ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More

Active ransomware exploitation

Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect and Prisma Access. The vulnerability, disclosed in May 2026, has since come under active exploitation. “Because this access originates through an organization’s own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft, or ransomware deployment is underway,” ReliaQuest said. “Organizations should immediately upgrade affected deployments, disable authentication override cookies where they are not required, terminate all active GlobalProtect sessions after patching, and investigate unexpected connections, including sessions using hostnames such as ‘kali.’ Patching alone may not remove access established before remediation.”

Hybrid warfare escalates across Europe

Russia is assessed to have escalated its use of hybrid, asymmetric warfare across Europe following its full-scale invasion of Ukraine in February 2022. “They do not involve troops moving across a country’s border or a state’s military dropping bombs on an adversary’s capital city,” Recorded Future said. “Instead, they are a complex kit of psychological, cyber, and physical tactics meant to achieve several key aims: (1) Test the enemy’s defensive capabilities, as Russia evaluates whether to escalate aggression into a formal, kinetic conflict, (2) Degrade the enemy’s critical infrastructure, and (3) Sow an environment of fear in the enemy’s government and population to degrade the enemy’s ability to respond.”

DNS-powered wallet theft

Infoblox has analyzed a cryptocurrency wallet-drainer kit, self-branded as Noir, that makes use of DNS TXT records to locate its hosted pool, which currently runs on Cloudflare Pages. It’s delivered by means of a loader that queries the TXT record through public DoH services to learn which backend pool is active. “The drainer does not need a seed phrase, password, or private key,” Infoblox said. “It tailors content to the user after receiving initial read permissions, developing a plan for the specific wallet. Then it obtains spending permissions that can look less alarming than a direct transfer and performs the theft from attacker-controlled infrastructure.” It’s suspected that the malware was created and maintained with AI assistance.

Discord-based remote access threat

A Rust-based remote access trojan dubbed CikaBika Bot has been observed being delivered via a document-themed lure containing a malicious LNK file and a PDF with an embedded payload. “The malware uses a Nim loader, PowerShell UAC bypass, and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity,” Darktrace said. The malware also supports screenshot capture and file transfers.

RAT combines theft and intimidation

A Windows remote access trojan (RAT) called KGB RAT is being marketed on underground forums since late 2025 as being fully undetectable. It features a built-in crypter, HVNC, credential theft, ransomware, and an unusual set of psychological harassment capabilities, per Group-IB. “KGB RAT is, in practice, a full-featured malware package that gives attackers silent and persistent control over infected Windows machines,” it said. “What sets it apart from comparable RAT families is not only its technical breadth — combining credential theft, keylogging, hidden desktop takeover, and ransomware in a single builder — but also a dedicated set of psychological harassment features, including screamer functions, jump scares, and forced blue screens of death. These ‘fun settings,’ as the developers themselves describe them, signal a threat actor profile comfortable weaponizing victim anxiety alongside data theft.” A public disclosure referencing a KGB RAT server at version 0.1 dates to late January 2022, indicating the developer had been building and testing the malware for years before bringing it to market.

Stealthy live-screen surveillance

A multi-stage infection chain on Windows has been observed deriving a previously undocumented .NET RAT with live screen surveillance capability. It’s been codenamed BotHelper RAT. “The first stage is a native x64 stager that fingerprints the host computer name, logged-on user, processor configuration, and installed memory, then connects to easyllms.xyz over HTTPS and retrieves a file named payload.bin from a path guarded by a long hexadecimal identifier, disabling TLS certificate validation beforehand,” Point Wild said. “The second stage is BotHelper RAT. It copies itself to a hidden location, registers a scheduled task to relaunch every 30 minutes, patches the Antimalware Scan Interface, and registers with the same host that delivered it before polling a set of PHP endpoints for tasking.”

New Android anti-scam defenses

Google said it’s rolling out multi-layered protections across Google Messages and third-party messaging apps to protect Android users against mobile scams. This includes enhanced Scam Detection with Private AI Compute, link safety checks with Gemini Nano, and redesigned warnings before tapping unfamiliar links. Google also said it’s bringing Scam Detection in chat notifications to warn users about suspicious messages directly from their notification shade to other Android devices in partnership with device makers. Other security improvements include automatic screen-share privacy to hide sensitive information in native apps, Chrome, and Android WebView, blocking apps from quietly enabling call forwarding in the background, and real-time verification for bank calls in collaboration with Banco do Brasil, Itaú Unibanco, and other leading banks. “Android checks incoming calls in real time to verify whether the bank actually initiated the call,” Google said. “If an incoming caller claiming to represent a bank fails this verification check, Android hangs up the call and immediately alerts you.” Since launching this feature in June 2026, Android has blocked more than 3 million spoofed calls from Banco do Brasil and Itaú Unibanco alone.

AI model theft defenses strengthened

Anthropic has disclosed that new measures like preserved thinking, two-stage classifiers, and charging for requests that are blocked by our safeguards before Claude responds in its Fable 5.1 and Opus 5.5 models have reduced data harvesting through distillation attacks by about 90% to 99%.

Enterprise browser security controls

Mozilla has launched Firefox Enterprise, a browser iteration “built for organizations with strict security, governance, and compliance requirements.” Mozilla added, “IT and security teams get more control over their data, IT infrastructure and browser environment — helping strengthen technological independence and operational resilience.”

Self-healing WordPress backdoor

Wordfence has detailed an unusual malware that’s installed as a must-use WordPress plugin and makes use of “several self-healing mechanisms in place in order to survive removal. It also makes use of EtherHiding, a technique that hides the location of the attacker’s servers behind a smart contract on the Ethereum blockchain, making the command channel resilient to takedown.” The malware is capable of establishing administrator access, hiding the rogue administrator account, harvesting administrator passwords, remote site modification, data exfiltration, and spreading to other WordPress installations on the file system.

Stolen credentials expose GitHub data

Meta said it’s notifying about 1,500 people, most of them its own employees in the U.S., after unknown threat actors broke into some of the company’s GitHub repositories. The intrusion, detected a few weeks ago, involved the use of an employee’s stolen credentials. The access has since been shut down, according to SecurityWeek.

XWorm expands surveillance capabilities

The malware known as XWorm has transitioned from an infostealer to a full-blown surveillance platform. The malware’s plugin count has expanded from 35 to 46. The latest versions detected since July 2025 are V6.4, V6.5 “XWorm Reborn,” V7.2, and V7.4. “The Maps plugin provides victims’ GPS location without triggering a user prompt,” Netskope said. “The Microphone plugin streams live audio from the victim’s device. HBrowser gives operators interactive control of authenticated browser sessions without touching credentials, bypassing MFA entirely. Webcam capture is also available on demand.”

Higher rewards for memory-safety bugs

Google has announced that it’s raising bug bounty rewards for some Chrome vulnerabilities, with a focus on memory safety issues. While the company lowered standard payout amounts for some vulnerabilities in April, such as a base reward of $500 for memory safety issues, it has now quadrupled base rates for memory safety flaws to $2,000. Vulnerabilities in Chrome’s browser, GPU, and network processes can now earn researchers up to $20,000.

Post-quantum readiness warning

Microsoft is urging organizations to prepare their certificate systems for post-quantum authentication, stating that public key infrastructure (PKI), hardware security modules (HSMs), and security appliances need testing before deployment. “Organizations should begin now by inventorying certificate dependencies, assessing vendor roadmaps, identifying long-lived infrastructure, and creating non-production test environments,” Microsoft said. “Early testing can surface compatibility and process gaps before post-quantum authentication is required at scale.”

AI tool credentials at risk

A new malware-as-a-service (MaaS) infostealer written in Rust comes with its own loader and a built-in cryptocurrency clipper. “Warden Stealer is one of the first infostealers targeting configuration files and local data belonging to AI assistants and agentic coding tools,” Gen Digital said. “Its builds are heavily obfuscated, morphed, and regularly updated to evade detection.”

Advanced browser data theft

Newer versions of CastleStealer can “bypass app-bound encryption in Chromium-based browsers, execute commands remotely, and exfiltrate stolen information in small encrypted transmissions rather than a single large archive,” according to Flashpoint. The C#-based stealer was first discovered in April 2026.

AI developer credentials targeted

The infostealer known as Aoki (aka Aokigahara) is targeting credential and session files used by AI coding assistants, including Claude, OpenAI’s Codex, Cursor, Codeium, and Gemini. The stealer was first seen earlier this year. “API keys and Open Authorization (OAuth) or session tokens allow malicious activity to be carried out under a legitimate developer’s identity and API quota,” the Symantec Threat Hunter team said. “They can also expose connected repositories, cloud services and CI/CD pipelines linked to that account, and may bypass safeguards that assume requests originate from a trusted user.” In a report published last month, Google-owned Wiz said AI service provider API keys are a hot commodity. “These AI credentials are highly lucrative; allowing attackers to freely run their own workloads or resell the access as part of the illicit LLM resale market,” it said. “In addition, these keys can potentially grant access to historical chat logs that may contain sensitive corporate data, but we’re not aware of public occurrences of this scenario.”

Customizable MaaS infostealer

K7 Labs has detailed a Python-based builder that is sold under a MaaS model and is used to embed an infostealer payload. “Rather than operating as a standalone stealer script, the builder follows a MaaS-style model,” it said. “It allows operators to generate customized Windows executables using Nuitka or PyInstaller, with webhook configuration integrated into the build process.” The stealer capabilities include anti-analysis techniques, persistence, credential harvesting, and data exfiltration.

Cloud credential theft risk

An SSRF vulnerability (GHSA-2phj-cp9f-qq6w, CVSS score: 8.5) in Harbor, the CNCF open-source container registry, can be abused by a registered user to steal cloud credentials. “Any registered user who can create a project can point a webhook at the cloud metadata endpoint and walk away with the server’s IAM credentials,” OX Security said.

Unauthenticated RCE chain

A set of high-impact vulnerabilities in Adobe Experience Manager (AEM) can be abused to achieve unauthenticated remote code execution (RCE). The chain combines four flaws: Unauthenticated DAM bulk import, stored cross-site scripting (XSS), unsafe XML parsing, and Groovy execution via /bin/asynccommand. The flaws affect only the cloud version of AEM and have been patched.

Critical unauthenticated RCE

Samsung has patched a critical security flaw (CVE-2026-110392, CVSS score: 9.8) in QA-Board that allows unauthenticated RCE. Samsung’s QA-Board is an experiment-tracking tool that’s used to organize, visualize, compare, and share research runs, specifically for algorithm and performance tuning. The problem stems from a case of improper neutralization of user-controlled data that could result in shell command injection. The vulnerability was flagged by Claude Opus 5.5.

Linux root and container escape

Security researcher Ziyi Guo has disclosed details of a critical Linux security vulnerability in NVIDIA’s GPU Display Driver for Linux (CVE-2026-47595, CVSS score: 7.5, aka Bad UVM) that could allow an unprivileged user can write to read-only memory by taking advantage of the fact that the memory’s permissions are not preserved. The vulnerability could be exploited to achieve code execution, escalation of privileges, denial-of-service, information disclosure, data tampering, and even a container escape. “By injecting our exploit code into nvidia-persistenced, we first force the hijacked process to execute a UVM-based local privilege escalation (LPE),” the researcher said. “Once the privilege barrier is crossed, we trigger the subsequent operations, ultimately granting us the ability to execute commands on the host with full root access.”

Active command injection attacks

A command injection vulnerability in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931, CVSS score: 8.5) has come under active exploitation in the wild. The flaw affects customers using version 2.20 or later with statistics enabled, which is turned on by default. Successful exploitation could allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on affected systems. It’s currently not known how the flaw is being exploited, by whom, and who is being targeted.

Critical unpatched SQL injection

Rapid7 has disclosed details of a critical SQL Injection vulnerability in Channel Software WebAlliance eCommerce (CVE-2026-108065, CVSS score: 9.8). “The exploit allows a malicious actor to read sensitive data from the database, or, if the database user has high privileges, run system commands on the database server,” Rapid7 said. “The SQL Injection exploit can be leveraged to view sensitive information in the database, such as user PII and passwords. If logged in with DB admin privileges, the vulnerability can be exploited to run system commands on the server running the database.”

Four code execution flaws patched

NSD has released patches for four security flaws (CVE-2026-101341, CVE-2026-101339, CVE-2026-101338, and CVE-2026-101337) that could be exploited to achieve execution of arbitrary commands. The vulnerabilities, credited to Qifan Zhang from Palo Alto Networks and Gaurang Maheta, have been patched in NSD 4.15.3 or newer.

Potential VM-to-host escape

The Xen project has published details of CVE-2026-79610, a race condition in Xen’s grant-table mechanism that could be abused to compromise the security of a virtual machine host and allow an unprivileged guest to elevate its privileges to that of the host. All Xen versions from 4.0 onwards are vulnerable. The issue has been addressed in xsa517.patch. As mitigation, it’s advised to use the “gnttab=max-ver:1” hypervisor command line option or the “max_grant_version=1” guest configuration option for guests. The project maintainers credited Anthropic’s Claude Opus with the discovery and Teddy Astie of Vates for diagnosing it as a security issue.

SYSTEM-level remote code execution

A Windows security vulnerability in MyReport Updater 2.1.1 can permit an attacker to seize control of a machine, including remotely, without authentication. “An attacker with standard user privileges can set an arbitrary reference server,” Quarkslab said. “If MyReportUpdaterService can contact this server over gRPC on TCP port 9095, the attacker can write files into a chosen directory with NT AUTHORITYSYSTEM privileges. The attacker can use this file-write access to place a DLL that will be loaded by a privileged process. The DLL code is then executed with high privileges. This vulnerability gives full control of the Citrix server. It can also affect other machines where the vulnerable MyReport solution is installed.”