Find what you’re looking for
Browse everything
6,838 results in Threat Reports
AdFection: When Every Ad Impression Becomes a Potential Zero-Click Spyware Attack
In October 2026, Citizen Lab at the University of Toronto published technical evidence that an Israeli ad-tech company, Discover-Tech, was operating a platform called Controlium to deliver commercial spyware through routine online ad impressions — a technique the researchers dubbed 'AdFection.' By winning real-time bidding auctions, Discover-Tech served specially crafted ads that, upon rendering, silently fingerprinted devices and routed matching targets through Candiru (Integrity Labs) validator infrastructure and ultimately to a Candiru command-and-control server. At least 45 devices belonging to Al-Jazeera personnel were confirmed infected without any user click or interaction, and Discover-Tech's ad inventory touched nearly 200,000 unique websites and apps across dozens of countries over just four months, exposing government, military, critical infrastructure, and media organizations to silent zero-click spyware delivery. The AdFection campaign represents a structural escalation in commercial surveillance: threat actors have weaponized the legitimate programmatic advertising supply chain itself, meaning perimeter and endpoint defenses that rely on user-initiated actions provide virtually no protection. As regulatory scrutiny of spyware vendors intensifies globally, the incident underscores that any enterprise or government agency that allows unfiltered ad traffic into its network perimeter is exposed to an entirely passive infection vector.
Inside Help TDS: How a Russian Affiliate Network Built an Industrial-Scale Microsoft Impersonation Scam
Since at least 2017, a Russian-language affiliate network called Hotejka has operated Help TDS, a malicious traffic distribution system that routes victims to Microsoft-impersonation tech support scams. Researchers at Infoblox infiltrated the affiliate panel and confirmed the platform serves over a dozen criminal affiliates—including known malware operations Balada Injector and DollyWay—redirecting compromised web traffic to fake Windows security alerts. Victims are socially engineered into installing remote desktop tools such as UltraViewer, granting threat actors persistent, repeated access to their systems. Over 20,000 malicious Cloudflare Pages domains were detected across a six-month period, with C2 infrastructure rolling over every five minutes via Telegram. This operation illustrates how commodity social engineering infrastructure has industrialized at scale, combining legitimate CDN abuse, dark-web affiliate models, and remote access tooling to enable long-term victim exploitation far beyond simple credit card fraud.
Inside the Cairn AI Attack Campaign: How Automated Agents Compromised 100+ E-Commerce Sites
In October 2026, researchers at NorForge uncovered a large-scale, AI-assisted attack campaign leveraging the penetration-testing tool Cairn to autonomously compromise over 100 e-commerce and payment-infrastructure websites across the US, Australia, Canada, and Japan. Chinese-speaking threat actors orchestrated more than 1,100 attack projects across 14 exposed dashboards, directing AI agents to discover and exploit SQL injection, authentication bypasses, unsafe file uploads, and server-side template injection vulnerabilities—ultimately installing web shells for persistent access. Named victims include John Deere, SharkNinja, and Cummins, with financial theft and credential harvesting confirmed as primary objectives. This campaign signals a structural shift in attacker economics: AI coordination tools now allow adversaries to run hundreds of exploitation workflows in parallel for roughly five dollars per task, dramatically lowering the barrier to targeting organizations that were previously considered too costly to attack. Security teams operating on traditional reactive cycles are increasingly outpaced by these automated, multi-stage offensive pipelines.
When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform
In October 2026, CISA published ICS Advisory ICSA-26-280-01 disclosing seven vulnerabilities in CISA Malcolm, the agency's own open-source network traffic analysis and ICS security monitoring platform. Reported by Seth Grover of Idaho National Laboratory, the flaws span authentication bypass via nginx regex spoofing (CVE-2026-107336), hardcoded credentials enabling direct Arkime backend access (CVE-2026-107361), SSRF through an unmodified FilePond PHP component (CVE-2026-107362), RBAC bypass via URL path normalization inconsistency (CVE-2026-107333), cross-site request forgery enabling forensic log destruction (CVE-2026-107337), percent-encoding authorization bypass (CVE-2026-107334), and a gzip-bomb denial-of-service (CVE-2026-107335). Collectively these vulnerabilities expose critical-infrastructure operators—in Energy, IT, and Water sectors worldwide—to unauthenticated access, privilege escalation, lateral movement, and destruction of forensic evidence. The compromise of a security-monitoring tool itself represents an acute supply-chain and defense-evasion risk. As ICS/OT environments deepen their dependence on network-visibility platforms, adversaries now actively target the monitoring layer—blinding defenders while moving laterally through operational technology networks, a tactic increasingly observed in critical-infrastructure threat campaigns.
ROMULUS ClickFix: How a New Malware Delivery Platform Is Turning Users Into Their Own Worst Enemy
In October 2026, cybersecurity researchers at Forescout Vedere Labs disclosed ROMULUS, a multi-payload ClickFix delivery platform distributing malware including LegionLoader (also known as Satacom, CurlyGate, and RobotDropper). ROMULUS operates by luring victims to fraudulent landing pages that instruct them to execute malicious PowerShell commands, triggering a staged infection chain. The platform delivers either trojanized MSI installers or encrypted, padded archives exceeding 1 GB designed to evade sandbox analysis. Six active IP addresses were identified, one linked to a prior campaign abusing ChatGPT Custom GPTs. The attributed operators remain unknown, though ROMULUS shares no overlap with China-aligned Silver Fox threat actor infrastructure. ROMULUS signals a significant evolution in ClickFix from a standalone social engineering trick into a scalable, commoditized malware-as-a-service delivery framework. The use of padded payloads to defeat sandboxes, multi-stage PowerShell loaders, and potential affiliate or commercial panel structures mirrors the professionalization trend seen in ransomware ecosystems, raising the risk profile for enterprises across all sectors.
CISA ICSMA-26-288-01: Path Traversal in Thermo Fisher Torrent Suite Puts Genomic Data at Risk
In October 2026, CISA published ICS Medical Advisory ICSMA-26-288-01 disclosing a path traversal vulnerability (CVE-2026-107777, CWE-22) in Thermo Fisher Scientific's Torrent Suite Software versions 5.18 and earlier, a genomic sequencing platform widely deployed in healthcare and public health environments worldwide. An authenticated remote attacker can exploit the flaw by sending a crafted HTTP request that escapes the application's restricted directory, allowing arbitrary file reads on the underlying Torrent Server under the privileges of the web service account. Scored CVSS 3.1 at 6.5 (Medium) and CVSS 4.0 at 7.1 (High), the vulnerability exposes sensitive genomic, patient, and configuration data without requiring user interaction or elevated credentials beyond basic authentication. Thermo Fisher resolved the issue in Torrent Suite Software version 5.22. Path traversal flaws in medical and ICS devices continue to be a primary vector for healthcare data breaches, with CISA and HHS reporting a sustained increase in targeted exploitation of unpatched clinical informatics platforms. The convergence of genomic research infrastructure with internet-accessible deployment architectures elevates the risk profile well beyond traditional IT vulnerabilities, making timely patching and network segmentation operationally critical.
Six Critical Flaws in J4Care dcm4chee Allow Unauthenticated Attackers to Steal, Forge, and Destroy Medical Imaging Records
On October 15, 2026, CISA issued ICS-Medical Advisory ICSMA-26-288-02 disclosing six critical and high-severity vulnerabilities in J4Care dcm4chee-arc-light 5.35.1, a widely deployed open-source clinical image archive used globally across healthcare and public health infrastructure. The flaws span missing authentication on DICOM and HL7 interfaces (CVE-2026-105279, CVE-2026-105667), missing authorization on storage management REST APIs (CVE-2026-97851), and denial-of-service conditions via malformed JPEG, MP4, and multipart inputs (CVE-2026-107621, CVE-2026-105273, CVE-2026-101021). Unauthenticated remote attackers can enumerate and exfiltrate patient records and medical images, inject forged diagnostic studies, permanently reassign patient identities across the archive, and trigger service outages—all without credentials, over the network, at CVSS scores reaching 9.3. These vulnerabilities illustrate a persistent and dangerous pattern in healthcare ICS environments: medical imaging systems exposed on internal clinical networks frequently lack authentication on legacy DICOM and HL7 interfaces, creating zero-barrier pathways for patient data exfiltration and record manipulation. With ransomware groups and nation-state actors increasingly targeting healthcare infrastructure, unpatched imaging archives represent a direct compliance liability under HIPAA and an operational risk to patient safety.
Hard-Coded Credentials in EseeCloud IP Cameras Give Attackers Full Remote Control—No Patch Available
In October 2026, CISA published ICS Advisory ICSA-26-288-02 disclosing three critical-to-medium severity vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP camera platform, affecting App versions ≤4.9.6 and Firmware versions ≤4.9.86.0 deployed worldwide across energy, communications, transportation, financial services, and government sectors. The most severe flaw, CVE-2026-107617 (CVSS 9.8), embeds hard-coded credentials that allow any remote, unauthenticated attacker to log in to EseeCloud devices at will. A second vulnerability, CVE-2026-97858, permits unauthorized device rebinding—stripping ownership from legitimate users and reassigning control to an attacker. A third flaw, CVE-2026-105664, exposes an enumeration oracle that lets token-holders discover every registered device serial ID at scale due to absent rate limiting. The vendor did not respond to CISA's coordination attempts, leaving no vendor patch available. These findings arrive amid a documented surge in nation-state and criminal exploitation of consumer and industrial IoT devices as persistent footholds into critical infrastructure networks. Hard-coded credential abuse in embedded devices has become a primary initial-access vector, and the absence of encrypted traffic controls means camera feeds and command channels remain fully interceptable once an attacker gains network adjacency.
How the Romulus ClickFix Platform Weaponized a Siemens Zero-Day to Drop a RAT Inside Your Network
In October 2026, threat actors exploited CVE-2026-110936, a high-severity DLL sideloading vulnerability (CVSS v4: 8.4) in Siemens Software Center, to deliver a Remote Access Trojan (RAT) via the ClickFix delivery platform known as Romulus. Attackers placed a malicious archive.dll alongside a legitimately signed SiemensSoftwareCenter.exe, distributed via AllMyBasic.msi, and leveraged msiexec.exe as the execution chain. Social engineering was amplified through malicious ChatGPT Custom GPTs directing victims to fake URLs serving PowerShell-based ClickFix lures. Command-and-control infrastructure included 96.62.218[.]59 and wizardexpensive[.]com, enabling persistent remote access to compromised endpoints across industrial and enterprise environments. This campaign illustrates a rapidly maturing attacker playbook: combining trusted software binaries, AI-augmented social engineering, and established malware-as-a-service platforms to bypass traditional defenses. The convergence of ClickFix lure delivery with OT-adjacent software like Siemens tooling signals escalating risk for critical infrastructure operators and enterprise IT teams dependent on industrial software ecosystems.
OVHcloud CLI Supply-Chain Hijack: How GlassWorm Turned a GitHub Release Into a Secret Stealer
On October 19, 2026, attackers hijacked a contributor's GitHub account and silently replaced download archives across five OVHcloud CLI releases (v0.11.0–v0.15.0) with a malicious binary designed to steal secrets stored on disk. The tampered files were live for up to 94 minutes before a customer's hash-pinning CI job detected the discrepancy and filed a public issue. The attack exploited the absence of GitHub's immutable-release setting, allowing anyone with repository write access to overwrite existing release artifacts without triggering the CI/CD pipeline. Affected users on macOS, Linux x86_64/arm64, and Windows x86_64 who installed or auto-upgraded during the window were advised to rotate all credentials immediately. This incident highlights a deepening supply-chain threat targeting developer toolchains: attackers are increasingly compromising trusted contributors rather than the build pipeline itself, bypassing conventional CI/CD controls. The campaign has been tentatively linked to GlassWorm, a threat actor known for hiding loader code in Unicode characters and abusing blockchain memo fields for C2 staging, signaling a sophisticated, multi-stage offensive posture against open-source ecosystems.
Six OPC UA Flaws in Eclipse Milo Put Critical Infrastructure at Risk: What Security Teams Must Do Now
In October 2026, CISA published ICS Advisory ICSA-26-288-01 disclosing six critical-to-high severity vulnerabilities in Eclipse Foundation Eclipse Milo, the widely deployed open-source OPC UA SDK used across chemical, energy, critical manufacturing, and water sectors worldwide. Flaws span incorrect authorization (CVE-2026-62927), missing authorization on diagnostics nodes (CVE-2026-63248, CVE-2026-58080), a padding-oracle attack enabling credential recovery (CVE-2026-60007), and two resource-exhaustion denial-of-service bugs (CVE-2026-63252, CVE-2026-61387). Unauthenticated remote attackers can delete protected OT data, impersonate legitimate users, or crash OPC UA servers entirely. The Eclipse Foundation has released version 1.1.5 as the remediation. These vulnerabilities underscore a systemic risk in ICS/OT environments: open-source protocol libraries embedded deep in industrial control stacks often escape rigorous security review cycles. As OPC UA adoption accelerates for Industry 4.0 connectivity, authorization bypasses and cryptographic weaknesses in foundational SDKs present nation-state and ransomware actors with high-value, low-friction entry points into operational technology networks.
ARMORY CASTLE Is Actively Exploiting BeyondTrust Remote Support: What Your Security Team Must Do Today
In October 2026, CISA issued an urgent advisory disclosing active exploitation of CVE-2026-102764, a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar) versions 24.3.1 and earlier. Threat actors tracked under the campaign identifier ARMORY CASTLE are leveraging this flaw to gain unauthenticated initial access to self-hosted Remote Support appliances, then establishing persistence, escalating privileges, and moving laterally across enterprise networks. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16, 2026, and patch BT26-05-RS is available for supported versions. SaaS-hosted deployments were patched automatically, but on-premises environments remain at significant risk without immediate action. This incident underscores a persistent and accelerating pattern of threat actors targeting privileged remote-access and support infrastructure as a high-value initial access vector. As remote-access tooling becomes increasingly embedded in enterprise and government IT operations, unpatched appliances represent a critical exposure surface that adversaries are systematically scanning and exploiting within days of disclosure.