Weekly Threat Roundup: Ransomware Hits VPNs, AI Credentials Targeted, and a Self ...

This week's security landscape spans active ransomware exploitation of PAN-OS VPNs, a wave of infostealers hunting AI developer credentials, a self-healing WordPress backdoor using blockchain for command resilience, and critical flaws in NVIDIA drivers, Adobe Experience Manager, and Samsung QA-Board enabling unauthenticated remote code execution.

Ransomware groups Qilin and Settra are actively exploiting an authentication bypass in PAN-OS GlobalProtect and Prisma Access (CVE-2026-0257), a flaw disclosed in May 2026. Because the access originates through an organization's own VPN, malicious activity resembles legitimate remote work and may go undetected until credential theft, lateral movement, or ransomware deployment is underway, according to ReliaQuest. The firm advises immediate upgrades, disabling authentication override cookies where unnecessary, terminating all active GlobalProtect sessions after patching, and investigating unexpected connections — including sessions using hostnames such as "kali." Patching alone may not remove access established before remediation.

Meanwhile, Recorded Future assesses that Russia has escalated hybrid, asymmetric warfare across Europe since its full-scale invasion of Ukraine in February 2022. These operations combine psychological, cyber, and physical tactics to test defensive capabilities, degrade critical infrastructure, and sow fear to degrade response ability.

Infostealers Pivot to AI Developer Credentials

A cluster of new and updated infostealers is targeting configuration files and session tokens belonging to AI coding assistants. Warden Stealer, a Rust-based malware-as-a-service offering with its own loader and cryptocurrency clipper, is "one of the first infostealers targeting configuration files and local data belonging to AI assistants and agentic coding tools," Gen Digital reports. Its builds are heavily obfuscated, morphed, and regularly updated to evade detection.

CastleStealer, a C#-based stealer discovered in April 2026, now bypasses app-bound encryption in Chromium-based browsers, executes commands remotely, and exfiltrates data in small encrypted transmissions rather than a single large archive, per Flashpoint.

Aoki (also known as Aokigahara) targets credential and session files used by Claude, OpenAI's Codex, Cursor, Codeium, and Gemini. "API keys and Open Authorization (OAuth) or session tokens allow malicious activity to be carried out under a legitimate developer's identity and API quota," the Symantec Threat Hunter team said. "They can also expose connected repositories, cloud services and CI/CD pipelines linked to that account, and may bypass safeguards that assume requests originate from a trusted user." Google-owned Wiz previously reported that AI service provider API keys are a hot commodity on illicit markets, enabling attackers to run workloads or resell access as part of an LLM resale market.

K7 Labs detailed a Python-based builder sold under a MaaS model that generates customized Windows executables using Nuitka or PyInstaller with integrated webhook configuration. The stealer includes anti-analysis techniques, persistence, credential harvesting, and data exfiltration.

Crypto Wallet Drainer Uses DNS for Resilience

Infoblox analyzed a cryptocurrency wallet-drainer kit branded as Noir that uses DNS TXT records to locate its hosted pool, currently running on Cloudflare Pages. A loader queries the TXT record through public DNS-over-HTTPS services to learn which backend pool is active. "The drainer does not need a seed phrase, password, or private key," Infoblox said. "It tailors content to the user after receiving initial read permissions, developing a plan for the specific wallet. Then it obtains spending permissions that can look less alarming than a direct transfer and performs the theft from attacker-controlled infrastructure." Researchers suspect AI assistance in the malware's creation and maintenance.

Remote Access Trojans Add Surveillance and Intimidation

Darktrace discovered CikaBika Bot, a Rust-based RAT delivered via a document-themed lure with a malicious LNK file and PDF containing an embedded payload. The malware uses a Nim loader, PowerShell UAC bypass, and DLL -order hijacking before leveraging Discord for command-and-control, reconnaissance, remote execution, and data exfiltration through ngrok. It also supports screenshot capture and file transfers.

Group-IB reports KGB RAT, marketed on underground forums since late 2025, combines credential theft, keylogging, hidden desktop takeover (HVNC), and ransomware with psychological harassment features — screamer functions, jump scares, and forced blue screens of death. "These 'fun settings,' as the developers themselves describe them, signal a threat actor profile comfortable weaponizing victim anxiety alongside data theft," Group-IB said. A public disclosure referencing a KGB RAT server at version 0.1 dates to January 2022, indicating years of development before market release.

Point Wild documented BotHelper RAT, a previously undocumented .NET RAT with live screen surveillance. The infection chain begins with a native x64 stager that fingerprints the host, then connects to easyllms.xyz over HTTPS to retrieve a payload while disabling TLS certificate validation. The second stage copies itself to a hidden location, registers a scheduled task for persistence every 30 minutes, patches the Antimalware Scan Interface, and polls PHP endpoints for tasking.

XWorm has transitioned from an infostealer to a full surveillance platform, expanding its plugin count from 35 to 46. Versions detected since July 2025 include V6.4, V6.5 "XWorm Reborn," V7.2, and V7.4. Netskope notes the Maps plugin provides GPS location without a user prompt, the Microphone plugin streams live audio, HBrowser gives operators interactive control of authenticated browser sessions without touching credentials (bypassing MFA entirely), and webcam capture is available on demand.

Self-Healing WordPress Backdoor Uses Blockchain for Command Resilience

Wordfence detailed an unusual malware installed as a must-use WordPress plugin with several self-healing mechanisms to survive removal. It employs EtherHiding, a technique that hides the attacker's server location behind a smart contract on the Ethereum blockchain, making the command channel resilient to takedown. The malware establishes administrator access, hides the rogue administrator account, harvests administrator passwords, enables remote site modification, exfiltrates data, and spreads to other WordPress installations on the file system.

Critical Vulnerabilities Enable Unauthenticated RCE

Adobe Experience Manager (Cloud): A chain of four flaws — unauthenticated DAM bulk import, stored XSS, unsafe XML parsing, and Groovy execution via /bin/asynccommand — enables unauthenticated remote code execution. Adobe has patched the cloud version.

Samsung QA-Board: CVE-2026-110392 (CVSS 9.8) allows unauthenticated RCE via improper neutralization of user-controlled data leading to shell command injection. The vulnerability was flagged by Claude Opus 5.5.

NVIDIA GPU Display Driver for Linux: CVE-2026-47595 (CVSS 7.5, "Bad UVM") allows an unprivileged user to write to read-only memory because memory permissions are not preserved. Researcher Ziyi Guo demonstrated exploitation via nvidia-persistenced to achieve local privilege escalation, then container escape and full root access on the host.

SiteGuard Server Edition: CVE-2026-106931 (CVSS 8.5), a command injection flaw affecting version 2.20 or later with statistics enabled (default), is under active exploitation in the wild. Successful exploitation allows arbitrary OS command execution with root or SYSTEM privileges. The exploitation method, threat actor, and targets remain unknown.

WebAlliance eCommerce: Rapid7 disclosed CVE-2026-108065 (CVSS 9.8), a critical SQL injection with no patch announced. The flaw allows reading sensitive database data or, with high-privilege database users, running system commands on the database server.

MyReport Updater 2.1.1: A vulnerability permits unauthenticated remote code execution as NT AUTHORITY\SYSTEM. An attacker with standard user privileges can set an arbitrary reference server; if MyReportUpdaterService contacts it over gRPC on TCP port 9095, the attacker can write files with SYSTEM privileges and load a DLL for code execution. Quarkslab notes this gives full control of the Citrix server and affects other machines with the vulnerable MyReport solution installed.

Additional Vulnerability Disclosures

Harbor (CNCF container registry): SSRF vulnerability GHSA-2phj-cp9f-qq6w (CVSS 8.5) allows any registered user who can create a project to point a webhook at the cloud metadata endpoint and steal the server's IAM credentials, per OX Security.

NSD DNS Server: Four high-severity flaws (CVE-2026-101341, CVE-2026-101339, CVE-2026-101338, CVE-2026-101337) enabling arbitrary command execution patched in NSD 4.15.3.

Xen: CVE-2026-79610, a race condition in the grant-table mechanism discovered by Anthropic's Claude Opus, could allow an unprivileged guest to elevate privileges to the host. All Xen versions from 4.0 onward are vulnerable; addressed in xsa517.patch.

Defensive Developments

Google Android: Multi-layered scam protections rolling out across Google Messages and third-party apps include enhanced Scam Detection with Private AI Compute, link safety checks with Gemini Nano, redesigned warnings for unfamiliar links, automatic screen- privacy to hide sensitive information, blocking apps from quietly enabling call forwarding, and real-time verification for bank calls with Banco do Brasil, Itaú Unibanco, and other banks. Since June 2026, Android has blocked more than 3 million spoofed calls from those two banks alone.

Anthropic: New measures in Fable 5.1 and Opus 5.5 — preserved thinking, two-stage classifiers, and charging for requests blocked by safeguards — have reduced data harvesting through distillation attacks by 90% to 99%.

Mozilla: Firefox Enterprise launches with controls for organizations with strict security, governance, and compliance requirements, giving IT and security teams more control over data, infrastructure, and browser environment.

Google Chrome Bug Bounty: Base rewards for memory safety issues quadrupled from $500 to $2,000. Vulnerabilities in Chrome's browser, GPU, and network processes can now earn up to $20,000.

Microsoft: Urges organizations to prepare certificate systems for post-quantum authentication by inventorying certificate dependencies, assessing vendor roadmaps, identifying long-lived infrastructure, and creating non-production test environments.

Meta notified approximately 1,500 people — mostly U.S. employees — after unknown threat actors accessed some company GitHub repositories using an employee's stolen credentials. The intrusion was detected weeks ago and access has been shut down, per SecurityWeek.

The week's stories a common thread: attackers don't always need novel exploits. A stolen login, a forgotten setting, or one small mistake often suffices. Even when a bug gets fixed, the access it enabled may persist. The lesson is straightforward — don't just check what's broken. Check who got in, what they touched, and whether they can return. Keep watching the things everyone assumes are safe. Those are the ones nobody examines until something goes wrong.

Source : thehackernews.com