Monday, September 28, 2026

⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats

A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface.

Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing exotic. Mostly things nobody expected to matter anymore.

Here’s the full recap of what mattered this week.

⚡ Threat of the Week

Citrix Warns of Actively Exploited NetScaler ADC and Gateway Flaws — Citrix released patches to address multiple vulnerabilities, including CVE-2026-88771 and CVE-2026-88772, that have come under active exploitation. CVE-2026-88771 is an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands, while successful exploitation of CVE-2026-88772 could allow for remote code execution or denial-of-service. CISA said "threat actors are actively exploiting these vulnerabilities globally," urging federal agencies to apply patches by Wednesday.

🔔 Top News

  • Bitget Resumes Withdrawals After Hack — Cryptocurrency exchange Bitget resumed Bitcoin withdrawals in phases after suspected North Korean hackers breached its systems last week and stole over $387 million. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," Bitget said. "Bitget's cold wallets and the overwhelming majority of platform assets remain secure and unaffected." According to a real-time fund tracing dashboard published by Coindesk, Circle and Tether have frozen stablecoins worth $339,100 linked to the hack.
  • PamStealer Adds Live C2 Payload Decryption — A new version of PamStealer has been found to incorporate a new anti-analysis trick that ensures the main payload can only be recovered using a server-side decryption chain. The latest artifacts continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. "Where earlier variants embedded their payload key material directly in the JXA source, it now fetches a purpose-built decryption utility and completes a key exchange with the server before the payload can be unwrapped," Jamf said. "Without the server's cooperation, the payload cannot be recovered statically."
  • Placeholder Domain Found References in ~1.7K Repos — The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. "third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays," Manifold Security said. "Unlike 'example[.]com,' third-party[.]com is not IANA-reserved. Anyone could register it, and someone did. Every doc, test, and skill that hard-coded it now points readers at attacker infrastructure." As of writing, the domain has been marked as malicious and unsafe on both VirusTotal and Google's Safe Browsing list. Manifold also identified 13 more placeholder domains that are not IANA-reserved, with two of them – yoursite[.]com and your-domain[.]com – serving scams and scareware to macOS visitors and an ordinary parking page to other users.
  • UNK_CondorFiltration Abuses TeamFiltration in New Campaign — An active TeamFiltration campaign codenamed UNK_CondorFiltration has targeted over 5,700 accounts across 28 Microsoft 365 tenants. The activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. "The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts – highlighting a critical exposure gap around forgotten, non-human identities carrying default or unrotated passwords and no MFA," Proofpoint said. The activity took place over three waves from late July to August 2026.
  • EvilTokens Taken Down in Law Enforcement Action — A coalition of law enforcement and private-sector tech companies led by Microsoft dismantled the EvilTokens phishing service, arresting two suspected website admins, Felix Utomi and Waidi Segun Adams, taking down more than 50 websites, and notifying victims of compromised email accounts. Per Coinbase, the EvilTokens operators were said to be working on expanding the kit to target Gmail and Okta accounts at the time of the takedown. Microsoft attributes the development and support of the platform to Storm-2992. EvilTokens is the latest example of professionalization of cybercrime, allowing bad actors to mount phishing campaigns with little effort and at scale. EvilTokens' notable feature was the device code phishing flow, which took advantage of security gaps in devices that cannot support standard sign-in methods like smart TVs, printers, conferencing tools, and Teams devices. In these attacks, victims are sent a short code and are told to enter that code into a phishing page to complete authentication. The important aspect here is that instead of a legitimate device requesting access, the threat actor initiates the flow and provides the user with a code through a phishing lure. When the code is entered, victims unknowingly authorize the cybercriminals' session and grant them access without ever handing over their password.
  • OpenAI Linked to More Website Hacks — AI research lab Transluce found three instances between May and June 2026 in which OpenAI's agents resorted to hacking when traditional methods failed. This included an attempt on an Australian government public health website. "Notably, the agents did this while attempting mundane data retrieval tasks which were not cyber-related," Transluce said. "This traffic goes back at least to March 6, 2026 and extends as recently as September 16, 2026, suggesting agents may still be exploiting these services to bypass restrictions."

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-77179 (Docker), CVE-2026-93485, CVE-2026-87902 (WordPress), CVE-2026-89775 (Linux kernel), CVE-2026-93616, CVE-2026-85102 (Check Point), CVE-2026-93952 (Arista VeloCloud Orchestrator), CVE-2026-90898 (Bifrost), CVE-2026-86555, CVE-2026-86554, CVE-2026-86553, CVE-2026-86552 (ZTE H188A/H288A firmware), CVE-2026-94545 (Next.js), CVE-2026-94127 (F5 BIG-IP Access Policy Manager), CVE-2026-86296, CVE-2026-86510 (D-Link DIR-822A), CVE-2026-87900, CVE-2026-87899, CVE-2026-68490 (cPanel), CVE-2026-82356 (Imprivata Enterprise Access Management), CVE-2026-86867 (Cinnamon Kotaemon), CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, CVE-2026-75698, CVE-2026-75745, CVE-2026-81995, CVE-2026-82000 (Adobe), CVE-2026-95350, CVE-2026-95357, CVE-2026-95339, CVE-2026-95281, CVE-2026-95313, CVE-2026-95349, CVE-2026-95284, CVE-2026-95322, CVE-2026-95329, CVE-2026-95356, CVE-2026-95310 (Google Chrome), CVE-2024-0244 (Canon MF753Cdw), CVE-2026-28324, CVE-2026-28325 (SolarWinds Observability Self-Hosted), CVE-2026-97359, CVE-2026-97360 (HFS2), CVE-2026-96560 (LightLLM), CVE-2026-80145, CVE-2026-80144, CVE-2026-80143 (Lantronix), CVE-2026-82987, CVE-2026-82988, CVE-2026-82989 (ViewSonic vCast), CVE-2026-75907 (Norwegian Cruise Line door access controller), CVE-2026-18311, CVE-2026-18312, CVE-2026-18320 (Readwise Reader for Android), CVE-2026-88771, and CVE-2026-88772 (Citrix NetScaler ADC and Gateway).

🎥 Cybersecurity Webinars

📰 Around the Cyber World

  • Clop Gang Moves Site After ShinyHunters Hack — The Clop ransomware gang moved its data leak site to a new Tor address after its previous server was compromised and defaced by ShinyHunters through an unpatched Grav CMS flaw that's now assessed to be an unauthenticated path traversal vulnerability (CVE-2026-42608). The vulnerability was patched by Grav in April 2026. In a statement shared with Bleeping Computer, Clop denied having any relationship or ongoing negotiations with ShinyHunters. "We do not know them, we have never worked with them, and at the moment we are not in contact with them; furthermore, we have not provided them with any information, nor will we do so – either now or in the future," the group was quoted as saying. The development comes in the aftermath of ShinyHunters seizing the FBI's FBIjobs.gov portal by what it said was a new zero-day in Oracle PeopleSoft.
  • Konni Targets Ukraine with Malicious LNK Lures — The North Korean threat group known as Konni has been observed using ZIP archives with malicious LNK files masquerading as PDF documents as lures in spear-phishing attacks targeting Ukraine-focused individuals and organizations to deliver a malware called VelvetCake as part of a campaign codenamed Operation Conflict Compass. The LNK file launches a VBScript that establishes persistence via a scheduled task, and triggers a PowerShell script to run every minute. The invoked PowerShell payload functions as a modular downloader designed to fetch and execute secondary server-side scripts. "VelvetCake embeds no fixed post-exploitation capability set locally. It operates as a lightweight task runner that continuously retrieves and executes server-side PowerShell modules, allowing operators to modify functionality without redeploying the core payload," SOCRadar said. "The campaign likely aimed to gather intelligence on the trajectory of the Russian invasion to gauge the medium-term outlook of the war."
  • Kimsuky Conducts Git-Based C2 Attacks — In more North Korea-related malicious activity, the Kimsuky group has resorted to conducting Git-based C2 attacks through malicious LNK files contained within ZIP archives. The activity has been dubbed Operation GitPower. The LNK files use filenames disguised as documents related to financial and corporate operations, including fund disbursement, insurance premiums, interest payments, policy funds, certificate renewal, store master data, customer documents, and Visa payments. These documents are said to have been mass-produced using AI models, spotlighting a trend where the threat actor has used local large language models (LLMs) using Ollama, GPT4All, and Msty to prepare attacks and create decoys. The LNK files serve as delivery vectors for follow-on PowerShell commands retrieved from GitHub Raw Content paths using a GitHub PAT. Select variants have also been observed using Pastebin as an alternative channel. The PowerShell code sets persistence, exfiltrates system information to GitHub, and takes steps to erase itself and the PowerShell command history file.
  • CISA Flags TeamCity Flaw as Exploited in Ransomware Attacks — CISA confirmed that ransomware gangs are exploiting a critical JetBrains TeamCity vulnerability patched in July. The flaw, CVE-2026-63077, is a critical authentication bypass vulnerability that lets attackers with HTTP(S) access execute arbitrary operating system commands. "An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process," JetBrains said. It's currently not known which ransomware group is behind the exploitation activity.
  • DeepMind Gives Private AI Compute a Secure, Server-Side Memory — Google has announced plans to bring a private, server-side memory to its Private AI Compute platform, giving AI systems long-term continuity across devices without sacrificing privacy. "With this new technical capability, a new persistent memory layer will be able to function like a secure digital vault in the cloud," Google DeepMind said. "Under this model, the information needed to assist you is sealed within dedicated, encrypted storage, while the cryptographic keys required to unlock it are held exclusively on your personal devices — ensuring your data is inaccessible to anyone else, even Google."
  • SectopRAT Hides Inside Legitimate Application — A new campaign has been observed delivering SectopRAT by concealing it within a legitimate program developed by an Italian digital-audio company. It's suspected that the operators added the malware after the application was installed on customer systems rather than compromising the vendor itself. "SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands," Fortinet said. "These include collecting sensitive data from the victim’s device, capturing screens, remotely managing processes and files, controlling bots, and other forms of remote device management."
  • Armenian National Sentenced to 2 Years for Ryuk Ransomware Attacks — Karen Serobovich Vardanyan, 34, who was extradited from Ukraine to the U.S. in June 2025, has been sentenced to 24 months in federal prison and 3 years' supervised release. In July 2026, Vardanyan pleaded guilty to conspiracy and computer fraud for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies across the U.S. "Between November 2019 through April 2020, Vardanyan illegally accessed computer networks of victim companies to deploy Ryuk ransomware on compromised servers and workstations," the U.S. Justice Department said. "Ryuk ransomware is a type of malicious software designed to encrypt data on a victim's computer or network and prevents the victim from accessing the encrypted files until a ransom is paid. Vardanyan worked with his co-conspirators to attack a company in Michigan that paid 200 bitcoin, or over $1.1 million at the time of payment, to restore access to their network. They also attacked a company in Wilsonville, Oregon, and in February 2020 attacked a school in Texas." Vardanyan and his co-conspirators are said to have illegally accessed computer networks of victim companies and deployed ransomware on hundreds of compromised servers and workstations, receiving over $15 million in illicit proceeds at that time. Vardanyan has also been ordered to pay over $1.21 million in restitution.
  • Scattered Spider Member Gets 45-Month Prison Sentence for Cybercrime Spree — Ahmed Hossam Eldin Elbadawy, of Texas, who admitted to being a member of the notorious cybercrime group Scattered Spider, has been sentenced to 45 months in prison. Following that, Elbadawy will face a three-year parole and is prohibited "from using privacy-based blockchain virtual currencies" without prior approval. Elbadawy was charged in November 2024 along with four other defendants.
  • Using Rogue External MFA Provider to Steal Passwords — Varonis has demonstrated a new attack technique called TrustSink which turns a rogue external MFA provider into a "persistent credential trap" within a legitimate sign-in flow. "An attacker with high privileges can register a rogue External Authentication Method (EAM) and place a convincing password page inside the legitimate sign-in flow," Varonis said. "The page captures the password in plaintext while the provider returns a valid signed token, completing the login without an error. Resetting a captured password did not remove the rogue provider. It remained in the authentication flow and captured the replacement password at the user's next sign-in." TrustSink builds on previous research by security researcher Dirk-Jan Mollema, who found that a rogue registered EAM provider can be used to bypass MFA by returning a signed JWT without performing a real authentication check.
  • New x47.c Botnet Drains AI API Credits — A previously undocumented Windows botnet dubbed x47.c has been advertised as capable of supporting 18 DDoS attack methods, browser credential theft, SOCKS5 proxies, and an AI module that uses SpaceXAI Grok to establish persistence on infected machines based on the current state. It's sold by a threat actor named WraithTools for a $200 base package with a $150 DDoS add-on. The entire toolset costs $950. "One of the advertised methods, 'AI API drain,' is designed to exhaust a victim's paid AI credits," Qrator Research Labs said. "Using a valid API key, an operator can send repeated requests that consume the account’s balance or increase its bill. The AI drain command starts with a valid API key for the account being targeted. Because those requests go straight to the provider, they do not need to pass through the victim’s application. The website can remain reachable while the account behind its AI features runs out of credits. If the provider rejects further requests once the account balance is exhausted or an enforced limit is reached, legitimate users lose access to those features."
  • Hundreds of Leaked GitHub App Keys Still Active — A new analysis from GitGuardian has found that hundreds of GitHub App private keys leaked in public code still work. From over 500,000 exposed RSA keys, 474 have been found to authenticate as 440 distinct Apps on GitHub's API. "72% of the compromised Apps had some content permissions, meaning that they could access private repositories of the organizations that use them," GitGuardian said. " 207 of them have content write permissions and can modify those repositories. Even worse, 44 Apps have organization administration privileges, 40 can administer self-hosted runners, and 98 can control workflows. Those permissions could allow a complete takeover of the target organization, or code execution on its internal infrastructure, with or without further supply-chain compromise."

Conclusion

The common thread this week was not sophistication. It was neglect. Forgotten accounts, stale assumptions, old flaws, exposed services, and tooling that keeps getting more capable faster than the controls around it.

That is usually how these weeks land: the dramatic stories get attention, but the quieter failures keep doing the real work underneath. The patch nobody rushed, the identity nobody owned, the placeholder nobody questioned, the service nobody hardened.

That’s it for this week. Patch the obvious stuff, check the forgotten stuff, and assume somebody else already noticed it too.



from The Hacker News https://ift.tt/njru3PN
via IFTTT
Posted by at
Labels: ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)