Threat Alerts

A newly identified Python-based implant framework, tracked as TWINLOOT, abuses trusted Microsoft services to conceal command-and-control (C2) activity and enable persistent access to compromised environments. The malware uses SharePoint Online and Microsoft Graph API for tasking and data exfiltration, while Microsoft Teams TURN infrastructure can relay interactive communications through WebRTC DataChannels. It can additionally route Graph traffic through a headless Microsoft Edge process, causing malicious communications to appear as legitimate browser traffic to Microsoft services.

Initial access was observed through Microsoft Teams social engineering, where an attacker impersonating IT support convinced a user to execute a PowerShell command that downloaded a staged Python runtime and payload. Once active, TWINLOOT provides arbitrary command execution, credential theft through a convincing fake Windows lock screen, reconnaissance capabilities, and a reverse SOCKS5 tunnel that can turn the compromised endpoint into a pivot point for lateral movement. The tunnel enables connections to internal services such as SMB, RDP, WinRM, SSH, and MSSQL while making the activity originate from the user endpoint.

TWINLOOT combines multiple persistence mechanisms, including COM hijacking, TaskCache manipulation, and a novel NTUSER.MAN technique that enables persistence without administrative privileges. Combined with trusted Microsoft services and legitimate browser processes for C2, these techniques allow the implant to maintain access while evading traditional detection controls.

A newly identified criminal operation combines file encryption with large-scale data theft, abusing thousands of compromised WordPress websites as core infrastructure — using them to spread malware, control infected machines, and store stolen documents, screenshots, and activity logs. Internal logs reveal thousands of affected IP addresses across many regions, with the heaviest concentration in the US, Russia, and India. The operation does not rely on a single piece of malware but on an entire toolkit of criminal software working in concert — some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat channel between attackers and their victims.
The infection chain begins with a ClickFix social-engineering technique that prompts victims to execute a PowerShell command, leading through two stages of downloaders and loaders, followed by several functional components including ransomware, an SMB/USB worm, a lock screen module, a VBS spreader, a chat utility, and a credential stealer. The operation exploits the widespread problem of unpatched WordPress installations — not only the core platform but also installed plugins. One examined compromised site was running a WordPress version from 2021, carrying nearly 40 different vulnerabilities, including SQL injection flaws, open redirects, authentication bypasses, and arbitrary file upload weaknesses.
Operational security failures by the developer exposed a significant volume of internal material, including detailed infection logs, victims’ screenshots, and source code of tools used to mass-manage compromised websites — discovered through a PHP script that inadvertently exposed directory listings. The stealer component generates a full list of files across all drives, then encrypts and exfiltrates it, with the operator able to direct targeted file collection remotely. Newer versions also include a keylogger, contact exfiltration from messaging applications, and screenshots captured at 30-second intervals during victim activity. The combination of broad infrastructure abuse, multi-stage malware, and opportunistic exploitation of neglected websites paints a picture of a well-organized, large-scale campaign that has been quietly expanding its reach across numerous regions.

A critical code injection vulnerability, CVE-2026-19478 (CVSS 9.4) in GitLab is being actively exploited in the wild shortly after its public disclosure. The flaw allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and manipulate repository data without requiring credentials or user interaction. Exploitation is possible through a GraphQL directive, affecting multiple versions of both GitLab Community Edition and Enterprise Edition.

Successful exploitation can enable attackers to wipe repositories, alter project data, forge merge records to falsely indicate that security fixes were implemented, and ban legitimate project maintainers. Security researchers reproduced the vulnerability shortly after disclosure and observed exploitation attempts through honeypot infrastructure, demonstrating the rapid transition from vulnerability disclosure to active attacks. Given the confirmed exploitation and the potential impact on source code integrity and software development workflows, organizations should prioritize patching affected GitLab instances and closely monitor internet-facing deployments for suspicious project or repository activity.

A new software supply chain campaign is targeting Linux environments through malicious npm packages disguised as lightweight calendar and streak-calculation utilities. Although the packages perform their advertised date-related functions normally, they contain a concealed binary implant capable of stealing credentials, conducting network reconnaissance and establishing access to internal infrastructure. The threat extends beyond individual developer systems, as compromised packages introduced into trusted build pipelines could expose source code, cloud credentials and production services. The malicious entry point executes automatically when the module is loaded, verifies and launches the embedded binary as a detached background process and does so without relying on npm lifecycle hooks, meaning controls that block install scripts may not prevent execution. Even indirect or transitive dependencies can therefore trigger the malicious behavior.

Once deployed, the implant communicates with attacker-controlled infrastructure over HTTP, maintaining separate channels for data exfiltration and additional payload delivery. It can harvest SSH keys, browser credentials, and database files, while establishing persistence through multiple system mechanisms that allow access to survive removal of the original npm package. The malware also incorporates an AI-assisted command-generation capability, allowing operators to translate natural-language instructions into executable command sequences for activities such as reconnaissance and credential harvesting. Additional proxying and port-forwarding capabilities enable compromised Linux hosts to act as gateways into otherwise inaccessible internal systems. The combination of supply chain delivery, persistent credential theft, AI-assisted operations, and network pivoting makes the campaign capable of evolving from a single compromised developer environment into a broader enterprise intrusion.

Multiple vulnerabilities in JFrog Artifactory allow unauthenticated attackers to bypass authentication and retrieve arbitrary artifacts, risking exposure of proprietary code, embedded secrets, and enabling further compromise via dependency tampering or lateral movement.

A path-matching flaw in the AWS token exchange flow, CVE-2026-42018 (CVSS Score 7.5), permits requests with a trailing slash to skip authentication filters, causing the service to mint a JWT for the anonymous principal without validating IAM mapping. The token can be used to call authenticated APIs and access resources normally restricted to authenticated users.

A separate issue in the UI stash feature, CVE-2026-69107 (CVSS Score 5.9), permits creation of server-side stash entries using attacker-controlled repository and path values; stash objects are saved to an HTTP session without authorization checks, exposing artifact metadata and content-addressing keys that can be dereferenced to retrieve artifact bytes.

Multiple critical vulnerabilities in Zoom Workplace, including CVE-2026-53413 and CVE-2026-53414, can allow an attacker participating in a meeting to achieve zero-click remote code execution on another participant’s device. The flaws affect Zoom’s annotation functionality and were confirmed across Windows, macOS, iOS, Android, and Linux clients, requiring no interaction, download, or visible action from the victim.

The vulnerabilities originate from memory-safety issues in Zoom’s proprietary annotation protocol. CVE-2026-53413 (CVSS Score 8.3) is an out-of-bounds write caused by insufficient validation of attacker-controlled data during annotation deserialization, while CVE-2026-53414 (CVSS Score 6.5) can expose process memory and potentially provide information required to bypass protections such as ASLR. By sending specially crafted annotation messages through a legitimate Zoom meeting, an attacker can corrupt the receiving client’s memory and potentially execute arbitrary code with the privileges of the Zoom process.