This week's security recap reveals how attackers are exploiting trusted tools and cloud infrastructure, from hijacked Outlook add-ins stealing 4,000+ Microsoft credentials to wormable botnets and AI-powered malware campaigns.
This week's security recap reveals how attackers are exploiting trusted tools and cloud infrastructure, from hijacked Outlook add-ins stealing 4,000+ Microsoft credentials to wormable botnets and AI-powered malware campaigns.
Threat of the Week: Malicious Outlook Add-in Turns Into Phishing Kit
In an unusual supply chain attack, the legitimate AgreeTo add-in for Outlook has been hijacked and turned into a phishing kit that stole more than 4,000 Microsoft account credentials. The attackers seized control of a domain associated with the now-abandoned project to serve fake Microsoft login pages.
"What makes Office add-ins particularly concerning is the combination of factors: they run inside Outlook, where users handle their most sensitive communications, they can request permissions to read and modify emails, and they're distributed through Microsoft's own store, which carries implicit trust," said Koi Security's Idan Dardikman.
Microsoft has since removed the add-in from its store, but the incident demonstrates how overlooked and abandoned assets turn into attack vectors.
Critical 0-Day Patches and Active Exploits
Google Chrome CVE-2026-2441
Google shipped security updates for Chrome to address a high-severity use-after-free bug in CSS that could result in arbitrary code execution. The vulnerability is actively exploited in the wild, though Google hasn't disclosed details about the attackers or targets.
BeyondTrust CVE-2026-1731
A newly disclosed critical vulnerability in BeyondTrust Remote Support and Privileged Remote Access products came under active exploitation less than 24 hours after a PoC exploit was published. The flaw (CVSS 9.9) could allow unauthenticated attackers to achieve remote code execution by sending specially crafted requests.
Apple iOS/iPadOS CVE-2026-20700
Apple released patches for a zero-day memory corruption flaw in dyld, its Dynamic Link Editor. Successful exploitation could allow attackers with memory write capability to execute arbitrary code on susceptible devices. Google's Threat Analysis Group discovered and reported the bug.
Emerging Threats and Campaigns
SSHStalker Botnet Uses IRC for C2
A newly documented Linux botnet named SSHStalker is using Internet Relay Chat (IRC) for command-and-control operations. The botnet achieves initial access through automated SSH scanning and brute forcing, using a Go binary that masquerades as nmap.
Compromised hosts are used to scan for additional SSH targets, allowing worm-like spread. The toolkit also drops payloads for privilege escalation using 15-year-old CVEs, AWS key harvesting, and cryptocurrency mining.
"What we actually found was a loud, stitched-together botnet kit that mixes old-school IRC control, compiling binaries on hosts, mass SSH compromise, and cron-based persistence," said Flare, describing it as a "scale-first operation that favors reliability over stealth."
TeamPCP Hijacks Cloud Infrastructure
TeamPCP is systematically targeting misconfigured and exposed cloud native environments to hijack infrastructure for cryptocurrency mining, proxyware, data theft, and extortion. The threat actor scans for exposed Docker APIs, Kubernetes clusters, Redis servers, Ray dashboards, and systems vulnerable to the React2Shell flaw.
Once inside, TeamPCP deploys malicious Python and Shell scripts that install proxies, tunneling software, and other components enabling persistence even after server reboots.
"Kubernetes clusters are not merely breached; they are converted into distributed botnets," Flare noted.
State-Sponsored Hackers Use AI at All Stages
Google found evidence of nation-state hacking groups using its AI chatbot Gemini at nearly every stage of the cyber attack cycle. The findings show how such tools are being increasingly integrated into malicious operations, even if they don't equip bad actors with novel capabilities.
One major concern is automating vulnerability exploitation development, allowing attackers to move faster than defenders. Gemini is being weaponized in other ways too, with some bad actors embedding its APIs directly into malicious code.
This includes a new malware family called HONESTCUE that sends prompts to generate working code that the malware compiles and executes in memory. The prompts appear benign in isolation and "devoid of any context related to malware," allowing them to bypass Gemini's safety filters.
Trending CVEs to Patch Immediately
- CVE-2026-2441: Google Chrome (use-after-free in CSS)
- CVE-2026-20700: Apple iOS/iPadOS/macOS (memory corruption in dyld)
- CVE-2026-1731: BeyondTrust Remote Support (unauthenticated RCE, CVSS 9.9)
- CVE-2026-25639: Axios (JavaScript library vulnerability)
- CVE-2026-25646: libpng (image processing library)
- CVE-2026-1357: WPvivid Backup & Migration plugin
- CVE-2026-0969: next-mdx-remote
- CVE-2026-25881: SandboxJS
- CVE-2025-66630: Fiber v2
Around the Cyber World
DragonForce Ransomware Cartel
S2W detailed DragonForce, a ransomware group active since December 2023 that operates under a Ransomware-as-a-Service model. The group has carried out attacks against 363 companies and affiliates with LockBit and Qilin.
DragonForce maintains the RansomBay service to support affiliates with customized payload generation and configuration options. The group is active on several dark web forums, including BreachForums, RAMP, and Exploit.
"DragonForce has been expanding its operational scope through attacks on other groups as well as through cooperative relationships, which is assessed as an effort to strengthen its position within the ransomware ecosystem," S2W said.
New Browser Fingerprinting Technique
Security researcher Melvin Lammerts discovered that country-specific adblock filter lists installed on browsers can be used to de-anonymize VPN users. The technique, codenamed Adbleed, probes blocked domains unique to each country's filter list.
"Users of ad blockers with country-specific filter lists (e.g., EasyList Germany, Liste FR) can be partially de-anonymized even when using a VPN," Lammerts explained. "If 20+ out of 30 probed domains are blocked instantly, we conclude that the country's filter list is active."
China's Tianfu Cup Returns
China's Tianfu Cup hacking contest made its return in 2026, now being overseen by the government's Ministry of Public Security. The competition, launched in 2018 as an alternative to Pwn2Own, focuses on demonstrating critical vulnerabilities in consumer and enterprise hardware and software.
With China's 2021 regulations requiring citizens to report zero-day vulnerabilities to the government, concerns have grown that Chinese nation-state threat actors are leveraging the law to stockpile zero-days for cyber espionage operations.
DoD Employee Indicted as Money Mule
Samuel D. Marcus, a Department of Defense employee, has been indicted for allegedly serving as a money mule and laundering millions of dollars on behalf of Nigerian scammers. Marcus faces charges including conspiracy to commit money laundering and illegal monetary transactions.
"From approximately July 2023 to December 2025, while employed as a Logistics Specialist with the Department of Defense, the defendant was in direct and regular contact with a group of Nigeria-based fraudsters," the U.S. Justice Department said.
Palo Alto Networks Attribution Decision
Reuters reported that Palo Alto Networks' Unit 42 opted not to attribute China to a sprawling cyber espionage campaign dubbed TGR-STA-1030 that broke into networks of at least 70 government and critical infrastructure organizations across 37 countries.
The decision was motivated "over concerns that the cybersecurity company or its clients could face retaliation from Beijing."
Trend Micro's New Threat Actor Taxonomy
Trend Micro outlined a new threat attribution framework that applies standardized evidence scoring, relationship mapping, and bias testing to reduce misattribution risk. The naming convention includes Earth for espionage, Water for financially motivated operations, Fire for destructive actors, Wind for hacktivists, Aether for unknown motivation, and Void for mixed motivation.
"Strong attribution comes from weighing evidence correctly," Trend Micro said. "Not all evidence carries the same weight, and effective attribution depends on separating high-value intelligence from disposable indicators."
Cryptocurrency Flows to Human Trafficking Services
Chainalysis reported that cryptocurrency flows to suspected human trafficking services, largely based in Southeast Asia, grew 85% in 2025, reaching hundreds of millions across identified services.
"This surge in cryptocurrency flows to suspected human trafficking services is not happening in isolation, but is closely aligned with the growth of Southeast Asia–based scam compounds, online casinos and gambling sites, and Chinese-language money laundering networks," Chainalysis said.
Munge Authentication Service Vulnerability
A high-severity vulnerability in Munge, an authentication service for high-performance computing cluster environments, could allow local attackers to leak cryptographic key material from process memory and forge arbitrary credentials.
The vulnerability, tracked as CVE-2026-25506 (CVSS 7.7), has been present in the codebase for approximately 20 years and affects every version up to 0.5.17.
"This vulnerability can be exploited locally to leak the Munge secret key, allowing an attacker to forge arbitrary Munge tokens, valid across the cluster," Lexfo said. "In a way, this is a local privilege escalation in the context of high-performance computers."
Large-Scale Malware Campaign Using Google Services
A campaign has been exploiting trusted Google services including Google Groups, Google Docs, and Google Drive to distribute Lumma Stealer and a trojanized Chromium-based Ninja Browser on Windows and Linux systems.
The attack chain involves embedding malicious download links disguised as software updates in Google Groups to trick users into installing malware.
"The operation leverages more than 4,000 malicious Google Groups and 3,500 Google-hosted URLs to embed deceptive download links within legitimate-looking discussions, targeting organizations worldwide," CTM360 said.
Cybersecurity Tools and Resources
SCAM (Security Comprehension Awareness Measure)
This benchmark by 1Password tests how safely AI agents handle sensitive information in real workplace situations. Instead of asking agents to identify obvious scams, it places them inside everyday tasks where hidden threats like phishing links and fake domains appear naturally.
The goal is to measure whether AI can recognize, avoid, and report risks before damage happens.
Quantickle
A browser-based graph visualization tool designed to help analysts map and explore threat intelligence data. It turns complex relationships—IPs, domains, malware, actors—into interactive network graphs, making patterns, connections, and attack paths easier to see, investigate, and explain.
Conclusion
Taken together, these incidents show how threat activity is spreading across every layer. User tools, enterprise software, cloud infrastructure, and national systems are all in scope. The entry points differ, but the objective stays the same: gain access quietly, then scale impact over time.
The stories above are not isolated alerts. Read as a whole, they outline where pressure is building next and where defenses are most likely to be tested in the weeks ahead.
Comments
Please log in or register to join the discussion