⚡ Haftalik xulosa: Muhim CVE'lar, Linux DDoS botneti, Qurilma kodi bilan fishing, Android josuslik dasturi va boshqalar

Bu haftadagi ba'zi hujumlar ko'p hiyla-nayrang talab qilmadi. Soxta qo'llab-quvvatlash qo'ng'irog'i, ishonchli kengaytma, umumiy havola yoki parolsiz qurilma. Odamlar deyarli o'ylamaydigan kichik narsalar. Biroq har biri jiddiy muammolarni keltirib chiqarish uchun yetarli bo'ldi.

Keyin esa kattaroq tartibsizliklar yuz berdi. Milyardlab o'g'irlangan mablag'lar, buzilgan qurilmalarning yashirin tarmoqlari, zaharlangan dasturiy ta'minot va hujumchilarning odatiy vositalarni foydalanuvchilarga qarshi ishlatishning yangi usullarini topishi. Hatto pul va tizimlarni xavfsiz saqlash uchun mo'ljallangan joylar ham muammolarga duch keldi. G'alati tomoni shundaki, zarar ko'pincha hech kim qaramagan joydan boshlanardi.

Va bu hali yangi xatolar, shubhali xizmatlar va aylanib yurgan firibgarliklarning uzun ro'yxatiga yetib bormagan. Saralash uchun ancha narsa bor. Mana ro'yxatga kirganlar.

⚡ Haftaning tahdidi

N. Koreya Binance'dan 6,43 mlrd dollarlik kripto o'g'irligi bilan yangi rekord o'rnatdi — AQSh Federal Tergov Byurosi (FBI) Binance'dan 11 ta blokcheynda 6 mlrd dollardan ortiq virtual aktivlar o'g'irlanganini TraderTraitor nomli Shimoliy Koreya xakerlik guruhi bilan bog'ladi. Bu 2025-yil fevralida Bybit'dan o'g'irlangan 1,46 mlrd dollardan ancha ko'p bo'lib, tarixdagi eng yirik kriptovalyuta o'g'irligiga aylandi. O'g'irlangan mablag'larning 82% Ethereum va Bitcoin'da edi. TraderTraitor tomonidan o'g'irlangan 6,43 mlrd dollardan 2,85 mlrd dollarlik aktivlar Tether, Circle, Ripple, Arbitrum va Optimism tomonidan zanjirda muzlatilgan.

🔔 Asosiy yangiliklar

Volt Typhoon 0-kun hujumlarida Silent Train yashirin tarmog'idan foydalanmoqda — Xitoy davlat homiyligidagi Volt Typhoon xakerlik guruhi talab bo'yicha buzilgan ulangan qurilmalar zanjirlaridan foydalanadigan, jumladan yuqori qiymatli tizimlarga qarshi nol kun zaifliklaridan foydalanishni osonlashtiradigan ramkadan foydalanmoqda. U Silent Train deb nomlangan, chunki tahdid aktori uni tanlangan nishonlarga qarshi ishlatadi, har bir operatsiyadan keyin aniqlash va bog'lanishni minimallashtirish uchun tozalaydi va doimiy ravishda yangilaydi. Silent Train hujumlarining kelib chiqishini yashirish uchun buzilgan qurilmalardan tashkil topgan relay infratuzilmasidir. Topilmalar "geosiyosiy keskinliklar yoki inqirozlar davrida muhim bo'ladigan strategik aloqa, muhim infratuzilma va boshqa ekotizimlar" ichida kirish imkoniyatini oldindan joylashtirish harakatlarining dalillarini ta'kidlaydi. Silent Train "tez aylanadigan buzilgan SOHO, IoT va korporativ qurilmalar zanjirlari" atrofida qurilgan. Bu qurbonlarning tabiati "mudofaa, logistika, aloqa, harbiy va fuqarolik operatsiyalarini, ayniqsa Hind-Tinch okeani mintaqasidagi keskinliklar yoki inqirozlar davrida qo'llab-quvvatlaydigan muhim ekotizimlarga kirish imkoniyatini saqlab qolish bo'yicha maqsadli harakatlar"ni ko'rsatadi.
Polymarket uchinchi tomon xakerligi tufayli savdoni qisqa muddatga to'xtatdi — Bashorat bozori platformasi Polymarket DebugBear nomli uchinchi tomon xizmatining buzilishi natijasida kriptovalyuta o'g'irlovchi JavaScript tarqatilgandan so'ng savdoni vaqtincha to'xtatdi. Bu bir soatdan kamroq vaqt ichida 33 ta depozit hamyondan taxminan 2,7 mln dollarlik aktivlarni o'g'irladi. "Bizning DNS server yozuvlarimiz domen registratorimiz orqali buzildi. Hozircha bizning domenimizga yuborilgan elektron xatlarni qabul qila olmayapmiz," deb aytdi DebugBear 2026-yil 31-oktabrda yangilanishda. "Dastlabki tekshiruvimizga ko'ra, bu hujum ma'lum bir mijozning veb-saytiga qaratilgan. Biz ichki tizimlarimizning buzilganiga hech qanday dalil ko'rmadik, garchi tekshiruvni davom ettiramiz." Iyun oyida Polymarket o'zining frontendiga zararli skript kiritilgan yana bir uchinchi tomon buzilishini e'lon qildi, bu esa taxminan 3 mln dollarlik yo'qotishlarga olib keldi.
Umumiy ChatGPT havolalari kod bajarilishiga olib keladi — Parameter Labs tadqiqotchilari ChatGPT'dagi endi tuzatilgan zaiflikni oshkor qildilar, bu oddiy umumiy havolani hujumchi nazoratidagi JavaScript'ga aylantirib, uni ochgan har kimning imzolangan sessiyasida ishlatdi. "Hujumchi zararli suhbat yaratishi, ChatGPT'ning odatiy umumiy funksiyasidan foydalanib nashr etishi va havolani boshqa foydalanuvchiga yuborishi mumkin edi," dedi Parameter Labs. "Jabrlanuvchi umumiy havolani ochganda, yuk chatgpt.com sifatida jabrlanuvchining autentifikatsiyalangan veb-sessiyasiga kirish huquqi bilan bajarildi." Muvaffaqiyatli foydalanish hujumchiga jabrlanuvchining suhbat ro'yxatini sanab o'tish, shaxsiy suhbatdan kontent olish va shu suhbatdan ma'lumotlarni tashqi serverga yuborish imkonini berishi mumkin edi.
Cursor Marketplace'dagi rasmiy Claude Code kengaytmasida SSH orqa eshigi — Cursor Marketplace orqali tarqatilgan Claude Code kengaytmasining ikki versiyasi buzilgan tizimlarga doimiy SSH orqa eshigini o'rnatish uchun o'zgartirildi. Cursor bu hodisa 5000 tagacha foydalanuvchiga ta'sir qilganini aytdi. Hodisaga javoban Cursor kalitlarini aylantirdi, bozorni qayta qurdi va bulut provayderi bilan serverni o'chirish uchun ishladi, shunda teskari qobiq endi ishlamaydi. Shuningdek, u hujum doirasida boshqa kengaytmalar zararli ravishda o'zgartirilmaganini ta'kidladi. Biroq, ta'minot zanjiri hujumiga oid bir nechta savollar javobsiz qolmoqda, jumladan tahdid aktori Cursor bozorida Anthropic nomi ostida zararli kengaytmani qanday nashr etganligi va ular qanday darajadagi kirish huquqiga ega bo'lganligi.
FBI Virtualine o'q o'tkazmas xosting provayderini musodara qildi — AQSh Adliya departamenti (DoJ) Virtualine nomli o'q o'tkazmas xosting provayderi (BPH) bilan bog'liq domen musodara qilinganini e'lon qildi. DoJ bu xizmat "voyaga yetmaganlarning jinsiy mazmundagi tasvirlarini reklama qilish, voyaga yetmagan va voyaga yetgan shaxslarning roziliksiz intim vizual tasvirlarini qasddan oshkor qilish va jinoiy xatti-harakatlarni yashirish va targ'ib qilish uchun mo'ljallangan xalqaro pul yuvish" kabi keng tarqalgan jinoiy faoliyatni amalga oshirish va osonlashtirish uchun ishlatilganini aytdi. Biroq, bunday tozalashlarning uzoq muddatli ta'siri shubha ostiga olingan. Intel 471 ma'lumotlariga ko'ra, buzilishlar mijozlarni sobiq qayta sotuvchilar tomonidan boshqariladigan yangi xizmatlarga yo'naltirib, talabni yo'q qilish o'rniga bozorni parchalaydi. Bu e'lon Avstraliya Signallar direktorati Amadey operatsiyalariga orqa eshik kirish huquqiga ega bo'lib, butun dunyo bo'ylab 180 000 ta kompyuterga kirish huquqini uzganini aytgan paytda keldi.
Keystone 18 835 ta apparat hamyonni yo'q qiladi — Keystone rasmiy veb-saytida uchinchi tomon ma'lumot monitoring vositasidagi zaiflikdan foydalanib, imtiyozlarni oshirish va qurilmalarimizning haqiqiyligini tekshirish uchun ishlatiladigan kalit bilan birga ba'zi mijoz ma'lumotlarini olish orqali sodir etilgan xavfsizlik hodisasini tasdiqladi. Bu 25 964 ta yozuvni o'z ichiga oldi, jumladan ismlar, aloqa ma'lumotlari, yetkazib berish manzillari va buyurtma ma'lumotlari, shuningdek 12 873 ta to'lov yozuvlari, jumladan foydalanuvchilar tomonidan taqdim etilgan ismlar, aloqa ma'lumotlari va yetkazib berish ma'lumotlari. Eski kalitdan foydalanishni to'xtatish bilan birga, Keystone eski kalitni o'z ichiga olgan mavjud inventardagi 18 835 ta qurilmani yo'q qilishni rejalashtirmoqda. "Rasmiy veb-saytimizdan jo'natilmagan barcha buyurtmalarni jo'natish to'xtatildi," deb aytdi u. "Yangi kalitdan foydalanadigan qurilmalar ishlab chiqarilishi tugaguncha savdo oldindan buyurtma modeliga o'tadi, shundan so'ng jo'natish qayta boshlanadi." Bog'liq rivojlanishda, yana bir apparat kriptovalyuta hamyon ishlab chiqaruvchisi Trezor Janubi-Sharqiy Osiyodagi qayta sotuvchisi CryptoBilis tomonidan sotilgan Trezor Safe 5'da shubhali apparat kripto-o'g'irlik implantiga oid ishonchli xabarlar olganini aytdi. "Agar siz 2026-yil mart oyidan boshlab CryptoBilis'dan Trezor sotib olgan bo'lsangiz va uni mablag'larni saqlash uchun ishlatayotgan bo'lsangiz, iltimos, mablag'laringizni yangi urug' bilan yangi yaratilgan hamyonga iloji boricha tezroq ko'chiring," deb aytdi u.
uCreator Android josuslik dasturi WeChat hisoblarini klonlashi mumkin — uCreator nomli tijorat Android josuslik dasturi Xitoy va Janubi-Sharqiy Osiyo bo'ylab mobil hamyonlar va xabar almashish ilovalarining oddiy foydalanuvchilarini nishonga olish uchun mo'ljallangan, jumladan GCash (Filippin), WeChat, WeCom, QQ, Telegram, WhatsApp, LINE, Zalo, KakaoTalk, Viber va MoMo. U shuningdek WeChat hisoblarini klonlash uchun ishlatilishi mumkin. Jabrlanuvchilar sideloading yoki ijtimoiy muhandislik oqimlari orqali tarqatilgan qonuniy ilovalarning qayta qadoqlangan nusxalarini o'rnatadilar. Hujum GodFather kabi zararli dasturda kuzatilgan qurilma ichidagi virtualizatsiya texnikasining o'zgarishidan foydalanadi. "GodFather bank ilovasini virtual konteyner ichida ishga tushiradi va yuqoriga soxta qoplama qo'yib, ma'lumotlarni o'g'irlash uchun ishlatadi: jabrlanuvchi haqiqatan ham hujumchining ekraniga yozmoqda," deb tushuntirdi xavfsizlik tadqiqotchisi Ovi Liber. "uCreator bir xil substratdan foydalanadi, lekin hech qanday qoplama chizmaydi. Bu haqiqatan ham ilovani-qoplash va ilovani-boshqarish holati, ikkinchisi esa tinchroq va faqat kirish ekraniga cheklanmagan. Operator sifatida, u sotuvchi yozgan har qanday modul uchun kengayadi."
Gheist GitHub Actions'ni yashirin ma'lumot olish xizmatiga aylantiradi — Gheist deb nomlangan avtomatlashtirilgan kampaniya o'g'irlangan GitHub tokenlari yetib boradigan har bir omborga "sync-check" nomli yashirin ma'lumot chiqaruvchi ish oqimini joylashtirishi kuzatilgan. "Ish oqimi omborning yashirin ma'lumotlarini o'z ish oqimi jurnaliga chop etishga intiladi," dedi Wiz. "Keyin, vosita GitHub API orqali jurnalni yuklab oladi va bir necha soniya ichida ishni o'chiradi." Google'ga tegishli bulut xavfsizligi kompaniyasi 850 dan ortiq buzilgan hisobdan 13 500 dan ortiq joylashtirilgan shoxalarni tiklaganini aytdi. Kampaniya birinchi marta 2026-yil sentyabr o'rtalarida aniqlangan.

‎️‍🔥 Trenddagi CVE'lar

Xatolar har hafta tushadi va yamoq bilan ekspluatatsiya orasidagi farq tez qisqarib bormoqda. Bu haftaning og'ir zarbalari: yuqori jiddiylik, keng tarqalgan foydalanish yoki allaqachon yovvoyi tabiatda tekshirilayotganlar.

Ro'yxatni tekshiring, mavjudlarini yamang va shoshilinch deb belgilanganlarga birinchi navbatda e'tibor bering — CVE-2026-115889, CVE-2026-115893 (Wasmtime), CVE-2026-90975 (Fireblocks mpc-lib), CVE-2026-91141 (COVESA vsomeip), CVE-2026-88781, CVE-2026-75775, CVE-2026-75779, CVE-2026-93489, CVE-2026-17518, CVE-2026-75753, CVE-2026-102438, CVE-2026-14911, CVE-2026-16528, CVE-2026-19386, CVE-2026-19396, CVE-2026-93495, CVE-2026-14157, CVE-2026-13313 (ASUS), CVE-2026-114573, CVE-2026-9082, CVE-2026-118539 (Drupal), CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598 (EPICS Base), CVE-2026-97631 (TianoCore EDK II), CVE-2026-115881, CVE-2026-115884 (GoAhead), CVE-2026-110720 (HashiCorp consul-k8s), CVE-2026-90885, CVE-2026-85250, CVE-2026-88901, CVE-2026-88900, CVE-2026-78165, CVE-2026-85251 (Apache Camel), CVE-2026-115547 (Okta), CVE-2026-114349, CVE-2026-111551 (Apache Kafka), CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344, CVE-2026-106378 (Google Chrome), CVE-2026-117860 dan CVE-2026-117954 gacha, CVE-2026-118005 dan CVE-2026-118017 gacha (Mozilla Firefox), CVE-2026-98432 (Linux kernel), CVE-2026-18672, CVE-2026-19219 (Telerik UI for ASP.NET AJAX), TRA-2020-14 (Kodi), CVE-2026-107239, CVE-2026-107238, CVE-2023-22793 (Veeam), CVE-2026-103401, CVE-2026-103402, CVE-2026-103403, CVE-2026-103404, CVE-2026-103405, CVE-2026-103406, CVE-2026-103407, CVE-2026-103408, CVE-2026-103409 (Juniper Networks Session Smart Router), CVE-2026-111585 (TeamViewer), CAN-2026-2035970 (Intelbras IP kameralari), CVE-2026-103594, CVE-2026-112709, CVE-2026-112710, CVE-2026-93857, CVE-2026-103593, CVE-2026-93865, CVE-2026-93866 (WatchGuard Fireware OS), CVE-2026-101296, CVE-2026-101356, CVE-2026-103119 (Apache Tomcat), CVE-2026-112816 (Canonical LXD), CVE-2026-93680, CVE-2026-110186 (Langflow OSS) va TightVNC'dagi oldindan autentifikatsiyalangan masofaviy kod bajarish zaifligi.

🎥 Kiberxavfsizlik vebinarlari

Identifikatsiya kontekstini tezroq, aqlliroq SOC javobiga aylantirishni o'rganing → Sizning xavfsizlik vositalaringiz shubhali faoliyatni aniqlay oladi, lekin identifikatsiya kontekstisiz muhim tahdidlar e'tibordan chetda qolishi mumkin. Mashina identifikatsiyalari va AI agentlari hujum yuzasini kengaytirar ekan, SOC jamoalariga samarali javob berish uchun chuqurroq ko'rinish kerak. Ushbu mutaxassislar rahbarligidagi vebinarga qo'shiling va identifikatsiya razvedkasini xavfsizlik operatsiyalari bilan bog'lash yashirin xavflarni ochish, tekshiruvlarni tezlashtirish va tahdidlarni tezroq cheklashga qanday yordam berishini bilib oling.
Nol kunlardan daqiqalarda ekspluatatsiyagacha: AI tahdidlariga tayyormisiz? → AI bilan quvvatlangan kiberhujumlar tezlashmoqda, bu esa xavfsizlik jamoalariga beriladigan vaqtni qisqartirmoqda.

The original text is in EN, taken from the source site. Source ↗

Some attacks this week didn't need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble.

Then there were the bigger messes. Billions stolen, hidden networks of hacked devices, poisoned software, and attackers finding new ways to turn normal tools against their users. Even the places meant to keep money and systems safe ended up with problems of their own. The strange part is how often the damage started somewhere nobody was looking.

And that's before getting to the long list of fresh bugs, shady services, and scams making the rounds. Quite a bit to sort through. Here's what made the list.

⚡ Threat of the Week

N. Korea Sets New Record with Binance $6.43B Crypto Theft— The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to a North Korean hacking group called TraderTraitor. The haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history. The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin. Of the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.

🔔 Top News

Volt Typhoon Uses Covert Silent Train Network in 0-Day Attacks— Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including to facilitate zero-day attacks targeting high-value systems. It's codenamed Silent Train because the threat actor uses it against select targets, cleans it up after each operation to minimize detection and attribution, and refreshes it continuously. Silent Train is a relay infrastructure formed of compromised devices to hide the origin of its attacks. The findings highlight evidence of efforts to pre-position access within what it described as "strategic communications, critical infrastructure and other ecosystems that become essential during geopolitical tensions or crises." Silent Train is built around "rapidly rotating chains of compromised SOHO, IoT and enterprise devices." The nature of these victims "indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region."
Polymarket Briefly Suspended Trading After Third-Party Hack— Prediction market platform Polymarket temporarily suspended trading after hackers compromised DebugBear, a third-party service, to distribute cryptocurrency-draining JavaScript that siphoned approximately $2.7 million in assets from 33 deposit wallets in under an hour. "Our DNS server records were compromised through our domain registrar. We are currently unable to receive emails sent to our domain," DebugBear said in an update shared on October 31, 2026. "Based on our initial investigation this attack targeted the website of a specific customer. We have not seen any indication of a compromise of our internal systems, though we will continue to investigate this." In June, Polymarket disclosed another third-party compromise that injected a malicious script into its frontend, leading to reported losses of around $3 million.
Shared ChatGPT Links Lead to Code Execution— Researchers from Parameter Labs disclosed a now-patched flaw in ChatGPT that turned an ordinary share link into an attacker-controlled JavaScript running inside the signed-in session of whoever opened it. "An attacker could create a malicious conversation, publish it using ChatGPT's normal sharing feature, and send the link to another user," Parameter Labs said. "When the victim opened the share, the payload executed as chatgpt.com with access to the victim's authenticated web session." Successful exploitation could allow an attacker to enumerate the victim's conversation list, retrieve content from a private conversation, and send data from that conversation to an external server.
Official Claude Code Extension on Cursor Marketplace with SSH Backdoor— Two versions of the Claude Code extension distributed through Cursor Marketplace were tampered with to install a persistent SSH backdoor on affected systems. Cursor said the incident impacted up to 5,000 users. In response to the incident, Cursor said it rotated its keys, rebuilt the marketplace, and worked with the cloud provider to take the server offline so that the reverse shell is no longer functional. It also stressed that no other extensions were maliciously modified as part of the attack. However, several questions surrounding the supply chain attack remain unanswered, including how the threat actor managed to publish a malicious extension under Anthropic's name on Cursor's marketplace and what level of access they were able to obtain.
FBI Seizes bulletproof hosting provider Virtualine— The U.S. Department of Justice (DoJ) announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. The DoJ said the service was being used to commit and facilitate prolific criminal activity, including "the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct. However, the long-term impact of such crackdowns has been questioned. According to Intel 471, disruptions have driven customers to newer services operated by former resellers, fragmenting the market rather than eliminating demand. The disclosure comes as the Australian Signals Directorate said it gained backend access to Amadey's operations and severed its access to 180,000 computers across the globe.
Keystone to Destroy 18,835 Hardware Wallets— Keystone confirmed a security incident involving its official website where an attacker exploited a vulnerability in a third-party data monitoring tool to escalate privileges and obtain some customer information and a key used to verify the authenticity of our devices. This included 25,964 records containing names, contact details, shipping addresses, and order information, along with 12,873 checkout records containing names, contact details, and shipping information submitted by users. Besides stopping the use of the old key, Keystone plans to destroy 18,835 devices in existing inventory that contain the old key. "Shipping of all unshipped orders from our official website has been suspended," it said. "Sales will switch to a preorder model until production of devices using the new key is complete, after which shipping will resume." In a related development, another hardware cryptocurrency wallet maker Trezor said it received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. "If you bought a Trezor from CryptoBilis from March 2026 onwards and are using it to store funds, please move your funds to a newly created wallet with a new seed as soon as possible," it said.
uCreator Android Spyware Can Clone WeChat Accounts— A commercial Android spyware offering called uCreator is designed to target ordinary users of mobile wallets and messaging applications across China and Southeast Asia, including GCash (Philippines), WeChat, WeCom, QQ, Telegram, WhatsApp, LINE, Zalo, KakaoTalk, Viber, and MoMo. It can also be used to clone WeChat accounts. Victims install repackaged copies of legitimate applications disturbed through sideloading or social engineering flows. The attack leverages a variation of on-device virtualization techniques observed in malware like GodFather to conduct fraud. "GodFather spins the banking app up inside a virtual container and drops a fake overlay on top to phish credentials: the victim is really typing into the attacker's screen," security researcher Ovi Liber said. "uCreator shares the substrate but it draws no overlay. This is a case really of overlay-the-app versus instrument-the-app, with the second being quieter and also not being confined to a login screen. As an operator, it scales to any app the vendor writes a module for."
Gheist Turns GitHub Actions into a Secret Extraction Service— An automated campaign dubbed Gheist has been observed planting a secret-dumping workflow named "sync-check" in every repository that stolen GitHub tokens can reach. "The workflow seeks to print the repository's secrets into its own workflow log," Wiz said. "Then, the tool downloads the log through the GitHub API and deletes the run seconds later." The Google-owned cloud security company said it recovered more than 13,500 planted branches from more than 850 compromised accounts. The campaign was first detected in mid-September 2026.

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-115889, CVE-2026-115893 (Wasmtime), CVE-2026-90975 (Fireblocks mpc-lib), CVE-2026-91141 (COVESA vsomeip), CVE-2026-88781, CVE-2026-75775, CVE-2026-75779, CVE-2026-93489, CVE-2026-17518, CVE-2026-75753, CVE-2026-102438, CVE-2026-14911, CVE-2026-16528, CVE-2026-19386, CVE-2026-19396, CVE-2026-93495, CVE-2026-14157, CVE-2026-13313 (ASUS), CVE-2026-114573, CVE-2026-9082, CVE-2026-118539 (Drupal), CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598 (EPICS Base), CVE-2026-97631 (TianoCore EDK II), CVE-2026-115881, CVE-2026-115884 (GoAhead), CVE-2026-110720 (HashiCorp consul-k8s), CVE-2026-90885, CVE-2026-85250, CVE-2026-88901, CVE-2026-88900, CVE-2026-78165, CVE-2026-85251 (Apache Camel), CVE-2026-115547 (Okta), CVE-2026-114349, CVE-2026-111551 (Apache Kafka), CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344, CVE-2026-106378 (Google Chrome), from CVE-2026-117860 through CVE-2026-117954, from CVE-2026-118005 through CVE-2026-118017 (Mozilla Firefox), CVE-2026-98432 (Linux kernel), CVE-2026-18672, CVE-2026-19219 (Telerik UI for ASP.NET AJAX), TRA-2020-14 (Kodi), CVE-2026-107239, CVE-2026-107238, CVE-2023-22793 (Veeam), CVE-2026-103401, CVE-2026-103402, CVE-2026-103403, CVE-2026-103404, CVE-2026-103405, CVE-2026-103406, CVE-2026-103407, CVE-2026-103408, CVE-2026-103409 (Juniper Networks Session Smart Router), CVE-2026-111585 (TeamViewer), CAN-2026-2035970 (Intelbras IP cameras), CVE-2026-103594, CVE-2026-112709, CVE-2026-112710, CVE-2026-93857, CVE-2026-103593, CVE-2026-93865, CVE-2026-93866 (WatchGuard Fireware OS), CVE-2026-101296, CVE-2026-101356, CVE-2026-103119 (Apache Tomcat), CVE-2026-112816 (Canonical LXD), CVE-2026-93680, CVE-2026-110186 (Langflow OSS), and a preauthenticated remote code execution vulnerability in TightVNC.

🎥 Cybersecurity Webinars

Learn How to Turn Identity Context Into Faster, Smarter SOC Response→ Your security tools can detect suspicious activity, but without identity context, critical threats may go unnoticed. As machine identities and AI agents expand the attack surface, SOC teams need deeper visibility to respond effectively. Join this expert-led webinar to discover how connecting identity intelligence with security operations can help uncover hidden risks, accelerate investigations, and contain threats faster.
From Zero-Days to Exploits in Minutes: Are You Ready for AI Threats? →AI-powered cyberattacks are accelerating, shrinking the time security teams have to detect, investigate, and respond. Are your defenses ready to keep up? Join this expert-led webinar to discover how to strengthen AI threat readiness, improve attack-surface visibility, and build faster, more resilient security operations before attackers gain the upper hand.

📰 Around the Cyber World

A massive search-hijacking campaign called Searchjacked involving 319 Chrome extensions with a combined 13.4 million reported installations hijacked users' searches through tracking servers, captured queries, and collected referral payments from Microsoft Bing and Yahoo. The findings from Socket expand on the April 2025 discovery of 57 Chrome extensions with six million users, adding 264 newly identified add-ons with another 8.7 million users. Although they are hosted on the Chrome Web Store, they are unlisted and don't appear in users' searches on the extension store. Instead, the extensions are promoted through sketchy advertisements shown as pop overs or pop unders on websites. Socket also discovered a cluster of malicious Firefox extensions that mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys. A third campaign, documented by Am I Being Pwned?, involves 60 Chrome extensions with 2.3 million installs across 4 publisher accounts. Called OffiDocs, the extensions masquerade as document programs and exfiltrate all URLs visited by users to be shared with business partners, and other third-parties, or redirect users to one of their pages on redcoolmedia.net or runapps.org
Microsoft revealed details of two human-operated intrusions in which threat actors used Microsoft Teams messages and calls to impersonate IT or help desk personnel and socially engineer users into granting interactive remote access, primarily through Quick Assist. "Once connected, the threat actors staged portable Python, Bun, or Java runtimes, performed host and network discovery, and assessed Active Directory Certificate Services (AD CS) for certificate-based authentication paths," Microsoft said. "This intrusion pattern is high impact because a user-approved remote session can become certificate-backed access to privileged identities and domain infrastructure."
Threat actors are increasingly turning tovulnerabilities as a means for breaking into corporate systems, as exfiltration and extortion-only attacks emerged as the fastest-growing category in the third quarter of 2026.
Check Point detailed three anti-detect browsers, Kameleo, AdsPower, and MultiLogin, that could enable a single operator to silently manage thousands of isolated accounts across multiple platforms, and evade detection systems that look for scams and coordinated inauthentic behavior. "Threat actors abuse these platforms, taking over accounts and using them for financial fraud, phishing and malware distribution," Check Point said. "These accounts can also be used to coordinate influence operations, which becomes an even greater concern ahead of elections. These tools already use AI integration, from built-in automation templates to offering a dedicated MCP server that pipes LLM-generated content directly into pre-warmed account profiles at machine speed. Running a large-scale social media operation now requires only a credit card instead of a technical team."
Russia and Ukraine both revealed their emergency alert systems were hit by cyber attacks. The attacks caused the two systems to send fake emergency alerts. Per BBC, Ukraine's air raid app sent false red-level air raid warnings nationwide. A few hours later, Russia said its alert app was also attacked, but said that it was only an "ancillary" service among sirens and other warnings. It’s not clear if the two incidents are connected.
A sophisticated Android malware campaign has been targeting the Indian banking sector since July 2025 using seven distinct trojan families that facilitate banking fraud through coordinated phishing, credential theft, and unauthorized cryptojacking. It is orchestrated by a financially motivated threat cluster codenamed CyberDakait that's operating in India since January 2025. The malware families are GhostBat, cyb3rx, godz, d-passive, d-shine, tenxen, and appkjl. Distributed via coordinated smishing and vishing campaigns, they are designed to harvest sensitive information, including bank mobile application credentials, credit card details, outstanding balances, through sophisticated overlay attacks. "The main goal of the campaign is the distribution of Android malware to conduct cryptojacking and elaborate banking fraud," Group-IB said. "The malicious applications are commonly hosted on GitHub repositories to maintain legitimacy and evade security controls, where the initial APK functions as a dropper that downloads and executes the main payload alongside a cryptocurrency mining module, enabling the threat actors to generate revenue through both direct financial theft and unauthorized cryptocurrency mining on infected devices." A total of at least 17,960 compromised devices have been identified, and about 7.6 million SMS messages were intercepted from victim devices.
A new phishing campaign has disguised credential theft as an invitation to a private AI event from Anthropic, and uses GoTo Webinar branding, a Zoom-style registration page, and convincing Google and Microsoft login pages to steal login credentials. "Risks to the organization from this campaign include threat actors compromising a sensitive account, accessing the account’s sensitive documents (e.g., proprietary marketing material), and using the compromised account as an initial vector to further infiltrate the organization," Cofense said.
A new campaign is using judicial-themed phishing emails targeting Colombian organizations to deliver XWorm via a multi-stage chain. The initial payloads resemble legitimate Colombian administrative or judicial correspondence, according to Arctic Wolf.
Multiple Russian-language traffer teams that have adapted affiliate-fraud models to capitalize on growing public interest in prediction markets such as PolyMarket and Kalshi. "The platforms offered by three such teams — AtlasCore, PolyFucked, and Magnetic Team — provide websites, administrative panels, cryptocurrency payment infrastructure, victim-management capabilities, technical support, and promotional guidance," Recorded Future said. "This model lowers barriers to entry for affiliates and enables campaigns to scale rapidly as new trends attract potential victims. The services combine convincing prediction-market interfaces with established fraud mechanisms designed to manipulate victims and prevent them from recovering deposited funds." Advertised compensation includes 70% to 80% of net profits for AtlasCore affiliates, a minimum 60% revenue share for PolyFucked affiliates, and a base 70% share of victim deposits for Magnetic Team affiliates.
Nozomi Networks detailed a new Go-based malware for Linux called Kairos that turns a compromised machine into a node in the operator's DDoS botnet. "On command, the bot opens hundreds to thousands of TCP connections to a target chosen by the operator and keeps them open for the requested duration, sending a single near-empty keepalive byte every few seconds," Nozomi Networks said. "Initial access came through Telnet, using the default credentials (user root, empty password). The operator then staged the payload with a short shell sequence that downloaded it over HTTP from the same server the bot later calls home."
A previously undocumented Microsoft device code phishing kit codenamed MadApe is using business-themed PDF lures, configurable redirects, and fake document-sharing pages to trick victims into completing Microsoft device code authentication. It was first observed by Group-IB on January 7, 2026.
Threat actors behind Aur0ra ransomware, aka Gold Ogre, are extensively using AI to develop tools and to orchestrate and execute ransomware operations, Sophos said. The AI-assisted post-exploitation framework is developed with Cursor AI assistance. "The threat actors used Cursor to escalate from credential access to domain administrator in preparation for data collection and ransomware deployment," Sophos said. "AI guardrails were bypassed by framing the intrusions as authorized red team activity or 'diagnostics testing.' Intrusions were orchestrated by Cursor's Composer agentic coding model as well as AI models provided by Anthropic, xAI, and Moonshot." Although the threat actors initially used Anthropic almost exclusively, they have since introduced other models.
Malicious model repositories on Hugging Face are being used to fuel a cryptomining and backdoor campaign. "The payloads were written for GPU hosts running self-hosted inference, especially Xinference and GPUStack, along with rented GPU machines, shared research notebooks, and CI jobs that pull small test models without anyone reading the code," Pluto Security said. Instead of using poisoned weights or pickle exploits, the campaign abuses a Hugging Face option, trustremotecode, that lets a model ship its own Python code. When this option is set to true, that code is automatically executed on a victim's machine as soon as the model loads.
Bitdefender and NETGEAR found that Smart TVs and connected plugs accounted for a large share of recorded security weaknesses. Televisions represented 22.7% of vulnerability observations, followed by smart plugs at 22.4%. "Before buying connected equipment, the support period deserves attention alongside the price and features," the 2026 IoT Security Landscape Report said. For equipment already in the home, knowing whether updates are still available is part of knowing whether it should stay connected.
A tech-support scam is directing victims to install the commercially available remote access application UltraViewer. Infoblox, which broke down details of the campaign, said it found links to a long-running QuickBooks phishing campaign. "That campaign uses over 350 QuickBooks-lookalike domains and directs victims to call scammers who attempt to steal QuickBooks credentials," Infoblox said. The scam has been found directing users to trojanized UltraViewer and UltraMailer, installers that lead to the deployment of DarkKometa and njRAT, respectively.

In an analysis of The Com ecosystem, Flare said the loose-knit collective comprises three distinct intrusion clusters, Scattered Spider, LAPSUS$, and ShinyHunters, while SP1D3R HUNTERS (aka Scattered LAPSUS$ Hunters) represents an amalgamation of all three. Security researcher Jon DiMaggio warned against attributing any activity post-2022 to LAPSUS, which ceased operating years ago. "LAPSUS$ operated at full capacity for roughly nine months, from its December 2021 attack against Brazil’s Ministry of Health through its concentrated campaign in early 2022, before a series of arrests in mid-to-late 2022 ended it as an organized entity," DiMaggio said. "Scattered Spider and LAPSUS$ overlapped by a few months at the start and by at least one individual across their lifespans, and they still ran different playbooks against different targets toward different ends."

Conclusion

That's about it for this week. Some attacks were carefully planned. Others worked because someone clicked the wrong thing, trusted the wrong tool, or left something exposed. Different methods, same result. And with so many systems connected to other systems, even a small mistake can travel further than expected.

The bigger concern is how normal some of these attacks have become. Nothing particularly clever is needed when the easy routes still work. Keep an eye on what has access, check what needs fixing, and don't assume familiar means safe. See you next week.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.