DEV Community: Anoymask

macOS Screen Sharing CVE-2026-65400: Authentication Bypass Leads to Root Access and Monero Miner Installation

Anoymask — Sat, 15 Aug 2026 04:23:00 +0000

macOS Screen Sharing CVE-2026-65400: Authentication Bypass Leads to Root Access and Monero Miner Installation

1. Basic Information

Severity: Critical
Title: Hackers exploit macOS Screen Sharing flaw to deploy Monero miner
Source: BleepingComputer
Published Date: 2026-08-14
Updated Date: N/A
Original Article: Original Article
Related Sources: Apple Security, NCSC-NL NCSC-2026-0280
Malware: Monero cryptocurrency miner (Name and hash unknown)
Threat Groups: N/A
CVEs: CVE-2026-65400
Products: macOS Screen Sharing, macOS Tahoe before 26.6.1, macOS Sequoia before 15.7.9, macOS Sonoma before 14.8.9, VNC/TCP 5900

2. Summary

An authentication state management flaw in macOS Screen Sharing exposed to the internet allows attackers to authenticate without valid credentials. Multiple cases have reached root access and the deployment of a Monero miner.

3. Attack Flow

Attack Chain Confirmed in Public Reports

The attacker connects to macOS Screen Sharing from the internet via TCP/5900.
The attacker exploits the authentication state flaw in CVE-2026-65400 to establish a session without valid credentials.
The attacker gains the ability to launch applications, access files, and change security settings via remote desktop.
In multiple cases reported to NCSC-NL, the attacker obtains root access.
A Monero cryptocurrency miner is installed.

4. Attacker Position and Execution Location

The attacker reaches the public VNC/TCP 5900 service from the internet.
Initial execution occurs within the macOS Screen Sharing service and the remote GUI session.
Specific steps for root acquisition, the presence of other vulnerabilities, and miner persistence methods are not publicly disclosed.

5. Visibility for Victims and Administrators

No user interaction is required. Screen sharing indicators or cursor/GUI changes may sometimes be visible.
Administrators may observe TCP/5900 connections from external IPs, screen sharing sessions not tied to regular accounts, root processes, and miners/high CPU usage.
Because valid accounts are not used, a password reset alone cannot contain the vulnerability.

6. Success and Failure Conditions

Success Conditions

Screen Sharing is enabled on the affected macOS.
TCP/5900 is reachable by the attacker.
Patches are not applied.
There are no controls to block execution or settings changes after a remote session.

Failure Conditions

Update to Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9, or later.
Disable unnecessary Screen Sharing.
Block TCP/5900 from the internet and restrict it to VPN or management networks.
Early detection and isolation of remote sessions, root processes, and miner/pool communications.

7. What Happens on Success

Remote desktop access without authentication.
File access, application launching, and security setting changes.
Root access and Monero miner installation in actual reported incidents.
Root acquisition paths, persistence, data theft, and lateral movement are not confirmed in public data.

8. Observable Logs

Email

None related.

Proxy / SWG / DNS

DNS queries and traffic to miner pools/Stratum endpoints (Specific IOCs not public).
Connections to unknown download sources.

Endpoint / EDR

Screen Sharing related processes and sessions.
Unknown binaries running as root.
Increased CPU/GPU usage.
Miner-specific processes and command lines.
LaunchDaemons (useful if identified, though specific persistence methods are not public).

Identity / IdP

Screen Sharing authentication success not tied to a valid account.
Inconsistencies in local login/authorization events.
Sessions persisting after password changes.

SaaS / Cloud

None related. MDM device versions and compliance can be used to check patch status.

Network

TCP/5900 connections from the internet.
Connections from the same source to multiple Macs.
Outbound miner pool traffic following a session.

9. Attack Success Determination

Contact Only

TCP/5900 scan or SYN packets only.

User Interaction

Not required.

Initial Execution

Screen Sharing session established and GUI/application manipulation observed.

Malware or Successful Authentication

Authentication success without valid credentials, root access, or miner process.

Data Theft / Session Compromise

Remote desktop sessions can be confirmed, but data exfiltration is not confirmed in public reports.

Subsequent Compromise Confirmation

Confirmation of miner installation, security setting changes, additional payloads, or lateral movement.

10. Investigation Playbook

Trigger

Internet-exposed TCP/5900.
macOS versions matching NCSC advisory.
Unknown Screen Sharing sessions.
Root miner or high CPU usage.

Initial Verification

Confirm macOS version, Screen Sharing settings, exposure path, initial source IP, and timestamp.
Cross-reference account/session logs with valid login activity.

Endpoint

Preserve process trees, launchd entries, file creations, quarantine/xattr attributes, unified logs, and network sockets.
Identify the start time of root access and the miner binary/hash.

Authentication and Cloud

Check local account/password change history, MDM commands, and SaaS sessions.
Note that initial access does not require a valid account.

Subsequent Actions

Hunt for downloads, persistence, pool communication, SSH/remote services, file access, and lateral movement.

Containment

Block TCP/5900, disable Screen Sharing, isolate the host, apply patches, and terminate all sessions.
Consider credential rotation and system rebuilding if root compromise is confirmed.

Determination Categories

Scanned
Unauthenticated Screen Session Confirmed
Root Access Confirmed
Miner Installed
Additional Compromise Confirmed

11. Defense and Detection Ideas

Single Event

Internet to TCP/5900 connection.
Screen Sharing success without a matching valid account.
Unknown miner running as root.
Sustained high CPU load.

Time-Series Correlation

Port 5900 connection → Screen Sharing session → GUI/process launch → Root process → Miner download → Pool communication.

Threat Hunting Perspective

Inventory of Macs exposed to the internet.
OS versions older than August 6.
Screen Sharing and remote management unified logs.
New binaries running as root.
Stratum or known miner pool connections.

Log Gaps

Screen Sharing authentication results.
Remote GUI actions.
Root acquisition path.
File access.
Miner IOCs.
Launchd modifications.

Priority Actions

Update operating systems.
Block port 5900 from the internet.
Set Screen Sharing to default-off.
Segregate management planes.
Monitor root processes and egress traffic.

12. Facts / Inference / Hypothesis

Facts

Apple patched CVE-2026-65400 on August 6, 2026.
The root cause is a state management flaw in Screen Sharing authentication, allowing network attackers to authenticate without valid credentials.
NCSC-NL reported active abuse on multiple systems with port 5900 exposed to the internet.
Root access and Monero miner deployment were confirmed in all reported cases.
Methods for root acquisition, miner names/hashes, and persistence are not publicly disclosed.

Inference

Macs with TCP/5900 directly exposed to the internet should be prioritized for inventory and patching.
Confirming a compromise requires correlating post-session root processes and egress traffic, not just authentication logs.

Hypothesis

Payloads other than miners could potentially be deployed, though this has not been confirmed in public reports.

13. MITRE ATT&CK Mapping

T1190 Exploit Public-Facing Application — Confidence: High
T1133 External Remote Services — Confidence: High
T1496 Resource Hijacking — Confidence: High
T1105 Ingress Tool Transfer — Confidence: Medium (Miner download path is not public)
T1543.004 Launch Daemon — Confidence: Low (Investigation perspective; persistence methods unconfirmed)

14. Unknowns and Additional Investigation

Specific attack chain for acquiring root access.
Miner binaries/hashes, download URLs, and pool/C2 servers.
Presence of persistence, defense evasion, lateral movement, or data access.
Number of victim systems, geographic locations, and threat actors.
Consistency between public PoCs and actual attack payloads.

15. Impact on SOCs and General Enterprises

Development, design, and research environments often utilize remote Mac support. Organizations should not lower priority based solely on a CVSS score of 7.1. Instead, they should execute emergency patching and retrospective hunting based on exposed port 5900, active exploitation, and root miner risks.

16. Summary by Target Audience

For SOCs: Evaluate port 5900 contact, unauthenticated sessions, root access, and miners as separate stages, and explicitly note that the root acquisition path remains unknown.
For Administrators: Update to the three patched versions, disable unnecessary Screen Sharing, and never expose port 5900 to the internet.
For Users: Report unexpected screen activity, sudden high system load, unusual heat generation, or fan noise on Macs to administrators.

GeoServer jsonArrayContains SQL Injection: Hundreds of Attempts Observed, RCE Conditions, and the 2023 CVE Gap

Anoymask — Sat, 15 Aug 2026 04:22:49 +0000

GeoServer jsonArrayContains SQL Injection Zero-Day Report: High Volume Probes, Verify PoC RCE Conditions and Differences from Known Vulnerabilities

1. Basic Information

Severity: Critical
Article Title: Hackers Exploiting Unpatched GeoServer Zero-Day
Publisher: SecurityWeek
Publication Date: 2026-08-14
Update Date: None
Original Article: Original Article
Related Sources:
- GeoServer OGC Filter Injection Vulnerability Statement (2023-02-20)
- GeoServer 2.22.2 Release / GEOT-7302 Escape user inputs in SQL queries
Malware: None
Groups: None
CVEs: Unassigned for the 2026 report (at the time of publication). The 2023 OGC Filter SQL injection involving the same jsonArrayContains is CVE-2023-25157 (GeoServer) / CVE-2023-25158 (GeoTools).
Products: GeoServer, GeoTools, jsonArrayContains filter/function, PostGIS JDBC data store, Oracle JDBC data store

Verification Note: The SecurityWeek article reports the 2026 issue as an unpatched zero-day. Meanwhile, GeoServer already fixed the OGC Filter SQL injection involving jsonArrayContains + PostGIS/Oracle in 2023 under CVE-2023-25157/CVE-2023-25158. A PoC reviewed during this analysis claims SQLi/RCE against PostgreSQL, but the currently verifiable GeoTools implementation includes escape processing for the expected string. It remains unconfirmed whether the 2026 issue is a regression, a different vector, an escape bypass, an unpatched branch/version, or a discrepancy from the PoC description. The PoC itself is not attached or republished in this report or the public article.

2. Executive Summary

SecurityWeek reported a GeoServer SQL injection zero-day via jsonArrayContains and a high volume of probes within hours of its public disclosure. However, this function was already targeted and fixed for SQL injection in 2023, and there are discrepancies between the assumptions of the analyzed PoC and the current GeoTools implementation. Therefore, additional confirmation is required to determine the exact root cause, impacted versions, and RCE conditions of the 2026 issue.

3. Attack Flow

SQL Injection / Probing (SecurityWeek Report)

An attacker sends a filter query to a publicly exposed GeoServer endpoint.
The attacker passes crafted user arguments to jsonArrayContains.
The attacker abuses input processing in the backend JDBC/DB query to attempt SQL injection.
The attacker attempts SQL query manipulation, DB data access, and DB behavior changes.
WatchTowr observations cited by SecurityWeek show hundreds of exploit attempts from a small number of source IPs within hours of public disclosure.
No follow-up compromise after the probes has been confirmed at the time of publication.

Configuration-Dependent RCE on PostgreSQL (Vector Claimed by Analyzed PoC)

SQL injection via jsonArrayContains succeeds.
Database connection conditions allow stacked queries.
The PostgreSQL connection user has high privileges required for server-side program execution.
The attack can lead to OS command execution on the database host via SQL features.
The execution occurs on the database host side (if PostgreSQL is on a separate host), not on the GeoServer/JVM host.

Blind Data Extraction (Vector Claimed by Analyzed PoC)

SQL injection succeeds.
Differences in database response time are used as a boolean oracle.
The attacker sequentially infers database names, table/column metadata, and allowed table data.
The scope of obtainable data depends on the privileges of the database user used by GeoServer.

4. Attacker Position and Execution Location

The attacker sends requests from the internet to the filter processing functions (such as WFS/WMS) of a public GeoServer instance.
The SQL injection is executed by the backend database connected from GeoServer, and the impact is limited by the database user privileges.
The RCE vector in the analyzed PoC assumes PostgreSQL server-side program execution. If successful, the resulting OS process, file, or network activity occurs on the database host.
Regarding Oracle, SecurityWeek and the 2023 official advisory mention it as a target for jsonArrayContains SQL injection, but the analyzed PoC targets PostgreSQL, and the same RCE vector cannot be generalized to Oracle.

5. Visibility for Victims and Administrators

No user interaction is required, and attack requests may be received concurrently with normal map and service usage.
Administrators may observe abnormal filters containing jsonArrayContains, SQL errors, database queries, or long response times.
If PostgreSQL RCE succeeds, prioritize checking for abnormal processes, file creation, and network connections under the database service, rather than the GeoServer/Java child process.
A high volume of probes does not mean a successful compromise. Judge HTTP request arrival, SQLi success, database data access, and OS command execution as separate stages.

6. Success and Failure Conditions

Success Conditions

The target GeoServer/filter endpoint is reachable by the attacker.
jsonArrayContains and the relevant String/JSON field are available on the target layer/data store.
Unidentified vulnerability conditions reported in 2026 actually apply to the target version and configuration.
The scope of readable/updatable data after SQLi is permitted by database user privileges.
The stacked-query path in the analyzed PoC requires connection conditions that allow multiple statements to execute.
PostgreSQL RCE in the analyzed PoC requires additional privileges allowing the database user to execute server-side programs.

Failure Conditions

Isolate GeoServer from the internet and restrict access to trusted networks/VPNs.
Block abnormal filter inputs using a WAF or API gateway.
Temporarily remove vulnerable function and data store combinations from public exposure paths.
Limit metadata/data access, writes, and server-side program execution using database least privilege.
If the vendor releases a patch or advisory for the 2026 issue, check the affected versions and apply updates quickly.
Update environments unpatched for the 2023 CVEs (CVE-2023-25157/CVE-2023-25158) to known fixed versions.

7. What Happens on Success

SQL query manipulation
Data read/modify within database user privileges
Potential blind data inference via time-based SQLi
Potential remote OS command execution on the database host in PostgreSQL configurations meeting the additional conditions assumed by the analyzed PoC
Hundreds of attempts/probing observed at the time of publication, while follow-on compromises remain unconfirmed

8. Observable Logs

Email

None related

Proxy / SWG / DNS

jsonArrayContains filter requests to the GeoServer endpoint
Abnormal CQL/filter strings containing quotes, comments, or functions
Repeated requests from the same source
Unknown egress originating from the database host after RCE success

Endpoint / EDR

For GeoServer/JVM, check for abnormal terminations, errors, and resource spikes during request processing
For suspected PostgreSQL RCE, look for unexpected child processes under the database service
Execution of shells, interpreters, or utilities
Unexpected file creation on the database host
Process execution outside normal operations by the database service account

Identity / IdP

Initial attacks target web filter processing as an entry point, so IdP authentication events alone are insufficient for determination
GeoServer/database service credential changes and secret access are targets for follow-on investigation

SaaS / Cloud

WAF/load balancer/API gateway access logs
GeoServer application logs
Managed database audit/query logs
Database service account/role privileges
Cloud flow logs

Network

Many requests from a small number of source IPs
GeoServer to database sessions
Unexpected outbound traffic from the database host
Callbacks/scans if a follow-on occurs

9. Attack Success Determination

Contact Only

Observed GeoServer scans or requests containing jsonArrayContains

User Interaction

None required

Initial Execution

Crafted filter requests reached and were processed by the GeoServer application

SQL Injection Success

Database errors/timing, audit queries, or unintended database side effects support SQLi success
When relying solely on time-based behavior from the analyzed PoC, separation from network latency is required

RCE Success

Confirm unexpected child processes under the database service, file creation, or network connections on the PostgreSQL database host
Do not rely solely on GeoServer/Java child processes as the condition for RCE success

Data Theft / Session Compromise

Confirm database result/data access, metadata enumeration, and external transmission with separate evidence
Confirm credential/session access as separate follow-on evidence

Subsequent Compromise Confirmation

Confirm persistence, internal scans, new accounts, web shells, data modification, and lateral movement

10. Investigation Playbook

Trigger

Abnormal jsonArrayContains requests
GeoServer exposure reported in SecurityWeek
SQL errors or timing spikes
Unexpected child processes under the database service

Initial Confirmation

Determine GeoServer/GeoTools version, data stores, public exposure, target layers/fields, and first requests/sources
Check application status of patches for 2023 vulnerabilities CVE-2023-25157/CVE-2023-25158
Review HTTP requests/responses, GeoServer logs, and database audit/query logs with time synchronization
Check PostgreSQL prepared statement settings and database user roles/privileges, while treating impact on the 2026 issue as unconfirmed

Endpoint

Preserve GeoServer/JVM process trees, application logs, temp/web directories, and sockets
For separate database hosts, prioritize preserving database process trees, service accounts, file integrity, and sockets

Authentication / Cloud

Privileges of GeoServer-to-database credentials
PostgreSQL role membership and server-side program execution capabilities
Check secret access, managed database audits, and control-plane changes

Subsequent Operations

Database query/data access, metadata enumeration
Callbacks from the database host
New users, scheduled tasks, web shells, and lateral movement
Data modification/exfiltration

Containment

Restrict public access
Apply WAF virtual patches
Stop public exposure paths for vulnerable functions and data stores
Implement database least privilege
Rotate database credentials if necessary
If RCE evidence exists, isolate the affected database host and decide whether to rebuild

Determination Categories

Scanned
Exploit Attempted
SQL Injection Suspected
SQL Injection Confirmed
Data Access Confirmed
RCE Confirmed
Follow-on Compromise Confirmed

11. Defense and Detection Ideas

Single Events

jsonArrayContains combined with SQL metacharacters or comments
GeoServer SQL errors
Database query latency anomalies
Database service to unexpected child process
Database host to unexpected outbound traffic

Time-Series Correlation

Crafted filter -> GeoServer/database error or timing anomaly -> abnormal database query -> database child process/file -> outbound traffic
Crafted filter -> repeated timing requests -> metadata/data access evidence

Threat Hunting Perspectives

Public GeoServer inventory
GeoServer/GeoTools versions and application status of 2023 OGC Filter SQLi patches
Use of PostGIS or Oracle
Layers and JSON fields utilizing jsonArrayContains
Source concentration after disclosure
New processes, files, or network activities by PostgreSQL service users
Database roles with server-side program execution privileges

Log Gaps

HTTP queries/bodies
GeoServer filter/application logs
Database audit/query logs
Database process lineage
Database service role/privilege snapshots
Egress traffic

Priority Countermeasures

Reduce external exposure
Apply WAF virtual patches
Verify application of known 2023 fixed versions
Implement database least privilege
Database host EDR/process monitoring
Monitor vendor advisories/patches for the 2026 issue

12. Facts / Inference / Hypothesis

Facts

SecurityWeek reported an unpatched GeoServer SQL injection zero-day via jsonArrayContains on 2026-08-14.
Information referenced by existing reports from SecurityWeek states that WatchTowr observed hundreds of exploit attempts from a small number of source IPs within hours of disclosure, with no follow-on activity confirmed at the time of publication.
GeoServer officially announced in 2023 that using jsonArrayContains with String/JSON fields and PostGIS/Oracle DataStores introduced SQL injection vulnerabilities tracked as CVE-2023-25157/CVE-2023-25158.
The 2023 issues were fixed in GeoServer 2.22.2, 2.21.4, 2.20.7, 2.19.7, 2.18.7, etc., and GEOT-7302 introduced SQL escaping for user input.
The analyzed PoC implements time-based SQLi, stacked queries, database metadata/data extraction, and OS command execution via server-side program execution (when extra privileges are present) targeting PostgreSQL.
The analyzed PoC assumes disabled prepared statements for its SQL/RCE modes using stacked queries, and requires PostgreSQL superuser or equivalent pg_execute_server_program privileges for OS command execution.
Currently verifiable GeoTools PostGIS FilterToSqlHelper.constructEquality() applies escapeJsonLiteral() to the expected string, and EscapeSql.escapeLiteral() escapes single quotes and similar characters.
The statement at the beginning of the analyzed PoC claiming "expected is written raw to SQL and only JSON pointers are escaped" does not match current verifiable GeoTools code.
RCE via H2 cannot be confirmed from the analyzed PoC.

Inference

If the 2026 report is correct, there may be a code path different from the 2023 fix, a regression, an escape bypass, or a specific version/branch/configuration issue, but it cannot be identified at this time.
HTTP requests alone cannot determine SQLi/RCE success; correlation with GeoServer logs, database audit/query logs, and database host processes/network activity is required.
Focusing solely on GeoServer/Java child processes when detecting RCE may cause analysts to miss the database host RCE assumed by the analyzed PoC.

Hypothesis

The high volume of probes in 2026 may be a reuse of known 2023 PoCs, a new 2026 bypass, or a mixture of both. Public information alone cannot distinguish them.
It is possible that this could evolve into follow-on payloads similar to past GeoServer mass exploitation campaigns, but no such follow-on compromise has been confirmed at the time of the SecurityWeek report.

13. MITRE ATT&CK Mapping

T1190 Exploit Public-Facing Application — Confidence: High
T1059 Command and Scripting Interpreter — Confidence: Medium (If OS command execution succeeds on the database host)
T1213 Data from Information Repositories — Confidence: Medium (If database data access is confirmed)
T1046 Network Service Discovery — Confidence: Low (Only if follow-on internal scans are confirmed)
T1505.003 Web Shell — Confidence: Low (Not confirmed in current reports/PoCs; kept as a follow-on investigation perspective)

14. Unknowns and Additional Investigation

CVE identifiers for the 2026 issue, affected GeoServer/GeoTools versions, official vendor advisories, and patch ETAs
The root cause and exact vulnerable code path that led SecurityWeek/WatchTowr to judge this as a 2026 zero-day
Technical differences from the 2023 CVE-2023-25157/CVE-2023-25158 vulnerabilities
Exact GeoServer/GeoTools versions and commits targeted by the analyzed PoC
The reason for the discrepancy between the PoC's description of raw expected and the current escapeJsonLiteral() implementation
Whether the 2026 issue succeeds when prepared statements are enabled
2026-specific exploit paths applicable to Oracle and impact conditions equivalent to the PostgreSQL PoC
Complete source IPs and IOCs
Real victims where SQLi/RCE success has been confirmed
Follow-on payloads, actors, and data impact

15. Impact on SOCs and General Organizations

Organizations exposing GeoServer should not automatically assume RCE based solely on 2026 zero-day reports. Instead, they should first inventory internet exposure, GeoServer/GeoTools versions, the application status of 2023 OGC Filter SQLi fixes, PostGIS/Oracle usage, and whether jsonArrayContains is utilized. Security Operations Centers (SOCs) must separate HTTP probes from successful compromises by incorporating database audit logs and database host process/network telemetry. Until vendors release official advisories for the 2026 issue, prioritize network restrictions, WAFs, and database least privilege.

16. Summary by Role

For SOCs: Do not judge compromises based on jsonArrayContains requests alone. Correlate HTTP -> GeoServer -> database queries -> database host processes/network activity. The PoC-assumed RCE targets the database host, so do not rely solely on Java child processes.
For Administrators: Verify the version, data stores, and 2023 patch status of public GeoServer instances. Reduce public exposure scopes, deploy WAFs, and enforce database least privilege until a 2026 advisory is confirmed.
For End Users: No user action is required. End users cannot take mitigating actions themselves; report any anomalies or service outages in mapping applications to administrators.

AmnesiaStealer: macOS Infostealer that Hijacks In-Browser Sessions via ClickFix

Anoymask — Sat, 15 Aug 2026 04:22:37 +0000

AmnesiaStealer: macOS Infostealer that Hijacks In-Browser Sessions via ClickFix

1. Basic Information

Severity: High
Article Title: AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers
Publisher: Jamf Threat Labs
Publication Date: 2026-08-13
Update Date: N/A
Original Source: Original
Related Sources: SecurityWeek
Malware: AmnesiaStealer, stream_module
Groups: None
CVEs: CVE-2020-9771 (Old TCC/APFS bypass. Failed in Jamf testing on current macOS 26)
Products: macOS, Chromium-based browsers, Apple Keychain, Apple Notes, Telegram

2. Executive Summary

AmnesiaStealer uses a fake GitHub ClickFix page to launch a Rust-based stealer. It steals login passwords, Keychain data, documents, and browser information. It also copies real browser profiles and uses CDP (Chrome DevTools Protocol) to secretly and remotely control active browser sessions.

3. Attack Flow

Stage 0: ClickFix and Payload Launch

A fake GitHub page tricks the user into pasting a command into the Terminal.
The system uses curl to download a shell script and runs it with nohup bash.
A password-protected ZIP file (password dulin) is saved to /tmp and extracted.
The system runs xattr -cr, adds execute permissions, applies an ad-hoc signature, and starts a Rust universal Mach-O binary.
Temporary files and the shell history are deleted.

Stage 1: Credential Theft, Data Exfiltration, and Persistence

A native dialog asks for the macOS login password. The malware verifies it locally using dscl or sudo -S -v.
The password is saved in plain text in a staging area and at ~/.pwd, then used to try to unlock the Keychain.
The malware collects data from the Keychain, Apple Notes, Telegram, documents, 16 types of Chromium profiles, crypto wallets, and system info.
It archives the staging folder (/tmp/<25 characters>) using ditto and sends it to the C2 server at /send/.
It uses the stolen password to create a root LaunchDaemon named com.apple.ReportCrash.agent_<digits>.

Stage 2: Hidden Browser Session Hijack

When it receives the C2 command remote_stream, it downloads an extra stream_module.
It copies the victim's Chromium profile to ~/.local/share/.stream/profiles/<browser>.
It launches the real browser in headless mode with remote debugging enabled.
It uses a WebSocket relay and Chrome DevTools Protocol (CDP) to control tabs, the mouse, the keyboard, and navigation.
It exports plain text cookies using Network.getAllCookies and can import them into another session using Network.setCookies.

Bypasses and Destructive Fallbacks That Failed on Current macOS

It tries CVE-2020-9771 and TCC database injection, but Jamf's tests on macOS 26 show this fails without Full Disk Access.
If it fails to get the Chrome Safe Storage key, it has a fallback: it deletes existing items and recreates them with a known password.
This fallback can destroy the ability to decrypt existing saved data.

4. Attacker Positioning and Execution

Initial lures and C2 servers run on attacker-controlled web and C2 infrastructure.
Stage 0 and Stage 1 start with user privileges. After getting the stolen login password, the malware tries to create a root LaunchDaemon.
Browser remote control runs using a legitimate Chromium app and an extra module on the victim's Mac. The operator controls it through a WebSocket relay.
Root access and Full Disk Access are separate things. Public reports do not state that root access alone automatically grants access to TCC-protected data.

5. What Victims and Administrators See

Victims see a GitHub-style download page, instructions to paste into the Terminal, and a macOS-style password dialog.
Administrators see curl/bash commands from the Terminal, /tmp/.com.apple.dt.*, ad-hoc signatures, LaunchDaemons, unknown C2 traffic, and headless browsers.
On macOS 26, using the security CLI to delete and recreate Chrome Safe Storage creates a strong sign of abnormal activity.
Stage 2 actions run inside a legitimate browser process. Because of this, identity providers (IdPs) might see them as normal sessions from the victim's device and IP address.

6. Conditions for Success and Failure

Conditions for Success

The user pastes the fake page's command into the Terminal.
Download/C2 communications, Mach-O execution, and password entry are allowed.
The stolen password is valid, allowing the creation of a LaunchDaemon.
The malware can access target browser profiles and cookies.
For Stage 2, operator commands and WebSocket relays can reach the target.

Conditions for Failure

Blocking fake domains, curl | bash, and Terminal pasting.
The user refuses to run the command or enter the password.
MDM/EDR blocks unknown Mach-O binaries, ad-hoc signatures, LaunchDaemons, or headless remote debugging.
Full Disk Access is missing, and the old TCC bypass fails as seen in Jamf testing.
Quick session revocation, password changes, and C2 blocking.

7. What Happens on Success

The theft of the macOS login password, Keychain data, documents, Notes, Telegram, wallets, and browser data.
Persistence after reboot via a root LaunchDaemon.
Remote control of logged-in Chromium sessions and cookie export/import.
Loss of access to existing saved information due to the Chrome Safe Storage fallback.
Stage 2 capabilities were verified in Jamf's isolated lab. Public reports do not confirm operators using this against real victims yet.

8. Observable Logs

Email

Public reports do not show email as the initial vector.

Proxy / SWG / DNS

github.aoitour[.]com
debug.allllowef[.]space
allllowef[.]space
shlyapadulina[.]space
138.124.70[.]84
138.124.96[.]160
C2 endpoints: /api/bot/join, /api/bot/actions, /send/
Browser WebSocket relays

Endpoint / EDR

Terminal → curl → bash
/tmp/._<digits>.zip
/tmp/.com.apple.dt.<digits>
xattr -cr, chmod, codesign, nohup
dscl, sudo -S -v
~/.pwd, ~/.chost, ~/.botid
/Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist
~/.local/share/.stream/profiles/
Chromium --remote-debugging-* flags
Chrome Safe Storage changes via the security CLI

Identity / IdP

Cookie reuse from the victim's device/IP
New sessions created after cookie export
Logins to services using reused passwords
Active sessions without MFA prompts

SaaS / Cloud

C2 uploads
SaaS operations performed inside the browser
Data access to Telegram, Notes, and similar apps

Network

C2 HTTPS traffic
WebSockets
Outbound traffic from headless Chromium
Quick archive uploads

9. Determining Attack Success

Contact Only

Viewed the fake page, did not run commands.

User Action

Pasted commands into the Terminal or entered the password.

Initial Execution

Process and file artifacts for Stage 0 shell and Rust Mach-O.

Malware or Authentication Success

C2 join, password validation, or LaunchDaemon creation.

Data Theft or Session Compromise

Successful /send/ upload, cookie export, C2 receipt, or use of stolen sessions.

Post-Compromise Confirmation

Confirmed Stage 2 module, headless browser, operator commands, or SaaS actions.

10. Investigation Playbook

Trigger

Terminal curl | bash execution
AmnesiaStealer hashes or domains
Fake CrashReporter LaunchDaemon
Chrome Safe Storage changes
Headless Chromium remote debugging

Initial Verification

Identify the target URL, command, execution time, login user, and whether a password was entered.
Correlate C2 DNS/Proxy traffic with the process tree.
Determine how far the attack reached (Stage 0, 1, or 2).

Endpoint

Preserve /tmp, ~/.pwd, the LaunchDaemon, browser profile clones, shell history, and Keychain operations.
Collect Mach-O hashes, code signatures, parent/child processes, and network sockets.

Authentication & Cloud

Change the macOS password, rotate Keychain/SSO secrets, and revoke all browser and SaaS sessions.
Check for SaaS actions and cookie usage from the same device/IP.

Subsequent Actions

Look for access to wallets, Telegram, Notes, and documents.
Search for additional payloads, operator commands, and credential reuse on other devices.

Containment

Isolate the host, block C2 traffic, stop the LaunchDaemon, preserve evidence, and rebuild the system.
Rotate passwords, tokens, cookies, and wallet secrets as needed.

Assessment Levels

Lure Viewed
Command Pasted
Payload Executed
Password Captured
Stealer Exfiltration Confirmed
Browser Session Hijack Confirmed

11. Defense and Detection Ideas

Single Events

Fake CrashReporter LaunchDaemon
~/.pwd file creation
Terminal → curl -s → nohup bash
Chrome Safe Storage deletion/recreation
Chromium remote debugging flags

Timeline Correlation

Fake GitHub view → Terminal paste → ZIP/Mach-O execution → Password dialog → Staging/archive → C2 upload → LaunchDaemon → stream_module → Headless browser

Threat Hunting Focus

com.apple.ReportCrash.agent_
~/.local/share/.stream/profiles
CDP actions like Network.getAllCookies
15-byte XOR keys or C2 IOCs
Stage 1 and Stage 2 SHA256 hashes

Log Gaps

Terminal command lines
TCC/FDA status
Keychain item changes
Browser CDP traffic
WebSocket payloads
File access telemetry

Priority Actions

Use MDM to detect Terminal pasting and curl | bash.
Control and monitor unknown LaunchDaemons.
Restrict browser remote debugging.
Shorten session lifetimes and use device binding.
Minimize Full Disk Access permissions.

12. Facts, Inferences, and Hypotheses

Facts

Jamf confirmed AmnesiaStealer in a real environment.
Stage 1 uses a Rust universal Mach-O binary to collect Keychain data, browser data, Notes, Telegram, wallets, and documents.
It includes code for root LaunchDaemon persistence using a stolen password.
Jamf's macOS 26 tests showed that old TCC bypasses failed without Full Disk Access.
Stage 2 successfully tested browser control and cookie exports in an isolated lab.
There is no public proof that Stage 2 was used by an operator against a real victim.

Inference

Because cookies are used inside the victim's real browser, an IdP's location and device checks alone may not spot unauthorized actions.
After password theft, you must check not just the compromised device, but also SaaS apps and VPNs that use the same password.

Hypothesis

Correlating high-frequency CDP commands with screencasts (around 3 fps) from a remote browser might help detect hidden session control.

13. MITRE ATT&CK Mapping

T1204.004 Malicious Copy and Paste — Confidence: High
T1059.004 Unix Shell — Confidence: High
T1105 Ingress Tool Transfer — Confidence: High
T1056 Input Capture — Confidence: High
T1555.001 Credentials from Password Stores: Keychain — Confidence: High
T1539 Steal Web Session Cookie — Confidence: High
T1560.001 Archive via Utility — Confidence: High
T1543.004 Launch Daemon — Confidence: High
T1070.004 File Deletion — Confidence: High
T1185 Browser Session Cookie — Confidence: Medium (Mapped to session control via CDP)

14. Unknowns and Further Investigation

Total victim count, target regions, and threat actor attribution.
Whether Stage 2 has been used against real victims.
Success rates of TCC bypasses on versions other than macOS 26.
Full lists of C2 servers, IOCs, and build differences.
Confirmed cases of stolen data and wallet losses.

15. Impact on Security Operations Centers (SOCs)

Development, design, and media teams often use Mac computers, making them potential targets. Organizations need detection strategies that span across ClickFix awareness training, Terminal command lines, LaunchDaemons, browser remote debugging, and session-level activities.

16. Summary by Role

For SOC Teams: Track attacks step-by-step from Terminal pasting to LaunchDaemons, C2 uploads, and headless browsers. Avoid confusing root access with Full Disk Access.
For IT Administrators: Use MDM and EDR to restrict unknown LaunchDaemons and remote debugging. If an infection happens, revoke passwords, Keychains, and browser sessions all at once.
For End Users: Never paste commands into the Terminal based on web page instructions, and never enter passwords into prompt boxes that appear after downloading files.

SAP Commerce Cloud CVE-2026-58231: Active Exploit Attempts for Unauthenticated RCE

Anoymask — Sat, 15 Aug 2026 04:22:24 +0000

SAP Commerce Cloud CVE-2026-58231: Active Exploit Attempts for Unauthenticated RCE

1. Basic Information

Severity: Critical
Article Title: Max severity SAP Commerce Cloud flaw now targeted in attacks
Source: BleepingComputer
Publication Date: 2026-08-14
Update Date: 2026-08-14
Original Article: Original Source
Related Sources: SAP Security Patch Day - August 2026, Onapsis
Malware: None
Groups: None
CVEs: CVE-2026-58231
Products: SAP Commerce Cloud, Data Hub Adapter, COM_CLOUD 2211, COM_CLOUD 2211-JDK21

2. Executive Summary

Attackers chained the default authentication client and input validation flaws in the Data Hub Adapter to target unauthenticated arbitrary code execution. These exploit attempts reached a honeypot three days after the patch was released.

3. Attack Flow

Exploit Flow Confirmed from Public Documents

The attacker reaches the Data Hub Adapter endpoint from the outside.
The attacker abuses the default authentication client to call specific functions without authentication.
The attacker sends crafted input to functions with missing validation.
If successful, this leads to arbitrary code execution and internal component compromise within the application.
The Defused honeypot observed exploit attempts three days after the patch release.

4. Attacker Location and Execution Point

Attackers connect to the SAP Commerce Cloud Data Hub Adapter from the Internet or a reachable network.
Initial execution happens on the Commerce Cloud application/JVM side.
Because public PoCs, exact payloads/endpoints, and post-exploitation details are not public, a request to the honeypot does not confirm a successful RCE.

5. Visibility for Victims and Administrators

No user action is required. Attacks can happen in the backend even while the storefront runs normally.
Administrators may see unauthenticated requests from the default client, Data Hub Adapter errors, and JVM child processes/files/networks.
The 4,200+ IPs reported by Shadowserver are product fingerprints, not counts of unpatched, vulnerable, or compromised systems.

6. Success and Failure Conditions

Success Conditions

The Data Hub Adapter extension is enabled and reachable by the attacker.
The affected version is unpatched.
The default authentication client and vulnerable functions are available.
Crafted input is not blocked by application controls.

Failure Conditions

Update to the fixed release in SAP Security Note 3771065, then rebuild and redeploy.
Restrict vulnerable endpoints to trusted DataHub server IPs using IP Filter Sets.
Isolate the Data Hub Adapter from the Internet.
Detect and isolate exploit requests and JVM execution.

7. What Happens on Success

Unauthenticated arbitrary code execution
Internal component compromise
High impact on the confidentiality, integrity, and availability of application data
Follow-on activities like successful RCE, web shells, credential theft, and data theft are unconfirmed in public information.

8. Observable Logs

Email

None

Proxy / SWG / DNS

External HTTP requests to the Data Hub Adapter
Abnormal calls using the default client
Unknown downloads or C2 from the SAP host (from a post-RCE investigation perspective)

Endpoint / EDR

Commerce/JVM child processes
Shells or interpreters
Unexpected file creation
Network connections by application service users

Identity / IdP

No normal user login because access is unauthenticated
Abnormal use of default clients/tokens
Check subsequent admin accounts/sessions if found

SaaS / Cloud

Commerce Cloud deployment/build version
WAF/API gateway logs
Application/audit logs
Cloud/SAP control plane changes

Network

External to Data Hub Adapter
Application host to internal components
Unexpected egress

9. Attack Success Determination

Contact Only

Scans/fingerprints only

User Action

Not required

Initial Execution

Crafted requests reach vulnerable functions

Malware or Successful Authentication

Confirm RCE via JVM child processes, shells, files, or callbacks. Do not use the term "authentication success."

Data Theft or Session Compromise

Confirm data access/egress or session/token theft with separate evidence

Subsequent Compromise Confirmation

Confirm web shells, credential use, internal lateral movement, or data modification

10. Investigation Playbook

Trigger

Defused-style exploit requests
Unpatched Data Hub Adapter
Unauthenticated abnormal calls
JVM child processes

Initial Check

Confirm version/build, extension enablement, patch/redeploy time, and external exposure.
Preserve the initial request, source IP, response, and application errors.

Endpoint

Check the JVM process tree, temp/web directories, shell history, file integrity, and network sockets.

Authentication / Cloud

Check default client settings, API tokens, admin sessions, Commerce Cloud deployment/audit logs, and secret access.

Subsequent Actions

Search for web shells, scheduled jobs, new accounts, database queries, internal access, and egress.

Containment

IP Filter Set, endpoint isolation, patch/rebuild/redeploy, secret rotation, forensic imaging.
Rebuild affected nodes if RCE evidence exists.

Judgment Categories

Fingerprint Only
Exploit Attempted
Vulnerable Function Reached
RCE Confirmed
Data/Session Compromised
Follow-on Compromise Confirmed

11. Defense and Detection Ideas

Single Event

Unauthenticated Data Hub Adapter call
Default client abnormal request
Commerce JVM to shell
Unexpected callback

Time-Series Correlation

External crafted request -> application error/success -> JVM child -> file/network -> internal access

Hunting Perspective

COM_CLOUD 2211/2211-JDK21 inventory
Data Hub Adapter exposure
Unauthenticated requests around 2026-08-14
Application service user processes/egress

Log Gaps

Exact exploit endpoints/payloads
HTTP body
Application audit logs
JVM command lines
Cloud network flows

Priority Actions

Apply Note 3771065 and redeploy
Configure IP Filter Sets
Keep the backend private
Monitor JVM processes
Prepare for secret rotation

12. Facts / Inference / Hypothesis

Facts

CVE-2026-58231 is an improper authorization vulnerability with a CVSS score of 10.0.
Unauthenticated attackers can abuse default authentication clients and crafted input to achieve RCE.
SAP released a fix in Security Note 3771065 on August 11, 2026.
Defused observed exploit attempts in their honeypot three days later.
There were no public PoCs at the time of publication, and SAP did not confirm active exploitation in their advisory.
The 4,200+ IP fingerprints do not indicate the number of compromises.

Inference

Because attack attempts have started without a public PoC, there is practically no patch-waiting window.
Do not assume compromise success based only on HTTP attempts; JVM/file/network evidence is required.

Hypothesis

Attackers may target Commerce credentials or customer data after a successful RCE, but public data does not confirm this.

13. MITRE ATT&CK Mapping

T1190 Exploit Public-Facing Application — Confidence: High
T1059 Command and Scripting Interpreter — Confidence: Medium. If shells/interpreters are found after RCE.
T1105 Ingress Tool Transfer — Confidence: Low. Follow-on payloads are unconfirmed.
T1505.003 Web Shell — Confidence: Low. An investigation perspective; placement is unconfirmed.

14. Unknowns and Additional Investigations

Exact vulnerable endpoints/functions, request formats, and response indicators
Complete list of source IPs/IOCs for exploit attempts
Success or failure of RCE on the honeypot
Real victim compromises, payloads, and threat actors
Number of unpatched instances

15. Impact on SOCs and General Enterprises

When enterprises use SAP Commerce Cloud, they must check the backend exposure of the Data Hub Adapter in addition to the storefront. Prioritize patching, redeployment, and IP restrictions—even during holidays—and strictly separate the investigation of scan attempts from successful RCEs.

16. Summary by Target Role

For SOCs: Distinguish unauthenticated requests as attempts, and treat JVM child processes/files/callbacks as confirmed RCEs.
For Administrators: Rebuild and redeploy to the fixed release in Security Note 3771065, and use IP Filter Sets to limit access to trusted DataHub servers only.
For End Users: No user action is required. Follow the administrator's investigation results regarding e-commerce anomalies or customer data impact.

JWR: A Real-Time PhaaS Using WebSockets to Monitor Victim Input and Remotely Control Screen Transitions

Anoymask — Fri, 14 Aug 2026 03:01:26 +0000

JWR: A Real-Time PhaaS Using WebSockets to Monitor Victim Input and Remotely Control Screen Transitions

1. Basic Information

Severity: High
Article Title: Dissecting the JWR phishing framework
Publisher: Cisco Talos Blog
Publication Date: 2026-08-13
Original Source: https://blog.talosintelligence.com/dissecting-the-jwr-phishing-framework/
Related Sources: Talos IOC repository (linked in the original article)
Related Entities: JWR, The Outsider, Outsider Enterprise, Shopify, WooCommerce, PayPal, Apple, Klarna, Vue.js, WebSocket

2. Executive Summary

JWR is not a static credential-stealing page. It is a Chinese-language PhaaS (Phishing-as-a-Service) that uses AES-CTR encrypted WebSockets to stream credit card details and credentials to attackers as the victim types them. The attacker uses over 40 different commands to dynamically trigger real-time screen switches for OTPs, secondary cards, and banking app approvals.

3. Attack Flow

Real-Time Exfiltration via SMS

The user receives an SMS disguised as a toll fee, postal service, or delivery company, which leads them to a malicious URL.
The parent page sets window.__HOST_MODE and launches the Host Bridge or Vue.js Content Mode.
It creates a session ID in the format JWRCVV-<timestamp>-<random>-<random>, and a Web Worker maintains the WebSocket connection.
An initial beacon sends the IP address, country, referrer URL, and device/OS information to the C2 server.
Input field values are streamed to the C2 server in real-time before the user clicks submit, allowing the attacker to review them.
The attacker uses commands like to_info, to_card, to_sms, to_2fa, to_pin, and to_app to remotely switch the victim's screen.
Fake errors such as tip_fail or tip_change_card are displayed to trick the user into entering a secondary card or re-entering information.
Upon completion, all cvvform data is sent via POST to api/open/the_final_interface, and the user is redirected to the legitimate website.

Alternative Communication Channels

In environments where WebSockets are blocked, the framework falls back to HTTP long polling via api/open/pollInstruction to fetch the same commands.
It supports Host Bridge, plugin iframe, and host iframe modes, even in configurations where child iframes cannot reach the C2 server directly.

4. Attacker Positioning and Execution Location

The JWR management console and C2 server run on the attacker's infrastructure.
The Host Bridge, Vue.js application, and Web Worker run inside the victim's browser.
The attacker monitors individual sessions from the management dashboard and manually dictates the next screen and error messages.

5. Visibility for Victims and Administrators

The victim sees a Shopify or WooCommerce checkout page that accurately replicates real product names, quantities, and amounts.
Credentials are stolen before the submit button is even pressed, and card declines or OTP failures appear legitimate.
Security Operations Centers (SOCs) can observe SMS URLs, long-lived binary WebSockets, Web Workers, continuous REST API requests, and the final POST request.

6. Success and Failure Conditions

Success Conditions

The user opens the SMS link and enters their information.
WebSockets or long polling are allowed by the network.
The victim trusts the fake brand, cart information, and screen transitions.
The attacker successfully keeps pace with the victim's input and legitimate authentication processes in real-time.

Failure Conditions

SMS URLs or newly registered domains are blocked.
JWR-specific WebSocket paths, REST endpoints, and JavaScript signatures are detected.
The user checks the checkout domain and refuses to enter a secondary card after seeing a fake error.
Financial institutions flag the card or OTP use immediately following exfiltration as high-risk.

7. What Happens on Success

Card numbers, CVVs, PINs, up to three sets of web credentials, PayPal, Apple, Klarna accounts, SMS/email OTPs, banking app approvals, ID card images, SSNs, cookies, and device fingerprints may be stolen. The operator can view values as they are typed and select the appropriate authentication screen next.

8. Observable Logs

Email: The primary vector is SMS. In email-based campaigns, check for spoofed URLs and branding.
Proxy/SWG/DNS: Newly registered domains, WebSocket upgrades, webSocket/QT/..., api/open/addClick, getSyncSettings, pollInstruction, addCvv, and the_final_interface.
Endpoint/EDR: Browsers, iframes, Web Workers, and JWRCID / JwrExecutedInstructions in sessionStorage. No endpoint malware is required.
Identity/IdP: Logins, OTPs, push approvals, and anomalous devices or locations immediately following exfiltration.
SaaS/Cloud: Shopify/WooCommerce order/cart referrers and payment provider fraud logs.
Network: Long-lived WebSockets, AES-CTR encrypted binary traffic, and fallback to long polling when WebSockets are blocked.

9. Attack Progression Stages

Contact Only: SMS received, URL accessed.
Initial Session: addClick event, JWRCID generated, WebSocket established.
User Interaction: Personal information, credit card, and OTP input events.
Data Exfiltration: Successful addCvv or the_final_interface request, followed by fraudulent use of the data.
Authentication Success: Attacker session or card approval confirmed in separate logs.
Subsequent Compromise: Account takeover or successful fraudulent payment confirmed.

10. Investigation Playbook

Trigger: JWR URL, WebSocket path, REST endpoint, ClamAV/Snort detection, or unauthorized login immediately following an OTP prompt.
Initial Verification: Preserve SMS messages, URLs, timestamps, input fields, browser history, and DNS/proxy logs.
Endpoint: Preserve browser storage, Service Workers/Web Workers, DevTools logs, and cookies.
Authentication/Cloud: Revoke and review target service sessions, OTPs, push notifications, and card authorizations.
Subsequent Actions: Check for secondary card usage, access to email/PayPal/Apple accounts, or identity document misuse.
Containment: Revoke sessions, change credentials, block cards, block domains, and report the SMS vector.
Classification: Delivered / Session Established / Data Entered / Exfiltrated / Account or Payment Compromised.

11. Defense and Detection Ideas

Single Event: JWR endpoints, JWRCVV- strings, unique WebSocket suffixes, and Talos Snort SIDs 66924–66928.
Time-Series Correlation: SMS click -> arrival beacon -> WebSocket -> multiple authentication screens -> final POST -> redirect to legitimate site.
Hunting: api/open/*, Vue 2 phishing bundles, 44 page command names, and abuse of Shopify cart_data.
Log Gaps: Without cross-referencing SMS, browser WebSockets, POST bodies, and card authorization logs, determining success is difficult.
Priority Actions: URL inspection, WebSocket monitoring, step-up authentication for financial transactions, user awareness training, and detecting communication patterns rather than relying solely on IOCs.

12. Facts / Inference / Hypothesis

Facts

Talos confirmed JWR in active SMS campaigns.
The framework features 44 phishing pages and over 40 operator commands.
It streams input values to the C2 server sequentially as the user types.
Talos assesses with medium confidence that this is a variant of The Outsider.
Management messages are written in Simplified Chinese.

Inference

This attack can easily be adapted for regional delivery, toll, and e-commerce brands by simply swapping out templates.
Blocking WebSockets alone is insufficient because the framework falls back to long polling; correlation between endpoints and behavioral patterns is required.

Hypothesis

Rapid screen transitions demanding multiple cards or OTPs after displaying a failure message can serve as a more effective user-side signal than static URL evaluation.

13. MITRE ATT&CK Mapping

High Confidence: T1566.002 Spearphishing Link, T1056 Input Capture, T1539 Steal Web Session Cookie, T1111 Multi-Factor Authentication Interception, T1185 Browser Session Cookie, T1071.001 Web Protocols.
Medium Confidence: T1656 Impersonation, T1583.001 Domains, T1041 Exfiltration Over C2 Channel.

14. Unknowns / Areas for Further Investigation

The relationship between JWR operators and Outsider Enterprise.
C2 infrastructure, sales channels, total number of victims, and actual financial losses.
The existence of localized language templates.

15. Impact on SOCs and Organizations

SMS messages disguised as delivery services, e-commerce platforms, or toll fees can easily trick users. In addition to securing mobile URLs, organizations must correlate WebSocket traffic, REST fallbacks, and anomalous logins following OTP prompts with financial and identity logs.

16. Summary by Target Audience

For SOCs: Correlate not only WebSockets, but also REST fallbacks and final POST requests.
For Administrators: Implement JWR signatures, Snort SIDs, SMS URL inspection, and authentication risk scoring.
For End Users: Never enter credit card details or OTPs in response to SMS messages about unpaid fees or redelivery links. Stop immediately if a fake error asks for a secondary card.

VMware vCenter CVE-2026-59310: Active Exploitation of Unauthenticated RCE for Persistent Reverse SSH

Anoymask — Fri, 14 Aug 2026 03:01:12 +0000

VMware vCenter CVE-2026-59310: Active Exploitation of Unauthenticated RCE for Persistent Reverse SSH

1. Basic Information

Severity: Critical
Article Title: Critical VMware vCenter RCE flaw exploited for reverse SSH access
Publisher: BleepingComputer
Publication Date: 2026-08-13
Original Article: https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/
Related Sources: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017, https://www.securityweek.com/critical-vmware-vulnerability-in-attackers-crosshairs/
Related Entities: CVE-2026-59310, VMware vCenter Server, vCenter Syslog Server, reverse_ssh, ESXi

2. Executive Summary

Five days after the patch release, attacks were observed exploiting a directory traversal vulnerability in internet-reachable vCenter Syslog Servers. Attackers achieved unauthenticated remote code execution, used cron to launch an open-source reverse_ssh client, and maintained outbound SSH C2 connections.

3. Attack Flow

The attacker connects over the network to an unpatched vCenter Syslog Server.
The attacker exploits the CVE-2026-59310 directory traversal flaw to achieve arbitrary code execution on vCenter without authentication.
The attacker creates a malicious cron job for persistence.
The attacker deploys and launches an open-source reverse_ssh client.
An outbound reverse SSH connection is established from vCenter to the attacker's C2 server, bypassing inbound firewall rules to maintain a remote shell.
Public reports do not describe subsequent successful ESXi/VM operations, credential theft, or lateral movement.

4. Attacker Position and Execution Location

The attacker connects to the vCenter Syslog Server from the external network.
The exploit, cron job, and reverse_ssh run on the vCenter Server appliance.
The C2 server is external, and the connection originates outbound from vCenter.
Although vCenter is the centralized management plane for ESXi and VMs, public data shows no evidence of actual impact on managed targets.

5. Visibility for Victims and Administrators

Unauthenticated abnormal Syslog Server requests, directory traversal patterns, and unexpected processes or files on vCenter are visible.
New or modified cron entries and unusual reverse_ssh processes remain.
Long-running SSH-like traffic from vCenter to unknown hosts occurs even without inbound sessions.
Finding a vulnerable vCenter or a reverse_ssh binary alone does not confirm successful CVE exploitation. Analysts must check timestamps, parent processes, cron jobs, and outbound C2 traffic together.

6. Conditions for Success and Failure

Success Conditions

Affected versions of the vCenter Syslog Server are reachable by the attacker.
The security patch is not applied.
File creation, cron modifications, and process execution after the exploit are not blocked.
Outbound communication from vCenter to the attacker's C2 is allowed.

Failure Conditions

The system is updated to a patched version.
The management plane is isolated from the internet and restricted to a trusted admin network only.
File, cron, and process changes on the vCenter appliance are detected and blocked.
Unknown SSH and tunnel destinations are blocked using an egress allowlist.
Broadcom provides no workaround, meaning mitigation steps cannot replace patching.

7. What Happens on Success

Unauthenticated code execution and a persistent remote shell are established on the vCenter appliance. Using vCenter management privileges and stored data to control ESXi and VMs is a severe subsequent risk, but public data does not confirm successful execution, so this is treated as an inference.

8. Observable Logs

Email: None.
Proxy/SWG/DNS: Outbound traffic from vCenter to unknown C2, DNS resolution, and reverse SSH connections.
Endpoint/EDR: reverse_ssh, unknown binaries, cron modifications, shells, and file creation on vCenter. If the appliance lacks EDR, use OS auditing or FIM instead.
Identity/IdP: Initial exploitation requires no authentication. Subsequent new sessions, tokens, or role changes if vCenter accounts or APIs are used.
SaaS/Cloud: vSphere API tasks, ESXi host/VM operations, snapshots, and credential/secret access.
Network: Malicious requests to the Syslog Server, long-running outbound connections from vCenter, and abnormal east-west traffic from the management network.

9. Determining Attack Success

Contact Only: Scans or malicious requests only, with no server-side artifacts.
Initial Execution Suspected: Unknown files/shells on vCenter, and errors/requests at the matching timestamp.
RCE Confirmed: Exploit requests and corresponding process/file generation confirmed in the same timeline.
Persistence/C2 Confirmed: Malicious cron jobs, reverse_ssh execution, and outbound C2 sessions.
Subsequent Compromise: Confirmed vSphere tasks, ESXi/VM modifications, or credential usage (not confirmed in public data).

10. Investigation Playbook

Trigger: CVE-2026-59310 exploit patterns, unknown vCenter cron jobs, reverse_ssh, and outbound SSH/tunnels.
Initial Check: Confirm the vCenter version/build, patch time, external reachability, and initial malicious request.
Endpoint: Preserve cron jobs, process trees, filesystems, shells/audits/syslogs, binary hashes, and network sockets.
Authentication/Cloud: Check vCenter sessions, SSO tokens, roles, API tasks, ESXi trust, and backup/snapshot operations.
Subsequent Operations: Investigate host additions/deletions, VM power states, snapshots, guest tools, datastores, credential exports, and lateral movement.
Containment: Isolate the vCenter management plane, block C2 traffic, apply patches, rotate credentials/certificates, rebuild compromised appliances, and investigate managed targets broadly.
Judgment Categories: Scanned / Exploit Attempted / RCE Confirmed / Persistence-C2 Confirmed / Management Plane Compromised / ESXi-VM Impact Confirmed.

11. Defense and Detection Ideas

Single Event: reverse_ssh on vCenter, unknown cron jobs, and Syslog Server traversal requests.
Timeline Correlation: Unauthenticated request -> file/process -> cron -> reverse SSH egress -> vSphere API task.
Hunting: Check all vCenter versions, cron differences, unknown ELF binaries, outbound SSH, and traffic after the disclosure date of 2026-08-03.
Log Gaps: Appliance EDR, full command lines, Syslog Server requests, egress traffic, and vSphere task retention logs are often missing.
Priority Countermeasures: Update to versions 9.1.0.0300, 9.0.2.0100, 8.0 U3k / U2f or later, isolate the management plane, and apply egress allowlists.

12. Facts / Inference / Hypothesis

Facts

CVE-2026-59310 is a directory traversal vulnerability in the vCenter Syslog Server that leads to unauthenticated arbitrary code execution. The CVSS score is 9.8.
Broadcom released a patch on 2026-07-29, and there is no workaround.
Callbacks were observed starting 2026-08-03, and public reports counted 361 victim IPs across 47 countries by 2026-08-07.
Attackers used cron and the open-source reverse_ssh client.
361 IPs do not necessarily equal 361 distinct organizations.

Inference

Because reverse SSH uses outbound connections, inbound firewalls alone cannot stop the C2 traffic.
vCenter compromise can potentially lead to ESXi/VM control, but public data has not confirmed this success.

Hypothesis

Due to rapid active exploitation and the high value of centralized management planes, multiple threat actors, including advanced groups, may use the same vulnerability.
QUIRSO suspects APT involvement, but public evidence alone cannot confirm attribution.

13. MITRE ATT&CK Mapping

High Confidence: T1190 Exploit Public-Facing Application, T1059.004 Unix Shell, T1053.003 Cron, T1105 Ingress Tool Transfer, T1572 Protocol Tunneling.
Medium Confidence: T1071.004 DNS (if C2 name resolution is confirmed), T1090 Proxy, T1210 Exploitation of Remote Services (if subsequent lateral movement is confirmed).

14. Unknowns and Further Investigation

Full formats of exploit requests and payloads, and the complete set of compromised binaries/C2 IOCs.
Execution privileges and whether vCenter SSO/certificates/credentials were accessed.
Actual subsequent operations on ESXi/VMs, data theft, and destructive activities.
Attacker attribution and the exact number of organizations included in the 361 IPs.

15. Impact on Organizations and SOCs

vCenter is a centralized management point for virtual infrastructure, making timely updates critical for organizations across industries such as manufacturing, finance, healthcare, and public sectors. Because there is no workaround, patching is the highest priority. Since exploitation began days after disclosure, organizations must conduct emergency changes and post-incident hunting instead of waiting for regular patch cycles.

16. Summary by Role

For SOCs: Distinguish between exploit attempts and successful RCE/cron/C2 establishment, and track up to vSphere tasks.
For Administrators: Update immediately to patched versions, isolate vCenter, restrict egress traffic, and check credentials and certificates.
For Users: General users do not need to take action. Report any virtual infrastructure anomalies or VM outages to administrators.

Jewelbug: XG-Web Infrastructure Supporting Government Webmail Compromise and Browser Takeover

Anoymask — Fri, 14 Aug 2026 03:01:01 +0000

Jewelbug: XG-Web Infrastructure Supporting Government Webmail Compromise and Browser Takeover

1. Basic Information

Severity: High
Article Title: Jewelbug: Espionage and Crypto Fraud Operations Intersect
Publisher: Symantec Threat Hunter Team / Security.com
Publication Date: 2026-08-13
Source Link: https://www.security.com/threat-intelligence/jewelbug-crypto-fraud-espionage
Related Information Sources: https://www.bleepingcomputer.com/news/security/hackers-breach-govt-webmail-while-running-parallel-crypto-fraud/
Related Entities: Jewelbug, Earth Alux, REF7707, CL-STA-0049, XG-Web, Antino, ClientKing, Microsoft Graph, Google Docs, Chrome, Firefox, ASUS routers

2. Executive Summary

Jewelbug injected JavaScript into government webmails on a shared hosting provider. This stole cookies and pushed fake Flash updates, deploying Antino, malicious browser extensions, Linux/router ClientKing implants, and rootkits. The group also used the same XG-Web infrastructure for cryptocurrency fraud.

3. Attack Flow

From Government Webmail to Windows Devices

The attackers insert a common malicious script tag into more than 15 government webmail tenants on a shared hosting provider.
When users log in or view their mailboxes, the script opens a WebSocket, completes a crypto handshake, and sends page cookies.
It shows a fake Adobe Flash update to devices that match the target government domain, are uninfected, and run Windows.
When a user runs the file, a fake Adobe installer or HTA deploys Antino.
Antino uses the Microsoft Graph API as a C2 channel to sideload a malicious "PDF Viewer" extension and a native messaging helper.
The extension steals cookies, history, bookmarks, screenshots, clipboard data, and network traffic, and injects arbitrary JavaScript.
The native helper runs commands via the Windows command interpreter.
The attackers also access internal virtualization management APIs from the compromised device.

Deploying ClientKing to Linux and Routers

The malware fetches a new random-XOR payload from Google Docs for each request.
It deploys the Rust-based ClientKing to Linux, ARM64, and ASUS routers.
It uses five types of C2 transport, including HTTP and DNS tunneling.
It provides a shell, a SOCKS proxy, and an in-memory kernel module.
A companion kernel rootkit and a malicious authentication module steal credentials for SSH, su, and sudo.

Cryptocurrency Fraud

The attackers create many AI-generated fake exchange pages that mimic OKX, Binance, and others.
They drive visitors to these sites using click bots and SEO poisoning.
They manage the scam sites using the same XG-Web control panel and infrastructure.

4. Attacker Locations and Execution Sites

The injected JavaScript and the XG-Web management infrastructure are on the attacker's side. The initial execution happens inside the victim webmail user's browser.
Antino, the extension, and the native helper run on Windows devices.
ClientKing, the rootkit, and the authentication module run on Linux, ARM64, and ASUS routers.
The infrastructure is the same, but public sources do not confirm the organizational relationship between the espionage team and the crypto fraud team.

5. Visibility for Victims and Administrators

Webmail users see an overlay that looks like a Flash update after a normal login.
Administrators can see common external scripts, WebSockets, cookie exfiltration, HTA or installer files, extension sideloading, and Graph API traffic.
On Linux and routers, they can see Google Docs requests, DNS tunneling, SOCKS traffic, unknown Rust binaries, kernel modules, and SSH authentication hooks.
Because the attack uses legitimate services like the Graph API, Google Docs, browser extensions, and shared hosting, simple domain allowlists cannot easily detect it.

6. Success and Failure Conditions

Success Conditions

The attackers successfully compromise a shared host to inject scripts into webmail templates.
Target users access the site on Windows and run the fake update.
The environment allows extension sideloading, native messaging, Graph API, Google Docs, and DNS egress.
The attackers have permissions to load implants and modules on Linux and routers.

Failure Conditions

Webmail template integrity monitoring removes the common script.
Users do not run the Flash update requested by the web page.
The organization blocks unauthorized extensions, native messaging hosts, and HTAs.
Security tools correlate and block Graph API, Google Docs, and DNS destinations along with device behavior.
Kernel module allowlists, Secure Boot, and router rebuilds eliminate ClientKing and rootkits.

7. What Happens Upon Success

Webmail cookies, email bodies, browser cookies, credentials, screenshots, clipboard data, and browsing history are stolen. Attackers gain the ability to run arbitrary commands on the device, relay SOCKS traffic, and explore internal management planes. On the crypto fraud side, victims are directed to fake exchanges and lose funds.

8. Observable Logs

Email: External scripts in webmail, email body access, and abnormal mailbox viewing.
Proxy/SWG/DNS: fonts.chrorne[.]com, WebSockets, Microsoft Graph, Google Docs, DNS tunneling, and fake exchange sites.
Endpoint/EDR: HTA files, fake Adobe installers, Antino, unauthorized PDF Viewer extensions, native helpers, Chrome native messaging registry keys, Rust binaries, and kernel modules.
Identity/IdP: Session reuse from new IP addresses or devices using stolen cookies, and mailbox access without authentication.
SaaS/Cloud: Microsoft Graph API calls, Google Docs payload downloads, and template changes in webmail tenants.
Network: SOCKS traffic, DNS tunneling, and internal access to https://192.168.x.x:8006/api2/json/cluster/resources.

9. Attack Success Determination

Contact Only: Malicious script loaded, overlay displayed.
User Action: Fake update downloaded or HTA executed.
Initial Execution: Antino, extension, and native helper created and started.
Authentication/Session Compromise: Cookies sent, and a different IP address uses those cookies for a session.
Data Theft: Cookies, credentials, or email bodies seen in C2 or management panels, or equivalent egress traffic confirmed.
Lateral Expansion: ClientKing, rootkit, SOCKS traffic, or internal virtualization API connections confirmed.

10. Investigation Playbook

Trigger: External script in webmail templates, chrorne domain, Graph C2, unauthorized extensions, or DNS tunneling.
Initial Verification: Identify affected tenants, template differences, script load times, target users, and cookie lifetimes.
Endpoints: Preserve downloads, HTAs, extension IDs/manifests, native messaging registry keys, Antino, ClientKing, modules, and shell history.
Authentication and Cloud: Revoke webmail and IdP sessions, and check Graph/Google Docs access, mailbox operations, and shared host admin changes.
Subsequent Operations: Search for internal virtualization management API access, SOCKS traffic, DNS tunneling, and stolen SSH/su/sudo credentials.
Containment: Repair templates, revoke sessions, change credentials, remove extensions and native hosts, rebuild infected Linux systems and routers, and block IOCs.
Decision Categories: Script Injected / User Exposed / Payload Executed / Session Stolen / Endpoint Controlled / Internal Expansion Confirmed.

11. Defense and Detection Ideas

Single Event: chrorne[.]com, unauthorized native messaging host, Flash update HTA, or unknown process communication with the Graph API.
Timeline Correlation: Webmail script -> cookie egress -> fake update -> HTA -> Antino -> extension -> Graph C2 -> internal API.
Hunting: Identical scripts across more than 15 tenants, com.microsoft.runedge registry keys, changing payloads from Google Docs, DNS tunneling, and ClientKing Rust builds.
Log Gaps: Webmail templates, browser extensions, Graph requests, and router/kernel telemetry are often missing.
Priority Measures: Isolate shared hosting, implement CSP/SRI, use extension allowlists, control native messaging, shorten session lifetimes, monitor DNS, and establish secure network device rebuild procedures.

12. Facts / Inference / Hypothesis

Facts

A common script tag was found in more than 15 government webmail tenants.
WebSockets were used to steal cookies and distribute Antino via fake Flash updates.
Antino used Microsoft Graph C2, malicious extensions, and native helpers.
ClientKing has 37 builds for Linux, ARM64, and ASUS routers, along with 5 C2 transports.
The management infrastructure recorded over 1 million check-ins, over 580,000 cookies, thousands of credentials, and more than 2,300 email bodies.
The same XG-Web infrastructure was used for both espionage and cryptocurrency fraud.

Inference

A single compromise of shared hosting provided a cross-tenant distribution point for multiple government targets.
Detection must focus on calling processes and API purposes, not just allowing or blocking SaaS traffic.

Hypothesis

The cryptocurrency fraud side most likely supplied access, infrastructure, and distribution capabilities to the espionage side, but the command relationship between the two remains unconfirmed.
Clipboard replacement for cryptocurrency addresses is implemented, but its use has not been confirmed in public espionage campaigns.

13. MITRE ATT&CK Mapping

High Confidence: T1189 Drive-by Compromise, T1056 Input Capture, T1539 Steal Web Session Cookie, T1176 Browser Extensions, T1059.003 Windows Command Shell, T1102.002 Bidirectional Communication, T1102.003 One-Way Communication, T1071.004 DNS, T1090 Proxy, T1014 Rootkit, T1556 Modify Authentication Process.
Medium Confidence: T1204.002 Malicious File, T1218.005 Mshta, T1021 Remote Services, T1041 Exfiltration Over C2 Channel.

14. Unknowns and Further Investigation

Initial access vector to the webmail shared hosting environment.
Complete list of victim organizations and countries, and actual damage from each artifact.
Contractual and command relationships between Jewelbug subgroups and registered companies in Hunan Province.
Direct targeting of Japanese-language fake exchanges or organizations in Japan.
Privilege escalation paths when deploying ClientKing and rootkits.

15. Impact on Global SOCs and Organizations

This campaign poses high relevance to organizations in government, telecommunications, aviation, defense, and cryptocurrency sectors. In environments where Microsoft Graph and Google Docs cannot be fully blocked, organizations must correlate telemetry across browser extensions, native helpers, DNS, and internal management APIs. Network devices, including ASUS routers, cannot be monitored using endpoint EDR agents alone.

16. Summary by Target Audience

For SOC Analysts: Track webmail scripts, sessions, extensions, Graph API traffic, and DNS tunneling as a single attack chain.
For Administrators: Maintain template integrity, enforce CSP, manage extension and native messaging allowlists, revoke sessions, and prepare router rebuild procedures.
For Users: Do not run Flash or PDF updates requested by webmail pages, and report unexpected browser extensions.

Akira: Intrusion Stopping EDR via Safe Mode and Exfiltrating Data Before Encryption

Anoymask — Fri, 14 Aug 2026 03:00:44 +0000

Akira: Intrusion Stopping EDR via Safe Mode and Exfiltrating Data Before Encryption

1. Basic Information

Severity: High
Article Title: Akira Hits Safe Mode: Ransomware Rebooting Around EDR
Publisher: Huntress
Publication Date: 2026-08-13
Original Article: https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr
Related Sources: https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/
Related Entities: Akira, SonicWall SSL VPN, Active Directory, WinRAR, s5cmd, Amazon S3, AnyDesk, Microsoft Defender, Windows Safe Mode

2. Executive Summary

This is a case where Akira attackers accessed a network via an SSL VPN without MFA. They enumerated Active Directory, compressed and exfiltrated shared data to Amazon S3, and installed AnyDesk for persistence. They then rebooted the system into Safe Mode with Networking to stop EDR. However, the ransomware failed to encrypt files due to low virtual memory.

3. Attack Flow

After many failed login attempts against a SonicWall SSL VPN, authentication succeeds on 2026-08-04 at 03:52:42 UTC.
About two hours later, the attackers RDP into the domain controller and run an elevated cmd.exe.
They use PowerShell commands (Get-ADUser and Get-ADComputer) to list users and computers, saving the output to C:\ProgramData.
On an application server, they use WinRAR to archive files from mapped network shares.
They use s5cmd cp --sp to send the archives to an attacker-controlled S3 bucket.
They install AnyDesk as a service for automatic startup to enable remote sessions, file transfers, and clipboard transfers.
They configure Safe Mode with Networking and add the AnyDesk service to the registry for SafeBoot.
After a reboot, they run akira.exe while Huntress and Defender real-time protection are not running.
After 13 seconds, a low virtual memory error occurs, and the encryption process fails.
After returning to normal mode, Defender isolates Akira. Data theft was completed before the encryption failed.

4. Attacker Positioning and Execution Locations

Initial access happened through an internet-facing SonicWall SSL VPN.
AD enumeration ran on the domain controller. Compression and exfiltration ran on the application server.
AnyDesk and Akira ran on Windows hosts. The S3 bucket and AnyDesk infrastructure are external.
Public reports do not explain additional privilege escalation methods. The use of an elevated shell was confirmed, but the path to obtain those privileges is unknown.

5. Visibility for Victims and Administrators

The VPN logs show many short-lived failed logins followed immediately by a successful login.
Administrators can see RDP connections, bulk AD enumeration, WinRAR, s5cmd, AnyDesk service registration, and Safe Mode reboots.
During Safe Mode, normal EDR and Defender monitoring stops. Defender Event ID 3002 records the startup failure.
Even without encrypted files or ransom notes, compression and outbound transfers mean data theft has occurred.

6. Success and Failure Conditions

Success Conditions

Valid credentials are used on a VPN without MFA.
RDP or administrative access is available from the VPN to the domain controller and application servers.
Reading shared data and running WinRAR, s5cmd, and AnyDesk are allowed.
The attacker has administrative rights to change SafeBoot settings and reboot.
Communication with external S3 buckets and AnyDesk is allowed.

Failure Conditions

VPN MFA, blocking failed login spikes, or risk-based authentication blocks access.
Network segmentation or RDP limits stop lateral movement.
Large-scale compression, S3 transfers, and AnyDesk installations are detected and isolated.
SafeBoot changes and Safe Mode reboots are blocked with high priority.
In this case, Akira ran out of virtual memory and failed to encrypt files.

7. What Happens on Success

Shared data is exfiltrated to the attacker's S3 bucket and can be used for double extortion. The attackers stop security products using Safe Mode and aim to encrypt files with Akira. In this case, data theft succeeded, but file encryption was not confirmed.

8. Observable Logs

Email: Public reports show no email vector.
Proxy/SWG/DNS: Traffic to external S3, AnyDesk, and attacker IP addresses. S3 object upload volume and timestamps.
Endpoint/EDR: Get-ADUser, Get-ADComputer, WinRAR, s5cmd, AnyDesk, msconfig.exe, SafeBoot registry keys, akira.exe, and virtual memory errors.
Identity/IdP: SonicWall VPN failed and successful logins, RDP logons, and privileged logons.
SaaS/Cloud: PUT or multipart uploads to the attacker's S3 bucket. If CloudTrail is missing on the victim side, proxy or network logs must cover this.
Network: VPN source IP 72.23.77.35, internal RDP, SMB share access, AnyDesk, and S3 egress.

9. Attack Success Assessment

Contact Only: VPN failure logs only.
Successful Authentication: VPN success and session issuance at 03:52:42 UTC.
Initial Execution: Internal RDP and enumeration commands confirmed.
Information Gathering: WinRAR archive creation of shared data.
Data Exfiltration: Confirmed via s5cmd success, S3 transfer volume, or destination objects.
Defense Evasion: Safe Mode startup and EDR/Defender stop confirmed.
Encryption: Failed in this case. No encrypted files or success logs.

10. Investigation Playbook

Trigger: VPN failure spike followed by success, SafeBoot changes, AnyDesk installation, s5cmd, and Akira detection.
Initial Check: Identify VPN sessions, source IP, authenticated user, destination, and the first RDP timestamp.
Endpoints: Preserve PowerShell logs, processes, registry keys, services, Kernel-Boot Event ID 27, Kernel-General Event ID 12, and Defender Event ID 3002.
Authentication & Cloud: Disable VPN credentials, check for RDP and administrative logons using the same ID, and review S3 traffic.
Subsequent Activity: Search for AdUsers.txt, AdComp.txt, WinRAR archives, s5cmd logs, AnyDesk transfers, and Akira binaries.
Containment: Disconnect VPN sessions, change credentials, isolate hosts, remove AnyDesk and SafeBoot persistence, block egress, and run a full scan in normal mode.
Assessment Categories: VPN Contact / VPN Compromised / Internal Execution / Exfiltration Confirmed / Defense Evasion Confirmed / Encryption Failed or Confirmed.

11. Defense and Detection Ideas

Single Event: SafeBoot registry changes, SAFEBOOT:NETWORK, AnyDesk SafeBoot service, s5cmd, and Defender error 0x8007043c.
Time-Series Correlation: VPN failure spike -> success -> RDP -> AD enumeration -> compression -> S3 transfer -> AnyDesk -> Safe Mode -> Akira.
Hunting: C:\ProgramData\AdUsers.txt and AdComp.txt, WinRAR commands with multiple share arguments, unknown S3 buckets, and AnyDesk peer 1778787240.
Log Gaps: Must cover VPN, RDP, process arguments, SMB, egress, and the lack of monitoring during Safe Mode.
Priority Mitigations: VPN MFA, administrative network segmentation, blocking SafeBoot changes, RMM allowlists, S3 egress controls, and EDR tamper protection.

12. Facts / Inference / Hypothesis

Facts

Successful authentication was confirmed on a SonicWall SSL VPN without MFA.
AD enumeration, shared data compression, S3 transfer via s5cmd, and AnyDesk installation were confirmed.
Huntress and Defender real-time protection did not run during Safe Mode.
Akira ran out of memory and failed to encrypt files.
This was the first time Huntress observed Akira using Safe Mode.

Inference

Even if encryption fails, extortion risks remain using the stolen data.
Visibility during Safe Mode is poor, so security teams must correlate pre-reboot settings changes with post-reboot forensic artifacts.

Hypothesis

On hosts with more virtual memory, the same Akira binary might complete encryption.

13. MITRE ATT&CK Mapping

High Confidence: T1133 External Remote Services, T1078 Valid Accounts, T1021.001 RDP, T1087.002 Domain Account Discovery, T1018 Remote System Discovery, T1560.001 Archive via Utility, T1537 Transfer Data to Cloud Account, T1219 Remote Access Software, T1562.001 Impair Defenses, T1486 Data Encrypted for Impact (execution attempted, not successful).
Medium Confidence: T1041 Exfiltration Over C2 Channel. Because of the S3 transfer, organizations may prioritize T1537 based on their ATT&CK framework usage.

14. Unknowns and Further Investigation

The source of the VPN credentials and the path to elevated privileges.
The full scope of exfiltrated data and how it is used.
The number of compromised hosts, additional persistence mechanisms, and the full infrastructure of the Akira operators.
Whether the encryption failure was environment-dependent or binary-specific.

15. Impact on SOCs

Tools like VPNs, RDP, AnyDesk, and WinRAR are common in enterprise environments, making isolated events easy to miss. Safe Mode reboots should not be assumed to be routine maintenance. Security teams should treat enumeration, compression, S3 transfers, and reboots occurring within hours of external VPN authentication as a single malicious intrusion flow.

16. Summary by Target Audience

For SOCs: Distinguish between file encryption success and data theft success, and correlate forensic evidence before and after Safe Mode.
For Administrators: Enforce VPN MFA, isolate RDP access, monitor SafeBoot changes, and maintain strict allowlists for RMM tools and cloud destinations.
For Users: Immediately report unexpected VPN authentication notifications or unexpected remote desktop activity.

Plug and Pwn: Getting Windows SYSTEM Privileges from Fake USB and RDP Devices

Anoymask — Thu, 13 Aug 2026 02:25:41 +0000

Plug and Pwn: Getting Windows SYSTEM Privileges from Fake USB and RDP Devices

1. Basic Information

Severity: High
Article Title: Plug and Pwn attack uses fake USB devices for Windows system access
Publisher: BleepingComputer (Original Research: Plug and Pwn)
Publication Date: 2026-08-12
Original URL: https://www.bleepingcomputer.com/news/security/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access/
Related Source: https://plugandpwn.com/
Related Entities: Windows 11, Windows Plug and Play, Windows Update, RDP USB redirection, Sierra Wireless, Sony FeliCa, Intel RealSense, FaceDancer, Cynthion, GreatFET, CVE-2019-10617

2. One-Sentence Summary

This research shows that simply connecting a fake USB device or a virtual USB via RDP can trick Windows Plug and Play into installing official drivers with SYSTEM privileges, leading to a reverse shell by chaining the installation process and known vulnerabilities.

3. Attack Flow

Chain A: Zero-Click SYSTEM Execution via Physical USB

The attacker uses FaceDancer, Cynthion, or GreatFET to fake a USB device descriptor.
Windows recognizes it as a Sierra Wireless device, automatically downloads a signed vendor package from Windows Update, and installs it with SYSTEM privileges.
The installed components are used to change DNS settings.
The same device re-enumerates as a Sony FeliCa device to download extra software via HTTP.
Poisoned name resolution points the download to the attacker, who writes malicious files with SYSTEM privileges.
The device re-enumerates as a Sierra device again, loads the malicious files, and gets a SYSTEM reverse shell.

Chain B: NoPlug and Pwn (RDP)

The attacker redirects a crafted USB descriptor through an RDP connection.
The remote Windows creates it as a local PnP device and selects the Intel RealSense driver package.
It abuses the load path of the co-installer DLL to run code with SYSTEM privileges.

Chain C: Old Driver Vulnerabilities

The device enumerates as a composite USB device and offers multiple functions via usbccgp.sys.
The INF installs an old driver as a service.
Known vulnerabilities, such as CVE-2019-10617, are used for local privilege escalation.

4. Attacker Position and Execution Location

Chain A starts with a person who has physical access to the device's USB port or a malicious peripheral.
Chain B presents a virtual USB from the RDP connection source, and the code runs with SYSTEM privileges on the destination Windows.
Driver acquisition, INF processing, and co-installers are executed by the Windows PnP and update systems with SYSTEM privileges.

5. Visibility for Victims and Administrators

No user logon or UAC approval is needed. It looks like a normal "Setting up a device" behavior.
Administrators will see the enumeration of different vendor devices in a short time, driver downloads from Windows Update, network setting changes, and SYSTEM child processes.
In an RDP environment, it is observed as a PnP creation from a remote session, even without a physical USB.

6. Conditions for Success and Failure

Conditions for Success

USB connection or RDP Plug and Play redirection is allowed.
Compatible driver packages can be downloaded from Windows Update.
Vulnerable processes remain, such as co-installers of the target package, HTTP downloads, or old drivers.
Device installation restrictions are not applied.

Conditions for Failure

The system rejects installations other than allowed Hardware IDs or Device Classes.
RDP PnP redirection is disabled.
Driver download sources and HTTP downloads are blocked.
A blocklist of old vulnerable drivers and application control are applied.

7. What Happens on Success

Without user action, the attacker can create files with SYSTEM privileges, load DLLs, create services, change network settings, and get a reverse shell. The published content is a research demo and is not confirmed to be used in actual attack campaigns.

8. Observable Logs

Email: None in principle. This is only relevant if malicious peripherals are delivered (Hypothesis).
Proxy/SWG/DNS: Windows Update or vendor downloads, HTTP downloads of Sony software, and immediate DNS changes followed by communication with the attacker.
Endpoint/EDR: Kernel-PnP, DriverFrameworks, SetupAPI, C:\Windows\INF\setupapi.dev.log, new drivers or services, and abnormal DLLs or shells run by SYSTEM.
Identity/IdP: RDP authentication, connection source, session ID. The physical chain has no authentication events.
SaaS/Cloud: Usually none.
Network: RDP USB virtual channel, driver downloads, connections after DNS changes, and reverse shells.

9. Attack Success Determination

Contact Only: USB insertion or RDP connection only.
Initial Execution Prep: New PnP enumeration, vendor package download.
Initial Execution: SYSTEM-privilege co-installer, service, or malicious DLL load.
Compromise Success: DNS modification, SYSTEM shell, external C2 connection.
Follow-on Compromise: Credential theft, persistence, and lateral movement only occur if additional evidence is found.

10. Investigation Playbook

Trigger: Unauthorized USB, PnP device creation during RDP, rapid re-enumeration of multiple vendors, SYSTEM network traffic.
Initial Check: Determine connection time, Hardware ID, Device Instance ID, RDP session, and presence of an operator.
Endpoint: Preserve SetupAPI, PnP events, DriverStore, INF, services, DNS settings, process tree, and memory.
Authentication/Cloud: Check RDP logon and source, RD Gateway, MFA, and session reconnection.
Follow-up Actions: Check for SYSTEM shells, credential access, persistence, and lateral movement.
Containment: Consider device isolation, stopping USB or RDP redirection, removing malicious drivers and services, restoring DNS, and rebuilding.
Judgment Categories: Device Presented / Driver Installed / SYSTEM Execution / C2 Confirmed / Follow-on Compromise.

11. Defense and Detection Ideas

Single Event: Unauthorized Hardware ID, new PnP during an RDP session, HTTP download by SYSTEM, DNS change right after driver installation.
Timeline Correlation: USB enumeration -> Signed driver download -> Re-enumeration to another vendor -> DNS change -> Outbound SYSTEM traffic.
Hunting: SetupAPI showing multiple vendors in a short time, co-installer DLLs, new kernel services, old vulnerable drivers.
Log Gaps: Requires USB asset inventory, SetupAPI collection, RDP virtual channels, and DNS setting change logs.
Priority Actions: Device Installation Restrictions, Hardware ID allowlist, fDisablePNPRedir, blocking vulnerable drivers, and blocking HTTP downloads.

12. Facts / Inference / Hypothesis

Facts

Researchers demonstrated a physical chain on a fully updated Windows 11 that reached a SYSTEM shell in about 5 minutes from a logged-out state.
They also demonstrated "NoPlug and Pwn," which works using only RDP USB redirection.
Windows runs part of its PnP packages with SYSTEM privileges without UAC.
DisableCoInstallers alone cannot stop this entire class of attacks.

Inference

In VDIs, jump servers, and shared conference room terminals, RDP redirection settings act as a boundary equal to physical port control.

Hypothesis

The physical chain can be used in actual attacks by delivering malicious peripherals, leaving them in conference rooms, or posing as maintenance personnel.

13. MITRE ATT&CK Mapping

High Confidence: T1200 Hardware Additions, T1068 Exploitation for Privilege Escalation, T1543.003 Windows Service, T1105 Ingress Tool Transfer, T1059.003 Windows Command Shell.
Medium Confidence: T1021.001 RDP, T1562.001 Impair Defenses, and credential access after T1098 only if follow-up actions are confirmed.

14. Unknowns and Additional Investigation

The scope of permanent fixes by Microsoft and various vendors.
Whether this is used in real attacks and the total number of vulnerable packages.
Reproducibility across different Windows SKUs and enterprise update management configurations.

15. Impact on SOCs and Organizations

Organization endpoints such as VDIs, remote maintenance tools, and factory, conference room, or reception terminals often trust PnP implicitly. Organizations must include not only USB control products, but also RDP redirection, driver downloads, and SetupAPI logs in their asset management and SOC monitoring scope.

16. Summary by Target Audience

For SOCs: Correlate PnP enumeration, driver downloads, SYSTEM execution, and DNS changes. Distinguish between research demos and real compromises.
For Administrators: Prioritize USB device allowlists and disabling RDP PnP redirection.
For Users: Do not connect unknown USB devices. Report immediately if an automatic setup starts after connecting a device.

City-Forum: Anonymous Data Enumeration Across Salesforce Aura / LWR and ServiceNow Guest Search

Anoymask — Thu, 13 Aug 2026 02:25:32 +0000

City-Forum: Anonymous Data Enumeration Across Salesforce Aura / LWR and ServiceNow Guest Search

1. Basic Information

Severity: High
Article Title: An Advanced Attacker Is Targeting Salesforce and ServiceNow
Publisher: Reco
Publication Date: 2026-08-12
Original Source: https://www.reco.ai/blog/city-forum-campaign-salesforce-servicenow
Related Sources: https://www.securityweek.com/stealthy-city-forum-attacks-target-salesforce-and-servicenow-with-custom-toolset/
Related Entities: City-Forum campaign, Salesforce Experience Cloud, Aura, LWR, UI API, GraphQL, ServiceNow Service Portal, 158.220.87.79, city-forum.com

2. One-Sentence Summary

A single Go-based tool uses unauthenticated Salesforce guest permissions to enumerate Aura and LWR GraphQL APIs, and quickly scans ServiceNow's private Service Portal search API from the same source to collect data that site administrators accidentally left public.

3. Attack Flow

Salesforce Aura

Finds an Experience Cloud site.
Sends a POST request to /aura or /s/sfsites/aura as a guest.
Uses HostConfigController.getConfigData to list Accounts, Contacts, Cases, Leads, Users, and ContentDocuments available to guests.
Uses SelectableListDataProviderController.getItems to page through records for each object.
Adds /SiteRegister and /CommunitiesSelfReg to each subsite to check if self-registration is open. No successful registrations were observed.

Salesforce LWR

Identifies LWR sites using the lwr_app Link header or LWR.define(...).
Sends a guest POST request to /webruntime/api/services/data/vNN.0/graphql.
Queries EntityDefinition to list objects available via the UI API.
Scans versions continuously from v56.0 to v66.0.
Uses cursors to retrieve records allowed by guest object permissions, FLS, and sharing rules.

ServiceNow

Opens the guest Service Portal using /$sp.do?...&id=landing.
Sends search terms, portal information, sources, and counts to POST /api/now/sp/search?sysparm_cancelable=true.
Uses response length to distinguish between empty responses and search terms that return content.
Collects results that Knowledge Bases and custom search sources expose to guests.

4. Attacker Position and Execution Location

The traffic source is 158.220.87.79 on Contabo, and city-forum.com has pointed to this IP since 2025-03-12.
The tool uses Go-http-client/1.1 and connects from the internet to public Salesforce and ServiceNow Web APIs.
The processes run under the SaaS Guest User context. No malware runs on victim corporate endpoints.

5. Visibility for Victims and Administrators

There are no user actions, logins, or MFA events.
In Salesforce, large amounts of AuraRequest, Sites, sequential API versions, and self-registration URLs appear.
In ServiceNow, syslog_transaction shows Created by = guest, REST requests, /api/now/sp/search, and non-human timing intervals.
HTTP 201 is returned even for empty responses, so status codes alone cannot confirm successful data leaks.

6. Success and Failure Conditions

Success Conditions

Salesforce Guest Users have read permissions for objects, fields, and sharing rules.
LWR has "Allow guest users to access public APIs" enabled.
ServiceNow public portals have search sources without login gates or have loose KB read criteria.
Rate limits and anomaly detection do not block fast enumeration.

Failure Conditions

Guest Users are set to minimum privilege, removing unnecessary sharing, FLS, files, and activity permissions.
LWR guest UI APIs are disabled.
ServiceNow search sources use gs.isLoggedIn(), GlideRecordSecure, and proper roles/read criteria.
Guest access, non-browser user agents, and high-frequency enumeration are blocked.

7. What Happens on Success

Without breaking authentication, an attacker can bulk-collect customers, contacts, cases, documents, and knowledge articles that site owners exposed to Guest Users. This does not breach the Salesforce or ServiceNow platforms themselves; it abuses the anonymous public settings of each tenant. No successful self-registration or escalation to authenticated privileges has been observed.

8. Observable Logs

Email: Not used in this chain. city-forum.com allows the IP as an SPF sender, but email attacks are unconfirmed.
Proxy/SWG/DNS: Limited on the external user side. DNS shows city-forum.com resolving to 158.220.87.79.
Endpoint/EDR: No execution on victim terminals.
Identity/IdP: Salesforce and ServiceNow Guest Users. Not visible in normal sign-in logs alone.
SaaS/Cloud: Salesforce Event Monitoring logs for AuraRequest/Sites, CLIENT_IP, USER_AGENT, ACTION_MESSAGE, and URIs. ServiceNow syslog_transaction logs for IP, URL, Created by, User agent, and Output length.
Network: WAF/CDN logs showing Go-http-client/1.1, sequential API versions, and high-frequency POST requests to /aura, /webruntime/, and /api/now/sp/search.

9. Determining Attack Success

Contact Only: Public site GET requests, empty 201 responses, failed GraphQL calls.
Enumeration Started: getConfigData, EntityDefinition, API version sweeps, search term scans.
Data Retrieved: Increasing response size, paging in batches of 2000, hasNextPage cursors, and growing ServiceNow output lengths.
Self-Registration Attempted: Access to registration URLs only. Without account creation logs, privilege escalation is not confirmed.
Follow-on Abuse: Using retrieved data, authenticated accounts, or expanding to other SaaS platforms requires additional evidence.

10. Investigation Playbook

Trigger: 158.220.87.79, Go-http-client/1.1, massive guest Aura requests, LWR version sweeps, and sudden spikes in ServiceNow searches.
Initial Check: Identify the target portal, time, source IP, user agent, and response count/length to separate simple contact from data retrieval.
Terminals: Generally out of scope. Do not assume administrator terminals are compromised.
Authentication & Cloud: Audit Guest Profiles, sharing rules, FLS, UI APIs, self-registration, ServiceNow search sources, and KB read criteria.
Subsequent Actions: Look for phishing using the same data and email addresses, credential attacks, and unauthorized access to other SaaS apps.
Containment: Do not just block IOCs. Fix anonymous public permissions and identify the specific records that leaked.
Judgment Levels: Scanned / Enumeration Confirmed / Data Returned / Bulk Collection Confirmed / Self-Registration Confirmed / Follow-on Abuse.

11. Defense and Detection Ideas

Single Events: Guest user + Go-http-client/1.1, LWR UI API, ServiceNow guest search.
Time-Series Correlation: Site discovery -> configuration enumeration -> object paging -> self-registration checks. For ServiceNow, correlate search counts with output lengths.
Hunting: Look for ACTION$getConfigData, ACTION$getItems, v56.0→v66.0, SiteRegister, and guest sp/search requests.
Log Gaps: If Salesforce Event Monitoring licenses are missing, use CDN/WAF logs as a backup. ServiceNow does not log POST bodies, so search terms cannot be recovered.
Priority Fixes: Set Guest Users to minimum privilege, disable LWR guest UI APIs, stop self-registration, audit ServiceNow search sources and KB criteria, and implement rate limiting.

12. Facts / Inference / Hypothesis

Facts

The same IP address and Go tool crossed between Salesforce Aura, LWR, and ServiceNow.
The largest Salesforce target recorded over 560,000 events.
This is the first reported real-world observation of Salesforce LWR guest UI API abuse.
ServiceNow search APIs return HTTP 201 to both anonymous and authenticated users.
Reco has not attributed the attacker to a specific threat group.

Inference

Communications, financial, manufacturing, and public sector organizations with customer portals face similar configuration risks.
Blocking IOCs alone allows attackers to restart the same guest enumeration from a different IP address.

Hypothesis

The collected contact and case information may be used to improve the accuracy of targeted phishing or helpdesk fraud.

13. MITRE ATT&CK Mapping

High Confidence: T1589 Gather Victim Identity Information, T1595 Active Scanning, T1213 Data from Information Repositories, T1530 Data from Cloud Storage (if public documents are retrieved). T1190 Exploit Public-Facing Application is rated Low to Medium because this attack relies on configuration abuse.
Medium Confidence: T1114 / T1567, etc., are not confirmed in this material and apply only if follow-up abuse is discovered.

14. Unknowns and Additional Investigation

Attacker attribution, storage locations for collected data, and final goals.
The exact records and sensitivity levels returned to each organization.
Whether any environments succeeded in self-registration.
The time gap between infrastructure setup in March 2025 and the actual start of scanning.

15. Impact on SOCs and Organizations

SOCs that focus mainly on SaaS authentication logs easily miss this activity. Organizations that publicly expose Salesforce Experience Cloud or ServiceNow Portals must treat Guest Users not as "unauthenticated and therefore without privileges," but rather audit them just like permanent service accounts.

16. Summary by Role

For SOCs: Monitor guest API enumeration and response volumes. Do not use HTTP 201 or the lack of logins as indicators of safety.
For Administrators: Audit Salesforce sharing, FLS, LWR UI APIs, and ServiceNow search sources/KB criteria.
For Portal Owners: Because this attack involves no user actions, portal owners must regularly review the scope of their public information.

WindRelay + SpyNote: Phone Remote Control and NFC Relay for Loan and Card Fraud

Anoymask — Thu, 13 Aug 2026 02:25:23 +0000

WindRelay + SpyNote: Phone Remote Control and NFC Relay for Loan and Card Fraud

1. Basic Information

Severity: High
Article Title: Android malware combo takes out loans and relays victims' credit cards
Publisher: BleepingComputer (Investigation by Group-IB)
Publication Date: 2026-08-12
Original Article: https://www.bleepingcomputer.com/news/security/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards/
Related Source: https://www.group-ib.com/masked-actors/tx-nfc/
Related Entities: WindRelay, SpyNote, Android, Accessibility Service, NFC, Host Card Emulation, Mobile Banking

2. Summary

This is a complex financial fraud scheme. Attackers call victims while posing as bank staff. They trick victims into installing a SpyNote APK that contains the victim's name and granting Accessibility permissions. The attackers then use remote control to take out loans. Next, they use WindRelay to relay real credit card NFC communication to the attacker's device in real-time, allowing them to make purchases at a legitimate POS terminal.

3. Attack Flow

Device Compromise and Loans

An attacker calls the victim and pretends to be a bank employee.
The attacker tricks the victim into sideloading a SpyNote APK that includes the victim's name.
The attacker makes the victim enable Android Accessibility Service permissions.
The attackers use SpyNote's remote control features to silently install WindRelay. In public cases, this required no extra user action.
The attacker remotely operates the official banking app to apply for a loan in the victim's name.

NFC Card Relay and Cash-Out

Following instructions over the call, the victim taps their real credit card on their smartphone and enters their PIN.
The victim's device runs WindRelay and acts as a card reader to capture NFC APDU commands.
The device relays the live traffic, including transaction-specific authentication data, to the attacker's device.
The attacker's device emulates the card and presents it to a legitimate POS terminal at a physical store.
Fraudulent payments are completed while the physical card stays safely with the victim.

4. Attacker Position and Execution Location

Social engineering and remote control happen via phone calls and attacker C2 servers.
SpyNote and WindRelay run on the victim's Android device.
NFC relay reception and card emulation run on the attacker's device. Cash-out happens at physical stores with legitimate POS terminals.
Root permissions are not required. The attack relies mainly on Accessibility, sideloading, and NFC permissions.

5. View from Victims and Administrators

To the victim, it looks like bank support steps, identity verification, or a card check.
The APK includes the victim's name, and the user is guided during a phone call, making it look very trustworthy.
To the bank, the actions may look like normal operations from a normal device, official app, and real card in a short time.
MDM and EDR tools might detect unknown APKs, Accessibility permissions, inter-app installations, NFC usage, and screen or input operations.

6. Success and Failure Conditions

Success Conditions

The victim allows the installation of an APK from an unknown source and grants Accessibility permissions.
The Android device supports NFC, and the victim taps their card and enters their PIN.
SpyNote successfully controls the banking app remotely.
The NFC communication delay is within the payment limit, and the attacker can access a POS terminal.

Failure Conditions

Block unknown APKs, dangerous Accessibility usage, and inter-app installations.
The bank assesses risks for new loans during phone calls, device state changes, and NFC relay characteristics.
The user hangs up the phone and calls the official number back.
The user stops the process when asked to tap a card or enter a PIN by someone claiming to be support.

7. What Happens Upon Success

The attackers can remotely control the victim's device to take out loans, steal credentials and screen data, and install more APKs. When the NFC relay succeeds, they can complete in-store payments without stealing the card. In the reported case, the entire process took about 13 minutes from the start of the call.

8. Observable Logs

Email: Not the main path. They might send APK URLs via SMS or messages, but details in public cases are limited.
Proxy/SWG/DNS: APK download sites, SpyNote/WindRelay C2, and short-lived new domains or IP traffic.
Endpoint/EDR: Sideload installs, unknown signed APKs, enabled Accessibility, additional APK installations from SpyNote, screen capture/input, and NFC foreground services.
Identity/IdP: Mobile banking device registration, sessions, loan applications, authentication methods, and device risk status.
SaaS/Cloud: MDM/MAM non-compliance, Play Protect warnings, and app permission changes.
Network: Low-latency two-way NFC relay traffic, C2 communication, and payment authentication between the attacker's device and the POS.

9. Attack Success Stages

Contact Only: Impersonation call, receiving an APK URL.
User Action: Installing the APK, granting Accessibility permissions, tapping the card, entering the PIN.
Initial Execution: SpyNote starts and connects to C2.
Malware Success: WindRelay installed, remote screen and input control active.
Authentication & Transaction Breach: Loan application approved, NFC relay session active, POS approval.
Loss Confirmed: Loan funds transferred, fraudulent payment completed, cash converted by the attacker.

10. Investigation Playbook

Trigger: Loans or payments made during a phone call, unknown APK + Accessibility, remote device operation and POS transaction at the same time.
Initial Check: Correlate call times, phone numbers, SMS, APKs, permission grants, card taps, and transaction times.
Device: Preserve APKs, signatures, hashes, Package Installer logs, Accessibility settings, notification access, overlays, NFC usage, C2, and screen operation traces.
Authentication & Cloud: Check bank sessions, loan workflows, device fingerprints, transaction authentication, and POS locations.
Subsequent Actions: Check for additional accounts, transfer destinations, other cards, stolen contacts/SMS, and new device registrations.
Containment: Enable airplane mode or isolate network, block cards, revoke bank sessions and credentials, put loans and payments on hold, and factory reset the device.
Verdict Categories: Social Engineering / SpyNote Installed / Remote Control Confirmed / WindRelay Confirmed / Loan Fraud / NFC Relay Transaction.

11. Defense and Detection Ideas

Single Events: Accessibility permissions right after a sideload, unknown APK installing another APK, NFC services used while banking.
Timeline Correlation: Incoming call -> APK installation -> Accessibility enabled -> Banking loan -> Card tap -> Remote POS payment.
Threat Hunting: APKs containing victim names, SpyNote permission sets, unknown Accessibility services, NFC relay services, and clusters of C2 IPs.
Log Gaps: Personal devices often lack MDM, app, Accessibility, and NFC logs. Bank transaction timelines serve as main evidence.
Top Priorities: Block unknown APKs, detect Accessibility abuse, identify risky devices within apps, require step-up authentication for high-risk transactions during calls, and detect card relay behavior.

12. Facts / Inference / Hypothesis

Facts

Group-IB identified about 20 related samples and 4 C2 IPs between November 2025 and July 2027.
Public cases targeted the Czech Republic, Slovakia, and Slovenia.
After SpyNote was installed, WindRelay was installed without extra user actions.
The phone calls lasted about 13 minutes.
No root privilege usage was confirmed in the public reports.

Inference

Similar vishing attacks targeting banks can be adapted for cryptocurrency and corporate banking app users, even if local APK sideload rates are low.
Without linking malware detection on devices to financial institution fraud detection, it is hard to see the full picture.

Hypothesis

Combining NFC round-trip latency, short-term remote POS usage with the same card, and transactions during phone calls can improve relay detection accuracy.

13. MITRE ATT&CK Mapping

High Confidence (Mobile): T1476 Deliver Malicious App via Other Means, T1456.002 GUI Input Capture, T1417 Input Capture, T1646 Exfiltration Over C2 Channel.
Medium Confidence: T1516 Input Injection, T1421 System Network Connections Discovery. NFC relay / HCE techniques do not have an exact match in existing ATT&CK Mobile and are treated as custom methods.

14. Unknowns and Further Investigation

Full APK hashes, C2 servers, package names, and signers.
Specific steps used to pass loan authentication and bypass bank checks.
WindRelay communication protocols, encryption, and latency management.
Expansion into Japanese-speaking regions or other Asian markets.

15. Impact on SOCs and Organizations

This type of attack requires joint investigations between corporate SOCs, financial SOCs, CSIRT, and Fraud departments. Organizations must manage Accessibility abuse and sideloading on BYOD and corporate Android devices. Financial institutions should prepare to correlate timelines for device risks, phone calls, loans, and NFC payments.

16. Summary by Role

For SOC Analysts: Correlate APKs, Accessibility, remote control, bank transactions, and POS approvals into a single timeline.
For IT Administrators: Restrict sideloading and dangerous Accessibility features. Control financial operations from non-compliant MDM devices.
For End Users: Bank staff will never ask you to install an APK, enable Accessibility, tap your card, or enter your PIN over the phone. Hang up and call the official number.

Lazarus "Operation Dream Job": From Windows Zero-Day to EDR Bypass and Backdoor Deployment

Anoymask — Thu, 13 Aug 2026 02:25:14 +0000

Lazarus "Operation Dream Job": From Windows Zero-Day to EDR Bypass and Backdoor Deployment

1. Basic Information

Severity: Critical
Article Title: Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack
Publisher: Check Point Research
Publication Date: 2026-08-11
Original Source: https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
Related Sources:
- https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820
Related Entities: Lazarus Group, Operation Dream Job, MISTPEN, Troy, FudModule, ForestTiger, RelayShell, CVE-2026-68820, Windows 11, Microsoft Graph, OneDrive, Roundcube

2. Executive Summary

This is a multi-stage attack. It sends fake job offer PDFs to defense and aerospace personnel, uses DLL side-loading to launch MISTPEN, gains SYSTEM privileges and bypasses EDR using the Windows 11 kernel zero-day CVE-2026-68820, and finally deploys the ForestTiger backdoor.

3. Attack Flow

Chain A: From Job Document to Kernel Compromise

The attacker sends fake job offers and interview invites to the target with an encrypted ZIP file.
A signed PDF viewer inside the ZIP side-loads a malicious libmupdf.dll file.
The DLL decrypts the payload (which is also an encrypted PDF), shows a decoy document, and runs MISTPEN in memory.
MISTPEN uses Microsoft Graph API and OneDrive as C2 servers to fetch AES-encrypted tasks.
It adds reconnaissance and persistence modules to collect host and environment information.
An LPE loader exploits CVE-2026-68820 (afd.sys race condition / use-after-free) to get kernel read and write primitives.
It loads FudModule to inject code into SYSTEM processes and modify security features, which reduces EDR visibility.
It deploys the final-stage ForestTiger backdoor.

Chain B: Troy via Fake Websites

The target is lured to a fake website or search result that mimics a legitimate company to download SecurityPDF and a crafted PDF.
It extracts content using identification strings in the PDF, XOR-decrypts the executable, and saves it as %TEMP%\new.exe.
It reflectively loads the Troy backdoor.
Troy uses 17 types of commands for device and process recon, file sending and receiving, archiving, process termination, in-memory DLL injection, and beacon setting changes.

Chain C: Roundcube Relay Infrastructure

It logs into Roundcube using credentials that are likely stolen.
It exploits CVE-2025-49113, an authenticated PHP object deserialization vulnerability.
It places the RelayShell web shell and uses at least 17 Roundcube servers as relays.
It uses the compromised Roundcube and WordPress servers as C2 and traffic relays.

4. Attacker Position and Execution Locations

Initial delivery and C2 operations happen from attacker-controlled infrastructure, OneDrive, and compromised web servers.
DLL side-loading, MISTPEN, Troy, and the LPE loader run on the victim's Windows device.
CVE-2026-68820 and FudModule run in the Windows kernel and use SYSTEM privileges.
RelayShell runs on compromised Roundcube servers.

5. Visibility for Victims and Administrators

Users see a job offer PDF and a normal decoy document, so they do not notice any failure.
Administrators see a signed viewer load a non-standard DLL, followed by Graph and OneDrive network traffic.
After EDR is disabled, subsequent processes and file operations may disappear. Correlating Windows events, proxies, and cloud audits is important.

6. Success and Failure Conditions

Success Conditions

The target extracts the ZIP file and runs the included viewer.
The executable and malicious DLL exist in the same folder.
The target Windows 11 build has not patched CVE-2026-68820.
Network traffic to Microsoft Graph and OneDrive is allowed.
Security products do not block kernel driver operations or SYSTEM process injection.

Failure Conditions

Isolating attached or downloaded ZIP files, or blocking execution via Mark-of-the-Web and application control.
Detecting DLL search order abuse and blocking DLL loading from untrusted folders.
CVE-2026-68820 is patched, so LPE fails.
Blocking abnormal app and device traffic to the Graph API.
EDR self-defense, kernel integrity, and driver load controls block modifications.

7. What Happens on Success

Device reconnaissance, persistence, file operations, and C2 communication become possible, along with SYSTEM privilege escalation, reduced EDR visibility, and additional backdoor deployment. Defense and aerospace design data and credentials are targets, but public articles do not prove successful data theft on every target.

8. Observable Logs

Email: Job and hiring themes, encrypted ZIP files, external senders, and unknown recruiters.
Proxy/SWG/DNS: Fake company websites, non-business app traffic to Graph API and OneDrive, and periodic traffic to compromised Roundcube and WordPress servers.
Endpoint/EDR: Signed PDF viewer loading libmupdf.dll, in-memory MISTPEN and Troy, %TEMP%\new.exe, abnormal I/O targeting afd.sys, SYSTEM process injection, and modification of EDR services and callbacks.
Identity/IdP: Abnormal logins to Roundcube and use of stolen credentials. Whether Graph usage requires an organization ID depends on the configuration.
SaaS/Cloud: Suspicious object downloads on OneDrive, low-frequency periodic access to the Graph API, and unknown clients or apps.
Network: AES-encrypted beacons, relays via compromised web servers, and endpoint connections to Roundcube and WordPress servers that are unrelated to normal business.

9. Attack Success Determination

Contact Only: Receiving a job email or visiting a URL.
User Action: Extracting the ZIP file and opening the PDF viewer.
Initial Execution: Loading the malicious DLL and executing MISTPEN or Troy in memory.
Malware Success: Fetching C2 tasks, sending recon results, and creating persistence modules.
Privilege Compromise: Obtaining a SYSTEM token after CVE-2026-68820, loading FudModule, and injecting into a SYSTEM process.
Data Theft & Further Compromise: Creating archives and transferring them outward, continuous beacons from ForestTiger, or using additional stolen credentials.

10. Investigation Playbook

Trigger: PDF viewer abnormal DLL loading, suspected OneDrive C2, SYSTEM process injection, and sudden disappearance of EDR telemetry.
Initial Check: Preserve the hashes and sources of the email, ZIP, executable, DLL, and PDF, and determine the exact execution time.
Endpoint: Investigate Prefetch, Amcache, Shimcache, MFT, memory, driver and kernel events, %TEMP%, and persistence locations.
Auth & Cloud: Check Graph and OneDrive audits, OAuth apps, Roundcube authentication, and cross-account use of the same credentials.
Subsequent Actions: Search for ForestTiger, archives, internal recon, connections to additional hosts, and web shells or relays.
Containment: Isolate the endpoint, update Windows, revoke related accounts and tokens, block Graph paths, and isolate or rebuild compromised web servers.
Confidence Levels: Targeted / User Executed / Initial Payload Confirmed / Kernel LPE Confirmed / Defense Evasion Confirmed / Exfiltration Confirmed.

11. Defense and Detection Ideas

Single Event: PDF viewer loading libmupdf.dll from the same folder, creation of %TEMP%\new.exe, and unknown processes accessing the Graph API.
Timeline Correlation: Receiving a job ZIP -> launching the viewer -> loading the DLL -> OneDrive communication -> kernel anomaly -> missing EDR telemetry.
Hunting: Non-standard DLLs loaded by signed document viewers, non-browser processes using the Graph API, injection into SYSTEM processes, and new PHP files in Roundcube web roots.
Log Gaps: Missing DLL image loads, kernel I/O, Graph audits, EDR self-defense, and web server FIM make it hard to break the attack chain.
Priority Actions: Patch CVE-2026-68820, isolate attachments, use application control, monitor Graph, enable EDR self-defense, update Roundcube, and rotate credentials.

12. Facts / Inference / Hypothesis

Facts

Check Point confirmed active exploitation of CVE-2026-68820 in Operation Dream Job targeting defense and aerospace sectors.
MISTPEN used Microsoft Graph and OneDrive as its C2.
CVE-2026-68820 uses a race condition / use-after-free in afd.sys to move from kernel read/write to SYSTEM privileges.
FudModule and ForestTiger were used in later stages.
Troy has 17 remote control commands.

Inference

Missing logs after EDR modification may mean defense evasion rather than "no activity," so network, Windows, and cloud logs should be used to fill the gaps.
Global defense, heavy industry, and aerospace supply chains also match these job themes and engineering user profiles.

Hypothesis

Combining OneDrive object names, API call frequency, and parent processes can reduce false positives with legitimate OneDrive usage.

13. MITRE ATT&CK Mapping

High Confidence: T1566.001 Spearphishing Attachment, T1204.002 Malicious File, T1574.002 DLL Side-Loading, T1055 Process Injection, T1068 Exploitation for Privilege Escalation, T1562.001 Impair Defenses, T1105 Ingress Tool Transfer, T1071.001 Web Protocols, T1102.002 Web Service: Bidirectional Communication.
Medium Confidence: T1547 (persistence details depend on the module), T1560 Archive Collected Data, T1041 Exfiltration Over C2 Channel.

14. Unknowns and Further Investigation

Initial delivery paths, stolen data, and scope of compromise across all targets.
Details of the tenants and apps used for Graph and OneDrive C2.
Specific EDR features disabled by FudModule in each environment.
Mapping between RelayShell infrastructure and endpoint chains per target.

15. Impact on Global SOCs and Enterprises

In defense, heavy industry, aerospace, and advanced manufacturing sectors, contacts pretending to be overseas job offers or joint research look very natural. Organizations need to monitor not only Windows updates, but also DLL side-loading of signed apps, Microsoft 365 communication used for C2, and missing EDR telemetry as a single connected chain.

16. Summary by Target Audience

For SOCs: Correlate events in a timeline from the job ZIP to Graph communication, kernel LPE, and missing EDR logs. Do not evaluate OneDrive traffic in isolation.
For Admins: Apply the CVE-2026-68820 patch to Windows 11, and verify application control, Graph audits, and EDR self-defense.
For Users: Do not run encrypted ZIP files or custom PDF viewers from unknown recruiters. Verify job postings through official channels of legitimate companies.