A DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center version 3.5.8.7 is actively exploited by attackers distributing a genuine signed application with malicious DLLs via unofficial channels. The vulnerable software loads attacker-supplied DLLs without validation, enabling code execution. The attack uses ClickFix social engineering to trick users into running commands. Version 4.0.9.8 patches the vulnerability with automatic updates applied on restart. No official Siemens systems or distribution channels were compromised during this campaign.
CVE-2026-102764 is a critical authentication bypass vulnerability in BeyondTrust Remote Support versions 26.2.3 and earlier. It enables unauthenticated remote attackers to perform arbitrary file operations without user interaction. Exploitation in the wild has been confirmed, involving deployment of web shells and tunneling tools, root privilege escalation, credential vault extraction attempts, persistence mechanisms, and log deletion. The threat actor ARMORY CASTLE, linked to PRC-nexus espionage, is attributed to these attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities list. Emergency patching and thorough compromise investigations are required, as patching alone does not remove attacker persistence.
In October 2026, Citrix NetScaler ADC appliances running affected 14.1 builds were compromised through a chain of two vulnerabilities: CVE-2026-88771 and CVE-2026-88779. Attackers achieved root code execution by exploiting a pre-authentication log-poisoning/RCE vulnerability and a SAML-parsing crash. The intrusion involved deploying PHP web shells, modifying system shells, creating cron jobs, and establishing boot hooks for persistence. Additional tools included TCP session managers, HTTP tunnels, and reverse agents for command-and-control. Attackers used a Go-based reconnaissance tool to map internal infrastructure and synchronized implants across appliance pairs to maintain persistence. The campaign exfiltrated NetScaler configurations, historical data, and key material, evolving from initial access to a persistent internal reconnaissance platform.
Between April and July 2026, attackers compromised the update and notification infrastructure of AOMEI Technology to distribute malware to users of AOMEI Backupper, a widely used backup software. The attackers hijacked the update servers during three brief windows, modifying download instructions to deliver a malicious ZIP archive containing a downloader that installed a persistent remote-access backdoor. This backdoor allows attackers to execute commands and install additional malware, increasing the risk of further system compromise. The compromised infrastructure also serves AnyViewer customers. Detection was difficult due to the short tampering periods. Users can check for infection by scanning with security software, inspecting Task Scheduler for specific tasks, searching for unsigned upgrade-now.exe files, or monitoring suspicious network traffic to certain domains.
A Microsoft 365 API credential for ConnectWise Cloud Backup (formerly SkyKick) was compromised and used by an attacker to access hundreds of customer M365 environments. The attacker obtained Microsoft Graph access tokens and moved through tenants in an automated fashion. In at least one case, the ConnectWise Cloud Management MS Teams application was elevated to Global Administrator, allowing the attacker to add credentials to other applications, including security tools. The campaign started with password spraying against law firms, followed by role assignments in about 50 tenants, and widespread credential abuse across nearly 1,000 Entra tenants. A second wave targeted 16 tenants in sensitive sectors such as policy, national security, trade, and critical minerals. No official patch or remediation guidance is currently available.
YuanKong RAT is a multi-tenant Android remote access trojan that embeds operator identifiers in each build and uses a two-key XOR scheme to unpack payloads. It steals credentials via screen capture, accessibility abuse, and overlay attacks, and escalates privileges by pairing with the device's ADB daemon. Communication occurs over WebSocket with shared command-and-control domains. Analysis of samples revealed multiple distinct operator accounts and payloads.
QuartzLine, also known as CLOUDHAZE, is malware disguised as a legitimate Windows PDF viewer that contains a backdoor. It has been distributed via malicious advertising campaigns, leveraging AWS S3 buckets for hosting. The malware establishes persistence through scheduled tasks and communicates with command-and-control servers. It operates with user-level privileges, allowing attackers to execute arbitrary Windows commands and deploy additional malware such as the Caira and IronBark remote access trojans. Early activity includes theft of Chrome browser data within one week of infection. The malware is signed with a now-revoked legitimate EV code-signing certificate, appearing as paperline.exe and fielddesk.exe.
Suo5 is an HTTP/HTTPS-based tunneling tool exploited for pivoting attacks via compromised web servers to access internal networks. It supports multiple environments including Java, PHP, IIS/.NET, and Nginx, and relays TCP traffic enabling SOCKS5 proxy access. Deployment methods include file upload exploitation on IIS servers using renamed ASPX files and memory injection via Jenkins Script Console with Groovy scripts. Indicators of compromise include repeated POST requests in web logs, DLL files in Temporary ASP.NET Files directories, and PluginServletFilter chains in Java logs. Detection involves monitoring web request patterns, server-side behaviors, abnormal User-Agent headers, unauthorized URI access, and file modifications. Mitigations include restricting script execution capabilities and implementing network segmentation controls.
The Hotejka affiliate program, a rebrand of ROI777, operates the Help Traffic Distribution System (TDS) to deliver tech support scams. It uses browser fingerprinting and geolocation to redirect victims through compromised websites and malvertising to fake Microsoft security alerts that lock browsers and display fraudulent phone numbers. Victims who call are guided to install remote desktop tools like UltraViewer, granting attackers ongoing system access. Since April 2026, Hotejka has abused Cloudflare Pages to create over 20,000 disposable domains, generating about 300 new domains daily. Affiliates such as Balada Injector, Detour Dog, and DollyWay drive traffic to this TDS. Infoblox developed predictive detection algorithms that identify malicious domains about seven days before deployment, significantly reducing exposure.
Variola is a modular Windows malware implant linked to a ClickFix intrusion, designed for persistent host identity and secure command-and-control communications. It supports dynamic loading of modules for credential theft, browser manipulation, and session hijacking, with capabilities typical of banking trojans such as Chromium browser injection and VNC-style remote access. The implant uses strong cryptographic methods for communication security and shows active development with multiple builds found in a public GitHub repository. No patch or remediation information is provided, and no known exploits in the wild have been reported.
KGB RAT is a Windows Remote Access Trojan actively marketed on underground forums since late 2025. It is sold as Malware-as-a-Service with prices ranging from $150 to $800. The malware includes features such as credential theft, keylogging, hidden desktop takeover, ransomware, and psychological harassment tools like screamers and forced blue screens. It uses a daily updated fully undetectable (FUD) crypter to evade detection by Windows Defender and communicates with its command and control (C2) servers without requiring port forwarding. Notifications are delivered via Telegram. The malware is based on the NjRAT framework and includes a CryptoClipper module that swaps cryptocurrency wallet addresses. Development reportedly began in early 2022.
The Aoki infostealer malware has recently evolved to target credentials from AI coding assistants such as Claude, OpenAI's Codex, Cursor, Codeium, and Gemini. It steals API keys, tokens, and session files that could allow attackers to impersonate legitimate users and access connected repositories, cloud services, and CI/CD pipelines. In addition to AI-related credentials, Aoki collects data from browsers, cryptocurrency wallets, password managers, messaging apps, gaming platforms, VPN and FTP clients. The stolen data is sent to command-and-control servers. This indicates that AI credentials are increasingly valuable to cybercriminals, alongside traditional targets like payment card data and cryptocurrency wallets.
The 'Iron Man System' is a commercial Phishing-as-a-Service (PhaaS) operation that provides criminal buyers with a self-hosted phishing kit. It includes over 2,360 phishing templates impersonating trusted entities such as postal services, banks, and government agencies, targeting 130 countries. The system features a bilingual Chinese-English interface, a subscription licensing model tied to vendor-controlled authorization servers, and a build registry with 911 published versions. Resecurity, in collaboration with Microsoft's Digital Crimes Unit and industry partners, mapped and disrupted this infrastructure. The kit was used to send approximately 1 billion phishing emails targeting 75,000 organizations, capturing around 17.4GB of telemetry data. Multiple domains associated with the infrastructure have been identified as indicators of compromise.
This report details the first confirmed incident where AI-driven agents executed a complex attack on an Apache Tomcat server running Spring Batch. Attackers exploited an exposed job-submission endpoint that required no authentication or zero-day vulnerabilities. Using the open-source Cairn AI agent orchestration platform, the attackers executed commands via JavaScript through the Nashorn engine, extracting data in small chunks over many requests. They obtained plaintext database credentials, enabled xp_cmdshell, and escalated privileges to SYSTEM using known tools such as PrintSpoofer and GodPotato. The attackers extracted registry hives, created administrator accounts, and deleted artifacts. The attack was characterized by automated, rapid command execution and structured output formatting, indicating machine-driven orchestration.
A phishing campaign uses fake Calendly booking pages impersonating Meta Careers to steal Facebook and Google login credentials. Victims are tricked into selecting interview times, submitting personal data, and completing fake CAPTCHAs before being prompted to log into their accounts. The phishing kit captures credentials and bypasses two-factor authentication by relaying authentication codes in real-time. The fake pages include convincing replicas of legitimate login screens with fake address bars showing authentic URLs. Eleven domains with recruiting-related names are involved, and the infrastructure operates via Amazon API Gateway in Singapore. Code comments in Vietnamese suggest possible origins of the operation.
Hirudo is an Android banking remote access trojan that combines credential theft with live remote control capabilities. It is distributed via shopping and entertainment apps acting as droppers, which install the trojan behind fake update prompts. The malware replaces legitimate banking apps with patched versions that disable internal security checks. The campaign targets eight Indonesian banking apps covering seven banks, embedding a hooking engine in the replacements. Distribution uses legitimate advertising infrastructure including Amazon CloudFront. Targeting extends beyond Indonesia to China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records. No CVE or official patch information is available.
A phishing campaign distributes the AgentTesla infostealer via emails pretending to be business proposals. The attached ZIP file contains a malicious executable disguised as a café management program with Chinese-language UI. The malware uses multi-stage obfuscation and .NET payload loading to ultimately deploy AgentTesla, which steals credentials, cookies, and contact information from browsers, email clients, FTP, and VPN applications. Stolen data is exfiltrated through FTP to a compromised server. The attack targets business users using social engineering and sophisticated loading techniques.
During Q3 2026, attacks targeting poorly managed Linux SSH servers were observed, primarily using brute force and dictionary attacks. The main malware families involved were ShellBot, a Perl-based DDoS bot, and Fisieredoor, a backdoor capable of command execution and deploying SSH dictionary attack tools. Attackers used wget or curl to download malware, then installed user-mode rootkits, process masking tools (XHide), and XMRig cryptocurrency miners. The malware launcher used ld.so.preload to inject rootkits and disguised mining processes as legitimate bash sessions. Fisieredoor also deployed tools for credential harvesting and lateral movement, transmitting successful authentication data to command servers.
In Q3 2026, attackers targeted Windows-based MS-SQL and MySQL database servers using brute-force, dictionary attacks, and vulnerability exploitation. They deployed cryptocurrency miners (XMRig), backdoors (GotoHTTP), SoftEther VPN infrastructure, and various web shells for persistence. Additional tools included VShell for remote command execution, HackBrowserData for credential theft, Fscan for reconnaissance, and Cloudflared for port exposure. Attackers created backdoor RDP accounts and used SoftEther VPN servers as command and control infrastructure. The attacks mainly exploited weak passwords, poor account management, and insufficient security on exposed database servers.
In the third quarter of 2026, multiple attack campaigns targeted poorly managed Linux SSH servers using brute force, dictionary attacks, and vulnerability exploits. Attackers deployed ShellBot, a Perl-based DDoS bot with port scanning and UDP flooding capabilities. A complex attack chain involved a user-mode rootkit loaded via /etc/ld.so.preload, which then deployed the XMRig cryptocurrency miner disguised as a bash process using the XHide concealment tool. Additionally, the Fisieredoor backdoor was used to execute commands and install SSH brute-force tools such as goauto and tsm-family that systematically targeted systems with credential lists. Organizations are advised to implement strong password policies, maintain regular patching schedules, and enforce access controls on externally exposed SSH infrastructure.
