Threat Library

A large-scale malvertising campaign is directing users to fake Solana, Luno, and TradingView websites that use malicious JavaScript to assemble malware directly in browser memory, evading disk-based detection. The campaign targets users seeking cryptocurrency and trading tools, likely aiming to steal credentials, wallet keys, or session tokens.

Threat actors are posting fake troubleshooting guides on Steam discussion forums that use the ClickFix social engineering technique to trick gamers into executing malicious commands via the Windows Run dialog. These commands ultimately deploy XMRig cryptominers on victim machines, hijacking system resources for cryptocurrency mining.

Johnson Controls C-CURE 9000 and victor application server products contain three vulnerabilities, including a critical SSRF flaw (CVSS 9.6) in victor Web and a .NET deserialization-related SSRF issue enabling unauthenticated remote code execution on the application server. Successful exploitation could allow attackers with adjacent network access to compromise physical access control and video security systems, including connected client workstations used by security personnel.

MZ Automation's lib60870 library, versions 2.4.0 and earlier, contains an out-of-bounds read vulnerability (CVE-2026-16002) in its IEC 60870-5-104 protocol parsing code. Remote, unauthenticated attackers can crash the parsing process, causing a denial of service in energy, water/wastewater, and chemical sector control systems that rely on this library for SCADA/ICS communications.

This item is a routine developer tooling announcement about Ruff v0.16.0 expanding its default lint rule set, not a security incident. The author describes using coding agents (Codex, Claude Code) to help fix newly surfaced lint issues in his own open-source projects. There is no evidence of prompt injection, tool poisoning, malicious packages, or any agent-to-agent attack.

SiYuan before v3.7.2 exposes 31 MCP tools via the /mcp kernel endpoint with only a superficial auth check that fails to enforce admin or role restrictions. When the Publish server runs in anonymous mode, a remote unauthenticated attacker can reach this endpoint, steal plaintext secrets from the config file, and write a malicious plugin that achieves code execution on the victim's desktop app at next launch. This is a critical, fully remotely exploitable vulnerability enabling complete administrator takeover.

Security researchers at Zenity Labs disclosed a critical vulnerability, dubbed AgentForger, in OpenAI's ChatGPT Workspace Agents that could allow an attacker to use a single phishing link to covertly create, authorize, and deploy a rogue autonomous AI agent inside a victim organization. OpenAI patched the issue as of June 8, but the flaw highlights significant risks in agent authorization and deployment workflows within enterprise AI platforms.

Security researchers H0j3n and Aniq Fakhrul disclosed Certighost, an exploit chain allowing low-privileged Active Directory users to request a certificate impersonating a Domain Controller. The resulting Kerberos credential inherits directory replication rights, enabling attackers to perform DCSync and extract the krbtgt secret, effectively achieving full domain compromise.

BlueNoroff, a North Korean state-sponsored threat actor, is operating an active phishing kit that impersonates Zoom and Microsoft Teams via typosquatted domains and ClickFix-style social engineering lures. The campaign profiles victims' cryptocurrency wallets before delivering malware, combining compromised industry contacts and trust abuse to maximize infection success.

Threat actors are compromising DNS settings on hotel and conference center Wi-Fi routers/gateways to silently redirect guests to convincing fake Microsoft 365 login pages. Victims who enter credentials on these spoofed portals have their Microsoft 365 accounts stolen, potentially exposing corporate email, files, and connected services. The campaign leverages trust in hotel network infrastructure and captive portal flows to bypass user suspicion.

A threat actor reportedly leveraged the open-source Hermes AI agent running in an unattended 'YOLO' (no human confirmation) mode to automate post-exploitation actions during a breach of Thailand's Ministry of Finance. This represents real-world weaponization of agentic AI frameworks to accelerate attacker operations rather than a novel vulnerability in the agent itself, but it highlights the risk of autonomous, unsupervised agents executing tools with elevated privileges against production/government systems.

OnTrac, a parcel delivery company, disclosed that attackers breached its corporate network and potentially accessed customer personal information. Details on the intrusion vector, threat actor, and full scope of compromised data remain limited based on available reporting.

MZ Automation's libIEC61850 library, widely used for IEC 61850 substation automation and protection communications, contains four vulnerabilities including stack- and heap-based buffer overflows and NULL pointer dereferences. An unauthenticated, network-adjacent attacker could exploit these flaws to crash critical protection and control services or achieve remote code execution, directly threatening energy, manufacturing, and transportation ICS environments.

Johnson Controls XAAP Android application versions prior to 1.53 store application data locally in cleartext, allowing an attacker with physical device access and a separate compromise vector to read sensitive data in plaintext. Exploitation requires local device access and cannot be performed remotely over a network.

9router versions up to 0.4.59 contain a chained vulnerability allowing a remote, unauthenticated attacker to gain full control of the host system. By logging in with a hardcoded default password, spoofing the Host header to bypass local-only network restrictions, and registering a malicious MCP plugin, an attacker can achieve arbitrary code execution. This is fixed in version 0.4.60 and should be patched immediately given the ease of exploitation and severity.

h2oGPT through version 0.2.1 contains an unauthenticated path traversal vulnerability in its OpenAI-compatible files API that allows attackers to read, write, and delete arbitrary files on the host. Because the default API key is empty and the bearer token is used unsanitized as a path component, attackers can bypass authentication entirely and achieve remote code execution by overwriting startup hooks or application-loaded files.

A vulnerability in NLnet Labs Unbound (versions 1.4.22 through 1.25.1) weakens DNS transaction security when SO_REUSEPORT load balancing is enabled, which is the default configuration. Attackers can infer the mapping between client source ports and internal worker threads, effectively reducing the entropy of outgoing query source ports and making DNS cache poisoning attacks significantly more feasible.

Jan's local API server (through v0.8.4) mishandles trusted host configuration, replacing user-defined allowed origins with a wildcard that reflects any origin while still allowing credentials. This lets a network-adjacent or DNS-rebinding attacker reach the unauthenticated OpenAI-compatible API to run inference, enumerate models, invoke MCP tools, and read cross-origin responses. Fixed in commit 3e1c1e7; upgrade is the primary remediation.

Suna versions before 0.9.102 fail to enforce ownership checks on the message queue API, letting any authenticated user read, delete, or inject messages into other users' prompt queues. This allows an attacker to inject arbitrary prompts that are forwarded by the background drainer to a victim's running AI agent, executed with the victim's own credentials and permissions.

BlenderMCP's download_polyhaven_asset tool fails to sanitize file paths derived from external API response keys, allowing an attacker who controls or intercepts that response to write files anywhere on disk, including dotfiles like .bashrc. This can be triggered either via a man-in-the-middle attack on the PolyHaven API or via a prompt injection that convinces the agent to fetch a malicious asset, ultimately leading to persistent code execution on the host running the MCP server.