Threat Library

A coordinated campaign involving 737 free VPN and proxy Chrome extensions, published across at least 40 developer accounts, has been found intercepting browser traffic and routing it through attacker-controlled proxy infrastructure. The campaign primarily targets Russian-speaking users attempting to bypass service blocks, with 274 extensions identified as impersonating 66 legitimate brands, and has amassed over 75,000 installs.

The North Korea-linked Lazarus Group exploited a zero-day vulnerability in Microsoft Windows to gain SYSTEM-level privileges and deploy a previously unseen backdoor. The campaign, part of the long-running Operation Dream Job cyber espionage effort, targeted defense and aerospace organizations in France, Germany, Brazil, and India. The vulnerability has since been patched by Microsoft.

Attackers are actively exploiting a critical vulnerability in Adobe Commerce and Magento platforms that allows hijacking of customer accounts. The flaw is being targeted in the wild shortly after disclosure, putting online retailers and their customer data at risk of unauthorized access and fraud.

A newly identified Android malware campaign pairs a novel NFC relay tool called WindRelay with the established SpyNote RAT to capture and relay victims' live credit card data to attackers in real time. The combo also facilitates taking out fraudulent loans using stolen victim information, indicating a financially motivated criminal operation targeting mobile banking users.

A campaign dubbed 'City-Forum' is using custom tooling to systematically harvest data exposed to anonymous/unauthenticated users through misconfigured Salesforce Experience Cloud sites and ServiceNow customer portals. The attackers exploit overly permissive guest-user access controls rather than a software vulnerability, allowing bulk extraction of sensitive records without authentication.

A critical flaw (CVE-2026-73268, CVSS 9.9) in the cluster-curator-controller component of multicluster engine (MCE) allows tenants with limited ClusterCurator permissions to inject arbitrary Job specifications that execute with the controller's elevated privileges. Successful exploitation enables arbitrary code execution, privilege escalation, and access to cluster-wide secrets, posing severe risk to multi-tenant Kubernetes/OpenShift environments.

A critical flaw in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM) allows a low-privileged namespace-admin tenant to abuse a highly privileged ServiceAccount via Subscription Custom Resources. This confused-deputy attack enables deployment of arbitrary cluster-scoped resources, leading to full privilege escalation and potential arbitrary code execution across the entire managed cluster.

A critical buffer overflow vulnerability exists in the PROFINET service of an industrial device in its default configuration, allowing unauthenticated remote attackers to crash the device or execute arbitrary code. With a CVSS score of 9.8, this flaw poses severe risk to industrial control system (ICS) and operational technology (OT) environments where the affected device is deployed.

A critical Incorrect Authorization vulnerability in Adobe Campaign Classic (ACC) allows an unauthenticated attacker to execute arbitrary code in the context of the current user without any user interaction required. The maximum CVSS score of 10.0 and changed scope indicate the flaw can escalate impact beyond the vulnerable component itself, making this a top-priority patching target for any organization running ACC.

Microsoft's August 2026 Patch Tuesday addresses nearly 398 vulnerabilities across Windows and supported software, including one flaw already under active exploitation and two others that were publicly disclosed prior to patching. Organizations should prioritize patching the actively exploited vulnerability to reduce risk of compromise.

A flaw in Zoom's screen annotation feature could have allowed any meeting participant to hijack the client of another attendee, including the presenter, without any user interaction. The vulnerability required no click, download, or visible prompt, making it a fully zero-click, in-meeting attack vector. This poses significant risk to organizations relying on Zoom for internal and external communications, including those coordinating distributed teams or automated workflows via meeting integrations.

Kimwolf v7, an evolution of the AISURU Android/IoT botnet, was discovered by Palo Alto Networks Unit 42 in February 2026 with enhanced HTTP/2-based DDoS capabilities designed to blend malicious traffic with legitimate browsing patterns. The improvements increase operational resilience and evasion, making detection and mitigation more difficult for defenders relying on traditional traffic-signature analysis.

The Russian state-linked threat group Sandworm is targeting system administrators and IT professionals with fake job offers designed to lure victims into installing a trojanized WireGuard VPN client. The campaign, active since at least May 2026, aims to compromise privileged accounts and gain persistent access to enterprise networks through social engineering and malicious software.

DeadLock is a ransomware operation that leverages blockchain-backed decentralized infrastructure to host its victim communication portals and data-leak sites, making takedown efforts by law enforcement and security researchers significantly more difficult. This resilience model represents an evolving trend among ransomware groups seeking to evade traditional infrastructure disruption tactics.

Google announced that Chrome's anti-abuse systems are now blocking over 7 billion unwanted push notifications per day on Android as of Q1 2026. This is a defensive product improvement rather than an active threat, reflecting Google's ongoing efforts to curb notification spam and deceptive web push abuse.

CISA disclosed eight vulnerabilities in the Mira Hormone Monitor firmware and companion Mira Android App, including missing BLE authentication, hard-coded credentials, and a broken login endpoint that returns valid session tokens for any password. Successful exploitation could allow attackers to hijack user accounts, exfiltrate or forge sensitive reproductive health data, track users physically via BLE, and cause denial-of-service on the device.

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog: a heap inspection flaw in Cisco Secure Firewall ASA/FTD, a use-after-free in the Windows Ancillary Function Driver for WinSock, and a SQL injection vulnerability in Metabase. Federal agencies are required under BOD 26-04 to remediate these on a prioritized timeline, and all organizations are strongly encouraged to patch given confirmed in-the-wild exploitation.

The Pulsetto Vagus Nerve Stimulator firmware accepts undisclosed, unauthenticated Bluetooth Low Energy commands that are not issued by the official companion app but are still processed by the device. Successful exploitation could allow a nearby attacker to disable electrical safety mechanisms or alter stimulation output settings, posing a physical safety risk to users. The vendor has not responded to CISA's coordination attempts, and no patch is currently available.

A critical Incorrect Authorization vulnerability in Adobe Campaign Classic (ACC) allows attackers to achieve arbitrary code execution in the context of the current user without any user interaction. With a CVSS score of 10.0 and a changed scope, successful exploitation could lead to full compromise of the marketing automation platform and downstream systems it integrates with.

MaxKey SSO contains a hard-coded JWT signing secret that allows unauthenticated attackers to forge valid admin-level JWT tokens and bypass authentication entirely via the password-skipped login endpoint. This grants full access to SSO application configuration and downstream application secrets, effectively compromising every service federated through the affected MaxKey instance.