Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety

Introducing a New Angle on LLM Safety

Our previous research on logit-gap steering demonstrated that the safety guardrails of an aligned LLM can be bypassed by closing a measurable gap in the model's output scores. That work answered the question of how an attacker bypasses alignment. A natural follow-up question is where inside the model the alignment lives in the first place — and how concentrated or how diffuse that defense actually is. The answer matters because it tells defenders whether safety is a thick perimeter or a thin layer of paint.

Modern LLMs are aligned through reinforcement learning from human feedback (RLHF), a training stage that pushes the model toward refusing harmful prompts and complying with safe ones. Until now, no method has been able to point to the specific pieces of the network that carry that learned behavior cheaply enough to run on every model an enterprise deploys. Our new academic research presents a method that does exactly that, and it produces a result that should change how the industry talks about LLM safety.

Our Research: Perturbation Probing Findings and Technical Impact

Our research introduces a method called perturbation probing. With only two forward passes per prompt and a significantly lower computational cost, it identifies the small set of feed-forward neurons inside an aligned LLM that are causally responsible for a targeted behavior, such as refusing harmful requests.

The headline finding is striking. On open-source LLM Qwen3-4B, just 50 neurons out of 350,208 — about 0.014% of the model's feed-forward neurons — control the safety refusal template. Removing those 50 neurons changes the response format on 80% of 520 standard harmful-prompt benchmarks. The result was replicated on 200 prompts of a second standard benchmark. On a smaller model, Qwen3.5-2B, just 20 neurons were enough to stop the LLM from falsely agreeing with users in multi-turn conversations, dropping that behavior from 36.7% to 0% across 30 questions.

This concentration matters because it demonstrates that an aligned LLM's refusal behavior does not live in a robust, distributed defense. It lives in a thin template layer — a tiny fraction of the network that an attacker who can manipulate internals could disable, and that even a normal optimization run could shift. Relying on this thin layer alone is the LLM analog of relying on a single perimeter firewall: structurally insufficient. True AI safety demands a defense-in-depth strategy, with external content filters and runtime guardrails layered on top of whatever the base model was trained to do.

Beyond identifying the neurons, the same computation produces a diagnostic we call the FFN/Skip ratio: a single number, computable in seconds per model, that predicts whether a model's safety circuit can be easily steered with minimal modifications. Across the 13 models tested, this ratio explained 81% of the variance in how vulnerable each model's safety behavior was to a small targeted change. That makes it a candidate for a quantitative safety fragility score, a metric that allows security teams to compare models on alignment robustness without running adversarial red-team campaigns first.

Figure 1 displays these tests below. The horizontal axis measures how much a model routes decisions through a narrow internal pathway, and the vertical axis measures how much the model’s safety behavior changed when we disabled just 50 neurons. Models track the diagonal closely, which is why one number can predict the other.

Figure 1. Graph displaying the 13 tested models.

Building a Stronger Future for AI Safety

We hope that perturbation probing will serve two roles for the AI security community. First, as a pre-deployment diagnostic. Security teams can measure how much of a model's safety rests on a thin, easily removed layer before they put that model in production. In our experiments, amplifying just 10 identified neurons on a small model improved factual self-correction from 52% to 88% on 200 TruthfulQA prompts without any retraining. The same toolkit that exposes fragility can also be used to repair it.

We are sharing this research to empower the broader AI and security community to build LLMs whose safety properties can be measured, audited and reinforced, not merely asserted. We urge researchers to read the full paper on arXiv, “Perturbation Probing: A Two-Pass-per-Prompt Diagnostic for FFN Behavioral Circuits in Aligned LLMs.” We also recommend integrating fragility diagnostics into your own evaluation pipelines.

For organizations deploying LLMs today, Prisma AIRS Runtime Security provides the external content filters and inline guardrails that a thin template layer alone cannot. Unit 42's AI Security Assessment helps identify where AI adoption introduces governance and exposure risk. Together, they deliver the defense-in-depth posture that this research shows is necessary.

Disclaimer

We used publicly available open-weight models under their respective licenses for local mechanistic and safety evaluation. The study reports aggregate rates, model-internal measurements, and non-operational summaries only. We do not release harmful generations, executable attack artifacts, jailbreak prompts or instructions that facilitate misuse. For models governed by acceptable-use or prohibited-use policies, experiments are framed as defensive safety evaluation and robustness measurement.

from Unit 42 https://ift.tt/acJjVpO
via IFTTT

Relaunching HashiCorp Validated Designs with improved usability

HashiCorp Validated Designs (HVDs) provide prescriptive, enterprise-focused guidance for deploying, operating, and using HashiCorp products in production. They are designed to go beyond feature documentation and general best practices by giving customers an opinionated, end-to-end path for achieving specific outcomes.  

This guidance is shaped by thousands of customer engagements across our field organization, including Solutions Engineers and Architects, Professional Services, and Forward Deployed Engineers. HVDs help teams reduce ambiguity, accelerate implementation, and adopt proven operating patterns with more confidence. 

Today, we are relaunching HVDs on developer.hashicorp.com with a refreshed structure, a more discoverable home, and a number of usability improvements. 

Why this refresh matters 

As our HVD library expanded across products, the content became harder to navigate consistently. Similar topics could appear in different places depending on the product, and readers often had to understand our maturity-model terminology to find the guidance they were looking for. 

This refresh removes that friction. HVDs are now linked directly from the Learn drop-down navigation and follow a more consistent structure across products. We have reorganized them around the work a reader needs to perform, instead of the cloud maturity stage they are in. That means teams can get to the right kind of guidance faster, whether they are deploying a platform for the first time, managing it in production, or enabling end-user workflows that deliver business value. 

Structural updates 

The refreshed structure moves away from the maturity model stages we previously used and organizes product guidance around the product lifecycle, the work being performed, and the teams responsible for it.

Installation guide 

For teams designing and deploying the system. This guidance focuses on infrastructure and system architecture, prerequisites, deployment, post-installation configuration, initial identity integration, observability setup, and other one-time setup tasks required to get a production-ready environment in place. Once system installation and initial configuration is complete, you shouldn't need to use this guide again unless you're deploying additional instances or making significant integration changes. 

Administration guide 

For platform and operations teams managing the system day to day. This guidance covers ongoing operational responsibilities such as identity and access management, consumer onboarding, recommended monitoring and alerting configuration, audit logs, backup and restore procedures, disaster recovery operations, upgrades, and support readiness. 

User guide 

For platform and application teams using the system to deliver product use cases. This guidance focuses on supported use cases that platform and application teams want to enable with the product, without forcing readers to navigate through operational content that is not relevant to their immediate goal. 

This role-aligned structure helps separate one-time deployment work from recurring operational work, and system administration from feature and use-case enablement. In practice, that makes it easier to understand where to start and where to go next.   

Discoverability, indexing and search improvements 

One of the biggest changes is discoverability. HVDs now feature in the main navigation, and product documentation, tutorials, and other developer resources can link directly to relevant HVD guidance.  This brings several direct benefits for readers: 

• The developer site search bar now indexes HVD content, allowing easy search across all guides 

• Public search engines such as Google and Bing can now index HVD pages 

• Product documentation and tutorials can link directly to HVD content 

• Validated guidance can now sit more naturally alongside docs, tutorials, and other public technical resources 

These improvements matter because customers often begin with a problem to solve, not with a specific document in mind. Better site search, public indexing, and tighter links from product documentation all make it easier to reach validated guidance. 

Learn more in HashiCorp Validated Designs 

This update makes HVDs easier to access and use, but the prescriptive guidance remains the same. If you've used these guides before, the content you relied on is still here, but has now moved into the guide that matches the work it supports. 

If you are already using HashiCorp products in production or evaluating how to deploy and operate them at scale, HashiCorp Validated Designs are designed to help you find the relevant, field-tested guidance faster and understand where to go next. 

from HashiCorp Blog https://ift.tt/dIzNpg3
via IFTTT

The Good, the Bad and the Ugly in Cybersecurity – Week 35

The Good | Authorities Launch New Operations Against Cybercrime Networks & Supply Chain Attackers

Operation Jackal IV, coordinated by INTERPOL across 22 nations, has led to the arrest of 58 individuals and the identification of over 200 suspects linked to West African cybercrime networks. The joint action successfully dismantled elements of the Black Axe syndicate, which orchestrates global romance, investment, and business email compromise (BEC) scams. Law enforcement agencies across South Africa, Argentina, and Romania also disrupted major Crime-as-a-Service (CaaS) providers, freezing millions of dollars in illicit financial assets.

The FBI, collaborating with the DoJ, have disrupted the global QScan and QTRouter hacking platforms operated by Chinese state-sponsored threat actors. The group QTFY, which maintains direct ties to China’s military and intelligence services, used these compromised IoT botnets to mask cyber espionage traffic targeting critical U.S. networks, including the Federal Reserve and NASA. Law enforcement successfully seized the core command-and-control (C2) domains hardcoded within the malicious frameworks.

From the U.S. Treasury is a new operation dubbed Economic Outcast, imposing sweeping sanctions on five Mabna Institute members and nearly 60 Iran-linked entities. Under the direction of Iran’s Ministry of Intelligence and Security (MOIS), the attackers breached multiple American critical infrastructure organizations, state governments, and defense contractors. These state-sponsored actors then exfiltrated datasets, executed high-value cryptocurrency heists, and now face federal indictments alongside a $10 million dollar reward for information leading to their arrest.

The Australian Federal Police (AFP) have arrested and charged two individuals for principal roles in TeamPCP, a cybercrime syndicate. The group systematically compromised trusted open-source projects, including Trivy, Checkmarx KICS, and LiteLLM, by stealing developer credentials and distributing backdoored software updates across major ecosystem release channels. This massive software supply chain campaign potentially compromised organizations worldwide and facilitated the unauthorized theft of hundreds of thousands of credentials.

The Bad | ‘NovaCookies’ Phishing Toolkit Exploits DocuSign Services to Steal Session Tokens

Security researchers have disclosed details of NovaCookies, a subscription-based phishing platform that systematically targets corporate networks to steal authenticated Microsoft 365 sessions. Operating as an Adversary-in-the-Middle (AitM) proxy, this malicious toolkit is advertised on Telegram for $320 monthly. The campaigns actively compromise hundreds of organizations across several nations, including the U.S., the U.K., Germany, and the U.A.E.

To establish a foothold, attackers distribute counterfeit document-sharing lures within genuine DocuSign notifications. Styled as a share notice, the decoy claims an accounting department shared a remittance-advice PDF and invites the recipient to open it. Since these notifications originate from legitimate servers, they bypass standard sender-authentication checks and reputation filters. The malicious link is embedded inside the shared document, below the inspection layer of most security gateways. Once clicked, the attack uses an OAuth error-redirect technique to guide the browser through legitimate Microsoft or Google endpoints before routing traffic to the phishing infrastructure. This transition ensures every intermediate step appears trustworthy until the user reaches the proxy.

Source: Island.io

NovaCookies is a variant of the Sneaky2FA platform, which operates on a centrally managed model where the operator hosts the infrastructure rather than individual affiliates. The kit offers customized flows targeting common identity providers. Affiliates register landing pages on .vu domains, utilizing deceptive, alternating-case subdomains like PwPt-sHaRe to masquerade as legitimate Microsoft portals. While these checks obscure the landing pages, the proxy relays credentials and multi-factor authentication (MFA) codes in real time to Microsoft. Because each individual hop of the attack chain appears legitimate, security analysts emphasize that the browser remains the critical intersection where these events converge.

The Ugly | Threat Actors Deploy Spark RAT to Target Cambodian Organizations

A recently uncovered campaign is targeting both individuals and organizations in Cambodia with Spark RAT, which functions as a Go-based, open-source remote access trojan. Distributing compressed archives through targeted phishing emails, the threat actors deploy diverse lures, including Cambodian government notices, public health announcements, and dental records. The multi-stage attack sequence begins when a victim executes an Inno Setup installer, which initiates a dynamic link library side-loading chain using a signed Tencent application to deliver intermediate payloads.

To guarantee execution, the DLL loader performs timing-based anti-sandbox checks to detect virtual environment delays and scans running processes in an attempt to weaken its permissions. The loader then decrypts shellcode hidden within an embedded PNG file to run a second stager that determines whether the malware operates with SYSTEM privileges. If these elevated rights are present, the malware proceeds directly to inject mode. Otherwise, it configures a Windows service for local persistence. Ultimately, the stager injects malicious shellcode into the legitimate vssvc.exe process, monitoring execution to re-inject the payload if terminated.

Source: Acronis

The intrusion chain utilizes the Bring Your Own Vulnerable Driver (BYOVD) technique that abuses a legitimate but vulnerable OPSWAT AppRemover driver, ardrv.sys, to escalate privileges and neutralize security programs. Operating under CVE-2026-36425, this driver enables the malware to terminate active security processes, including Microsoft Defender, Huorong Internet Security, and Tencent PC Manager. The program also patches Antimalware Scan Interface and Event Tracing for Windows, executes user-mode termination of security tools, and injects Spark RAT into ctfmon.exe. Although operational tactics and driver usage closely mirror the Chinese-speaking Silver Fox syndicate, analysts classify the campaign as an unattributed cluster due to the absence of shared infrastructure, certificates, or code reuse.

from SentinelOne https://ift.tt/MteAR5O
via IFTTT

19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities.

The extensions, per Socket security researcher Karlo Zanki, share similarities in code and tradecraft, with evidence indicating that the campaign may have been active since February 2024. Socket is tracking the activity under the name Superior.

The modus operandi is relatively straightforward: the threat actor either acquires legitimate extensions with proper functionality or pushes a clean version that's devoid of any malware. Once the extensions begin to gather user downloads, a new version with the malicious behavior is published.

Of the identified extensions, 14 were created by the threat actor, while the remaining five were purchased from their previous owners. The complete list of extensions is below -

• Extensions bought by the threat actor
• koccklolohdacbfooifnpebakpbeipc - Enable Right Click & Copy — Smart Unlock + OCR
• fegckejpfnlmfgkfjpinlbgmeeijjkel - RapidLens - Google Lens for Screen Search & Images
• kdenlnncndfnhkognokgfpabgkgehodd - QuickLens - Search Screen with Google Lens
• jamminefolhgepgihbmcjjhgldbfcikp - Password Protect PDF
• inmkjedjdhgpknjogbjomhnbgdccckkg - Allow Copy - Select & Enable Right Click (Microsoft Edge)
• Extensions created and published by the threat actor -
• fcgdejjichpgfaaafflplhfijcnieopb - PixelCheck
• cfpnjdbpojpcongfaefcamjbaolpelcd - Creative Library - Ad Spy Tool
• aapdalkmclfaahehnmicbglkohkldhne - Website Traffic Checker: MirrorSphere SEO Stats
• dkdadldmiefjldmegbjbnhhfddnkhlhm - Site Signal - Website Traffic & SEO Checker
• fjmlhlkccegopebcllcmafahkmeejpph - SEO Pulse Pro - Website Traffic & SEO Analyzer
• iekoapohahgmogbagegmcgplbkikcgke - Private Crypto News Reader
• ahpnnnjbnfbhoikhohglpohnoocjcoco - Blockfolio: Address Monitor
• oeacadlaclegkkkdehjmiifnjhcekclj - Crypto Rates & Fiat Converter
• jmlgannjlbliikgcaieomgmcnfplglea - Crypto Alerter: Price Alarms & Volatility Warnings
• lhmcajhgadanidbopgaoobjlldegjmke - DeFi Pulse Tracker
• gfackggoapepdmnjnkblogdcjpgcjiak - Crypto Price Badge: Quick Glance
• hfijkbdkpidafdbeebnnkhfccildbcle - Multi-Chain Explorer
• cngchfbfgejllcbhmeadjhiebebiome - LedgerLook: Wallet Checker
• aodkjdeghbjiaienipfjkbpcikkacbcp - Meta & Facebook Ad Library Spy — Save Ads, Finder, Downloader | FeedX-Ray

It's worth highlighting that the "QuickLens - Search Screen with Google Lens" was previously flagged by both Annex Security and monxresearch-sec earlier this year, detailing its ability to push malware to downstream customers, inject arbitrary code, and harvest sensitive data.

The latest findings from Socket suggest that the activity is broader in scope than previously thought and has been ongoing since February 2024. Some aspects of this campaign were documented by DomainTools Investigations in May 2025.

At the time, the threat actor was observed creating fake websites masquerading as legitimate services, productivity tools, ad and media creation or analysis assistants, VPN services, cryptocurrency or banking utilities to trick users into installing malicious extensions from the Chrome Web Store.

"The extensions typically have a dual functionality, in which they generally appear to function as intended, but also connect to malicious servers to send user data, receive commands, and execute arbitrary code," DomainTools Investigations said.

The extension with the most potential impact is "Enable Right Click & Copy — Smart Unlock + OCR," which has a collective install base of 80,000 users across both Chrome and Edge browsers. Each of the extensions also supports the ability to establish contact with a command-and-control (C2) server and set up a persistent WebSocket connection.

"Worth noting is that the loading framework supports rotation of the C2 endpoint based on instructions received from the initial C2 server and this behavior has been observed in the wild," Zanki explained.

"That functionality enables threat actors to distribute victims to different groups and dedicated C2 infrastructure and to reduce the detection risk. Data exfiltration endpoint is also dynamically received from the C2 instructions enabling a per-victim exfiltration channel."

As observed in the case of QuickLens, the malicious code embedded in the extensions strips Content Security Policy (CSP) headers from every page and facilitates the injection of JavaScript code modules on targeted websites using content scripts. A total of 16 modules have been identified. They span the following categories -

• Multi-chain wallet drainer
• Hardware-wallet seed-phrase harvester
• Cryptocurrency exchange and wallet account harvester
• Universal credential or form grabber
• Facebook and LinkedIn account stealers
• Browser history stealer
• ClickFix-style lure

The ClickFix module injects a fake web browser update and employs operating system-specific instructions to get the user to copy and paste the malicious command.

Exactly who is behind the campaign remains unknown. But the fact that they have been successfully operating for more than two years points to a "very capable threat actor."

"The biggest risk for end-users is the operational technique in which the threat actor successfully acquires legitimate extensions and releases new versions empowered with malicious functionality," Zanki said. "That approach, combined with Chrome's default extension update settings, performs auto-updating to the latest version of extension, providing the threat actor with a powerful vector to maximize the impact and reach of the extension acquisition."

from The Hacker News https://ift.tt/CQr2H8f
via IFTTT

Key Reasons Why Identity Fabric Matters in 2026

An Identity Fabric knits fragmented identity systems into a coherent layer that observes how identities behave across applications, APIs, and infrastructure. As enterprise access spans more cloud services and automated workloads, identity security depends less on static configuration and more on runtime visibility. This article covers the architecture, the risks of unmanaged identities, and practical steps to close the gap between access intent and actual execution.

The guidance here focuses on enterprise hybrid and multi-cloud environments; smaller single-directory deployments may not require the full scope described.

Understanding Identity Fabric Architecture and How It Works

An Identity Fabric is not a single product but an architectural approach that connects identity providers, governance systems, applications, and infrastructure into one observable layer. Its purpose is to reconcile what access policy intends with how identities are actually used at runtime. Closing this gap is what an Identity Fabric is designed to accomplish.

Identity management has traditionally operated across two dimensions: design time and runtime. Understanding both clarifies where an Identity Fabric adds value.

Two dimensions the fabric must connect

• Design time: Identity lifecycle management, provisioning, joiner-mover-leaver (JML) workflows, and policy definition express access intent.
• Runtime: Authentication, authorization enforcement, single sign-on (SSO), and access checks reveal how that intent executes inside applications.

The gap between these two dimensions is where risk, drift, and attack activity emerge. IAM platforms define and provision access, but they rarely verify how it is implemented inside every application. This unobserved territory is sometimes called identity dark matter: identities, applications, and authentication flows that exist outside centralized visibility. An Identity Fabric exists to illuminate it.

Why Identity Fabric Matters in 2026: Key Reasons for Modern Organizations

Modern environments no longer resemble the tidy directories that early identity tools were built for. Access now spans SaaS applications, cloud platforms, APIs, and automated workloads that provision themselves faster than governance teams can review them. This scale is why an identity fabric has become foundational rather than optional. For a deeper primer on this approach, this identity fabric guide breaks down the core concepts.

Identity Sprawl Across Users, Apps, APIs, and Cloud Services

Identity sprawl happens when accounts, credentials, and access paths multiply faster than any central system can track. Human employees represent only a fraction of the total. APIs authenticate to other APIs, workloads assume roles, and SaaS integrations create trust relationships that often go undocumented.

The operational consequence is straightforward: security teams cannot govern what they cannot see. When identity sprawl outpaces inventory, orphaned credentials and excessive privileges accumulate quietly, expanding the attack surface without necessarily triggering an alert.

Why Visibility Is the Foundation of Modern Identity Security

Many organizations monitor only identity provider (IdP) logs, leaving application-layer activity unobserved. That is a serious blind spot, because a portion of identity-based attacks play out inside applications rather than at the IdP itself.

Why behavioral visibility compounds

• Legitimate-looking activity: Attackers increasingly use valid credentials, so identity attacks often generate normal-looking logs.
• Behavioral comparison: Observability lets teams compare intended access with actual execution and flag the gaps.
• Detection fidelity: Application-layer telemetry surfaces behavior that IdP logs alone miss.

Configuration data tells you what should be allowed. Behavioral visibility tells you what is actually happening.

The Challenge of Non-Human Identities and Machine Identity Management

Non-human identities outnumber human accounts in many enterprises, yet they typically receive a fraction of the governance attention. Because machine identities are often created by infrastructure automation rather than HR-driven lifecycle events, they routinely bypass normal identity management controls.

Common Types of Non-Human Identities: Service Accounts, Bots, Workloads, and API Keys

Non-human identities take many forms, and each carries distinct governance needs. Understanding the categories helps teams apply the right controls.

Categories of non-human identities

• Service accounts: Persistent accounts that run background processes and scheduled jobs, often with standing privileges.
• Automation bots: Scripted or robotic process automation (RPA) identities that execute repetitive tasks across systems.
• Cloud workloads: Containers, functions, and virtual machines that assume roles to access resources.
• API keys and tokens: Credentials that let applications and AI identities authenticate to other services programmatically.

Control-plane identities are a subset that govern infrastructure behavior. Because infrastructure automation credentials often require broad permissions, they are especially valuable to attackers.

Risks from Overprivileged, Dormant, and Unowned Machine Identities

The core problem is accountability. When no human owns a service account, no one right-sizes its permissions, rotates its secrets, or decommissions it when the underlying workload disappears.

These identities become risk multipliers in specific ways. Overprivileged credentials grant far more access than any task requires, handing attackers ready-made privilege. Dormant identities remain valid long after their purpose ends, offering quiet footholds. Unowned identities have no defined lifecycle, so drift accumulates unchecked.

Control-plane identities amplify these risks further, because they can reshape the environment itself, including, in some cases, disabling the controls meant to detect them.

Lifecycle Governance for Secrets, Certificates, and Tokens

Non-human identities need the same governance attributes as human accounts: an owner, a defined purpose, an expiration, and active monitoring. Applying that discipline to secrets, certificates, and tokens turns a chaotic sprawl into a governable inventory.

1. Assign ownership: Tie every service account, certificate, and token to an accountable human or team.
2. Define purpose and scope: Right-size permissions to the specific task, not the convenience of broad access.
3. Set expiration: Establish rotation schedules and hard expiry so credentials cannot outlive their need.
4. Monitor usage: Watch for behavior that deviates from the credential's stated purpose.

Mature governance here is event-driven and continuous rather than a periodic manual review that leaves months of drift between checks.

Identity Fabric Benefits: From Zero Trust to Operational Resilience

The practical payoff of an Identity Fabric is that it makes zero trust more achievable and can speed incident response. Zero trust assumes no identity is inherently trustworthy, which requires continuous evaluation grounded in real behavior, the kind of signal a fabric provides.

Unified Identity Visibility Across Hybrid and Multi-Cloud Environments

Hybrid and multi-cloud estates scatter identities across providers that each implement access control differently. A unified fabric normalizes this into a single view, connecting identities to the applications and infrastructure where access is actually enforced.

This matters because cloud lateral movement frequently occurs through IAM trust relationships. When permission sprawl goes unaddressed after deployment, those trust paths can become largely invisible routes for attackers. Discovering identities directly from applications and infrastructure, rather than trusting IAM configuration alone, helps close that blind spot.

Continuous Access Evaluation and Least-Privilege Enforcement

Periodic access reviews struggle to keep pace with dynamic environments. Continuous access evaluation checks entitlements against real usage, revoking or flagging privileges that no longer match observed behavior.

Least-privilege enforcement becomes more practical when the fabric shows which permissions are actually exercised. Instead of guessing, teams can trim standing access to what identities genuinely use, shrinking the blast radius of any single compromised credential.

Faster Incident Response Through Identity Context

Fragmented tools force analysts to reconstruct identity timelines across disconnected systems, which delays containment. An Identity Fabric supplies context that can accelerate response.

Where identity context speeds response

• Unified timeline: Correlated activity across apps, APIs, and infrastructure reduces manual reconstruction.
• Blast-radius clarity: Trust relationships reveal where a compromised identity could move next.
• Behavioral baselines: Deviations from normal usage help distinguish legitimate access from quiet escalation.

Because identity attacks often progress quietly through privilege escalation and lateral movement before triggering alerts, this context can determine whether an incident is contained early or becomes a prolonged breach.

AI Identities and the Future of Identity Management

AI identities are among the fastest-growing categories of non-human identities, and they behave differently from most credentials that came before. An AI agent is granted a task, then determines how to accomplish it, which means its execution can diverge from its intent in ways static policy did not anticipate.

How AI Agents Create New Identity and Access Risks

The key risk surface is the gap between an agent's intended task and its actual execution. An agent authorized to summarize data might, through chained actions or manipulated inputs, reach resources no one intended.

Two dimensions deserve particular attention. First, agents act across many systems, so their behavior must be observed rather than merely permissioned. Second, data itself becomes an attack surface: in data-poisoning scenarios, an agent acting on compromised or manipulated inputs can turn trusted automation into an unwitting attacker.

Governing AI Identities with Policy, Context, and Accountability

Governing AI identities means treating them as observable actors, not only as access-control objects. Policy sets boundaries, but context and accountability determine whether those boundaries hold at runtime.

Pillars of AI identity governance

• Policy scope: Define what the agent may access and the conditions under which access applies.
• Behavioral context: Observe execution across systems and compare it against declared intent.
• Human accountability: Assign an owner responsible for the agent's actions and lifecycle.

The recurring theme holds: configuration alone cannot govern behavior. Observing how AI identities act is the most reliable way to catch divergence between intent and execution.

Implementing Identity Fabric: Practical Steps for Security Teams

Building an Identity Fabric is a maturity journey rather than a single deployment. Organizations typically move from manual, static governance toward automated, continuous control, and eventually to behavioral observability. The steps below sequence that progression.

Map Identity Sources, APIs, Applications, and Trust Relationships

You cannot govern what you have not discovered. Begin by inventorying every identity source (directories, cloud IAM, secrets managers), then extend discovery into the applications and infrastructure where identities actually operate.

A critical step is mapping trust relationships, because these are the paths attackers exploit. Discovering identities directly from applications, rather than relying only on IAM configuration data, surfaces the identity dark matter that governance platforms often assume is covered but do not always verify.

Prioritize High-Risk Identities and Critical Access Paths

Not every identity carries equal risk, and treating them equally wastes effort. Prioritization focuses on remediation where exploitability is highest. Misconfiguration alone does not equal exploitability; real risk depends on identity permissions, network reachability, and runtime context together.

High-priority identity risk signals

• Excessive privilege: Standing permissions far broader than observed usage.
• Reachable exposure: Credentials accessible from untrusted networks or exposed services.
• Insecure authentication: Weak protocols, missing multi-factor authentication (MFA), or orphaned credentials.
• Control-plane reach: Identities able to alter infrastructure or disable security controls.

Define Identity Fabric Metrics for Visibility, Risk Reduction, and Resilience

Metrics turn an Identity Fabric from a project into an ongoing program. Track progress across three linked goals: how much you can see, how much risk you have removed, and how quickly you can respond.

Useful measures include the percentage of identities discovered outside IAM, the share of non-human identities with assigned owners, reduction in overprivileged accounts, and mean time to reconstruct an identity timeline during an incident. Because compliance evidence is only as reliable as visibility into the underlying systems, audit-ready evidence drawn from identity telemetry can be a meaningful differentiator.

When comparing platforms that support this journey, teams should weigh governance-centric, posture-centric, observability-centric, and detection-centric approaches separately, since each addresses a different part of the problem.

Identity platform approaches

The identity platforms below are ordered to reflect an observability-driven fabric emphasis; the right choice depends on your existing stack, deployment model, and priorities.

1. Orchid Security: Discovers identities directly from applications and infrastructure rather than relying only on IAM configuration, pairing behavioral observability with audit-ready evidence from identity telemetry.
2. Microsoft Entra: Broad IAM platform with strong directory and access-management coverage, typically strongest inside its own ecosystem.
3. Okta: Widely adopted IdP and access-management platform centered on authentication and lifecycle at the identity provider layer.
4. Ping Identity: Enterprise access management and federation with flexible deployment across hybrid environments.
5. SailPoint: Governance-centric platform focused on identity lifecycle, access certification, and policy compliance.
6. Saviynt: Governance and cloud entitlement management with a converged compliance orientation.
7. CyberArk: Privileged access and secrets management, strongest around securing high-value credentials.

The distinction that matters most in 2026 is to choose the right identity platform that defines access and observes how it is used. Identity security ultimately requires watching identity behavior, not only managing identity configuration, and that observability is what an Identity Fabric is built to deliver.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/SzZU63G
via IFTTT

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices.

The implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.

VulnCheck, which assigned both identifiers as a CVE Numbering Authority (CNA), rated each 9.3 on the CVSS 4.0 scoring system and 9.8 on CVSS 3.1. Both vectors record a network attack requiring no privileges and no user interaction.

SPEAKINGSTONE, which runs as the service yunmgrd, sends beacons over UDP port 10000 to a hardcoded command-and-control (C2) server. Because the implant dials outward, it functions from behind NAT and ordinary egress filtering.

Its protocol supports message types that execute arbitrary commands as root, exfiltrate the WAN PPPoE username and password, write and read a DNS hijack list, and open a reverse SSH tunnel.

"This is a surveillance implant with root access to every device it runs on," VulnCheck said in its supply chain research.

DARKLANTERN operates as the service infosrvd on UDP port 9992, which the router's stock firewall opens to inbound connections from any internet address. VulnCheck's advisory describes the service's authentication as ineffective, resting on a hardcoded salt and an all-zero wildcard MAC value that bypasses its own address check.

Between August 18 and August 21, VulnCheck identified 203 internet-facing DARKLANTERN instances across 22 countries, self-reporting 16 distinct models. The figure counts hosts that answered a probe rather than devices found compromised.

Both implants were found on an $88 Deep Orange 3G/4G/LTE Router bought from a U.S. supplier, a white-labeled ZBT-WE826-T2 whose firmware was built in 2019. That unit predates ENDLESSDOORS (CVE-2026-66747), the phone-home implant VulnCheck disclosed on August 5 and found in at least 20 Zbtlink router models.

VulnCheck's advisory for the DARKLANTERN command injection and its advisory for the SPEAKINGSTONE C2 implant name the following models and firmware builds -

• CVE-2026-74233 (DARKLANTERN) - Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108 and WG3526 on firmware 19.1101, WE2426-C on 19.1112, WE5926-EC_QP on 20.0516 and WF3526-P on 19.051, plus CTN720-W1, LF-1541 and MT7620N on 19.1101 and WRC1 on 20.0622, which the CVE record lists under an unidentified vendor.
• CVE-2026-74232 (SPEAKINGSTONE) - Zbtlink L3_V2_8 on 3.0.0.4.528, WE826-T2 on 19.1101, ZBT-7628 on 1.0.0.2.007 and ZBT-ZBT7621 on 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A and MQAP-7628 on 1.0.0.2.000, and AP522 on 1.0.0.2.014, AP7628 and HC5661A on 3.0.0.4.380, APG721B on 19.0809, HK300 on 1.0.0.2.032 and MAP-N10 on 1.0.0.2.044 under an unidentified vendor.

The advisory pages display those builds as upper bounds, while the CVE records name each firmware as a single exact build and set the default status of every other version to unknown. Neither advisory names a fixed firmware release, leaving an owner on a build outside the listed set without a published basis for deciding whether the flaw applies.

Model number rather than brand is the reliable check, because ZBT sells the same hardware and firmware to resellers that put their own name on the case. The Hacker News confirmed via the IEEE-registered MAC prefix database on August 28 that the blocks 78:A3:51 and F8:5E:3C are both assigned to Shenzhen Zhibotong Electronics, letting an owner identify the manufacturer from the device's own address.

SPEAKINGSTONE carries a hardcoded backup C2 domain that the implant reaches for where a primary server was never configured, and VulnCheck found that domain unregistered.

The company registered the domain and stood up a server running a reverse-engineered implementation of the protocol. Beacons began arriving as soon as the server was live.

As of August 21, 392 unique devices had reported in, of which 390 were in China. VulnCheck said 83 percent were on China Mobile's network, that 304 of the 392 broadcast SSIDs beginning with "CMCC", and that 363 self-reported a single model, L3_V2_8, running firmware 3.0.0.4.528.

Because a device reaches the backup domain only where a primary C2 was never configured, the 392 are a floor drawn from an unrepresentative subset rather than a count of affected devices.

VulnCheck flags CVE-2026-74233 in its own Known Exploited Vulnerabilities catalog, whose published criteria require that a vulnerability be "publicly-reported as exploited in the wild."

CISA's Vulnrichment enrichment, recorded against the same CVE on August 27, rates exploitation as proof of concept, which the agency's documentation defines as a public proof-of-concept existing at the time of analysis. The Hacker News confirmed via CISA's Known Exploited Vulnerabilities catalog, version 2026.08.27, that none of the three ZBT CVEs appear in it as of August 28.

VulnCheck published the following indicators of compromise (IoCs) -

• Domains - www.ac-link[.]com, the SPEAKINGSTONE primary C2, and www.findmyipaddr[.]com, the backup domain VulnCheck registered
• IP address - 47.107.224[.]89, an Alibaba Cloud address in Shenzhen that the primary C2 domain still resolved to when The Hacker News checked on August 28
• Ports - UDP/9992 inbound for DARKLANTERN, UDP/8897 for its responses, and UDP/10000 outbound for SPEAKINGSTONE beacons
• Services and paths - infosrvd, yunmgrd, inetdetect, /etc/exec/cmd, /tmp/info.txt and /tmp/yunclient.conf
• SHA-256 hashes - b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818 (yunmgrd), 7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245 (infosrvd) and ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926 (inetdetect)

VulnCheck's guidance for the earlier implant was to block and alert on the endpoints at both the egress and the resolver, and to treat the router's LAN as untrusted.

Because DARKLANTERN listens on UDP/9992, blocking inbound traffic to that port at the network edge closes off the listener while a fixed release is outstanding.

VulnCheck published Suricata and YARA rules alongside the research, one of which alerts on DARKLANTERN command output arriving on UDP port 8898 while the accompanying text and scanner both use 8897.

Zbtlink addressed the earlier ENDLESSDOORS component in a statement on its website, saying it serves solely as an after-sales technical support tool used only on a customer's explicit request and authorization.

"This component has never been used for unauthorized access," the company said.

A Zbtlink spokesperson told The Hacker News on August 6 that the feature is "solely intended" for after-sales maintenance and serves no other purposes.

"It is generally retained only on sample units to assist customers with software debugging," the spokesperson added.

That statement addresses ENDLESSDOORS alone, and Zbtlink has issued no public statement on yunmgrd or infosrvd.

The Hacker News found on August 28 that the company's firmware download pages were live and serving eight images dated August 17, among them builds for the WE826-T2 and WE2426-C, both named in the new advisories.

VulnCheck said the implants ship with ZBT firmware, and pointed to MOFI Network, which develops its own firmware for the same platform and whose examined image was free of the three implants.

The Hacker News has reached out to Zbtlink for comment on whether its current firmware still contains the two components, and to VulnCheck for the evidence behind its catalog listing, and will update this story with any response.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/n5LbcFU
via IFTTT

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user.

The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM.

cPanel described the issue as a critical security vulnerability and said that an authenticated account holder who can add parked or addon domains can create arbitrary files on the server.

"Successful exploitation leads to code execution as the root user, giving an attacker full control of the server," cPanel said in a notification to customers.

cPanel has released the following patched versions -

• 11.110.0.141 or later
• 11.134.0.53 or later
• 11.136.0.37 or later
• 11.138.0.2 or later
• 11.138.1.7 or later (WP Squared)

The notification names WP Squared in its patched list and does not mention DNSOnly.

cPanel patched three separate flaws in July, and the fixed builds named in those advisories included the 11.118 and 11.126 branches. The August 27 list covers the 110, 134, 136, and 138 branches, and the company has not said whether 11.118 and 11.126 remain supported.

cPanel said in its July advisory about the Exim flaw that it may allow privilege escalation from Team User sub-accounts. The August 27 notification does not specify whether a Team User sub-account with permission to the parked and addon domains is in scope.

Servers configured for automatic daily updates receive the patched build automatically, according to the advisory published on August 27.

Administrators can apply it immediately by logging in to the server as root and running /scripts/upcp --force. The update can also be installed from WHM under Home > cPanel > Upgrade to Latest Version, and the installed build can then be verified under Server Configuration > Update Preferences.

Servers running an end-of-life version have to upgrade to a supported version to receive the fix.

The customer notification carries no CVSS score, and The Hacker News confirmed via the CVE Program's record store on August 28, 2026, that no record has been published for CVE-2026-65643. Records for CVE-2026-58048 and CVE-2026-58047, two cPanel flaws disclosed on July 31, were both present at the time of the check.

cPanel has not said whether the flaw has been exploited, and it is absent from the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog as of the version released on August 27, 2026. The catalog already carries two flaws in a cPanel plugin.

CISA added CVE-2026-48172, a privilege escalation issue in the LiteSpeed cPanel plugin, on May 26, 2026, and noted that it can be exploited by any cPanel user account to execute arbitrary scripts with root privileges.

It added CVE-2026-54420, a symlink-following flaw in the same plugin, on June 15, 2026, for shared hosting servers running CloudLinux or CageFS where a user has FTP or web shell access.

The catalog also lists CVE-2026-41940, the authentication bypass patched in April, with known use in ransomware campaigns.

The customer notification provides no interim mitigation and no way to verify whether a server has already been compromised.

cPanel carried a command to grep the Apache error log for signs of exploitation in its Phusion Passenger advisory, published on August 14, 2026.

cPanel said that the issue does not affect default installations and applies only to servers where an affected Passenger package has been installed.

Plesk, which WebPros develops alongside cPanel, updated its own advisory for the same flaw on August 14, 2026, with a five-item checklist for spotting a prior compromise that begins with unexpected entries in /etc/ld.so.preload.

"Patching closes the vulnerability going forward, but it does not undo anything an attacker may have already done," Plesk said.

Phusion, which develops Passenger, shipped a fix in Passenger 6.2.0 on August 18, 2026, for a Watchdog API flaw that does not have a CVE identifier.

"We have seen exploitation of this vulnerability in the wild at a shared hosting provider," Phusion said.

from The Hacker News https://ift.tt/IJWhSls
via IFTTT

APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026.

These campaigns, per Recorded Future Insikt Group, have led to the deployment of a previously undocumented backdoor dubbed HOOKEDGE, a lightweight Windows batch script that's distributed via macro-enabled Microsoft Word documents bearing diplomatic-themed lures. Early versions are said to have impersonated Spanish government material, before switching to a social engineering approach a month later.

The activity has been attributed with moderate confidence to a Russian state-sponsored hacking group known as APT28 (aka Fancy Bear and Forest Blizzard). It's tracked by the Mastercard-owned cybersecurity and threat intelligence firm under the moniker BlueDelta.

This determination is based on what Recorded Future described as significant code and tradecraft overlap between HOOKEDGE and HEADLACE, a modular Windows backdoor previously put to use by APT28 in attacks targeting diplomats since April 2023.

This includes similarities in core architecture and the abuse of webhook[.]site services for command-and-control (C2), payload staging, and data exfiltration, thereby allowing malicious activity to blend in with regular network traffic and obviating the need for setting up dedicated infrastructure.

"The implant has undergone continuous refinement between September 2025 and April 2026, likely to evade automated sandbox environments and adapt to reduced free-tier API limits on webhook[.]site," Recorded Future said in a Thursday analysis, describing it as a "direct evolutionary successor to HEADLACE."

HOOKEDGE's primary delivery vehicle is a macro-enabled Microsoft Word document that, when opened, prompts the target to click "Enable Content" to display the contents, causing the macro routing to write six files to the "%userprofile%" directory and launch the HOOKEDGE installer chain.

It starts with an installer launcher that creates a scheduled task that runs every 30 minutes to execute the HOOKEDGE launcher with the backdoor as its argument. The main installer then deletes itself, along with the installer launcher, and the task definition file, from the directory in an attempt to cover up traces of the malicious activity, reduce forensic footprint, and complicate incident response efforts.

The lure document also embeds a hidden image that references a webhook[.]site URL to alert the operators as soon as it's opened by the victim. As for HOOKEDGE, it's a basic Windows batch backdoor that enters into a polling loop to facilitate remote command execution by fetching arbitrary .cmd payloads from a staging webhook, executing them, and sending the resulting output back to the webhook URL using an HTML file.

The command retrieval and data exfiltration occur by launching a Microsoft Edge instance in headless mode or in a hidden window and making an HTTP request to the webhook. Once the data is transmitted, all temporary files are deleted, and any process whose window title matches the HOOKEDGE task identifier is terminated.

BlueDelta has also been observed deploying a second-stage HOOKEDGE payload against high-value targets with a beaconing interval as little as five minutes, giving the threat actors more operational control over tasking and interactive post-compromise activity.

"The two-stage architecture also helps to mitigate one of BlueDelta's infrastructure constraints," Recorded Future explained. "webhook[.]site's free tier imposes a maximum of 100 requests per unique endpoint, meaning a 30-minute beaconing interval would exhaust a given endpoint's request allocation within approximately two to three days."

"By moving high-priority victims to dedicated second-stage webhook endpoints, BlueDelta effectively separates initial-access infrastructure from active collection infrastructure, ensuring that ongoing operator tasking and collection do not prematurely exhaust the limited request quotas of the initial-access webhook endpoints."

It's believed this approach is a deliberate choice on the part of the attackers. While the first-stage implant focuses on broad initial access, the information gleaned from this phase is likely used to identify victims deemed to be of higher intelligence value and escalate collection against them.

What's more, BlueDelta has continually tweaked the modus operandi to better suit its operational requirements, going as far as to remove the document-open canary that captured the victim IP addresses when the document was opened. While the motivation behind this change is unclear, it's suspected that the move is likely an attempt to reduce network-based indicators of compromise.

To counter the threat, organizations are recommended to prioritize blocking macro execution from internet-originated documents, and implement detection coverage for scheduled task abuse, headless Microsoft Edge execution, and outbound connections to webhook services.

"BlueDelta continues to invest in lightweight, easily adaptable initial-access tooling to support intelligence collection against European government and diplomatic targets," the cybersecurity company concluded. "Rather than introducing new capabilities, the group has steadily refined its existing tradecraft, emphasizing operational resilience by adapting established tooling to evolving defensive measures and infrastructure constraints."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/HOvxbnU
via IFTTT

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine.

The rest of the week gets stranger: botnets borrowing AI, command traffic hiding in public infrastructure, malicious tools waiting before showing their real behavior, exposed systems getting scanned, and exploit windows shrinking again. Different tricks, same advantage: attackers keep finding places where trust is cheap and friction is low.

That sets the tone. Here’s the full list of what surfaced this week.

The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

1. Social engineering attempt fails

   Cybersecurity company ReliaQuest has confirmed that one of its employees was targeted in a social engineering attack after hackers impersonated a member of the security team. The incident took place on August 22, 2026. "The threat actor registered a lookalike domain and stood up a fake ReliaQuest single sign-on (SSO) page behind a content delivery network," the company said. "The threat actor then called multiple ReliaQuest teammates, each time posing as a security employee by name in an attempt to steer them towards the fake page. One teammate entered their password and approved the push notification on their phone. That handed the attacker a brief session on our identity dashboard." ReliaQuest said the extent of the access was view only, and that no applications or systems were accessed, and no customer data was ever touched. Although the company did not attribute the incident to a particular threat actor, it noted the playbook aligns with tactics adopted by ShinyHunters and other extortion crews, such as "an impersonation call, a throwaway lookalike domain registered and burned within the hour, a harvesting page behind a content delivery network, MFA push abuse, and a rapid attempt to enroll a new authenticator." The development comes as ShinyHunters listed the company on its dark web portal. Last week, ReliaQuest said it's tracking a ShinyHunters campaign using domains that follow the "company[.]claims" pattern, including "reliaquest[.]claims."

2. Trojanized productivity apps

   Fake websites advertising productivity software are being used to lure users into downloading a deceptively functioning program that contains malware. The Electron-based applications, such as Kitchen Canvas, Food or Meal Formula, DocConvertWizard, and other PDF conversion tools under different names, gain the ability to dynamically execute injected scripts and access desktop capture functionality through Electron APIs.

3. Live operator-driven phishing

   An undocumented phishing framework, internally branded "JWR" by its developer, is designed to convincingly impersonate checkout and login pages across major payment and shopping platforms. "The client engine of the JWR phishing framework is a real-time, operator-driven system that, rather than merely logging form submissions like a static credential-stealing page, keeps an AES-CTR encrypted WebSocket open to the threat actor so they can steer each victim's session live," Cisco Talos said. "The victim data targeted by the actor using JWR extends well beyond payment data, encompassing identity documents, Social Security numbers, passport and driver's license images, website and PayPal credentials, 2FA codes, and full device fingerprints, all committed to the actor's server once a session ends." The JWR phishing framework is assessed to be a variant of The Outsider phishing-as-a-service (PhaaS) platform, based on several similarities in the client engine scripts and functionalities of the two PhaaS platforms.

4. Android fraud bot for rent

   Cybersecurity researchers have disclosed Octagon, a previously undocumented Android on-device fraud bot sold as malware-as-a-service (MaaS) by the Russian-speaking actor AndroidKitKat. "The operator advertises Octagon for $1,400 a month, giving buyers accessibility overlays, hidden VNC, SMS and one-time password interception, unlock-pattern capture, and on-screen balance reading," iVerify said. "It targets crypto wallets and banking apps after installation, while the delivery app can use an unrelated theme."

5. Rust backdoor tied to ransomware

   A new Rust-based malware family dubbed C2Looper is likely leveraged by a ransomware-related threat actor and delivered to victims through a multi-stage ClickFix infection chain. Zscaler ThreatLabz said it discovered the malware in July 2026. "C2Looper supports typical backdoor commands including remote shell execution, reconnaissance, and deploying additional malware tooling," Zscaler said. "C2Looper dynamically resolves Windows APIs and encrypts strings." There also exists a variant with additional features and capabilities, including the use of GitHub for command-and-control (C2) communications.

6. 296,000 IoT devices compromised

   Nearly 296,000 devices have been compromised by a botnet named Dysphoria. "Dysphoria targets IoT devices and its primary function appears to be for use in DDoS-attacks," the Shadowserver Foundation said. "Recently the botnet has gotten residential proxy functionality."

7. C2 moves onto Polygon

   A recently discovered C++ botnet loader called Aeternum has shifted its C2 infrastructure entirely to the public Polygon blockchain. "Instead of relying on centralized servers or domains, threat actors operate Aeternum by writing encrypted and plaintext instructions directly using smart contracts," Palo Alto Networks Unit 42 said. "Infected devices continuously query public remote procedure call (RPC) endpoints to retrieve and execute these on-chain commands. The Aeternum botnet uses decentralized networks and evasion techniques, such as virtual machine detection and antivirus scanning, to operate effectively. This combination establishes a highly resilient, low-cost threat that complicates existing law enforcement takedown methods."

8. AI enters botnet workflows

   An AArch64 Linux peer-to-peer botnet called ToxNetV2 has integrated a large language model (LLM) into the operational workflow of its controller. The controller communicates with NVIDIA NIM using the z-ai/glm-5.2 model, becoming a part of a feedback loop that determines how its capabilities can be put to use on a given machine based on information about the infected environment. "The controller collects host and botnet telemetry, sends that context to NVIDIA NIM, parses selected model responses into structured actions, and queues those actions for operator approval," Joe Security said. "The system is not fully autonomous or self-modifying. The operator remains the final approval point for its higher-impact AI-generated actions. Once approved, however, those actions can reach local command execution, file writes, remote SSH, persistent state, and a compilation workflow." According to the cybersecurity company, the AI subsystem resides within a broader Tox-based botnet featuring encrypted peer-to-peer C2, host-management capabilities, scanner workers, self-propagation logic, and 17 network-attack launchers.

9. Two stealers target credentials

   An information stealer called Phantom Stealer is designed to collect browser credentials, saved passwords, session cookies, cryptocurrency wallet files, and detailed system fingerprints. "Since its appearance, Phantom Stealer has been observed in multiple campaigns targeting users across different countries, frequently distributed through phishing lures, cracked software, and malicious links spread via platforms like Discord and Telegram," Splunk said. "Its modular design and relatively low barrier to entry have made it an attractive option for both novice and experienced threat actors, contributing to its growing adoption and making it a persistent and evolving threat in the infostealer landscape." A second stealer malware family that has emerged in the wild is Salat Stealer, which is written in Go and can perform system reconnaissance, conduct credential theft, and monitor victim activity through desktop streaming and audio/video capture.

10. ClickFix chain drops new RAT

    A previously undocumented remote access trojan (RAT) called CNCMachineRMS is being delivered via BabaDeda Loader. "Infection starts with a ClickFix lure that launches a legitimately signed IBM SPSS IDE executable, WinWrapIDE.exe, whose scripting engine is abused to load a malicious DLL," LevelBlue said. "Four decoy DLLs load through ordinary Windows import resolution, then the final stage smuggles shellcode into execution via EnumTimeFormatsEx, a benign date-formatting API." The Trojan gives an operator remote administration of the host, including an interactive shell, a file manager, screen capture functionality, a local account backdoor, seven persistence mechanisms, and twenty typed commands for pulling down and running further payloads.

11. New modular RAT emerges

    Speaking of RATs, Abyssos is another new malware family that's written in C++ and supports credential theft, file exfiltration, and remote access via VNC. The modular malware was first detected in June 2026. "Abyssos uses a custom TCP protocol for network communication," Zscaler said. "Abyssos supports a number of different network commands and downloads additional modules from the command-and-control (C2) server to enhance its capabilities."

12. Disk encryption bypass remains unpatched

    A zero-day boot-chain vulnerability in HP ThinPro 8 and 9 could allow physical attackers to bypass Trusted Platform Module (TPM) full-disk encryption and extract LUKS keys securing the device's root partition. The flaw stems from an incomplete measured-boot policy that omits the Linux kernel and initramfs (aka the initial RAM file system). "For defenders running ThinPro with disk encryption today: turn Secure Boot on and set a BIOS password," AmberWolf said. "Both slow an attacker down; neither closes the PCR gap. Beyond that, treat the encryption as no protection once the device is out of your control. Destroy the M.2 on disposal, and do not rely on ThinPro FDE for a lost or returned unit." The vulnerability remains unpatched.

13. 1.99 million mobile attacks blocked

    Data from Kaspersky shows that more than 1.99 million attacks were recorded and blocked against mobile devices in Q2 2026 using malware, adware, or unwanted mobile software. "The Trojan-Banker category was the most prevalent mobile malware threat with a 30.77% share of total detected applications," Kaspersky said. More than 304,000 malicious installation packages were discovered, including 93,574 packages related to mobile banking Trojans and 570 packages related to ransomware.

14. Python stealer targets credentials and wallets

    Cybersecurity researchers have discovered a new Python-based stealer malware called Vanta Stealer that combines extensive credential harvesting capabilities with layered obfuscation techniques that make it possible to collect valuable user data while complicating analysis efforts. "Vanta Stealer targets a broad range of applications and digital assets, including Chromium-based browsers, Discord, Telegram Desktop, Steam, Riot Games, Roblox, Minecraft, Mullvad VPN, cryptocurrency wallets, and locally stored sensitive documents," Point Wild said. "In addition to harvesting browser passwords, cookies, and stored payment information, the malware collects authentication tokens, gaming platform data, VPN configurations, cryptocurrency wallet files, screenshots, webcam captures, and documents containing wallet recovery phrases or private keys." Exactly how it's delivered is currently not known, although it could be through phishing emails, fake installers, game cheats, fake software updates, SEO poisoning, malvertising, and malicious code repositories.

15. Two more credential stealers surface

    Elsewhere, malicious LNK files disguised as PDF documents have been found to launch a multi-stage infection chain using cmd.exe, legitimate Windows utilities, AutoIt, and PowerShell to deploy DARTHVADER Stealer. Europe and the U.S. have been targeted by DestinyStealer, which exhibits clear code continuity from StormKitty Stealer. It collects browser data, cookies, passwords, cryptocurrency wallet extension storage, Outlook and VPN data, FileZilla credentials, Wi-Fi profiles, and desktop screenshots.

16. Stealer scores hosts for sandbox signs

    An information stealer called ScarfaceStealer has been observed propagating via an Electron-based application masquerading as AI-related tools. The malware performs a set of environment checks intended to evade sandbox environments and evaluates the host through 11 indicators and combines their results into a weighted suspicion score. If the score reaches 7 or higher, it enters a decoy loop that continuously displays random message boxes. Execution continues only if the score is below 7. "Unpacking the Electron application exposed a second-stage JavaScript-based loader that performs initial evasion checks before decrypting and executing the next stage," Joe Security said. "That third stage applies four additional decryption layers, maps an embedded PE in memory, and transfers execution to it. The recovered final stage revealed the core anti-sandbox logic: a scoring-based mechanism used to decide whether the ScarfaceStealer payload should continue execution."

17. Fake scans push antivirus removal

    Malwarebytes is calling attention to a scam campaign that uses a set of 11 fake websites that claim to offer a way to check if antivirus tools are working as expected. The tools carry Microsoft branding and go by names like SysScan to lend them a veneer of legitimacy, only to instruct users to immediately uninstall antivirus programs installed on their machines to address compatibility issues. "Although the names vary, the sites work in essentially the same way: Run a convincing-looking but fake security scan, tell the victim their antivirus is causing problems, collect their information, and prepare them for a supposed refund call," the company said.

18. ClickFix chain drops Amatera

    Fake CAPTCHA checks that employ ClickFix lures and bogus software download campaigns are being used to deliver PavinLoader (aka RenPy Loader and RenEngine Loader), indicating the tool is being offered as a loader-as-a-service to other cybercriminals. "What happens next is much more consistent," Malwarebytes said. "PavinLoader uses legitimate Windows tools alongside malicious .NET files to run several stages of malware. It also uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to find the server from which it should retrieve additional malware." This ultimately leads to the deployment of Amatera Stealer and other malware. "In some cases, WiX Burn bundles downloaded another payload associated with PavinLoader. In others, we detected Hijack Loader," it added. "This gives the campaign operators the ability to deploy multiple payloads on a compromised machine."

19. Per-app privacy controls tested

    Microsoft has begun piloting new privacy controls that will let Windows 11 users choose which desktop applications can access their camera, microphone, and precise location. "Windows Insiders can now manage camera, microphone, and location permissions for individual desktop apps," Microsoft said. "Previously, access for traditional desktop applications was managed through a single device-wide setting. With this update, you can review and control access on an app-by-app basis, giving you greater visibility into which apps are requesting access to sensitive resources and more control over your privacy choices."

20. Telegram-sold RAT used by TA4922

    Proofpoint has disclosed details of a new RAT and C2 framework called PackClient that's sold on Telegram and is being used by at least one threat actor, Chinese-speaking TA4922, as part of its continued efforts to expand its malware arsenal. The first campaign, observed in late May 2026, used a tax-themed lure and impersonated the Shandong Provincial Tax Bureau to trigger a sense of urgency. Two other campaigns in mid- to late-July 2026 have been found to impersonate Indian tax authorities and used penalty-themed lures to deliver the malware. "PackClient consists of a first-stage loader executable, a second-stage loader ('PackClientLauncher') DLL module, a core module ('PackClientCore'), and several optional plugins that can be downloaded upon operator command," Proopoint said. "The malware connects to two hard-coded C2 endpoints over raw TCP sockets to download and reflectively execute the core RAT DLL, receive commands, and download additional plugins or payloads." The commands allow the malware to configure C2 servers, run shell commands, start screen capture, launch a SOCKS proxy tunnel, record using a webcam, perform file operations, enumerate running processes, log keystrokes, and update the core module. No less than 11 plugins have been identified. They allow remote desktop screen sharing, RDP-style virtual desktop, file management, system administration, interactive remote shell, and webcam streaming.

21. Cloud database powers C2

    A modular post-exploitation framework called Miraak has been found exposed in attacker-controlled open directories ("144.172.96[.]13"). "Miraak is designed to provide operators with persistent control of compromised systems while supporting command execution, file transfer, process management, screenshot collection, and extensible post-exploitation activity," Blackpoint Cyber said. "A defining aspect of the framework is its use of cloud-hosted PostgreSQL and Timescale infrastructure for command-and-control. Rather than communicating through traditional web-based C2 endpoints, Miraak uses database connections to register infected systems, retrieve operator tasking, track jobs, and return results." The malware has not been attributed to any known threat actor or group.

22. Stored XSS enabled account takeover

    A security vulnerability in Microsoft Purview could be exploited by a single external Teams message, email, or Copilot prompt to carry stored malicious code into a Purview reviewer's authenticated browser and turn a routine compliance check into a path to token theft and account takeover. "A standard user, including a user in a completely different tenant with no permissions in yours, could send a Teams message, an email, or a Copilot prompt containing a malicious payload, wait for it to be flagged and have their JavaScript execute inside the authenticated purview.microsoft.com session of every compliance analyst who opened the case," Cymulate said. "In our proof of concept, that meant the reviewer's access and refresh tokens leaving the browser and reaching an attacker-controlled server, which constitutes full impersonation of a privileged compliance identity." Microsoft has since issued a service-side fix.

23. Malicious MCP server targets secrets

    A supply chain attack campaign codenamed Deadbugz has been observed attempting to distribute a malicious Model Context Protocol (MCP) server through public GitHub pull requests. "The server calls itself productivity-suite and initially looks harmless: it offers text formatting and summarization," Pillar Security said. "After a connected client makes three tool calls, however, it changes the instructions it returns to the AI agent. The new metadata directs the agent to seek sensitive information, including SSH keys, AWS credentials, shell history, and Kubernetes configuration, and to conceal the activity from the user." The campaign also makes use of what's called runtime-gated MCP metadata poisoning, wherein the malicious instructions are built into the server, but remain withheld until the client has made three ordinary tool calls.

24. Exploit timelines keep shrinking

    Microsoft is warning that the window for patching vulnerabilities is rapidly shrinking, as bad actors exploit newly disclosed flaws faster than organizations can patch them, driven by advances in AI and the rapid spread of exploit information. "Modern attack campaigns operate at internet scale," the company said. "Security research, public disclosures, proof-of-concept exploits, and threat intelligence circulate globally within hours. A vulnerability announced in the morning can become the focus of active scanning and exploitation efforts by the afternoon. Defenders remain responsible for protecting entire environments that may include thousands of servers, applications, databases, containers, and network assets. Attackers only need to identify a single viable path to exploitation." Microsoft has proposed a "control plane" that's centered on the network to reduce exploitability while remediation efforts are underway. "The objective is not to avoid patching," Microsoft added. "The objective is to create a meaningful layer of defense during the period when patching has not yet been completed."

25. Hardware-attested AI evidence standard

    The Linux Foundation has announced TRACE (short for Trust, Runtime Attestation and Compliance Evidence), a new open specification for hardware-attested runtime and compliance evidence for AI agents and confidential workloads. It's developed collaboratively by AMD, Intel, Microsoft, OPAQUE, and TII. "TRACE creates a standard, open evidence layer that enables reliable governance records for AI agents and other confidential workloads," the foundation said. "As organizations deploy increasingly autonomous AI agents and open-weight models, they need a consistent, trustworthy method to prove sensitive data is being handled according to policy. TRACE creates a standardized, hardware-enforced governance record that binds together the runtime environment, software, policies, data classifications and tool usage into a portable, cryptographically verifiable artifact that travels with the workload across clouds and confidential computing environments."

26. 100+ exposed water systems targeted

    The July cyber attacks aimed at the U.S. Water and Wastewater Systems (WWS) Sector targeted over 100 internet-exposed systems, the Cybersecurity and Infrastructure Security Agency (CISA) said. The attacks have been attributed to Iranian threat actors. The attacks leveraged programmable logic controllers (PLCs) connected directly to a cellular modem. "Directly connecting PLCs to the internet through cellular modems can create significant security risks," CISA added. "However, internet exposure reduction does not mean disabling necessary remote access; organizations should remove remote access when it is unnecessary and secure it when it is necessary." Ben Bernstein, Manager of Huntress' Cybersecurity Advisors Team, described the activity as opportunistic, automated scanning that targeted publicly accessible systems. "The fact that attackers are using AI tools to write exploit scripts for these devices is an interesting twist, but they are ultimately still just walking through a wide open front door," Bernstein said.

27. Cloaked search results hide phishing

    A new tactic called Chameleon SEO Poisoning uses cloaked search engine results to deploy phishing payloads such as credential theft and session hijacking. "This allows them to remain invisible to standard security scanners and remain active longer," Fortra said. "By heavily utilizing SEO poisoning on Search Engine Result Pages (SERPs), attackers rank at the top for high-intent keywords like 'Bank Name Customer Portal' or 'Credit Card Login' on search engines like Google or Bing." The cloaking is designed to block direct visits to the malicious sites, while serving a pixel-perfect banking portal clone when the page is visited from a search engine.

28. Fake Chrome extension enables remote control

    A multi-stage attack has been observed delivering a Rust binary, which, in turn, drops a malicious Chrome extension and an AutoIt script, the latter of which deploys the StealC stealer. The extension masquerades as Google Translate. "Once installed, it behaves as a full data-theft and remote-control tool," VMRay Labs said. "It extracts browser history, bookmarks, the list of installed extensions, saved credentials, and cookies. Beyond theft, it gives the operator live control: a stream of the victim's Chrome windows, the ability to interact with sites through remote mouse clicks and keyboard input, a proxy setting, and the injection of malicious JavaScript into specific sites." What's more, the remote control extends to out-of-focus windows and the extension can conduct an adversary-in-the-middle (AitM) attack by replacing a legitimate login form with an iframe that loads from a phishing page while the address bar still shows the actual domain.

29. SharePoint exploit chain under probing

    Defused Cyber has warned that threat actors are exploiting two Microsoft SharePoint flaws – CVE-2026-55040 (an authentication bypass flaw in the JWT token validation pipeline) and CVE-2026-63520 (an improper input validation in Microsoft Office SharePoint that allows code execution) – to obtain remote code execution against its honeypots. "The JWT bypass (55040) was exercised, followed by heavy admin enumeration and probing of the Business Data Catalog sink behind CVE-2026-63520," it said. "No code execution observed yet."

30. 80% of AI tools lack IT oversight

    A new report from Reco has found that four in five AI tools operate without IT oversight, leaving security teams without a clear picture of which ones are active, who owns them, or what access they hold. An analysis of 500 published agent tools and MCP servers has identified 62% of them to be capable of both reading local data and reaching the internet, offering a direct data exfiltration pathway. "AI agents have moved from experimentation into daily business workflows, but our findings show only 20% of AI tools in enterprise ecosystems are currently governed by IT oversight," Reco said. "That leaves organizations exposed to a new class of operational risk. Agents embedded in applications can operate through existing permissions, OAuth grants and workflow access, creating toxic combinations that expose data and trigger actions beyond what any owner approved."

The week’s weirdest detail may be how little separation remains between “advanced” and “ordinary.” Blockchain-backed command channels, AI-assisted botnets, live phishing operators, poisoned software, exposed industrial systems. Different levels of sophistication, often landing on the same old weaknesses.

That is probably the part worth keeping. Attackers do not need every idea to be brilliant. They need one exposed box, one convincing page, one permissive tool, or one person who clicks at the wrong moment. The tooling keeps changing. The openings are often painfully familiar.

That’s it for this ThreatsDay. Patch what matters, question what looks normal, and assume next week will find another cheap way through.

from The Hacker News https://ift.tt/flOCBxr
via IFTTT