Threat Library

Mantax Otax is a newly identified Android malware strain that blends ransomware and spyware functionality, encrypting victim files while simultaneously exfiltrating sensitive personal data. The malware also spams and harasses victims, likely leveraging stolen contact lists or device permissions, indicating a hybrid extortion and intimidation model beyond typical file-encryption ransomware.

AVEVA Pipeline Integrity Monitor (PIMBoards) versions up to 2025_SP1_P1_build_7.1.9580.8513 contain four vulnerabilities including a hard-coded cryptographic key, weak password hashing, missing authorization, and a stored/reflected XSS flaw. Exploitation could allow attackers with file access to decrypt sensitive project data, brute-force user credentials to gain administrative access, perform unauthenticated information disclosure, or execute arbitrary JavaScript in a victim's browser session via social engineering. No public exploitation has been reported, but the highest-severity issue (CVE-2026-81821/81822) rates CVSS 8.4.

Orthanc DICOM Server versions prior to 1.13.0 contain an integer overflow vulnerability in pitch/buffer-size computation that leads to a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can exploit this to crash the Orthanc process, causing a denial-of-service condition affecting medical imaging availability.

CISA has added two actively exploited MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities Catalog: a missing authentication flaw for a critical function and a command argument injection issue. Federal agencies must remediate under BOD 26-04, and CISA urges all organizations to prioritize patching given confirmed in-the-wild exploitation.

CVE-2026-67277 is a missing authentication vulnerability in MikroTik RouterOS's btest (bandwidth test) service, allowing unauthenticated attackers to trigger kernel memory disclosure and denial of service. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a short remediation window (added 2026-09-10, due 2026-09-13).

CVE-2026-86060 is an actively exploited vulnerability in MikroTik RouterOS involving improper neutralization of argument delimiters in command processing, allowing attackers to manipulate the trusted RouterOS policy mask and escalate privileges. CISA has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog with a short remediation window, indicating confirmed in-the-wild exploitation.

Threat actors are using commodity infostealer malware (Lumma Stealer, Vidar, and similar families) to harvest session tokens, credentials, and API keys from systems accessing AI platforms like Google and Anthropic. These stolen, replayable tokens allow attackers to bypass MFA entirely and gain persistent illicit access to AI accounts and their connected tooling without needing to re-authenticate.

Healthcare company AdaptHealth confirmed that a July cyberattack attributed to the ShinyHunters threat group exposed personal data of 4.1 million individuals. The incident highlights ongoing targeting of healthcare organizations for large-scale data theft and extortion rather than encryption-based ransomware.

Dell SCG 5.0 Appliance and Application versions prior to 5.36.00.16 and 5.36.00.00 respectively contain an improper certificate validation flaw that allows unauthenticated remote attackers to gain unauthorized access. This vulnerability likely enables man-in-the-middle attacks or certificate spoofing, undermining trust boundaries within the affected infrastructure.

CVE-2026-80131 is a path traversal vulnerability in Dell SCG 5.0 Appliance and Application prior to versions 5.36.00.16 and 5.36.00.00 respectively. An unauthenticated remote attacker can exploit this flaw to escape restricted directories and achieve remote code execution on the affected system.

Microsoft released its largest-ever monthly patch batch, addressing approximately 974 security vulnerabilities across Windows and other Microsoft products. The company attributes part of the surge in discovered flaws to AI-assisted vulnerability research, while security experts caution that the scale of the release will strain organizations' ability to test and deploy fixes in a timely manner. Delayed patching windows increase exposure time to any of the disclosed flaws being weaponized.

An attacker exploited a bug in the Elements software underlying the Liquid Network, a Bitcoin sidechain, to steal nearly 4,000 BTC. The following day, 3,400 BTC was returned, leaving approximately 598.5 BTC ($47M reported total held) unaccounted for, with the network still paused and L-BTC redemptions halted.

CrowdStrike has identified a new financially motivated threat actor, dubbed Slim Spider, targeting Brazilian financial institutions since at least March 2026. The group demonstrates deep knowledge of Brazilian financial infrastructure, including instant payment systems, and has been observed stealing crypto custody secrets from a targeted institution.

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog affecting Adobe Commerce/Magento, Microsoft Windows, and N-able N-central, all confirmed under active exploitation. FCEB agencies must remediate per BOD 26-04, and CISA urges all organizations to prioritize patching given the demonstrated real-world attack activity.

CVE-2026-85880 is a heap-based buffer overflow in Microsoft Windows Advanced Local Procedure Call (ALPC) that enables local privilege escalation. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation in the wild, with a remediation deadline of September 22, 2026.

CVE-2026-81963 is a local privilege escalation vulnerability in the Microsoft Windows Update Stack caused by improper handling of file system links, allowing a local attacker to gain SYSTEM-level privileges. The flaw has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a remediation deadline of September 22, 2026.

This weekly recap covers multiple active threats including a Chrome 0-day, router hijacking campaigns, and a notable supply chain attack against the Coder platform that resulted in credential theft. Attackers also demonstrated a novel phishing technique using text-rendered QR codes to bypass email image-blocking protections, and abused a network management protocol for malicious purposes.

A threat cluster is targeting executives (directors, VPs, senior staff) at organizations using Microsoft 365 and other SaaS platforms through IT help desk vishing calls, adversary-in-the-middle (AitM) session token theft, and sign-ins routed through residential proxy networks to evade geolocation-based detection. Stolen credentials and session tokens are used for data exfiltration followed by extortion demands. The campaign leverages human trust in IT support workflows rather than software exploits, making it effective against organizations with strong technical controls but weaker identity-verification processes.

PEEP is a post-compromise toolkit that disguises itself as a bookmarks extension for Chrome and Edge, requiring prior administrative or code execution access to deploy. It forges Chromium's Secure Preferences file to bypass Web Store validation and user consent prompts, effectively turning the browser into a persistent backdoor capable of executing host commands.

Online mathematics learning platform Mathspace disclosed a data breach affecting over 1 million students, staff, and parents after attackers compromised its Metabase internal reporting system. The breach exposed personal data likely including names, emails, and academic records tied to a widely used education platform. No technical details on the intrusion vector into Metabase have been disclosed.