#VB2027 is heading to London, 6–8 October 2027! 🎉

We’re excited to return to this iconic city and bring together brilliant minds from across the cybersecurity industry for another three days of cutting-edge research, insightful discussions and unforgettable moments.

Infoblox traced Hidden Hawk's gambling SEO across school and government domains. Researchers contacted the group using a fake casino persona. infoblox.com/blog/threat-in…

The Trellix team found Sirius Backdoor behind a blank FedEx PDF. A provisioning package allows it to reinstall after a Windows reset. trellix.com/blogs/research…

Vojtech Moravec at GenDigital details how AMOS can replace Ledger and Trezor apps to steal phrases. The campaign used Google Ads and fake claude.ai pages. gendigital.com/blog/insights/…

Huntress researchers Jonathan Semon & Rich Mozeleski show how stolen ConnectWise credentials were used against nearly 1000 M365 tenants. In two cases, attackers gained privileged roles within three hours. huntress.com/blog/connectwi…

We observed in-the-wild exploitation of CVE-2026-102785 on a site running a vulnerable version of YOOtheme Pro two days after the patch. Scanners planted JPEG/PHP polyglot webshells in uploads, then operators deployed an ALFA webshell. Details: bit.ly/48fpUZ3

Microsoft wants EDR out of the Windows kernel. We checked the binaries

They even come with public symbols. Full write-up from @zodiacon : go.es.io/4zcdL2U

Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in
What we found:
• wesp.sys: a Microsoft-built file system mini-filter at altitude 329500
• EspFilterPort: the filter communication port it uses to reach user mode
• espclient.dll: 120 Esp* exports for rules, filters and event queues

Seemingly routine threats can escalate fast, posing a larger threat to your organization.

Our Threat Response Team experienced this first hand when they were investigating an alert involving the unexpected execution of a PDF document.

Learn more: trellix.com/blogs/research…

🚨 testmetest goes beyond npm.
JFrog Security Research identified 42 armed GitHub repositories across 11 legitimate owners hiding an npm publisher, plus a new native addon that decrypts its payload at runtime and stays dormant in CI, sandboxes, and analysis tools.

The campaign spans 25 npm package names. Check whether you installed any testmetest or @iobandamwer packages and remove them if found.

Full analysis: research.jfrog.com/post/beyond-te…

🚨 BlockStrap (Magento / Adobe Commerce, CVSS 10.0)

We've reproduced several RCE chains and expect threat actors to follow suit imminently.

If you haven't patched yet, we strongly urge you to do so now.

sansec.io/research/block…

🚨 We discovered StyleSmuggler, an unauthenticated RCE in Magento & Adobe Commerce under active exploitation. Confirmed on clean 2.4.7, 2.4.8 and 2.4.9 installs. PHP executes during failed payment email rendering.

Our research: sansec.io/research/style…

⚠️ RAT families showed contrasting activity trends last week. #Romulus climbed 32% while #AsyncRAT dropped 35%, with #Remcos and #XWorm also declining. Meanwhile, #FormBook gained nearly 40%.

📌 Trend to watch: declining activity among leading RATs doesn't mean every family is should assess detection gaps at the family level rather than assume lower volumes mean reduced exposure.

Monitor the malware driving today’s attacks: any.run/malware-trends…

#Top10Malware

A token “spray-and-replay” campaign set the stage for business email compromise at dozens of orgs. Across nearly 500 M365 sign-ins, we saw:

📱rogue Entra devices
🧼 wiped and replaced MFA
📩 email hiding rules

How tradecraft evolved over 10 weeks: huntress.com/blog/token-rep…

A compromised LiteLLM 1.107.0 release added files that Python could execute during normal interpreter initialization. Applications did not need to import LiteLLM for the payload to run; starting Python in an affected environment could be enough. msft.it/6012axjt8

Microsoft analyzed two execution paths: a credential collector targeting authentication material across developer tools, cloud environments, browsers, and infrastructure, and a Unix-oriented loader capable of retrieving and executing additional Python code.

Endpoint observations on Windows and macOS matched the collector’s discovery, encryption, and outbound connection behavior. Starting Python in an affected environment could activate the payload, so investigators should avoid using Python or pip during evidence collection.

Read the Microsoft Security research for analysis of the startup mechanisms, credential exposure, Defender detections, hunting queries, indicators of compromise, and recovery guidance.

Infostealers are hijacking the AI train.

What’s Aokigahara after?
🎯AI sessions from Claude and ChatGPT Desktop
🔑IDE data and developer secrets
💰Browser credentials and crypto wallets
Your AI workspace is on the collection list.

Read more 👇
research.checkpoint.com/2026/infosteal…

Zscaler ThreatLabz observed attackers exploiting Citrix CVE-2026-88771 to deliver a FreeBSD-based implant that we track as TimeSmuggler. @sansecio observed the same malware being distributed as part of the StyleSmuggler zero-day campaign. The backdoor is written in Rust and on and supports the following commands:

- interval_check: Reconfigures the C2 polling interval
- system_check: Runs a system command
- dl_ex: Downloads and executes a binary file
- open_shell: Spawns an interactive reverse shell
- uninstall: Removes itself, including its persistence mechanisms

The interactive shell opens a direct WebSocket channel, but the main communication takes place using a NTP-like protocol over UDP port 123. The first 4 bytes of the communication are either an NTPv4 server or client header, depending on whether the malware is sending data or just polling the command-and-control server, but the rest of the package is sent as MessagePack chunks.

The malware adds a crontab entry to gain persistence and renames itself to resemble legitimate processes such as chronyd, kworker, fc-cache, and gvfsd-user.

In addition, TimeSmuggler includes string obfuscation. The obfuscation works by calculating a unique offset per string to locate the encoded string within the binary. Interestingly, the functions that calculate each string's offset have their control flow flattened (CFF). After the string's address is resolved, TimeSmuggler uses a set of inline decoding operations to obtain the final deobfuscated string. The decoding operations are different for each string, which makes the analysis more time consuming.

IOCs below:

SHA-256: 878bc868bdb23be276f1fab8a4418a35264439f3344ffaf9404414ab08744782

C2 NTP domain: ntp[.]reposync[.]to
C2 WSS domain: reposync[.]to
TimeSmuggler version number: 2.1.6

For more details on CVE-2026-88771, visit our blog: zscaler.com/blogs/security…

Check Point Research analysed Aokigahara, a new infostealer with a dedicated module targeting authentication and session data from Codex, Claude, Cursor, Copilot and Gemini. research.checkpoint.com/2026/infosteal…

Microsoft researchers analysed a compromised LiteLLM 1.107.0 release published to the PyPI & distributed through official container images. They explain the startup mechanisms, the credentials the payload could reach, & the evidence to investigate exposure microsoft.com/en-us/security…

Hungry? This ClickFix campaign relies on some mouth-watering domain names: grillmasterspro, EmbersAndBites, and more.

Read more about an attack that starts with a Google search for Amazon business and ends with a serving of “finger-licking” malware: huntress.com/blog/amazon-cl…

Four months after Operation Endgame, StealC's seller is back.

Dubbed Stadia, this new product is a full RAT with hidden desktop control, a command shell, a file explorer, and a loader. Varonis Threat Labs got the build the day it was listed, reversed it, and ran its panel wn, discovering that the code inside matches StealC's.

Operation Endgame forced StealC's seller to start from scratch with new servers, names, and panels, but it's clear they're not done yet.

Read more about our findings here: varonis.com/blog/stealc-re…

#ESETresearch uncovered #MythicRatatoskr, an undocumented Go backdoor hiding its C&C server inside the #Yggdrasil mesh network. It was used against a Ukrainian 🇺🇦 grain logistics firm in an intrusion that ended in a destructive #Sandworm attack.
welivesecurity.com/en/eset-resear… 1/6