Threats tagged 'nkabuse'

CVE-2026-39987 is a critical pre-authorization remote code execution vulnerability in the Marimo Python notebook platform. Shortly after disclosure, multiple threat actors exploited this flaw to deploy malware via typosquatted HuggingFace Spaces, leveraging the NKN blockchain for command and control. The malware, disguised as a Kubernetes tool named kagent, established persistence on infected systems and targeted AWS credentials, API tokens, and databases such as PostgreSQL and Redis. Exploitation events were observed from multiple countries, demonstrating active and widespread abuse of this vulnerability in AI/ML infrastructure environments.