Threat Alerts

Researchers identified TerminalFix campaign, a variant of the ClickFix technique, targeting organizations across multiple industries. The campaign uses compromised websites displaying fake Cloudflare CAPTCHA prompts to trick users into executing malicious PowerShell commands. Unlike traditional ClickFix activity commonly associated with information stealers, TerminalFix deploys a multi-stage infection chain that establishes persistence, performs internal reconnaissance, and provides attackers with persistent network access through compromised systems.

Following execution, the PowerShell command downloads an archive containing a legitimate Windows executable and a malicious DLL. Additional payloads are retrieved through PNG images using steganography, while persistence is established through Registry Run keys and scheduled tasks. The malware subsequently performs AD and network reconnaissance.

The campaign ultimately deploys a custom Python-based reverse tunnel that communicates with attacker-controlled infrastructure over encrypted connections. This capability turns the compromised endpoint into a network pivot, potentially allowing attackers to access internal systems and conduct further malicious activity, including lateral movement, credential theft, data exfiltration, and ransomware deployment.

Threat actors have found a new way to abuse a fundamental network protocol feature — FTP banners — turning them into Dead Drop Resolvers (DDRs) that serve malicious commands and C2 addresses without ever embedding them directly in the malware stager itself. As security tools grow more effective at catching suspicious delivery methods, attackers continue to pivot toward legitimate services and protocols to stay under the radar. This technique has been observed in the wild since early July 2026 and led to the discovery of two previously undocumented remote access trojans.
The initial infection begins with a fake “Voucher” claim — that trick users into executing a shortcut file, which retrieves commands embedded in an FTP banner. Those commands then connect to a secondary server to download and execute a malicious payload. The first RAT exploits the architecture of a legitimate, signed application by replacing its core logic while keeping its trusted dependencies intact, so the operating system sees nothing suspicious loading. The result is a Node.js-based implant with capabilities ranging from live desktop streaming and screenshot capture to encrypted C2 communication and privilege escalation. Its beaconing mechanism is particularly dynamic, cycling between active, semi-active, and inactive states based on how recently it received a task — shifting check-in intervals from milliseconds to several seconds to blend in with normal traffic.
The second RAT represents a more advanced operation, using a multi-stage delivery chain with evasion techniques including Halo’s Gate syscall resolution and Early Bird APC Injection, while pulling its C2 configuration from embedded content on mainstream consumer platforms and routing traffic through a cloud proxy service. The dropper writes a large block of encoded data disguised as a certificate file, then uses built-in Windows utilities to decode and extract the final executable — a chain designed to minimize forensic traces at every step. The use of FTP banners as a delivery mechanism is a creative, if less stealthy, evolution in malware staging — and one that could easily be adapted beyond phishing attachments into social engineering campaigns, with the two discovered RATs representing distinct operational clusters sharing the same core delivery technique.

The Iranian-linked cyber-espionage group Tortoiseshell has expanded its malware arsenal with newly identified tools designed to maintain persistent and covert access to targeted networks. The group has primarily focused on defense, aerospace, IT service providers, and military organizations, with recent findings suggesting a potentially broader targeting scope. One of the newly identified tools is a reverse SSH tunneling utility disguised as a legitimate Windows DLL that abuses the system’s built-in SSH client to establish connections with attacker-controlled infrastructure and create tunnels into compromised networks.

A second tool is a C++ backdoor, also masquerading as a legitimate Windows DLL and executed through DLL search-order hijacking. The backdoor communicates with multiple hardcoded command-and-control servers over encrypted channels, generates unique victim identifiers, and supports file transfers, shell command execution, in-memory DLL execution, and directory manipulation. Researchers also identified infrastructure associated with the group using country and regional identifiers, indicating a potentially expanded targeting profile, although its exact operational use remains unclear. The combination of reverse SSH tunneling, DLL hijacking, encrypted C2 communications, and evolving infrastructure highlights Tortoiseshell’s continued efforts to enhance its espionage capabilities and maintain long-term access to targeted environments.

A newly identified Python-based implant framework, tracked as TWINLOOT, abuses trusted Microsoft services to conceal command-and-control (C2) activity and enable persistent access to compromised environments. The malware uses SharePoint Online and Microsoft Graph API for tasking and data exfiltration, while Microsoft Teams TURN infrastructure can relay interactive communications through WebRTC DataChannels. It can additionally route Graph traffic through a headless Microsoft Edge process, causing malicious communications to appear as legitimate browser traffic to Microsoft services.

Initial access was observed through Microsoft Teams social engineering, where an attacker impersonating IT support convinced a user to execute a PowerShell command that downloaded a staged Python runtime and payload. Once active, TWINLOOT provides arbitrary command execution, credential theft through a convincing fake Windows lock screen, reconnaissance capabilities, and a reverse SOCKS5 tunnel that can turn the compromised endpoint into a pivot point for lateral movement. The tunnel enables connections to internal services such as SMB, RDP, WinRM, SSH, and MSSQL while making the activity originate from the user endpoint.

TWINLOOT combines multiple persistence mechanisms, including COM hijacking, TaskCache manipulation, and a novel NTUSER.MAN technique that enables persistence without administrative privileges. Combined with trusted Microsoft services and legitimate browser processes for C2, these techniques allow the implant to maintain access while evading traditional detection controls.

A newly identified criminal operation combines file encryption with large-scale data theft, abusing thousands of compromised WordPress websites as core infrastructure — using them to spread malware, control infected machines, and store stolen documents, screenshots, and activity logs. Internal logs reveal thousands of affected IP addresses across many regions, with the heaviest concentration in the US, Russia, and India. The operation does not rely on a single piece of malware but on an entire toolkit of criminal software working in concert — some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat channel between attackers and their victims.
The infection chain begins with a ClickFix social-engineering technique that prompts victims to execute a PowerShell command, leading through two stages of downloaders and loaders, followed by several functional components including ransomware, an SMB/USB worm, a lock screen module, a VBS spreader, a chat utility, and a credential stealer. The operation exploits the widespread problem of unpatched WordPress installations — not only the core platform but also installed plugins. One examined compromised site was running a WordPress version from 2021, carrying nearly 40 different vulnerabilities, including SQL injection flaws, open redirects, authentication bypasses, and arbitrary file upload weaknesses.
Operational security failures by the developer exposed a significant volume of internal material, including detailed infection logs, victims’ screenshots, and source code of tools used to mass-manage compromised websites — discovered through a PHP script that inadvertently exposed directory listings. The stealer component generates a full list of files across all drives, then encrypts and exfiltrates it, with the operator able to direct targeted file collection remotely. Newer versions also include a keylogger, contact exfiltration from messaging applications, and screenshots captured at 30-second intervals during victim activity. The combination of broad infrastructure abuse, multi-stage malware, and opportunistic exploitation of neglected websites paints a picture of a well-organized, large-scale campaign that has been quietly expanding its reach across numerous regions.

A critical code injection vulnerability, CVE-2026-19478 (CVSS 9.4) in GitLab is being actively exploited in the wild shortly after its public disclosure. The flaw allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and manipulate repository data without requiring credentials or user interaction. Exploitation is possible through a GraphQL directive, affecting multiple versions of both GitLab Community Edition and Enterprise Edition.

Successful exploitation can enable attackers to wipe repositories, alter project data, forge merge records to falsely indicate that security fixes were implemented, and ban legitimate project maintainers. Security researchers reproduced the vulnerability shortly after disclosure and observed exploitation attempts through honeypot infrastructure, demonstrating the rapid transition from vulnerability disclosure to active attacks. Given the confirmed exploitation and the potential impact on source code integrity and software development workflows, organizations should prioritize patching affected GitLab instances and closely monitor internet-facing deployments for suspicious project or repository activity.