Threat database

Between July and August 2026, a sophisticated phishing campaign targeted organizations in East and Southeast Asia, particularly Japanese entities. The attackers used phishing emails in Japanese and Korean, masquerading as product damage complaints, to lure victims to fake document-sharing websites. These sites delivered ZIP archives containing malware executables with double extensions and DLLs employing advanced loader techniques. The final payloads were consistently from the PureRAT and PureLogs malware families. The campaign used frequent changes in loader structures and multiple evasion techniques to bypass detection. Infrastructure analysis showed commonalities in sending patterns and identifiers across campaigns.

Campaign#purerat#process hollowingJapan

CVE-2026-95655 is a high-severity authorization bypass vulnerability in Webkul Aureus ERP versions before 1.5.0. The flaw allows authenticated users to access, modify, or delete arbitrary messages across departments or companies by exploiting improper scoping of message lookups in the ChatterPanel. Attackers can enumerate all notes in the system by submitting sequential message IDs.

CVE-2026-94387 is a stored cross-site scripting (XSS) vulnerability in Webkul Aureus ERP versions before 1.6.0. The flaw exists in the Chatter field-change log where old_value and new_value entries are not properly escaped. This allows users with permission to edit tracked text fields to inject malicious markup that executes when other users view the Chatter panel, including administrators.