Threat Dashboard

Google and industry partners dismantled the XCPE backdoor that enrolled over 1.3 million set-top boxes into a botnet. The backdoor was intentionally developed and operated by Videostrong Technology Co., an Android OEM/ODM, who monetized it by selling access to criminal affiliates. These affiliates loaded malware modules conducting ad-fraud, enrolling devices into residential proxy networks, and installing additional malware. The disruption also severed access to at least 10 million additional compromised devices by taking down affiliate C2 domains. The malicious software was built directly into various device models over multiple years with dedicated infrastructure. Google has banned Videostrong from making certified Android devices and implemented improvements to firmware integrity reviews on Android TV devices.

A sophisticated phishing campaign impersonates OpenAI by sending fraudulent ChatGPT Plus billing emails claiming failed subscription payments. Victims are directed to fake payment pages hosted on compromised WordPress instances under Nexcess's nxcli.io infrastructure. The operation features live attacker involvement, where operators monitor submitted credit card information and dynamically decide whether to request one-time passwords through a real-time polling mechanism. After victims submit payment details including card numbers, expiry dates, CVV codes, and cardholder names, the page maintains a loading animation while the browser polls a backend system approximately every 500 milliseconds. The attackers can then redirect victims to verification-code collection pages to complete fraudulent transactions. The campaign uses distinctive redirect domains and identical client-side code across multiple instances.

An open-source framework called CyberStrikeAI was used in real-world attacks against educational institutions across Africa and Latin America. The framework combines LLM-based orchestration with a traditional C2 server, where an AI model on the server plans actions and generates commands while an implant executes them on compromised hosts. Attackers initially gained access through compromised SQL Server infrastructure, then deployed the CyberStrikeAI agent which performed reconnaissance, privilege escalation, credential dumping, lateral movement, and data exfiltration. The AI orchestrator automated post-exploitation activities that traditionally require manual operator intervention, reducing the skill barrier for attackers. While the AI component operates server-side, the actual malicious activities on victim systems use standard techniques like Kerberoasting, AS-REP Roasting, LSASS dumps, DCSync, and Golden Ticket attacks, making them detectable through conventional security controls. Chinese-language art...

VAPOR PANDA conducted a sophisticated espionage campaign beginning October 17, 2026, using the ARTEX AI-driven framework alongside DeepSeek and commercial LLMs to orchestrate parallel intrusions against over 200 organizations worldwide. Targets included foreign ministries across Latin America, Europe, Asia, and the Middle East, plus U.S.-based semiconductor, defense, pharmaceutical, nuclear, and telecommunications entities. The adversary deployed BLOODALCHEMY backdoor, conducted credential spraying, and explicitly instructed AI agents to identify systems without endpoint security sensors. This represents an escalation from single intrusions to multiple simultaneous engagements, with agents autonomously pursuing attack paths while human operators provided strategic direction in Chinese. The campaign demonstrated how threat actors combine open-source AI frameworks with commercial LLMs to dramatically scale intrusion operations beyond manual capabilities.

VOLTA is a sophisticated Windows infostealer that incorporates AI-powered victim profiling to prioritize targets based on monetization potential. After harvesting credentials, browser data, cryptocurrency wallets, sessions from various platforms, and personal information, it compiles a structured evidence bundle and submits it to OpenRouter using LLM models like Claude Opus, with fallback options to Kimi-K2 and Gemini. The LLM acts as a forensic intelligence analyst, ranking stolen assets by value and assessing victim security posture. VOLTA performs live enrichment by accessing victim Gmail, Uber Eats, DoorDash, Discord, and Roblox accounts using stolen tokens. The malware self-deletes and operates through third-party infrastructure without actor-owned servers, suggesting a builder-based distribution model where customers can deploy customized versions.

Attackers impersonated IT help desk personnel on Microsoft Teams to gain unauthorized access to Active Directory environments through social engineering and misconfigured certificate services. Two distinct intrusion campaigns leveraged Quick Assist remote support sessions after convincing users to share connection codes. Adversaries deployed portable Python, Bun, and Java runtimes to enumerate domain infrastructure and exploit vulnerable Active Directory Certificate Services configurations through ESC1 and ESC8 attack paths. In one incident, attackers obtained certificates for multiple privileged accounts and performed DCSync operations to harvest credentials. Data exfiltration was conducted using Rclone transferred to external SFTP destinations. The second intrusion used PetitPotam to coerce domain controller authentication and relay NTLM credentials to obtain unauthorized certificates. Neither attack exploited Teams vulnerabilities, but rather combined impersonation tactics, legitimate remote access tool...

North Korean operators execute cryptocurrency thefts by initially compromising developers through social engineering on the open internet before moving operations on-chain. The Bybit theft in February 2025 began when operators tricked a Safe{Wallet} engineer into running a malicious stock-trading project via getstockprice[.]com, later planting code in Bybit's wallet interface. Binance experienced similar compromise through a DevOps engineer's laptop. These operations rely on registering domains before targeting victims, with bybit-assessment[.]com registered hours before the Bybit theft. An investigation revealed three US-registered front companies (BlockNovas, Angeloper Agency, and SoftGlide) used to deliver malware through fake job interviews. Preemptive defense mechanisms identified 206 Binance-named domains with maximum risk scores, with 64 showing live activity, enabling defenders to block malicious infrastructure before deployment.

On October 29, 2026, Cursor's VS Code extension marketplace served malicious Claude Code extensions (versions 2.1.312 and 2.1.313) designed to plant SSH backdoors on developer machines. The fake extensions, not developed by Anthropic, operated for approximately 11 hours before removal. They installed attacker SSH keys, established reverse SSH tunnels to 134.209.82[.]225, and created persistence mechanisms disguised as legitimate system components. Expel investigated four incidents involving Mac computers, discovering that malicious activity occurred up to 8 hours after Cursor's stated exposure window closed. The backdoor survives extension uninstallation and requires separate removal. The attack collected system information including hostname, username, Git email, and environment variable names. Organizations relying solely on the 11-hour exposure window for scoping may miss compromised machines.

Throughout October 2026, at least nine AI Developer Platforms experienced security breaches involving credential theft and subsequent abuse of AI model access. The attacks targeted platforms including Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank. Attackers exploited various vulnerabilities to access stored environment variables containing AI credentials, then monetized stolen access through LLM broker infrastructure. Follow-on activity included validation sweeps, quota enumeration, and large-scale token abuse resembling resold coding-agent traffic. Two documented cases show approximately 800,000 and 1.7 million unauthorized Bedrock calls respectively, generating over $100,000 in fraudulent usage. Multiple reseller operations were identified, including actors using infrastructure at llm-routing.com and xingjiabiapi.org, selling discounted access to frontier models using stolen credentials.

Two human-operated intrusions leveraged Microsoft Teams messages and calls to impersonate IT personnel, socially engineering users into granting remote access through Quick Assist. Threat actors staged portable Python, Bun, or Java runtimes, performed network discovery, and assessed Active Directory Certificate Services for authentication paths. The incidents diverged at the certificate layer: one exploited an ESC1-vulnerable certificate template to obtain authentication certificates for privileged accounts and performed DCSync operations, while the other used PetitPotam to coerce domain-controller authentication and relayed it to AD CS Web Enrollment through ESC8, obtaining a domain-controller certificate for Kerberos authentication. Automated attack disruption limited progression in the first case except for an excluded privileged identity that enabled data exfiltration, while customer-led device isolation stopped progression in the second case following Defender alerts.

PHP2Shell emerged from two critical PHP memory-safety vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 and patched on October 21, 2026. Investigation of open directories uncovered 616 PHP2Shell-related files revealing widespread exploit development across multiple operators. While exploitation succeeded only on honeypots operated by watchTowr, 0x4D31, and GreyNoise for the open internet, the vulnerability has been successfully weaponized against Palo Alto PAN-OS firewalls. Attackers chained PHP2Shell with the Fragnesia Linux kernel privilege-escalation vulnerability (CVE-2026-46300) to obtain root access on 25 PAN-OS firewalls. The campaign utilized AI-driven reconnaissance frameworks to automate target selection, narrowing approximately 19,000 internet-facing firewalls to 240 high-value targets. Multiple operator clusters were identified sharing exploit toolkits, custom heap exploits, and staging infrastructure targeting government ministries, national banks, telecommunications, and cr...

Belarus-aligned threat actors deployed a VBScript wiper against a Ukrainian manufacturing company involved in the transportation sector in late May 2026. The group, tracked as FrostyNeighbor (also known as UNC1151, PUSHCHA, Storm-0257, and TA445), utilized Chisel, UltraVNC, and Cobalt Strike before delivering the destructive payload through Group Policy. This incident marks the first documented destructive cyberattack by a Belarus-aligned actor, representing a shift from traditional espionage operations. The targeted company's role in Ukraine's transportation sector suggests potential wartime operational value. Researchers assessed that Belarus-aligned groups are becoming increasingly aggressive and selecting targets aligned with Russian intelligence priorities, potentially acting as a proxy, though direct cooperation remains unconfirmed.

During September 2026, multiple APT attack campaigns targeting South Korean entities were identified, primarily delivered through spear phishing emails. The attacks utilized various techniques including LNK files with embedded PowerShell scripts, HTA files downloaded via curl.exe, and malicious DLL files. Five distinct attack types were classified (Type A through D, plus Unknown). These campaigns deployed AutoIt scripts, Infostealers, keyloggers, backdoors including XenoRAT, and established persistence through Task Scheduler entries. Attackers leveraged legitimate services like GitHub, Google Drive, and PubNub for command and control operations. The malicious files were disguised as legitimate documents to deceive users, ultimately exfiltrating system information, credentials, and virtual asset data while maintaining persistent access to compromised systems.

Between September 9 and September 14, 2026, an unattributed Russian-speaking operator compromised at least six legitimate Ukrainian small-business websites to deliver a fake Cloudflare verification page. The ClickFix chain convinced victims to manually execute msiexec.exe commands via the Windows Run dialog, achieving a 14 percent completion rate (79 infections from 426 clicks). The payload, internally named Psychedelic, combines credential theft with persistent agent capabilities, installing browser extensions with native-messaging bridges, establishing scheduled tasks, and polling a REST API for arbitrary executable tasking. Targeting focused overwhelmingly on Ukraine with clear financial motivation, collecting browser credentials, session tokens, and cryptocurrency wallet data from MetaMask, Trust Wallet, Exodus, Atomic Wallet, and others. The technique deliberately avoids encoded PowerShell, using signed Microsoft binaries to bypass common ClickFix detections.

A sophisticated multi-component campaign targeting telecommunications and network-edge appliances has been discovered, featuring BPFDoor variants and a newly identified implant designated AVERAT. The operation leverages SMTP traffic on port 25 to blend command-and-control communications with legitimate mail relay activity, exploiting the trust environments of targeted systems. Attackers deploy a dropper that stages payloads into memory-only execution, leaving no on-disk artifacts for forensic analysis. BPFDoor variants impersonate legitimate processes such as SpamSniper components on South Korean systems, while AVERAT samples target Taiwanese appliances using regionalized disguises. The infrastructure relies on compromised consumer devices including NAS units, CCTV systems, and DVRs as operational relays, consistent with China-nexus covert network patterns. Each component demonstrates advanced operational security through process spoofing, encrypted configurations, and deliberate evasion of network monitor...

A cryptocurrency-stealing operation utilizing an Aotera/Tedy loader injects a Vidar-class stealer into Windows processes, launching Chrome or Edge to inject malicious scripts into victim sessions. The malware builder, dubbed Underground, has been active since October 2023. The operation employs seven gate domains and has drained approximately $100,000 across 80+ destination addresses on 23 blockchain networks from 350-430 victims. The infection begins with lure archives containing trojanized files, deploying a loader that implements anti-analysis checks against 67 monitoring tools. Once injected, the stealer automatically drains cryptocurrency exchange accounts through fake security overlays, converts holdings to Bitcoin, and modifies withdrawal confirmation emails. A clipboard clipper targeting two dozen cryptocurrencies replaces copied wallet addresses with operator-controlled addresses. The operation rotates Cloudflare-fronted domains faster than reputation-based detection can respond.

A critical path traversal vulnerability combined with improper NULL byte neutralization in FortiMail versions 7.2 through 8.0 allows unauthenticated attackers to write arbitrary files on the underlying system through crafted HTTP or HTTPS requests. This vulnerability is actively exploited in the wild. Affected versions include FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and 7.2.0-7.2.9. Indicators of compromise include modified system binaries, added malicious libraries, and suspicious archive configurations communicating with external IPs. Organizations should immediately disable the IBE feature or restrict management interface access until patches become available.

TIKTOUK is a multi-component toolkit designed to collect credentials from WordPress sites. It consists of three components: a Python probing module that identifies WordPress installations and scans for exposed secrets, a Python collection module that extracts configuration files and database credentials, and a Go-based JavaScript crawler that harvests secrets from client-side code. The toolkit exploits exposed configuration files, decrypts email credentials from popular SMTP plugins using recovered encryption keys, and scans for cloud service credentials. All collected data is sent to a centralized HTTP controller. Real-world incidents revealed approximately 50,000 compromised server credentials across 37,000 domains, including hundreds of validated AWS keys with potential for service abuse.

CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. LevelBlue's Threat Hunt Operations & Research (THOR) team identified active exploitation across multiple customer environments featuring malicious authentication events with attacker-controlled usernames containing pitboss and NSPPE strings. Observed activities included command-execution testing, payload retrieval using curl and wget, configuration collection and staging, reverse-shell deployment, persistence mechanisms, web-shell installation, and attempted exfiltration of NetScaler configuration data. Analysis revealed two second-stage payloads: main.py establishing reverse shells to command-and-control infrastructure, and update_c08937.pl creating privileged accounts, deploying PHP web shells, and attempting configuration exfiltration. Post-exploitation artifacts included creation of sec_monitor superuser accounts, modification of system binaries, deployment of .local_jou...

On August 31, 2026, threat actors exploited two zero-day vulnerabilities in PaperCut MF affecting a customer in the Education sector. The attackers targeted an internet-facing print server running vulnerable PaperCut MF version 24.0.2, deploying an in-memory Java loader that established a web shell. Through this web shell, they delivered a trojanized Microsoft Copilot binary containing an AdaptixC2 implant. The implant connected to command-and-control infrastructure hosted on Alibaba servers. After remaining dormant for approximately one day, attackers returned to perform reconnaissance and Active Directory enumeration. They then stole a token from a domain-privileged service account and moved laterally to a domain controller. On the compromised domain controller, they dumped credentials from memory and registry, enabled Windows Restricted Admin mode for pass-the-hash attacks, and extracted the NTDS.dit database containing password hashes for all domain accounts, achieving complete domain compromise.

A malicious cyber actor exploited a Citrix NetScaler Gateway zero-day vulnerability on September 24, 2026, three days before public disclosure. The attacker, using IP address 149.104.78.141, attempted exploitation that was detected through behavioral analysis despite no CVE-specific signatures existing at the time. The exploitation chain aimed to establish persistence through a password-protected webshell, attempting to set setuid and setgid bits on /bin/sh for root access. The attacker tried to configure the web server to execute a hidden PHP webshell disguised as a CSS file, using aliases to route requests. Though unsuccessful in compromising the targeted sensor, the post-exploitation playbook revealed sophisticated techniques for maintaining access and evading detection through web server manipulation.

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that Microsoft tracks as “RedFlick”. These changes represent a notable shift in the actor’s operational tradecraft and support ongoing cyberespionage activity targeting Ukrainian individuals and institutions as well as international non-government organizations (NGOs), Western think tanks, governments, and other organizations associated with international policy—particularly those with a nexus in supporting Ukraine.

In August 2026, a new loader designated 2CLoader was identified being used to distribute information stealers including Vidar and Remus, along with XWorm RAT. The loader implements extensive anti-analysis capabilities including anti-VM, anti-debug, and user activity checks. It employs sophisticated evasion techniques such as indirect system calls using Hell's Gate technique and inline trampoline hooks to bypass endpoint security detection. The loader stores its configuration and encrypted payload as a PE resource, using rolling XOR and AES-GCM encryption for payload protection. It supports multiple payload execution methods including RunPE, LoadPE, and CLR hosting for .NET assemblies. Network communication with command-and-control servers uses HTTP POST requests with JSON formatted messages encrypted via XOR. Multiple persistence mechanisms are available through registry keys, scheduled tasks, and startup folders.

Microsoft Threat Intelligence identified active exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite's SNMP notification path. Exploitation occurred between patch availability on July 20, 2026 and public disclosure on August 13, 2026. Attackers delivered JSP webshells and reverse shells without requiring authentication, achieving privilege escalation through PAM configuration abuse and establishing persistent access via systemd services. Post-exploitation activity included cluster-wide lateral movement using Zimbra SSH keys, collection of authentication secrets and mailbox data, and attempted exfiltration using cloud-storage tools. Multiple organizations across different regions and industries were affected through both automated payload delivery and hands-on-keyboard operations targeting internet-facing Zimbra mail servers.

Seven months after initial disclosure, the Coruna iOS exploit framework continues to evolve, now deploying two distinct chains based on device operating system version. Targets running iOS 17.2.1 or earlier receive the legacy Coruna framework, while later builds receive DarkSword-derived chains. Analysis identified 608 domains delivering Coruna-family code, with 93 sites mapping to 21 distinct tracking collectors. Distribution spans dating portals, AI-companion platforms, cryptocurrency promotions, media streaming services, and compromised legitimate sites. The attack requires no user interaction beyond loading a webpage, operating through hidden iframes that deploy browser exploits leading to native code execution. Recovered modules include kernel memory manipulation, code-signing enforcement changes, process memory access, encrypted command-and-control communication, and cleanup routines. One delivery vector involves compromised npm packages, enabling legitimate websites to serve exploits through their o...