Threat Library

The Silver Fox threat actor is distributing the ValleyRAT backdoor concealed within a digitally signed Chinese desktop-wallpaper application called QN Wallpaper. By running under a trusted, signed process that users commonly whitelist in antivirus exclusions, the malware evades detection and establishes persistent remote access on infected hosts.

North Korean threat actors are expanding their long-running fraudulent IT worker employment scheme into new sectors, including healthcare and sales/marketing roles. This insider threat operation uses stolen or fabricated identities to secure remote employment, generating revenue for the DPRK regime while creating potential access and data exposure risks for employers.

Microsoft Exchange Online experienced a widespread service disruption causing authentication failures, email delays, and delivery failures for customers. This is an availability incident rather than a malicious attack, but it can disrupt business email operations and any downstream services relying on Exchange authentication or mail flow.

Microsoft has identified a new ClickFix variant called TerminalFix that uses fake Cloudflare CAPTCHA verification prompts on compromised websites to trick users into copy-pasting and executing malicious PowerShell commands in Windows Terminal. The attack establishes reverse tunnels for persistent remote access, enabling attackers to bypass network perimeter defenses.

An attacker exploited a price-manipulation vulnerability in the Tectonic cryptocurrency lending platform on the Cronos blockchain, enabling fraudulent borrowing of approximately $74 million. The exploit forced validators to halt and restart the Cronos network to contain the incident, disrupting trading activity network-wide.

CISA has added two actively exploited PaperCut NG/MF vulnerabilities to its Known Exploited Vulnerabilities catalog, one involving missing authentication for a critical function and another involving unsafe reflection. These flaws pose significant risk to organizations running PaperCut print management software, with federal agencies required to remediate under BOD 26-04.

A critical privilege escalation vulnerability in hulumi (versions prior to v1.3.2) allows attackers with access to a documented IAM principal to abuse an overly permissive weekly integration policy. This enables creation of persistent, higher-privilege af-e2e-* roles in sandbox accounts, potentially leading to full account compromise.

A critical flaw in @hulumi/policies before version 1.3.2 allows attackers to craft AWS IAM condition operators (ForAnyValue:StringLike) that evade security guardrails designed to detect overly permissive GitHub Actions OIDC trust policies. This enables attackers to establish stealthy, wildcard-based trust relationships between arbitrary GitHub repositories/workflows and AWS IAM roles, potentially leading to unauthorized cross-account access.

A critical stack-based buffer overflow vulnerability affects the TOTOLINK NR1800X router firmware, exploitable remotely via the setUploadSetting function without authentication. A public exploit exists, making this an immediate risk for internet-exposed devices.

A critical remote code execution vulnerability exists in D-Link DIR-825M 1.1.8 routers, caused by a stack-based buffer overflow in the LTE Module Firmware Upgrade handler (formLtefotaUpgradeFibocom). An attacker can remotely manipulate the fota_url parameter to trigger the overflow, with a public exploit already available, making this an immediate risk to exposed devices.

A critical, publicly disclosed vulnerability affects the Tenda HG10 router (firmware 300001138) via its Boa Web Server admin interface. The flaw allows remote, unauthenticated attackers to trigger a buffer overflow through the destNet parameter in the formIPv6Routing function, potentially leading to full device compromise. With a CVSS score of 10.0 and public exploit code available, active exploitation is highly likely.

PaperCut NG/MF is affected by an unsafe reflection vulnerability that allows attackers to manipulate system configuration parameters and execute arbitrary Java bytecode under the security context of the PaperCut server process. This flaw has been added to CISA's Known Exploited Vulnerabilities catalog and can be chained with CVE-2026-81578 to achieve full remote code execution, mirroring the exploitation pattern seen in prior PaperCut attacks used for ransomware and network intrusion.

Security researcher Olivier Laflamme disclosed two independent exploit chains achieving root remote code execution on the Unitree G1 EDU humanoid robot, tracked as CVE-2026-76639 and CVE-2026-76640. One chain requires only Bluetooth Low Energy proximity to compromise the robot's Locomotion PC, while the other exploits a network-adjacent path through the chat_go and bashrunner components, posing serious risks for research, industrial, and educational deployments of the robot.

Researchers identified 19 malicious Chrome and Edge extensions published over the past six months that steal cryptocurrency wallet secrets and drain funds. The extensions share common code and tradecraft, suggesting a coordinated campaign distributed through official browser extension stores. This poses a broad supply-chain risk to any user or organization installing these extensions.

Microsoft disclosed a new ClickFix-style social engineering campaign, dubbed TerminalFix, that uses fraudulent Cloudflare CAPTCHA pages to trick users into executing malicious commands in Windows Terminal or PowerShell instead of the traditional Run dialog. Successful execution deploys a reverse-tunnel backdoor granting attackers persistent remote access to the compromised host. This shift to terminal-based execution increases the likelihood that victims run more complex, capability-rich payloads compared to earlier ClickFix variants.

Multiple malicious extensions distributed through the Chrome Web Store and Microsoft Edge Add-ons store delivered a modular malware framework capable of stealing cryptocurrency, browsing history, and other sensitive data. The campaign also deployed ClickFix-style social engineering lures to trick users into executing further malicious commands, expanding the attack's reach beyond simple browser compromise.

Anthropic has warned that infostealer malware infecting user PCs is exfiltrating active Claude session tokens, allowing attackers to hijack accounts and consume victims' paid usage. This represents a growing trend of infostealers specifically targeting AI service credentials and session cookies rather than just traditional banking or email accounts.

The threat actor group FulcrumSec claims to have stolen 86 GB of data from Manchester Airports Group (MAG), including detailed customer, booking, and travel records. BleepingComputer validated at least one traveller's record from leaked samples, suggesting the breach scope exceeds what MAG initially disclosed.

A critical remotely exploitable memory corruption vulnerability exists in TOTOLINK A720R routers running firmware 4.1.5cu.630_B20250509, affecting the setMacFilterRules function within cstecgi.cgi. The flaw is triggered via manipulation of the 'desc' argument in MAC filtering rules and has been publicly disclosed with exploit details available, increasing the likelihood of active exploitation.

The MyHome Core plugin for WordPress (versions up to 4.4.5) contains an authentication bypass vulnerability that allows unauthenticated attackers to hijack unconfirmed user accounts, including administrator accounts, under specific configuration conditions. Successful exploitation grants full administrative access to the WordPress site, enabling complete site takeover.