Find what you’re looking for

UAT-11985: How AI-Powered Fake Event Invites Bypassed MFA to Compromise Taiwan Research Accounts

In mid-2026, a threat actor tracked as UAT-11985 launched a sophisticated spear-phishing campaign targeting individuals affiliated with Taiwan research organizations. The operation used AI-assisted content generation to craft convincing fake event invitations impersonating legitimate academic and policy institutions, including the Taiwan European Union Centre and NCCU Institute of International Relations. Victims were lured to an adversary-in-the-middle (AitM) phishing framework that spoofed Google login pages, harvesting credentials and MFA codes in real time via obfuscated JavaScript and WebSocket connections. The campaign also embedded malicious QR codes into legitimate event posters to extend the attack surface beyond email recipients. This incident reflects a broader and accelerating trend of AI-augmented phishing operations targeting geopolitically sensitive organizations. The combination of AitM proxy techniques, MFA bypass, and QR code phishing (quishing) represents a significant evolution in credential theft tradecraft, making traditional perimeter defenses and user awareness training insufficient on their own.

Five Minutes Was All It Took: How UNC7017 Weaponized AOMEI Backupper's Update Channel to Backdoor Organizations in 11 Countries

Between May and July 2026, a threat actor tracked as UNC7017 conducted a precision supply-chain attack against AOMEI Backupper, a widely deployed Windows backup and disk-cloning tool. Attackers gained write access to AOMEI's update servers and swapped two unsigned configuration files—down_html.ini and Notifycfg.ini—during three windows lasting five to ten minutes each. Any copy of the software that polled for updates during those windows silently downloaded and executed a backdoor called SHINYROAD, delivered via a DLL-sideloading chain using a signed Radmin binary. Affected organizations span IT services, telecommunications, and higher education across 11 countries, and a secondary WebDAV trick enabled NetNTLMv2 credential theft with no code execution required. This incident crystallizes a maturing attacker playbook: compromise the trusted update mechanism of a legitimate vendor, operate in sub-ten-minute windows to defeat point-in-time scanning, and leave no exploited CVE to patch. As software supply-chain intrusions grow more ephemeral and harder to triage, organizations face mounting pressure from CISA, NIST CSF 2.0, and PCI DSS 4.0 to enforce cryptographic verification of software updates and apply zero-trust network controls around all outbound software delivery paths.

MALFEX 2026: How a Nine-Line npm Package Smuggled a Shellcode Loader into Windows Developer Environments

In late September 2026, threat researchers uncovered a sustained software supply-chain campaign dubbed MALFEX, in which an unknown threat actor published a series of malicious npm packages—most recently 'imgdecode'—targeting Windows developers. The package conceals a compiled Windows DLL inside a Node.js native addon; when loaded, the DLL fetches encrypted shellcode from a GitHub repository, decrypts it, and injects it into a legitimate dllhost.exe process. The malware deploys both the Overlord RAT and a Go-based Node.js infostealer ('movinlike') capable of harvesting browser credentials, crypto wallets, Discord, Telegram, seed phrases, SSH keys, and gaming platform tokens, while establishing a persistent WebSocket C2 channel and evading sandbox detection. Active since August 2023, the campaign has cycled through at least eleven package identities in direct response to npm takedowns. This incident underscores an accelerating attacker pattern of weaponizing open-source package ecosystems to reach enterprise CI/CD pipelines and developer workstations. The adversary's rapid republishing cadence—replacing removed packages within hours—highlights the inadequacy of reactive registry enforcement and reinforces urgent demand for proactive supply-chain controls, network egress enforcement, and east-west segmentation in cloud-native environments.

One Stolen Credential, 173 Breached Tenants: Inside the ConnectWise Cloud Backup OAuth Attack

On October 15, 2026, unknown threat actors exploited a compromised OAuth credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to 173 Microsoft 365 tenants. Operating from IP address 144.172.64.128 between 06:13 and 08:34 UTC, attackers scripted through tenants in sorted GUID order, harvesting Microsoft Graph tokens and inheriting the application's broad permissions—full mailbox access, OneDrive, SharePoint, Teams, and directory data. In at least one tenant, a ConnectWise app elevated itself to Global Administrator and injected credentials into trusted third-party applications, extending the blast radius across the MSP customer ecosystem. This incident underscores the accelerating abuse of trusted OAuth applications and MSP supply-chain vectors as force-multipliers for attackers. A single compromised vendor credential cascaded across 173 organizations simultaneously, illustrating how identity-centric supply-chain attacks are rapidly displacing traditional network-based intrusions as the dominant enterprise threat pattern in 2026.

37 Years in the Kernel: How a Legacy BSD Integer Overflow Was Chained Into a Full OpenBSD Root Exploit

In October 2026, security firm Calif published a working local privilege escalation exploit against OpenBSD 7.9 that chains a 37-year-old signed 16-bit integer overflow in the shmat() shared-memory attachment counter with a separate kernel use-after-free, ultimately bypassing OpenBSD's KARL kernel-address randomization and hardware SMAP/SMEP protections to achieve root. The attack requires no information-disclosure vulnerability, exploiting deterministic kernel memory allocators to locate function pointers at predictable addresses. OpenBSD shipped patches in September 2026 via errata 018 and 026, available through syspatch across all architectures. No CVE was assigned and no in-the-wild exploitation has been observed. This disclosure highlights how legacy type definitions inherited across decades of BSD lineage can survive in security-hardened operating systems, and how layered exploit chains increasingly neutralize multiple independent mitigations simultaneously. The research underscores growing attacker sophistication in local privilege escalation techniques targeting hardened Unix-family kernels—a trend increasingly relevant to cloud workloads, container escape scenarios, and shared multi-tenant infrastructure.

Inside the AOMEI Supply-Chain Attack: How UNC7017 Hijacked Update Servers to Silently Deploy Backdoors

Between April and July 2026, threat actor UNC7017 conducted a stealthy supply-chain attack against AOMEI Backupper, a widely deployed Windows backup application, by compromising the vendor's update and notification server infrastructure. Attackers briefly modified two configuration files—down_html.ini and Notifycfg.ini—during three narrow windows lasting five to ten minutes each, redirecting the software to download a malicious ZIP archive and silently execute a novel downloader (CROSSROAD) and backdoor (SHINYROAD) without user interaction. SHINYROAD leveraged legitimate Radmin components to establish outbound C2 connectivity. Affected organizations spanned IT services, telecommunications, and higher education across the United States, Australia, India, Singapore, Spain, and Switzerland. This incident illustrates a growing attacker preference for ephemeral, low-dwell-time supply-chain tampering that evades traditional perimeter and endpoint defenses. By operating inside trusted vendor delivery channels and restoring malicious files within minutes, UNC7017 exploited the implicit trust organizations place in signed, vendor-distributed software updates—a pattern increasingly observed across enterprise software ecosystems in 2025–2026.

REF8801: How a Fake Web3 Accelerator Turned npm Packages Into an AI Agent Spy Operation

In October 2026, Elastic Security Labs uncovered REF8801, a threat operation posing as a Web3 venture capital accelerator called Apex Accelerator. The campaign published malicious npm packages—@apexacc/cli and @apexacc/audit—targeting cryptocurrency founders and developers with promises of AI credits, coding tools, and smart contract audits. Once installed, the packages deployed the CloudSyncD macOS backdoor and a custom Windows infostealer exfiltrating data via Telegram, while simultaneously hijacking victims' AI agent traffic by redirecting OpenRouter LLM requests through attacker-controlled infrastructure and registering rogue MCP servers to intercept prompts, code snippets, and conversation history. This campaign reflects a sharp escalation in supply-chain threats targeting the intersection of Web3 and agentic AI ecosystems. As developers increasingly embed LLM-powered agents into workflows, attackers are pivoting from credential theft alone to compromising the AI control plane itself—silently reshaping agent behavior, poisoning prompt context, and exfiltrating proprietary code and conversation data at scale.

Rank Math PRO Hijacked: How a Trusted WordPress Plugin Update Channel Became a Self-Restoring Backdoor

Between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, attackers compromised Rank Math's own distribution infrastructure and replaced legitimate downloads and auto-updates of the paid Rank Math PRO WordPress SEO plugin (v3.0.123) with a malware-laced build. Any site that installed and activated the tainted copy should be treated as fully compromised. The malware (CVE-2026-111862, CVSS 9.8) installs a self-restoring PHP backdoor, drops rogue admin accounts, adds SSH keys, modifies .htaccess to execute .cache files as PHP, plants scheduled tasks, and exfiltrates credentials to the attacker-controlled domain rank1cdn[.]com—registered roughly 24 hours before the attack window opened. This incident is the third confirmed case in 2026 of a premium WordPress plugin vendor's update channel being weaponized to deliver backdoored builds, following similar attacks on Smart Slider 3 Pro in April and ShapedPlugin Pro plugins in June. The pattern signals a deliberate, escalating campaign targeting the supply chains of commercial WordPress ecosystems, where millions of sites silently auto-update from vendor-controlled servers outside the scrutiny of WordPress.org's checksum infrastructure.

Plex2Shell: How a Four-CVE Chain Turned Media Servers Into Crypto Mines and Proxy Nodes

In October 2026, threat actors began actively exploiting a chained set of four vulnerabilities in Plex Media Server—collectively dubbed Plex2Shell—to achieve unauthenticated remote code execution. The attack chain, involving CVEs 2026-96652, 96654, 96655, and 96656, was weaponized within 24 hours of a public proof-of-concept release on October 16, 2026. Attackers deployed the XMRig-based cryptominer 'mylovelyminer' and a stealthy Linux reverse proxy backdoor named 'myawesomeproxy,' both linked to the AISURU proxyware botnet infrastructure. Plex had patched the flaws in version 1.43.3.10861 released August 3, 2026, but unpatched internet-exposed instances remained vulnerable. This incident underscores the persistent danger of n-day exploitation windows—where attackers race to compromise unpatched systems immediately after PoC publication. The connection to the AISURU botnet signals organized, infrastructure-backed campaigns targeting self-hosted media platforms to harvest compute resources and build covert proxy networks for downstream attacks.

GhostAction's Font File Trick: How a Fake Woff2 Asset Stole Secrets from 94 GitHub Repos

In October 2026, the GhostAction threat actor escalated a supply-chain campaign by registering the phishing domain my-github[.]com and deploying a reverse-proxy kit that silently harvested GitHub credentials and 2FA codes, then stealthily authorized OAuth tokens with repo and workflow write permissions. The actor embedded a credential stealer inside a fake font file (fa-solid-400.woff2) committed to 94 repositories across 66 owners, using a VS Code tasks.json runOn:folderOpen trigger to persist on developer machines entirely outside GitHub's runner controls. The stealer harvested AWS keys, PyPI and npm tokens, Kubernetes credentials, SSH private keys, and AI provider secrets, exfiltrating everything over plain HTTP to a single attacker-controlled IP. This incident illustrates a maturing supply-chain playbook in which attackers combine OAuth device-code phishing, IDE auto-execution abuse, and stealer malware disguised as legitimate assets to survive platform-level mitigations. As open-source ecosystems grow more interconnected, a single compromised maintainer account can cascade stolen secrets across thousands of downstream consumers, amplifying both blast radius and regulatory exposure.

TAG-217 and ARTEX: How AI-Powered Attackers Breached Seven South Korean Banks

In October 2026, threat actor TAG-217 executed a multi-institution cyberattack against at least seven South Korean financial organizations, exposing personal data of approximately 68,000 individuals. Preparations began as early as August 2026, with the actor assembling tools leveraging the open-source AI penetration testing framework ARTEX alongside multiple AI platforms including Claude Code, DeepSeek, Grok, and Zhipu AI. TAG-217, assessed as a Chinese-speaking operator, exploited AI-assisted automation to opportunistically probe systems at scale across diverse targets, using residential proxies to obscure origin. Compromised data included customer records and outsourced developer personal information. This incident marks a significant inflection point in AI-enabled offensive operations. The use of open-source AI pentesting frameworks lowers the barrier for sophisticated, multi-target financial sector intrusions. As agentic attack tooling becomes commoditized, defenders face campaigns that are faster, broader, and harder to attribute—making cloud network segmentation, egress controls, and behavioral anomaly detection essential countermeasures.

Inside the ShinyHunters Betrayal: When Your Ransomware Negotiator Works for the Attacker

In October 2026, U.S. federal investigators revealed that executives at two ransomware negotiation firms maintained covert operational ties to ShinyHunters, a prolific extortion group responsible for over $70 million in victim payments that year. One U.S.-based consultant allegedly helped operate Shinywire, the group's victim-shaming extortion portal, while Canadian executive Edward Dubrovsky was arrested for threatening to disclose stolen data and interfering with commerce through extortion. Signal messages recovered during the Dutch arrest of ShinyHunters suspect Pepijn van der Stap exposed that negotiators knew of breaches—including the FBI jobs site hack—before victims were notified, revealing a systemic corruption of the incident response supply chain. This case exposes a structural flaw at the heart of the cyber extortion ecosystem: ransomware negotiators incentivized by percentage-based fees on ransom payments have a financial interest in ensuring victims pay—and pay more. As regulators and insurers scrutinize negotiator conflicts of interest, organizations must question whether their incident response partners are working for them or against them.