Two critical use-after-free vulnerabilities in the PHP engine's session.upload_progress feature allow unauthenticated remote code execution by bypassing WAFs during multipart request parsing. Exploit code rapidly spread after the October 21, 2026 patch release, with UNC actors targeting over 70% of unpatched PHP infrastructure globally. Exploitation campaigns include mass scanning, Mirai botnet C2 infrastructure, and session poisoning via WordPress LFI vulnerabilities, affecting public, business, and educational sectors worldwide.
Three financially motivated threat actors acquire expired malicious domains through dropcatch to inherit traffic from previously compromised websites. Stuffy Squirrel specializes in hiding activity within legitimate scripts and has operated since 2020, selling traffic to affiliate advertising networks. Shady Squirrel uses custom JavaScript and Keitaro injections with multi-step cloaking, partnering with initial access brokers to deliver tech support scams and SocGholish malware, notably facilitating SocGholish's return within weeks of Operation Endgame disruption. Swiping Squirrel, the most prolific actor, operates in greyhat territory by selling fraudulent traffic to zero-click advertising platforms like ZeroPark, often resulting in malvertising and malware distribution. These actors control thousands of domains collectively, exploiting lingering infections from previous compromises without conducting new attacks themselves.
This analysis examines how threat actors abuse Keitaro, an advertising performance tracker, for various malicious purposes. The report covers a wide range of threats, including malware delivery, phishing, scams, and illegal content distribution. Key findings include the use of Keitaro for cloaking and traffic distribution in malvertising campaigns, spam operations leveraging Keitaro for cryptocurrency wallet draining, and the abuse of Keitaro in investment scams. The report also highlights specific threat actors and their tactics, such as domain hijacking for adult content delivery and the use of fake arrests as clickbait for investment scams. Overall, the analysis demonstrates how Keitaro's features make it attractive to cybercriminals seeking to maximize their reach with minimal effort.
In 2025, a significant surge in phishing attacks targeting major U.S.energy companies was observed. The campaign primarily focused on Chevron, ConocoPhillips, PBF Energy, and Phillips 66, utilizing sophisticated impersonation techniques. Attackers employed HTTrack-based cloning to replicate legitimate websites, creating over 1,465 phishing domains. The infrastructure was distributed across multiple hosting providers and countries to evade takedowns. Notably, Chevron faced the highest volume of impersonation attempts with 158 fake domains. The phishing sites combined credential harvesting with investment scam frameworks, enhancing their profitability. Many malicious domains showed low detection rates across security vendors, exposing gaps in current defense systems. The analysis highlights the need for improved threat intelligence integration and faster mitigation strategies in the energy sector.
