#otx — Public Fediverse posts

Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection

Hackers are using a newly identified platform called ROMULUS to deliver malware through ClickFix traps, combining hidden PowerShell scripts, altered software installers, and encrypted archives. The platform supports separate infection paths, including one that installs LegionLoader and another that abuses a legitimate Stardock program to load malicious code. The findings show how a single delivery […] The post Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection appeared first on Cyber Security News .

Pulse ID: 6ad23af8e4dab85ba85e4622
Pulse Link: https://otx.alienvault.com/pulse/6ad23af8e4dab85ba85e4622
Pulse Author: CyberHunter_NL
Created: 2026-10-16 14:55:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #Deliver #Malware #PowerShell #OTX #CyberHunter_NL

CVE-2026-102764: Critical BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers

BeyondTrust has disclosed CVE-2026-102764, a critical vulnerability in Remote Support (RS) that was exploited as a zero-day by a suspected China-nexus cyber espionage actor. The flaw carries a CVSS 4.0 score of 9.3 and can allow an unauthenticated remote attacker to perform arbitrary file operations on a vulnerable appliance. Google Threat Intelligence Group and Mandiant […] The post CVE-2026-102764: Critical BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers appeared first on SOC Prime .

Pulse ID: 6ad21eee81d607bb814c8f92
Pulse Link: https://otx.alienvault.com/pulse/6ad21eee81d607bb814c8f92
Pulse Author: CyberHunter_NL
Created: 2026-10-16 12:56:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CVE2026102764 #China #ZeroDay #Cyberespionage #OTX #CyberHunter_NL

New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials

Aoki, also known as Aokigahara, is a data-stealing malware that has added credentials for AI tools to its growing list of targets. Recent versions seek local files and session data linked to ChatGPT, Claude, OpenAI Codex, Cursor, Codeium and Gemini. The change raises the risk for developers who use AI assistants alongside source-code repositories, cloud […] The post New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials appeared first on Cyber Security News .

Pulse ID: 6ad202e05b04c328bef763a3
Pulse Link: https://otx.alienvault.com/pulse/6ad202e05b04c328bef763a3
Pulse Author: CyberHunter_NL
Created: 2026-10-16 10:56:32

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ChatGPT #Malware #Cloud #developers #OTX #CyberHunter_NL

BAE Systems cyberattack disrupts US federal court operations

The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. [...]

Pulse ID: 6ad1d87afc6d15365e37f02e
Pulse Link: https://otx.alienvault.com/pulse/6ad1d87afc6d15365e37f02e
Pulse Author: CyberHunter_NL
Created: 2026-10-16 07:55:38

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberAttack #Office #OTX #CyberHunter_NL

Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors

A suspected China-linked espionage group exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to gain access, reach root privileges and install tools for continued access. Google Threat Intelligence Group (GTIG) says the activity took place in late August 2026, before BeyondTrust disclosed the flaw on October 15. The vulnerability, tracked as CVE-2026-102764, could let […] The post Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors appeared first on Cyber Security News .

Pulse ID: 6ad1d8975ff02a2fa93bd1fd
Pulse Link: https://otx.alienvault.com/pulse/6ad1d8975ff02a2fa93bd1fd
Pulse Author: CyberHunter_NL
Created: 2026-10-16 07:56:07

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Chinese #Deploy #ZeroDay #CVE2026102764 #OTX #CyberHunter_NL

Ivanti CVE-2026-104935: Zero-Day Chain Exploited in Operation Innovate

Pulse ID: 6ad1a742ddcd2481e3009b06
Pulse Link: https://otx.alienvault.com/pulse/6ad1a742ddcd2481e3009b06
Pulse Author: Tr1sa111
Created: 2026-10-16 04:25:38

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CVE2026104935 #Ivanti #ZeroDay #OTX #Tr1sa111

Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email

Pulse ID: 6ad1a6f2b9b385730edae86d
Pulse Link: https://otx.alienvault.com/pulse/6ad1a6f2b9b385730edae86d
Pulse Author: Tr1sa111
Created: 2026-10-16 04:24:18

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AgentTesla #Email #Malware #OTX #Tr1sa111

CVE-2026-0322: Actively Exploited PAN-OS RCE Flaw Enables Root Access

Palo Alto Networks has released security updates addressing CVE-2026-0322, a high-severity remote code execution vulnerability affecting the management interface of PAN-OS. The flaw carries a CVSS 4.0 score of 8.6 and enables an authenticated attacker with network access to execute arbitrary code with root privileges on a vulnerable appliance/system. Palo Alto Networks disclosed the issue […] The post CVE-2026-0322: Actively Exploited PAN-OS RCE Flaw Enables Root Access appeared first on SOC Prime .

Pulse ID: 6ad0bfe0fe1ebf8f6b3f19c9
Pulse Link: https://otx.alienvault.com/pulse/6ad0bfe0fe1ebf8f6b3f19c9
Pulse Author: CyberHunter_NL
Created: 2026-10-15 11:58:24

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CVE20260322 #RCE #PaloAlto #OTX #CyberHunter_NL

Hirudo: From Fake Updates to Patched Banking Apps

A new Android banking remote access trojan named Hirudo has been identified, combining credential theft with live remote control. It is delivered through shopping and entertainment apps that act as droppers, installing the trojan as a separate package behind fake update prompts. The malware replaces legitimate banking applications with patched versions that disable security checks from within the app itself. Eight Indonesian banking apps covering seven banks have been targeted with purpose-built replacements embedding a hooking engine. The campaign uses real advertising infrastructure including Amazon CloudFront for distribution, with targeting extending beyond Indonesia to China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records.

Pulse ID: 6acf85338bff164de62a2759
Pulse Link: https://otx.alienvault.com/pulse/6acf85338bff164de62a2759
Pulse Author: AlienVault
Created: 2026-10-14 13:35:47

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#FakeUpdates #Amazon #Android #China #OTX #AlienVault

Ivanti CVE-2026-104935: Zero-Day Chain Exploited in Operation Innovate

Ivanti has released emergency security updates after attackers exploited a chain of three zero-day vulnerabilities in Connect Secure VPN appliances to gain root-level access without authentication. The attack began on October 3, targeting an appliance running version 22.8R2.4. Two vulnerabilities are tracked as CVE-2026-104935 with a CVSS score of 8.6, involving an authentication bypass and remote code execution through manipulated CGI requests and malicious file uploads. A third unpatched vulnerability allows privilege escalation to root by manipulating a privileged service through memory modification. While patches address the authentication bypass and RCE, the privilege escalation flaw remains unresolved. CISA added the vulnerability to its KEV catalog with an October 16 remediation deadline for federal agencies.

Pulse ID: 6acf8533a44062761084826c
Pulse Link: https://otx.alienvault.com/pulse/6acf8533a44062761084826c
Pulse Author: AlienVault
Created: 2026-10-14 13:35:47

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CVE2026104935 #Ivanti #ZeroDay #CISA #OTX #AlienVault

Disruption Targets Major Chinese-Language Phishing Kits with Japanese Focus

A coordinated disruption action targeted Chinese-speaking cybercriminals operating three major phishing kits: CoGUI, CoAceV, and CoFish_Ws, which collectively distributed hundreds of millions of credential phishing messages primarily targeting Japanese organizations. These operations impersonated 66 well-known brands, mainly consumer and finance companies, to steal usernames, passwords, and payment data. The threat actors demonstrated sophisticated capabilities, utilizing approximately 17,000 unique domains with frequent rotation and evasion techniques. The ecosystem enablers YAM Store and Iron Man were also targeted through a civil lawsuit and domain seizures, conducted in collaboration between Microsoft, Health-ISAC, and multiple security partners. This coordinated action is expected to significantly impact the Chinese phishing ecosystem and cause substantial operational disruption to multiple threat groups conducting financial fraud.

Pulse ID: 6acf8736e6d91800bcdb734a
Pulse Link: https://otx.alienvault.com/pulse/6acf8736e6d91800bcdb734a
Pulse Author: AlienVault
Created: 2026-10-14 13:44:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Chinese #Phishing #Credential #FinancialFraud #OTX #AlienVault

Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls

Hackers are exploiting a high-severity flaw in Palo Alto Networks PAN-OS that allows authenticated attackers to run code with root privileges on affected firewalls. Tracked as CVE-2026-0322, the vulnerability affects the management interface, with the company confirming “very limited exploitation” and urging customers to apply fixes as soon as possible. Palo Alto Networks published its […] The post Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls appeared first on Cyber Security News .

Pulse ID: 6ad04ef4ab212bf6bd0849e7
Pulse Link: https://otx.alienvault.com/pulse/6ad04ef4ab212bf6bd0849e7
Pulse Author: CyberHunter_NL
Created: 2026-10-15 03:56:36

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#0Day #PaloAlto #CVE20260322 #OTX #CyberHunter_NL

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]

Pulse ID: 6ad016777a22b36655d161ff
Pulse Link: https://otx.alienvault.com/pulse/6ad016777a22b36655d161ff
Pulse Author: CyberHunter_NL
Created: 2026-10-14 23:55:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#PaloAlto #RCE #CVE20260322 #ZeroDay #OTX #CyberHunter_NL

CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited for Unauthenticated Code Execution

Ivanti has disclosed CVE-2026-104935, a high-severity vulnerability in Ivanti Connect Secure (ICS) that is being actively exploited in real-world attacks. The flaw carries a CVSS score of 8.6 and enables unauthenticated attackers to bypass authentication and execute arbitrary commands on vulnerable VPN appliances. The vulnerability came to light after Volexity investigated a compromised Ivanti Connect […] The post CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited for Unauthenticated Code Execution appeared first on SOC Prime .

Pulse ID: 6acfec758b19e13db1592211
Pulse Link: https://otx.alienvault.com/pulse/6acfec758b19e13db1592211
Pulse Author: CyberHunter_NL
Created: 2026-10-14 20:56:21

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CVE2026104935 #ConnectSecure #Ivanti #ZeroDay #OTX #CyberHunter_NL

Hackers Use Fake WatchGuard VPN Download Site to Steal Login Credentials

Hackers used a fake WatchGuard VPN download website to steal login details before offering visitors the real, digitally signed VPN installer. The attack collected a VPN server address, username, and password through a browser pop-up, leaving victims exposed without installing a malicious client. The campaign shows how a normal software search can lead to credential […] The post Hackers Use Fake WatchGuard VPN Download Site to Steal Login Credentials appeared first on Cyber Security News .

Pulse ID: 6acf97fe55584a9c37c68d7d
Pulse Link: https://otx.alienvault.com/pulse/6acf97fe55584a9c37c68d7d
Pulse Author: CyberHunter_NL
Created: 2026-10-14 14:55:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#VPN #Credential #Installing #Password #OTX #CyberHunter_NL

U.K. Sanctions Cryptomus for RU Money Laundering

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.

Pulse ID: 6acf9801cf8e35c95d00c88d
Pulse Link: https://otx.alienvault.com/pulse/6acf9801cf8e35c95d00c88d
Pulse Author: CyberHunter_NL
Created: 2026-10-14 14:56:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberCrime #Russia #UnitedKingdom #cryptocurrency #OTX #CyberHunter_NL

ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure

An evolving Linux malware campaign deploys ClingSTUN, a back-connect proxy backdoor exploiting known vulnerabilities in Internet-facing IoT and network devices. The malware establishes persistent access and converts compromised systems into remotely controlled proxy nodes. Supporting multiple Linux architectures, ClingSTUN combines boot persistence, process termination, watchdog manipulation, process concealment, remote command execution, and self-propagation. It abuses legitimate public STUN infrastructure for NAT traversal. The campaign has expanded the number of vulnerabilities and device vendors it targets over time, affecting products from D-Link, EnGenius, Realtek, TP-Link, AVTECH, Ivanti, Tenda, Lantronix, and others, highlighting the continued risk posed by unpatched, unsupported, and unnecessarily exposed Internet-facing devices.

Pulse ID: 6acf7922d9bc17d95d27ec5c
Pulse Link: https://otx.alienvault.com/pulse/6acf7922d9bc17d95d27ec5c
Pulse Author: AlienVault
Created: 2026-10-14 12:44:18

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ClingSTUN #Edge #BackDoor #IoT #OTX #AlienVault

Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email

A phishing campaign has been observed distributing AgentTesla infostealer through emails masquerading as business proposal requests. Recipients are asked to review an attached product list, but the ZIP file contains an executable file instead of a document. The malicious EXE disguises itself as a café management program using Chinese-language descriptions and UI elements. Through multiple stages of obfuscation, the malware extracts encrypted data from bitmap resources, performs XOR decryption, and loads successive .NET payloads into memory. The final payload is AgentTesla, which steals credentials, cookies, and contact information from browsers, email clients, FTP and VPN applications. Stolen data is exfiltrated via FTP to a compromised server. The attack demonstrates sophisticated multi-stage loading techniques and social engineering tactics targeting business users.

Pulse ID: 6acf82f3a84bcf5248537bf9
Pulse Link: https://otx.alienvault.com/pulse/6acf82f3a84bcf5248537bf9
Pulse Author: AlienVault
Created: 2026-10-14 13:26:11

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Email #Malware #Chinese #Cookies #OTX #AlienVault

Disruption Targets Major Chinese-Language Phishing Kits with Japanese Focus

Key findings A disruption action targeting prominent players across the Chinese-speaking phishing and fraud ecosystem struck a blow to the most high-volume threats in Proofpoint data. Proofpoint supported Microsoft and other private and public partners in the civil lawsuit and takedown action. The highest-volume direct email threats in Proofpoint campaign data come from three phishing kits our researchers named CoGUI, CoAceV, and CoFish_Ws, which all actively target Japanese organizations. These are part of the targeted actions. Campaigns linked to these phishing kits impersonate well-known companies, mainly consumer and finance brands, and distribute hundreds of millions of messages. Proofpoint assesses with high confidence that all these phishing kits have common roots and are used by overlapping affiliates. The disruption that includes broader ecosystem enablers YAM Store and Iron Man is likely to impact the efficacy and success of these phishing kits, potentially causing...

Pulse ID: 6acf89d8e3d0653228bb3181
Pulse Link: https://otx.alienvault.com/pulse/6acf89d8e3d0653228bb3181
Pulse Author: CyberHunter_NL
Created: 2026-10-14 13:55:36

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Chinese #Phishing #Email #Microsoft #OTX #CyberHunter_NL

The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for large-scale phishing. In collaboration with law enforcement agencies and other partners worldwide, Microsoft’s Digital Crimes Unit (DCU) facilitated a disruption of the ecosystem. The post The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime appeared first on Microsoft Security Blog .

Pulse ID: 6acf8a07c9cefb171e90015a
Pulse Link: https://otx.alienvault.com/pulse/6acf8a07c9cefb171e90015a
Pulse Author: CyberHunter_NL
Created: 2026-10-14 13:56:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberCrime #Phishing #Chinese #LawEnforcement #OTX #CyberHunter_NL

Q3 2026 Statistical Report on Malware Targeting Windows Database Servers

During the third quarter of 2026, attackers targeted MS-SQL and MySQL servers on Windows systems through multiple attack vectors including brute-force attacks, dictionary attacks, and vulnerability exploitation. Threat actors deployed XMRig cryptocurrency miners, GotoHTTP backdoors, and SoftEther VPN infrastructure along with various web shells including Sharp4WebCmd, Suo5, and PowerShell-based shells for persistence. Additional tools used included VShell for remote command execution, HackBrowserData for credential theft, Fscan for network reconnaissance, and Cloudflared for port exposure. Attackers created backdoor accounts for RDP access and operated SoftEther VPN servers in Cascade Connection mode as command and control infrastructure. The attacks primarily resulted from weak passwords, improper account management, and inadequate security measures on externally exposed database servers.

Pulse ID: 6acf2be17afb8c6c6b066bc9
Pulse Link: https://otx.alienvault.com/pulse/6acf2be17afb8c6c6b066bc9
Pulse Author: AlienVault
Created: 2026-10-14 07:14:41

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Windows #BackDoor #BruteForce #Credential #OTX #AlienVault

2026 Q3 Linux SSH Server Targeted Malware Statistics Report

During Q3 2026, honeypot monitoring revealed attacks targeting poorly managed Linux SSH servers through brute force and dictionary attacks. Primary malware families included ShellBot (also known as PerlBot), a Perl-based DDoS bot with C&C infrastructure at specific IPs, and Fisieredoor, a backdoor capable of executing commands and deploying SSH dictionary attack tools. Attackers downloaded malware using wget or curl, then installed user-mode rootkits, XHide process masking tools, and XMRig cryptocurrency miners. The launcher malware utilized ld.so.preload to inject rootkits and disguised mining processes as legitimate bash sessions. Fisieredoor deployed additional tools including goauto and tsm for credential harvesting and lateral movement, transmitting successful authentication results to command servers.

Pulse ID: 6acf2be335dd8bbd4e27ec2e
Pulse Link: https://otx.alienvault.com/pulse/6acf2be335dd8bbd4e27ec2e
Pulse Author: AlienVault
Created: 2026-10-14 07:14:43

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Linux #SSH #Malware #BackDoor #OTX #AlienVault

Fake Calendly “Meta Careers” pages steal Facebook and Google logins

An interview invitation becomes a trap for your Facebook and Google passwords, even with two-factor authentication turned on.

Pulse ID: 6acf6dd3ca2d5b23dbf6a2d5
Pulse Link: https://otx.alienvault.com/pulse/6acf6dd3ca2d5b23dbf6a2d5
Pulse Author: CyberHunter_NL
Created: 2026-10-14 11:56:03

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Facebook #Google #Passwords #TwoFactorAuthentication #OTX #CyberHunter_NL

Coruna and DarkSword Exploit Kits Can Fully Compromise iPhones From a Single Web Visit

Two powerful iPhone exploit kits, Coruna and DarkSword, show how a visit to a malicious or compromised website can put an outdated device at risk. The kits can link several software flaws together to break out of the browser and reach deeper parts of iOS. Depending on the device’s software version and the kit used, […] The post Coruna and DarkSword Exploit Kits Can Fully Compromise iPhones From a Single Web Visit appeared first on Cyber Security News .

Pulse ID: 6acf51aa19acce8aaaaa5ac1
Pulse Link: https://otx.alienvault.com/pulse/6acf51aa19acce8aaaaa5ac1
Pulse Author: CyberHunter_NL
Created: 2026-10-14 09:55:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Coruna #iOS #OTX #CyberHunter_NL

Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email

Recently, the AhnLab SEcurity intelligence Center (ASEC) identified instances of phishing emails being circulated that disguise themselves as requests to review a business proposal. The email body asks recipients to review the attached product list and reply with their feedback on inventory and pricing, thereby prompting users to download and open the attached ZIP file. […]

Pulse ID: 6acf51b5c6f6c3f873fbfa08
Pulse Link: https://otx.alienvault.com/pulse/6acf51b5c6f6c3f873fbfa08
Pulse Author: CyberHunter_NL
Created: 2026-10-14 09:56:05

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Email #AhnLab #ASEC #ZIP #OTX #CyberHunter_NL

Beware of Phishing Emails Disguised as Purchase Orders

Recently, the AhnLab SEcurity intelligence Center (ASEC) identified instances of phishing emails being circulated that disguise themselves as requests to confirm purchase orders. The email body asks recipients to review the attached purchase order and reply with the relevant information, prompting users to download and open the attached DOCX file. Attachment: PURCHASED ORDER.Docx [Figure […]

Pulse ID: 6acf51bc058003f738dc221f
Pulse Link: https://otx.alienvault.com/pulse/6acf51bc058003f738dc221f
Pulse Author: CyberHunter_NL
Created: 2026-10-14 09:56:11

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Phishing #AhnLab #ASEC #Email #OTX #CyberHunter_NL

The phone was compromised before the user turned it on: the rise of Midnight Mimosa

Pulse ID: 6acf3148ea146a48200d699a
Pulse Link: https://otx.alienvault.com/pulse/6acf3148ea146a48200d699a
Pulse Author: Tr1sa111
Created: 2026-10-14 07:37:44

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#MidnightMimosa #OTX #Tr1sa111

Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client

Pulse ID: 6acf31885c19e18d5025e81b
Pulse Link: https://otx.alienvault.com/pulse/6acf31885c19e18d5025e81b
Pulse Author: Tr1sa111
Created: 2026-10-14 07:38:48

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#VPN #OTX #Tr1sa111

Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials

Attackers chained three zero-day flaws in Ivanti Connect Secure VPN appliances to gain root-level access without logging in, then searched for credentials and sensitive Active Directory data. The activity, which began on October 3, 2026, targeted a fully patched appliance running version 22.8R2.4, showing that keeping a device current did not protect it from these […] The post Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials appeared first on Cyber Security News .

Pulse ID: 6acf3588ce13c600c5c1f437
Pulse Link: https://otx.alienvault.com/pulse/6acf3588ce13c600c5c1f437
Pulse Author: CyberHunter_NL
Created: 2026-10-14 07:55:51

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ConnectSecure #Ivanti #VPN #ZeroDay #OTX #CyberHunter_NL

Hackers Abuse Google Search to Attacks ITadmins with Weaponized PuTTY Installer

IT administrators searching Google for PuTTY may see a convincing fake download result mixed with legitimate links. Researchers documented a campaign that uses a lookalike website to deliver a malicious Windows installer disguised as the popular SSH client. The installer opens a working PuTTY window as a decoy while secretly starting a separate malware chain […] The post Hackers Abuse Google Search to Attacks ITadmins with Weaponized PuTTY Installer appeared first on Cyber Security News .

Pulse ID: 6acf359270f4f1a6b64c6e63
Pulse Link: https://otx.alienvault.com/pulse/6acf359270f4f1a6b64c6e63
Pulse Author: CyberHunter_NL
Created: 2026-10-14 07:56:02

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Google #Deliver #SSH #Windows #OTX #CyberHunter_NL

Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client

In early October, a sophisticated credential phishing campaign targeted WatchGuard Mobile VPN users through a fake download site at watchguard-vpn[.]net. The attack used SEO poisoning to appear in search results and deployed a unique technique: after collecting victim credentials twice through browser pop-ups, it downloaded the genuine, validly signed WatchGuard installer directly from WatchGuard's official CDN. This eliminated malicious files that security tools could detect. The first credential submission was deliberately rejected as incorrect to collect multiple passwords. The credential collection endpoint at watchguard-ssl[.]online received server addresses, usernames, and passwords, providing attackers network access. This domain was previously reported in January with no backend functionality but was re-registered in August with full phishing capabilities implemented by September.

Pulse ID: 6acec272f01b1f0cac6ecb2a
Pulse Link: https://otx.alienvault.com/pulse/6acec272f01b1f0cac6ecb2a
Pulse Author: AlienVault
Created: 2026-10-13 23:44:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#VPN #CDN #Credential #Endpoint #OTX #AlienVault

Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026

During the third quarter of 2026, multiple attack campaigns targeted poorly managed Linux SSH servers using brute force, dictionary attacks, and vulnerability exploits. Threat actors deployed ShellBot, a Perl-based DDoS bot, utilizing C&C servers at specific IP addresses with capabilities including port scanning and UDP flooding. A sophisticated attack chain involved launcher malware that executed user-mode rootkit libSSL2.3.0.So via /etc/ld.so.preload, subsequently deploying XMRig cryptocurrency miner disguised as -bash using XHide process concealment tool. Additionally, Fisieredoor backdoor was deployed, capable of command execution and installing SSH brute-force tools including goauto and tsm-family, which systematically targeted systems using credential lists. Organizations must implement strong password policies, regular patching schedules, and access controls for externally exposed SSH infrastructure.

Pulse ID: 6acf002e7c7fddeb927af2d8
Pulse Link: https://otx.alienvault.com/pulse/6acf002e7c7fddeb927af2d8
Pulse Author: AlienVault
Created: 2026-10-14 04:08:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Linux #SSH #Malware #BackDoor #OTX #AlienVault