent has blocked the exploit for all users. The good news is that researchers found no evidence that attackers used the flaw in real-world attacks, but the case shows how dangerous zero-click vulnerabilities can be.
“Simply by calling a victim, WeWorm can hijack their account and call their friends, spreading from phone to phone.” reads the report at Calif. “If exploited, actors can compromise over a billion phones (or accounts), upending livelihoods and breaking communities worldwide.”
Researchers built a demo WeChat worm that spread between three test phones without requiring any action from the victims. They started with a Pixel 10a and called an iPhone 17e, exploiting the flaw while the phone was still ringing. After taking control of the iPhone, they used it to call another Pixel 10a and compromise that device too. In other words, one compromised account can become the starting point for the next attack.
The exploit works within seconds and gives the attacker full control of the victim’s WeChat account. They can read and send messages, make calls and use the account as if they were the victim. The victim does not need to answer or touch the phone. Even answering the call does not stop the attack. Declining the call blocks that attempt, but the attacker can simply try again later.
The main limitation is that the attacker must already be a WeChat contact. However, compromising one of the victim’s friends could provide a way around that restriction.
“The victim does not need to answer the call, or interact with their phone at all. Even if they do answer, they hear nothing, and the exploit still succeeds. Declining the call stops that attempt, but the attacker can simply try again later, for example, while the victim is asleep.” the researchers explain. “This exploit requires the attacker to be on the victim’s friend list. But that’s not much of a barrier: an attacker can compromise one of your friends first and use their account to reach you.”
Calif published both Android and iOS RCE demos. The firm did not disclose technical details about the issue and will present the full analysis at a conference. For now, defenders have no clear indicators to search for, and users cannot tell if attackers targeted them with a call.
Combined with other Android and iOS flaws, the attack could also lead to full device control.
Researchers say AI helped them find the flaw and build an RCE exploit in about two days. They then built the worm in another week. They argue that AI is making advanced attack capabilities available to less-skilled attackers, increasing the risk of zero-click threats.
Researchers say the goal of publishing the findings is to raise awareness and encourage governments and technology companies to work together on AI security.
The WeChat flaw comes from a memory corruption bug in the app’s VoIP system. Researchers are keeping the technical details private for now and plan to present their full analysis at a future security conference.
The team believes this bug is just one example of the unusual attack surfaces found in messaging apps. They are researching similar weaknesses in other apps and working with developers to reduce these risks. Some changes may require cooperation from platform owners. Once the work progresses, they plan to publish more details about the WeChat flaw.
In August, Tencent released versions Android 8.0.77 and iOS 8.0.76 that addressed the issue.
WeChat is Tencent’s messaging and social platform, launched in 2011 and now much more than a chat app. It lets users send messages, make voice and video calls, create group chats and share content through Moments. It also includes official accounts, video channels, games, search and Mini Programs, which provide services such as shopping, bookings and deliveries without requiring separate apps.
In China, its local version, Weixin, also integrates Weixin Pay for mobile payments. Tencent reported 1.418 billion combined monthly active users for Weixin and WeChat at the end of 2025, making the platform one of the world’s largest messaging ecosystems.
An exposed Vietnam-linked APIS database contained 220.8 million passenger and crew records, including passport and flight data.
Researchers found an exposed Advance Passenger Information System (APIS) database containing 220.8 million passenger and crew records from January 2017 to April 2026.
The data includes sensitive details such as passport numbers, identities and flight information, potentially affecting travelers of many nationalities who flew to, from or through Vietnam. Kinryū Labs discovered the Elasticsearch cluster, named “pax-info,” while searching for exposed databases.
It contained 29 indices and about 107 GB of data. The researchers linked the server to IP space assigned to Viettel in Hanoi, but could not confirm which Vietnamese organization operated it.
Researchers found an exposed APIS database linked to Vietnam that contained more than 220 million passenger and crew records from 2017 to 2026. The data included passport numbers, identities and flight details. The Elasticsearch database, discovered by Kinryū Labs, held about 107 GB of data across 29 indices. It was hosted on IP addresses assigned to Viettel in Hanoi, although researchers could not confirm which Vietnamese organization operated the system.
The exposed database contained names, dates of birth, sex, nationalities, passport or travel-document numbers, expiration dates and issuing countries, BleepingComputers reports.
It also included flight numbers and dates, airlines, departure and destination airports, transit airports, seat numbers, baggage references, and scheduled, estimated and actual flight times. The database covered many airlines across Asia-Pacific, Europe and the Middle East, so it could affect people from around the world who traveled to or through Vietnam between 2017 and 2026.
Kinryū Labs confirmed the data was real by matching records with its researchers’ own trips to Vietnam. The total also counts travel records, not unique people, so frequent travelers may appear multiple times.
While the researchers could not provide a complete breakdown by nationality, the data covered numerous international airlines across Asia-Pacific, Europe, and the Middle East. As a result, the exposed records could relate to people from virtually anywhere who visited or transited through Vietnam over the nine-year period.
Kinryū Labs verified that the information was legitimate by matching records in the database against its researchers’ own travel to Vietnam.
The figures represent travel records rather than unique individuals. Passengers and crew members who flew multiple times may therefore appear repeatedly in the database.
Kinryū Labs reached the exposed database by combining two security misconfigurations. Direct internet access returned a 401 error, but another cloud-based path exposed the cluster and accepted default credentials.
FOFA first detected the host in 2022 and identified it as a database in 2023, but researchers could not determine when the passenger data became accessible. The records cover more than nine years, but the actual exposure period remains unknown.
Kinryū Labs reported the issue to Vietnamese authorities, affected airlines and national CERTs on June 3. The database was secured by June 8, with Singapore Airlines helping coordinate the response.
Researchers found no evidence that the listed airlines operated the system or suffered a network breach. They also found no ransom notes or signs that attackers had altered the database.
However, without server logs, they could not determine whether anyone had copied or stolen the data before the system was secured.
North Korea-linked hackers hid a backdoor inside HAProxy, masking C2 traffic and stealing data while keeping the load balancer working normally.
North Korean-linked hackers found a genuinely clever hiding spot for their malware: inside the actual source code of HAProxy, the load balancing software running at the edge of two South Korean companies’ networks. Rapid7’s research documents a previously undocumented Linux toolkit hitting South Korea’s automotive and media sectors, and the depth of integration here goes well beyond a typical backdoor bolted onto a system.
“A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named “ted backdoor”, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd.” reads the report published by Rapid7. “This previously undocumented framework enabled threat actors to execute remote commands on compromised servers, inject malicious scripts into web traffic, perform credential harvesting, and engage in long-term surveillance.”
The implant, which Rapid7 calls the “ted backdoor” based on debug strings the attackers left behind, isn’t a separate process running alongside HAProxy. It’s compiled directly into HAProxy’s own source code as a custom plugin, using the software’s native filter API, internal memory management, and event scheduler to intercept HTTP traffic while completely legitimate load balancing keeps running normally on top of it.
“The standout feature of this toolkit is its depth of integration with the target environment. The ted backdoor is compiled as part of the victim’s existing HAProxy version 2.8.12.” continues the report. “It uses its native filter API, internal memory pools, event scheduler, and process management infrastructure to intercept traffic and hide from monitoring, while genuine load balancing traffic operates as expected.”
Rapid7 explains, which is really the whole thesis of why this backdoor is so hard to spot: it’s not an addition to the software, it’s woven into it.
The backdoor receives commands through a surprisingly simple trick. The attackers send a request for a fake image at /favorite_list_2x_m500_ico.jpg. This switches the HAProxy filter into command-and-control mode.
The malware then saves the command in a named pipe and removes traces of the request from HAProxy’s internal counters. It also clears the forwarding buffers, so the request never reaches the backend server. The command ends at the load balancer, leaving nothing in the application logs to show that it happened.
This ability to erase its own traces makes the backdoor very different from a normal web shell. The C2 requests never reach the backend server and are also removed from HAProxy’s statistics.
As a result, neither the application logs nor HAProxy’s connection logs show that the attack happened. A security team checking the logs could find nothing suspicious because the backdoor has already erased the evidence.
Beyond remote command execution, the backdoor can quietly inject malicious scripts or entirely swap out page content for specific victims matched by IP address, browser fingerprint, or even a hidden authentication credential smuggled inside the Accept-Language header, effectively turning a company’s own load balancer into a watering hole against its own visitors. It also hooks response bodies carefully enough to hide the size difference caused by injected content, stripping the header that would let a browser notice the byte-range mismatch. That’s a level of protocol-level care that suggests real HAProxy internals expertise, not a quick copy-paste job.
The main backdoor also comes with a separate toolkit that modifies common Linux system daemons such as crond, agetty, atd, and sshd. These programs continue to work normally but also carry malicious features.
One component acts as an SSH keylogger. It captures passwords that administrators enter in plain text and quietly records them. Another tool, called curlRAT, contacts a remote server every 12 hours by default, or every 30 seconds when the attacker enables its fast-poll mode.
curlRAT also checks whether the system runs inside a virtual machine. If it does not find the expected signs, it refuses to run. This behavior suggests the attackers designed the malware to avoid sandboxes and other analysis environments.
Attribution here sits at medium confidence, and Rapid7 is upfront about the limits of what the evidence actually shows. The targeting pattern, simple XOR-based encryption, a custom substitution cipher, and command-server infrastructure already linked to APT37 by other threat intelligence feeds all point toward North Korean state involvement, with some technical overlap also drawing comparisons to a concurrent Lazarus Group campaign against South Korean media sites.
“Further evidence is necessary to make a more definitive assessment. Moreover, the presence of ngx_* prefixed routines within the ted backdoor suggest code reused from an nginx backdoor. The ngx_* prefixed routines were observed during the latest Funnull campaign, where (similar to our case) a custom nginx filter was registered to hook HTTP traffic, and simple XOR encryption was applied to the configuration file.” Rapid7 states. “However, other than a similar naming convention, no significant code-level overlaps exist to support a stronger linkage.”
If your organization runs HAProxy, or really any edge component handling SSL termination and traffic routing, the practical lesson here is uncomfortable but simple: that software deserves the same scrutiny as your actual application servers, not less. The Hacker News confirmed in early September that the specific command domains used in this campaign have already gone dark, returning no DNS records at all, which is useful for reviewing historical logs but does nothing to stop whatever comes next from the same operators. Checking a load balancer’s own logs isn’t enough anymore when the backdoor’s entire design goal is making sure those logs never see it in the first place.
“ted backdoor and curlRAT were designed to persist during long-term espionage operations with the ability to steal cookie sessions, credentials, redirect selected users, conduct drive-by download attacks, and hide evidence of the tampered page to a specific range of IPs to evade detection.” concludes the report. “Defenders should treat any edge component managing user traffic, SSL, or runtime modules with the same strict security standards as their main application servers. Relying on the component’s own logs is not enough; securing these systems requires independent network correlation, memory behavioral analysis, and binary integrity checks.”
Attackers bypass endpoint security by posing as IT staff, stealing Microsoft 365 sessions, draining SaaS data and demanding extortion.
Forget installing malware because today’s extortionists just pick up the phone instead of writing code. A widespread threat cluster tracked as PREY-0058 bypasses endpoint security entirely by targeting Microsoft 365 and SaaS environments through pure social engineering.
Attackers pose as internal IT help desk staff via phone calls and direct executives toward rogue authentication portals.
“The threat actors impersonate internal IT or helpdesk personnel by phone and direct them to an authentication-themed URL, often formatted as <victim organization>.<lure domain>.” reads the report published by Artic Wolf. “These attacks most frequently target Directors, Vice Presidents, and other executive staff.”
Once victims land on these pages, adversary-in-the-middle panels intercept credentials and multi-factor approvals in real time.
Stolen session tokens are then replayed using residential proxy networks that match the victim’s exact geographic location.
“Stolen sessions are replayed from residential proxy infrastructure, most notably NodeMaven, often from IP addresses that resolve to the same geo-location and network (ASN) as the victim.” states Artic Wolf. “Initial sign-in activity involves applications such as “My Signins”, “My Profile”, “My Apps”, which reveal account details and the applications available to the victim.”
This clever trick blinds standard impossible travel alerts and leaves defenders scratching their heads.
Intruders waste no time once they slip past the front door, immediately shifting focus to massive data harvesting.
“After initial access, the threat actors perform discovery techniques against SharePoint and Entra ID.” continues the report. “SharePoint discovery includes SearchQueryPerformed events with contentclass:STS_Site, contentclass:STS_Web, and wildcard searches using indexdocid for pagination.”
They map out repositories and drain sensitive files from OneDrive, Exchange, and Box before dropping a heavy extortion demand.
To detect these attacks, monitor Microsoft 365 sign-ins coming from residential proxies or hosting networks such as NodeMaven. Suspicious activity is more likely when several common Microsoft account pages are accessed at the start of a session, especially OfficeHome, My Signins, My Profile, My Apps and Microsoft Account Controls.
Alerts should also consider changes from a user’s normal sign-in pattern, such as a different location, ISP, browser, operating system or user agent.
In SharePoint, look for unusual SearchQueryPerformed events that map or enumerate sites and files. In Exchange, watch for large numbers of MailItemsAccessed events in a short time, especially when they come from hosting or proxy IPs. Also monitor heavy SharePoint and OneDrive file access or downloads from one user, particularly when scripting tools such as Python requests or Microsoft Graph are used. Finally, watch for new phishing domains that imitate your organization and target passkey or MFA registration.
To reduce the risk, require managed devices for Microsoft 365 and block or challenge access from proxy and hosting networks. Use phishing-resistant MFA such as FIDO2 keys or device-bound passkeys, which can stop AiTM attacks. Limit users’ access to sensitive SharePoint data, enable Continuous Access Evaluation, and train employees and help-desk teams to verify unexpected IT calls through a trusted channel.
Artic Wolf also released Indicators of Compromise (IoCs) for these attacks.
Condé Nast user data from 32.8 million accounts is reportedly for sale, raising risks of targeted phishing, fraud and scams.
A database said to contain 32.8 million Condé Nast user records is being offered for $15,000 on a Russian-language cybercrime forum. Ransomnews reviewed a 5,000-record sample and concluded that it is consistent with genuine Condé Nast account data collected between September and late October 2025, including records that have not appeared publicly before. Ransomnews’ original report provides the underlying analysis.
The alleged dataset covers users across Condé Nast’s publishing portfolio, which includes Vogue, The New Yorker, GQ, Glamour, WIRED, Vanity Fair and other titles. Condé Nast has not publicly confirmed the breach or commented on the new sale listing.
The seller claims the database contains 32,815,767 unique email addresses. It also allegedly includes names, postal addresses, gender, dates of birth and phone numbers for portions of the population, but no passwords, password hashes, usernames or payment-card data.
“A database of 32,815,767 Condé Nast user records went on sale on a Russian-language hacker forum on 7 September 2026 for $15,000, offered as the full set behind December’s WIRED leak.” Ransomnews states. “Ransomnews tested the 5,000-row sample: it is genuine Condé Nast account data, captured in September and October 2025, and the 30.5 million non-WIRED records have not surfaced publicly before. Condé Nast has never commented on the breach.”
Ransomnews found that 31.6% of records allegedly include both first and last names, 22.3% include a postal address, 17.5% include gender, 12.6% include a date of birth and 2.9% include a phone number. The data is valuable because it can be filtered and combined with other information, not because every record contains every field.
The listing claims to include the full dataset behind the December 2025 leak involving WIRED, one of Condé Nast’s best-known publications. The seller says that a separate version excluding WIRED contains 30,455,594 records, which implies a WIRED subset of roughly 2.36 million records.
That figure closely matches the 2,366,576 WIRED records made public in December 2025. SecurityWeek previously reported that the actor behind that leak, using the name “Lovely,” claimed to have stolen more than 40 million Condé Nast records and threatened to release data linked to other publications.
Here’s a simpler and more natural version:
The numbers connect the new listing to the earlier WIRED breach, but they don’t prove that the seller is the original attacker. The seller could be the same person, a partner, or someone who got the data later.
The sample does not look like a recycled copy of the public WIRED leak. It contains names and street addresses at higher rates than the earlier WIRED dataset, has a different field structure and shows a demographic distribution that fits a broader collection of Condé Nast consumer titles, including publications with predominantly female readerships.
Ransomnews did not test the records against live Condé Nast accounts, which would have created further privacy risks. Instead, it used internal consistency checks to determine whether the sample behaved like a real long-running consumer database.
The 5,000-record sample closely matched the seller’s claims, with field-completion rates differing by only 1.2 percentage points. Among records with full names, 61.9% had an email address that matched the name or its initials. When names were randomly mixed between records, that figure fell to just 0.3%.
The data also passed basic time and location checks. None of the 227 records using Apple Relay, iCloud, Outlook, Me.com or Proton addresses appeared to predate those services. Also, 96.4% of U.S. ZIP codes matched the listed state, while 93.5% matched the listed city.
Messy data can be useful evidence. Fields such as “Select your state,” numeric dropdown values, inconsistent country labels, lower-case names and dates of birth set to 1 January are the kind of ordinary web-form errors that accumulate in a database built over decades. Fabricated data is usually cleaner. Real data is often embarrassingly human.
Account-creation dates in the sample run from February 1999 to 23 October 2025. Ransomnews notes that new-account entries thin sharply from September 2025 onward, which suggests the extraction took place over several weeks between September and late October.
That timing fits the earlier incident. The public WIRED leak contained records dated through September 2025, while the person calling themselves Lovely contacted DataBreaches.net in November and the WIRED material appeared online in December.
SecurityWeek’s earlier analysis said the attacker’s technical claims were consistent with insecure direct object reference, or IDOR, and broken access-control issues. In that kind of failure, an application lets one user view or alter another user’s data because it checks identifiers but fails to verify authorisation properly.
The seller’s account is new, has little visible reputation and offers escrow, according to Ransomnews. That profile fits a seller seeking a single buyer rather than public attention, especially when the dataset is priced at less than one-twentieth of a cent per record.
A public dump produces headlines. A private sale can produce a more focused problem: a buyer can use the data for phishing, lead generation, fraud, credential-stuffing preparation or correlation with other leaked datasets without ever publishing the full file.
The absence of passwords does not make the data harmless. A person who subscribed to Vogue, booked a gift subscription for GQ or registered for The New Yorker may receive a message that accurately uses their name, address and publication relationship. That is enough to make a fake renewal, refund or billing request look far more credible than ordinary spam.
Readers should treat unexpected messages about subscription renewals, billing problems, delivery issues, gifts or account verification with caution. Instead of using an email link, open the publisher’s website directly through a known address and check the account there.
A password reset is not the first priority based on this dataset alone, because no passwords or password hashes were found in the sample. However, anyone who reused the same email address across many services should be alert to follow-on phishing and should use a password manager and multi-factor authentication on important accounts.
Postal addresses were present in more than one-fifth of the claimed records. That means fraud may also arrive as physical mail, not only by email or SMS. A letter that references a real magazine title or subscription is not proof that it is genuine.
The more uncomfortable lesson is about breach economics. An attacker can release a small, recognisable subset to demonstrate that the data is real, then hold the larger collection back until a buyer appears. The public sees a leak. The criminal market sees inventory.
StyleSmuggler Magento zero-day is under active attack, letting unauthenticated attackers execute code and install backdoors on stores that may already be patched.
A new zero-day flaw, dubbed StyleSmuggler, in Magento and Adobe Commerce is under active attack, giving unauthenticated attackers a path to run code on vulnerable online stores. Sansec researchers say it affects current Magento Open Source releases, including 2.4.7, 2.4.8 and 2.4.9. According to the experts, exploitation began on September 4.
“Sansec discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. All current versions are affected, including 2.4.9.” reads the report published by Sansec. “Attacks started September 4th. Sansec is rolling out emergency mitigation.”
This is not a routine patch-cycle problem. Sansec reproduced the full attack chain on clean installations and observed a first victim running Magento 2.4.6-p15 with July and August 2026 patches already applied and a clean patch-status result. In plain terms, a store could be fully updated according to its normal process and still be exposed.
“StyleSmuggler injects malicious code into Magento’s template system.” states Sansec. “By using the styles properties, it can evade existing safeguards. It works in two stages:
Inject (poison) PHP code, for example by generating a failure report.
Let Magento execute the poisoned code via a failed payment email“
The attack is especially dangerous because it does not require a victim to open an attachment, click a link or even receive a successful email. Magento can execute the injected code while it renders its standard “Payment Transaction Failed Reminder” notification, and the chain can still work if email delivery itself fails.
That makes unusual spikes in failed-payment reminders a useful detection clue, although not conclusive proof of compromise. Legitimate payment failures happen. A sudden burst of them combined with strange system activity is a different conversation.
StyleSmuggler works by placing PHP code into Magento’s templating path and later causing the platform to evaluate it. The first stage creates or poisons a record, while the second stage turns a routine email-rendering process into remote code execution.
The attack reportedly uses GraphQL-related handling and the styles property to evade safeguards that would normally reject dangerous input. Sansec says moving sessions to Redis or a database does not stop the attack, because operators have already adapted their methods when one delivery route fails.
“Moving sessions to Redis or the database does not stop the attack. One merchant reported an attempt that failed against session storage and, eight seconds later, a second attempt that succeeded by using a file uploaded through Magento’s custom options instead.” continues the report. “Both came from the same operator.”
That detail matters because it shows an active operator, not a static proof-of-concept circulating online. Defenders should assume attackers are testing several paths, watching failures and changing tactics quickly.
Once the exploit succeeds, Sansec observed a lightweight Rust backdoor that connects to attacker-controlled infrastructure and waits for commands. At the time of the report, Sansec had not seen evidence that operators had yet used the implant for follow-on actions, but a backdoor that is installed and waiting is not an idle technical curiosity.
The malware initially hid behind a process name resembling [kworker/u:8:0], then appeared as fc-cache on September 6 and as chronyd on September 7.
These names are designed to blend into Linux environments, where administrators may expect to see kernel workers, font-cache utilities and Network Time Protocol daemons.
The fc-cache variant copies itself into a font-cache directory, writes a PID lock file and uses cron to restart twice an hour. The chronyd version can persist through cron as well, but Sansec also observed a build that relaunched itself without relying on a visible cron entry. An empty crontab is not proof that a host is clean.
The command channel is disguised as time synchronisation traffic. The implant sends 48-byte UDP packets to port 123, the standard NTP port, and uses domains that resemble time servers.
“Command and control is disguised as time sync. Every 60 seconds it resolves ntp.timesync.to and sends 48-byte UDP packets to port 123 that look like NTP server replies.” continues the report.
Only the first four bytes look like a normal NTP message; the remaining data can carry the agent ID, hostname, username, operating-system version, memory and disk use, uptime, root status and implant version.
That is a smart concealment choice. Many networks allow NTP traffic without close inspection because reliable time synchronisation is a normal operational requirement. Calling your malware chronyd and making it speak something that resembles NTP is not subtle genius. It is just clever enough to pass a lazy allowlist.
Sansec also found signs of a second, apparently unrelated attacker operating against stores compromised through StyleSmuggler. This actor deployed a compact PHP dropper that placed a web shell inside the product-image cache, using hash-like directory names to make the extra PHP file less obvious.
The web shell returns a normal-looking 404 response unless a request contains the correct X-Cache-Token header. With the header present, it can execute PHP supplied through a POST parameter. That design helps the attacker keep the shell invisible during casual checks and automated scans.
“Before writing that file, the dropper calls out to 457cfa2fb7p5.daf892t5qau4og8pi4cghbc6fhm1dim3u.oast.site, a subdomain of a public service that developers and testers use to confirm that injected code ran.” states the report. “This actor came in through StyleSmuggler. We recovered the dropper from a Store: request header, and its PHP tags are still JSON-escaped from the record Magento logged it into.”
The lesson is not merely to remove the obvious background process. Stores need a full compromise assessment, including a review of PHP files under pub/media, cron spool files, unexpected processes, altered templates, report records, web-server logs and outbound connections.
Adobe was working on a patch as of September 7, according to Sansec, but no release date had been confirmed. A scheduled Adobe security release was due on September 8, although it was not known whether it would address StyleSmuggler.
Until an official fix is available and applied, merchants should consider temporarily disabling GraphQL if they do not have a compensating control capable of blocking this exploit. This can affect storefront and integration functions, so it should be treated as a risk decision rather than a casual configuration change.
Operators should also hunt for processes named [kworker/u:8:0], fc-cache and chronyd that run from unusual paths such as temporary directories, user cache directories or hidden folders. A legitimate chronyd process does not normally emit nine NTP server-mode packets in rapid succession every minute.
Security teams should inspect outbound traffic to suspicious NTP-like domains and UDP port 123 destinations, particularly 185.157.160.251, which Sansec linked to the observed domains on September 7. They should also search authentication and system logs for repeated crontab command not allowed messages generated by the web-service user, such as www-data.
If compromise indicators appear, treat the system as compromised, not merely vulnerable. Isolate the host, preserve logs and forensic evidence, rotate Magento administrator credentials, API tokens, database credentials, payment-provider secrets and cloud keys, then search for secondary backdoors before restoring normal operations.
The Sansec StyleSmuggler report includes current indicators of compromise, malware hashes, C2 infrastructure, suspicious process names and file paths. Its guidance will likely change as the campaign develops, because the attackers have already changed payload names and persistence methods within days.
Android banking fraud is entering a deceptive phase. Attackers are using malware that copies targeted banking apps into a concealed Android work profile, separating a fraudulent session from warning signs seen on the phone.
The operation begins with Gigabud, an Android remote-access trojan active since 2022. Victims are lured through phishing sites, messaging apps, or social-media posts into sideloading fake airline, tax, or government applications, while fake banking app downloads can turn a brand into a trap.
Group-IB analysts identified Vwork, a modified version of the open-source Shelter app cloner, appearing minutes after Gigabud infections alongside tampered banking applications.
The researchers link the activity to GoldFactory and found compatible samples targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and a Gulf Cooperation Council member state.
Group-IB said in a report shared with Cyber Security News (CSN) that from February through July 2026, researchers observed about 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia, with estimated losses of roughly $960,939.
Those figures reflect observed activity rather than the full scope, but show why Android banking trojan campaigns remain a concern.
Hackers Clone Banking Apps Into Hidden Android Work Profiles
Gigabud first asks for Accessibility access, permission to draw over other apps, and battery-saving exemption. If a victim agrees, operators can remotely control the device, list installed apps, place fake login screens over real banking apps, and capture the device lock-screen code.
The next stage is simple but effective. The operator installs Vwork, which creates an isolated work profile and clones a banking app into it. In a confirmed Indonesian case, the cloned app was a fake version of a bank application.
Gigabud and Vwork fraud scheme flowchart (Source – Group-IB)
Android keeps applications in separate profiles isolated. That boundary is intended to protect work and personal data, but attackers use it to make the banking session look new.
A security signal tied to malware in the personal profile may not follow the cloned application into the work profile. The operator can then conduct transactions through the clean-looking profile while hiding activity behind a black screen.
The bank may see a new environment rather than the already-flagged personal profile, weakening the connection between device risk and a fraudulent transfer. Similar hidden remote-control Android attacks demonstrate how control features can be concealed from victims.
Vwork reduces visible clues. Its launcher icon is hidden and cloning functions can be controlled by another app. Gigabud includes commands to initialize Vwork, clone an application, and upload the clone list, showing the tools were designed to work together.
Phishing Delivery and Defensive Signals
An early warning is a consumer phone unexpectedly creating an isolated work profile. A banking app installed across profiles, a nearly empty profile, or a second suspicious installation shortly afterward should raise risk.
For users, the advice is simple: install applications only from official stores, reject Accessibility requests from apps that are not genuine accessibility tools, and use a banking second factor that does not depend on SMS. A raw app file sent through a chat is not a legitimate bank distribution channel.
Banks and wallet providers should bind logins to trusted devices, examine unusual session actions, and block high-risk transactions when an unrecognized app has active Accessibility access. Detection should combine signatures with behavior, rather than assuming one malware alert is enough.
This case underlines a broader shift in mobile fraud. Attackers combine social engineering, overlays, remote access, and Android features meant for legitimate separation. banking PIN theft malware shows how overlays and device control can scale financial theft.
The key lesson is that a clean-looking banking session is not always a clean device. Security teams should treat unexpected work-profile creation, cross-profile application duplication, and accessibility abuse as linked warning signs.
That approach can expose the fraud path before a transfer is completed. It also helps teams distinguish ordinary work use from coordinated account takeover before funds leave an account during urgent financial fraud investigations.
Vwork package identifier referenced by Gigabud samples
Note:IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cybercriminals are using autonomous AI agents to turn compromised cloud systems into fast-moving credential theft platforms.
In one recent case, attackers planned, built, and launched a large-scale campaign in less than six hours, stealing thousands of third-party credentials.
The operation shows how attackers can combine AI coding tools, automated scanning, and cloud resources to work at a speed that previously required a larger team and far more time.
Rather than manually checking systems and fixing errors, the agents handled much of the work themselves. Analysts from Google Cloud identified the activity while tracking the growing use of AI-driven automation in real-world intrusions.
Google Cloud said in a report shared with Cyber Security News (CSN) that the attackers used an AI coding chatbot, a prompt, and preconfigured instructions to carry out the campaign.
The incident is part of a broader shift in cybercrime. Attackers are increasingly using AI to scan for weaknesses, create phishing content, write malicious code, steal secrets, and maintain access after an initial break-in. This trend makes rapid detection and strong cloud security more important than ever.
Hackers Use Autonomous AI Agents
The financially motivated attackers first compromised an organization’s cloud infrastructure, then used it as the launch point for their operation.
Working from a trusted cloud environment helped their traffic appear more legitimate and made it harder for defenders to quickly separate malicious activity from normal services.
The AI-driven framework used written instruction files as operating playbooks. These instructions guided the agents through vulnerability scanning, credential collection, troubleshooting, and IP address rotation without requiring constant human decisions.
The result was a campaign that harvested credentials at a scale normally associated with much larger criminal groups.
This differs from traditional information stealers, which usually wait for a victim to run malicious software and then collect data from that device.
In this case, the agents actively searched server-side systems, identified weaknesses, and carried out targeted actions against online infrastructure.
The campaign highlights the risks outlined in recent reporting on AI agents breach company networks, where automated agents can map services, locate exposed tokens, and move toward valuable administrative access.
Once valid credentials are collected, criminals can reuse them for cloud access, fraud, espionage, extortion, or additional attacks.
Researchers also found an exposed command-and-control server hosting a separate automated reconnaissance and credential management framework called Recon.
Its dashboard was designed to organize, validate, and manage more than 23,800 stolen secrets in real time, including API keys connected to cloud and AI services.
Bespoke Vulnerability Scanning and Credential Harvesting Campaign (Source – Google Cloud)
The source report illustrates how attackers combined compromised cloud resources, AI-generated instructions, automated scanning, and credential harvesting into a single accelerated operation.
Cloud and Developer Systems Face Growing Risk
The attack demonstrates why cloud credentials and developer environments have become high-value targets. A single exposed access token can give attackers a trusted path into cloud services, source code repositories, automation pipelines, and sensitive business data.
The risks are similar to those described in stolen cloud credentials attacks, where valid keys can let intruders enter as approved users.
AI coding environments can create additional openings when developers download unsafe packages, clone altered repositories, or allow tools to process untrusted workspace files.
In related activity, the UNC6780 group used compromised developer accounts to distribute trojanized resources and targeted CI/CD environments for authentication tokens.
The DUSTMAKER credential stealer was also observed hiding files inside common AI coding workspace directories.
It could use malicious configuration files to influence an assistant into running scripts during routine development work, while fake pipeline tasks disguised as AI utilities searched for extra tokens and keys.
Organizations should treat AI tool configurations, developer tokens, and cloud API keys as sensitive credentials.
Security teams should rotate exposed keys quickly, apply least-privilege permissions, protect CI/CD runners, review third-party dependencies, and investigate unexpected automation tasks or workspace configuration changes.
Teams should also monitor cloud activity for unusual API calls, unfamiliar service accounts, unexpected public services, and suspicious outbound scanning.
Guidance from coverage of typosquatted npm package theft shows why dependency checks and secret scanning remain essential for development teams.
The findings do not mean autonomous exploitation is now common across every intrusion. However, they show that AI agents can reduce the delay between compromise and credential theft.
Defenders need controls that can detect abuse at the same pace, especially as attackers continue combining AI automation with familiar methods such as stolen credentials, exposed services, and malicious packages.
Indicators of compromise (IoCs):-
Type
Indicator
Description
Package name
tiktoken_mcp
Trojanized fork of a legitimate MCP server published to PyPI by UNC6780.
Repository name
azure-functions-mcp-extension
Official organizational GitHub repository reportedly targeted for malicious code injection.
Directory
.claude/
Hidden AI coding workspace directory abused by DUSTMAKER.
Directory
.vscode/
Hidden IDE workspace directory abused by DUSTMAKER.
Directory
.cursor/
Hidden AI coding workspace directory abused by DUSTMAKER.
File name
setup.mjs
Script referenced as capable of being executed through malicious workspace configuration.
Agentic configuration file exposed on the Recon command-and-control server.
File name
KNOWLEDGE.md
Knowledge file exposed on the Recon command-and-control server.
File name
agentic_vuln_research.md
Vulnerability-research instruction file exposed on the Recon server.
Directory
.openclaw/
Modular framework directory observed on the exposed Recon server.
Directory
memory/
Framework directory observed on the exposed Recon server.
File name
secrets.json
Cline configuration file targeted by ACRSTEALER for potential plaintext API keys.
File name
config.yaml
Continue AI configuration file targeted by ACRSTEALER for API keys and model-routing endpoints.
Note:IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cybercriminals are widening the reach of information-stealing malware by targeting the local data created by AI coding agents.
The shift puts access tokens, saved connections, prompt histories, and project records at risk on already infected computers. The activity does not point to a newly discovered flaw in Claude, Cursor, or Codex.
Instead, it shows criminals adapting established stealers to collect valuable files stored in predictable local folders, a concern echoed in reporting on Claude session theft involving browser-based account access. Analysts at Gen Digital identified the expanding collection rules after examining recent malware activity.
Gen Digital said in a report shared with Cyber Security News (CSN) that the findings concern locally installed development agents, not a direct compromise of an AI model or agent.
The impact can extend well beyond a single paid account. A stolen archive may give criminals both a reusable way into an account and the context needed to identify sensitive projects, connected services, and people worth targeting with follow-on fraud or phishing.
Hackers Target Claude, Cursor and Codex AI Agents
Over a three-month period, Gen Digital recorded Amatera and Remus detections among tens of thousands of protected Windows users.
Amatera focused on data linked to Cline and Continue, while Remus targeted Claude, Cursor, and OpenCode, indicating that agent data has entered the broader infostealer economy.
CallbackBeaver has also added Cursor and Claude to its collection scope, with more than 5,000 samples seen in a 30-day period.
BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer illustrate how quickly the technique is spreading, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo.
What stealer is looking for (Source – Gen Digital)
Criminals do not necessarily need to rebuild a payload to add a newly popular tool. Many stealers use remotely managed rules that specify folders, file names, databases, extensions, and search limits, so adding another target may amount to a configuration update delivered to machines that are already compromised.
That low barrier matters because a local agent directory can contain far more than settings. Security teams investigating AI agent artifacts should consider authentication files, conversation databases, recent-project data, and connected-service settings as high-value endpoint material, alongside browser profiles and cloud command-line credentials.
Stolen Tokens Expose Work Context
Some agents keep access tokens or refresh tokens locally to avoid requiring a fresh login every session. A stolen access token may let an attacker use an account until it expires, and a refresh token can sometimes extend that window, enabling paid API abuse or resale of working access.
MCP configurations can raise the stakes further. These files may hold endpoints, headers, environment variables, API keys, or other authentication details for external tools, meaning reusable secrets could expose source control, ticketing, databases, cloud resources, or collaboration services connected to the agent.
Prompt histories and transcripts are equally useful to intruders. Developers often use assistants to examine code, analyze logs, and solve incidents, and their chats may reveal source code, internal hostnames, repository names, deployment details, or secrets pasted during troubleshooting.
Related MCP security weaknesses show why connected tools need careful oversight. Organizations should inventory the agents in use, review what they store locally, and use operating-system-protected credential storage where available.
They should keep passwords, private keys, API secrets, and customer data out of prompts, give connected tools only necessary permissions, and favor short-lived, narrowly scoped tokens.
After a suspected stealer infection, responders should work from a clean device to revoke AI sessions, rotate API keys and other connected credentials, review account activity, and determine whether local conversations exposed company information.
Multi-factor authentication remains important, but it may not prevent replay of a token that malware has already copied. Users should also keep endpoints and applications updated and avoid ClickFix or FakeCaptcha instructions, cracked software, and unofficial installers, which are common delivery routes for stealers.
Teams deploying coding agents at scale can apply lessons from AI agent approval flaws by reviewing trusted projects, connections, and access boundaries before they become an attacker’s shortcut. The targeting will likely grow as workplace adoption expands.
Hackers are using Google Sheets as an unlikely control channel in a cryptocurrency theft campaign. The operation turns a familiar browser session into a place where malicious code runs, rather than placing a conventional program on a victim’s computer.
The attackers promote a fake report claiming to expose profitable flaws at cryptocurrency swap services. Victims are told to paste JavaScript into Chrome’s address bar or add it to a browser extension, allowing the code to run on the trading site they are visiting.
The campaign began with ClickFix-style lures in October 2025 and adopted Google’s Visualization API in March 2026.
The researchers found messages on Telegram, DarkForums, email, and paste sites, targeting people interested in trading, coding, hacking, and quick financial gains. The result is a wallet-address swap at the moment a user expects to make a deposit.
Telegram channel post promoting the “API Exploit” lure document (Source – Cisco Talos)
Cisco Talos said in a report shared with Cyber Security News (CSN) that they identified 49 Bitcoin addresses used by the operation; 24 received a combined 0.159 BTC, valued at about $10,000 in early August 2026, although the actual total may be higher.
Hackers Abuse Google Sheets
This campaign changes the familiar ClickFix formula. Instead of asking a user to open Run or a terminal, the lure asks them to alter their browser. Requests for the next attack stage can therefore look like normal traffic to a trusted Google service.
The first lure described a fabricated API flaw that supposedly delivered around 38 percent higher payouts on SwapZone. A later version claimed a SimpleSwap loyalty feature could provide a 25 percent bonus, then instructed users to install Tampermonkey and paste in a loader script.
Here, the loader retrieves hidden, scrambled JavaScript from cells in a publicly published Google Sheet using the Visualization API, joins the code together, and injects it into the active page.
A screenshot of a private message on a dark web forum (Source – Cisco Talos)
The malicious code behaves like a web skimmer. It watches the transaction page, changes displayed deposit addresses, intercepts web responses that contain wallet data, and replaces copied addresses in the clipboard with an attacker-controlled alternative.
It also adds false bonus information to make a transaction seem more attractive. The extension-based version gives the attackers an added advantage: persistence. Each time the target returns to the selected trading site, the loader can reconstruct and insert the payload again.
The operators also changed their Sheet and hosting setup after takedown efforts, making simple disruption short lived. The danger extends beyond cryptocurrency trading.
A compromised extension, web dependency, or customer-facing application could use similar browser-side tricks to quietly modify forms or information.
The abuse of recognized online services resembles trusted mirror ClickFix abuse, where a credible host can make a harmful page appear less suspicious.
Defending Against Browser-Based Lures
Users should treat any online claim of a secret trading bonus, exploit, or special API access as a warning sign. No website should require visitors to paste code into the address bar, developer console, terminal, or browser extension to unlock a legitimate feature.
This case also reinforces lessons from fake verification page attacks, in which a convincing prompt shifts execution to the victim. Before sending funds, users should compare the address shown on screen with the address copied to the clipboard and verify it through a trusted channel.
Organizations should control browser extensions by role and limit developer-level browser functions where they are not required.
Security teams should investigate unusual requests to Google Docs from browser sessions without normal document activity, especially after an employee visits untrusted forums or links.
A view of the rows storing code in the script after downloading in CSV format (Source – Cisco Talos)
Web application owners should test third-party code and remove unexplained, heavily obfuscated JavaScript. The campaign’s methods overlap with browser-based ClickFix techniques, but its public spreadsheet use shows why network trust alone is not enough to judge whether a web request is safe.
Training should focus on behavior, not just blocked domains. Employees and customers need clear guidance that copying code from a document, message, or trading “research” page can hand an attacker control of the browser session, even when the destination appears to be a well-known service.
Indicators of compromise (IoCs):-
Type
Indicator
Description
Domain
docs.google[.]com
Google-hosted documents and Sheets were used for lure hosting and payload retrieval through the Visualization API
Domain
paste[.]sh
Hosted first-stage JavaScript loader scripts used in the campaign
Paste site URL promoted for the Tampermonkey-based loader script
Domain
SwapZone[.]io
Cryptocurrency trading site targeted by the initial lure version
Domain
SimpleSwap[.]io
Cryptocurrency trading site targeted by the later Tampermonkey-based lure
File name
API Logic Flaw
Name used for the fraudulent Google Docs lure document
Tool or service
Obfuscator[.]io
JavaScript obfuscation service whose output patterns were observed in payload samples
Note:IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Microsoft has released security updates for CVE-2026-69485, an Important-rated remote code execution vulnerability affecting the Windows Remote Desktop Client.
The flaw could allow an authenticated attacker with low privileges to execute code on an affected server by sending a specially crafted network request.
The vulnerability was disclosed on September 8, 2026, and is tracked as CVE-2026-69485. Microsoft assigned it a CVSS 3.1 base score of 8.8, while the temporal score is 7.7.
The issue has a network attack vector, low attack complexity, requires low privileges, and does not need user interaction. Microsoft said the flaw stems from the Remote Desktop Client using an uninitialized resource.
Uninitialized resources can cause software to use memory, handles, or other system objects before they are properly prepared. In this case, an attacker may trigger the faulty condition through a crafted network request and gain the ability to run code.
Windows Remote Desktop Client Vulnerability
Remote code execution flaws are highly significant because they can give attackers control over vulnerable systems. Successful exploitation could affect the targeted device’s confidentiality, integrity, and availability.
Depending on the permissions available to the compromised account, an attacker could access sensitive data, modify files or system settings, install additional tools, or disrupt services.
According to Microsoft’s advisory, exploitation requires an attacker to first authenticate with low-level access to an affected server. The attacker could then send a specially crafted request to execute code on that server.
The attack does not require a user to click a link, open a file, or approve a prompt, reducing opportunities for defenders to stop it through user awareness controls alone.
Microsoft’s initial assessment states that the vulnerability was not publicly disclosed before the security update and has not been detected in active exploitation.
The company rates exploitation as “Exploitation Less Likely” at the time of publication. However, organizations should treat the finding as a priority because public patch releases can help threat actors study the vulnerability and develop working exploit techniques.
The affected products include Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations.
Microsoft also listed several Windows client editions, including Windows 10 versions 1607, 1809, 21H2, and 22H2, along with Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for supported x64 and ARM64 systems.
Administrators should deploy Microsoft’s September security updates as soon as possible.
KB Update
Windows Version
KB5123099
Windows Server 2016 / Windows 10 1607
KB5122876
Windows Server 2019 / Windows 10 1809
KB5122882
Windows Server 2022
KB5122878
Windows 10 21H2 / 22H2
KB5122880
Windows 11 23H2
KB5124008
Windows 11 24H2 / 25H2
KB5124012
Windows 11 26H1
KB5122871
Windows Server 2025
Security teams should also review Remote Desktop exposure, restrict RDP access to trusted networks, enforce least-privilege access, and monitor authentication and Remote Desktop logs for unusual activity. Microsoft credited security researchers yhw and txz for reporting the vulnerability through coordinated disclosure.
A newly published ShieldCrash proof of concept from researcher MSNightmare claims that Microsoft Defender remains vulnerable to an arbitrary file-read flaw, despite Microsoft’s earlier fix for ShieldBreak, tracked as CVE-2026-69414.
The researcher says the issue could let a local attacker make Defender read files with SYSTEM-level privileges on fully updated, supported Windows systems.
According to the MSNightmare, Microsoft addressed several parts of the original ShieldBreak issue but left a specific attack path available. Under certain conditions, that remaining path allegedly recreates the core security impact of the prior vulnerability.
The reported impact is significant because the SYSTEM account has broader permissions than normal users and most administrator accounts. Windows services, security software components, and protected operating system processes often run under SYSTEM.
If an attacker can force a Defender component to access a protected file and expose its contents, they may obtain sensitive data that their existing account should not access.
Windows Defender ShieldCrash 0-Day Flaw
Potentially exposed data could include application configuration files, credential-related material, security product settings, private keys, browser or service secrets, or files belonging to other Windows users.
The exact impact depends on which files the attacker can target, whether they can reliably recover their contents, and what permissions the attacker already has before launching the attack.
The available proof of concept is described as a structure implementation rather than a complete SYSTEM privilege-escalation exploit.
The researcher says it demonstrates arbitrary file reading as SYSTEM after the September 2026 Windows security updates, while noting that a more complete proof of concept could be released later. Reading a file does not mean you can run code or system commands, but it can still weaken Windows security.
PoC (Source: MSNightmare)
The ShieldCrash repository includes C++ project files, a DLL named Warden.dll, resource files, and an EICAR test archive. The EICAR file suggests the research may involve Defender’s malware-detection or file-handling workflow.
However, organizations should avoid running untrusted public proof-of-concept code on production endpoints, especially code that interacts with antivirus services or privileged Windows components.
The GitHub ShieldCrash PoC claims Microsoft’s fix for ShieldBreak (CVE-2026-69414) failed to fully address the underlying issue, allowing arbitrary file reads as SYSTEM on patched Windows systems.
Microsoft has not publicly confirmed the newer bypass, which remains a researcher-reported claim pending independent reproduction or a Microsoft security advisory. The earlier issue is tracked as CVE-2026-69414, while the new bypass has not yet received a separate CVE assignment.
Defenders should monitor endpoints for suspicious local tools that interact with Microsoft Defender scanning paths, unexpected creation or loading of unsigned DLLs, abnormal access attempts involving protected files, and child processes or file operations associated with Defender services.
Security teams should also keep the Microsoft Defender platform and intelligence updates current, apply future Microsoft patches promptly, and restrict untrusted code execution through application control policies.
A new U.S. government advisory has raised concerns over large-scale attempts to copy the capabilities of leading artificial intelligence systems.
The activity did not involve conventional malware, but instead focused on harvesting model outputs at a scale that could accelerate rival AI development.
The alleged campaigns relied on huge volumes of automated requests sent through application programming interfaces, cloud services, aggregators, and proxy networks.
CISA said in a report shared with Cyber Security News (CSN) that by collecting responses from advanced AI models, operators could create synthetic datasets designed to teach other systems how to perform similar tasks.
Analysts from the Cybersecurity and Infrastructure Security Agency, alongside the NSA and FBI, said China-based AI companies likely extracted billions of tokens across millions of exchanges from U.S. frontier models since late 2024.
The advisory describes the activity as malicious industrial-scale knowledge distillation rather than routine AI research. The reported impact reaches beyond unauthorized access to a single platform.
CISA warned that extracting reasoning, coding, agentic, and domain-specific capabilities can cut both the cost and time required to develop competitive models, creating economic and national-security concerns for the wider AI ecosystem.
CISA Warns Chinese AI Firms Extract Billions of Tokens
CISA named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as companies involved in campaigns targeting variants of Claude, GPT, Gemini, and Grok.
The agency said the operations appeared likely to have occurred with Chinese government awareness, although the advisory did not claim direct government control. Knowledge distillation is normally a legitimate method in which a smaller model learns from a larger one.
The concern arises when companies allegedly obtain restricted outputs from competitors at scale, then use those results to imitate protected capabilities without authorization, as seen in previous reporting on large-scale AI distillation attacks.
DeepSeek allegedly ran organized collection activity from at least late 2024 through mid-2025, seeking reasoning abilities, specialized optimization, legal functions, and writing support for its R1 and V3 models.
CISA said its public training-cost claims did not reflect the full value of data gained through alleged distillation. Moonshot AI was linked to widespread activity from at least mid-2025, including the alleged extraction of Claude Fable 5 data for Kimi-K3 and GPT-4o data for Kimi-K2.
Other reported targets included programming, mathematics, reinforcement-learning, and software-engineering functions. The advisory also said Alibaba used distillation to improve software engineering, customer service, character creation, and training workflows.
Separate reporting had already examined allegations of unauthorized Claude model extraction, illustrating how model-output collection has become a major concern for AI providers.
Proxies and Prompt Attacks
According to CISA, the operations used “transfer stations,” a gray market of API proxies that can mask user metadata and help users bypass geographic restrictions.
These intermediaries can also obscure the organization making requests, making isolated accounts look less connected than they really are.
The advisory described account pools, bulk premium subscriptions, and automated routing systems that could switch among providers when access controls changed.
It also highlighted behavior such as sustained activity around the clock, repeated use from multiple locations, immediate maximum use by new accounts, and coordinated timing across separate pathways.
Some operators allegedly used prompt injection and jailbreak-style requests to force models to disclose hidden chain-of-thought reasoning.
This is distinct from ordinary prompts because the goal is to manipulate a model into exposing protected internal processes, a risk also explored in coverage of prompt injection attack techniques.
CISA urged AI providers to strengthen identity checks, monitor unusual subscription-to-usage ratios, apply rate limits, and log requests for investigation.
Providers should also share infrastructure and behavioral signals with cloud platforms and API aggregators, since a distributed campaign may not be visible from one service alone.
The agencies further recommended targeted response changes for high-confidence malicious requests, such as reducing response fidelity or varying outputs, without alerting suspected operators.
Differential privacy, adversarial testing, stricter API controls, and measures to limit prompt injection can add layers of protection against extraction attempts.
Entrar
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
