Hello there 👋
Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week’s top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!
Top News Stories
Theme 1: ClickFix & macOS Endpoint Under Siege
Stories
🗞️ Critical macOS Screen Sharing Flaw Exploited to Deploy Monero Miners (NCSC NL) — CVE-2026-65400 gives unauthenticated root on internet-exposed Macs via VNC port 5900, and it’s being used to drop Monero miners. The bug bypasses state management credential validation entirely, so a network-based attacker authenticates to the built-in remote desktop service with no valid credentials and lands as root.
🗞️ Novel macOS “AmnesiaStealer” Delivered via ClickFix Attacks to Hijack Chromium Browsers (Jamf) — Multi-stage infostealer pushed through fake GitHub download pages that steals credentials and keychains, then hands operators live control of the browser. The remote-control module clones browser profiles and drives them over DevTools protocols, giving live screencast control and plaintext cookie theft without tripping browser automation flags. 🔎 Threat Hunting Package
🗞️ Unmasking MacSync Stealer: How Attackers Exploit macOS Devices and Hide in Plain Sight (Microsoft Security) — macOS stealer after keychain material, crypto wallets, and cloud/SSH keys, delivered through fake browser prompts and helpdesk chats. It rotates 30+ C2 domains to defeat static blocking, but the behavioural footprint never changes. Predictable curl command lines, AppleScript staging in /tmp/, and HTTP PUT exfil carrying upload_id and chunk_index. 🔎 Threat Hunting Package
🗞️ Unmasking StopAndProtect: How 2,000+ Hijacked WordPress Sites Fueled a Massive Campaign (Check Point Research) — Thousands of compromised WordPress sites used for C2, payload delivery, and exfil, feeding ClickFix lures to over 6,000 victim IPs. The delivery is standard ClickFix PowerShell, but the actor’s OPSEC failures left directory listings exposed. Over 31,000 stolen screenshots, victim logs, and the source for their own site-management tooling. 🔎 Threat Hunting Package
Recommendations
☑️ Patch macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 across managed Macs; where patching lags, disable Screen Sharing, block inbound 5900, and force admin sessions through VPN or ZTNA.
☑️ Train users and developers never to paste Terminal or PowerShell commands from web pages, fake CAPTCHAs, or helpdesk chats. Also, turn on the macOS 26.4+ malicious-paste blocking.
☑️ Hunt behaviour rather than IOCs: osascript spawning curl with -k -s –data-binary, Terminal launching unsigned Mach-O binaries, archive creation in /tmp/, and unprivileged PowerShell kicked off from a browser child process.
☑️ Audit TCC grants and Full Disk Access across the fleet, alerting on anything unexpected touching login keychains or browser profile directories.
☑️ Filter egress and watch for HTTP PUT requests carrying upload_id / chunk_index with macOS user agents and static API-key headers.
☑️ For anyone running WordPress: update core, plugins, and themes, inspect wp-content/mu-plugins for hidden backdoors, and put a WAF in front to block unauthorised uploads.
Theme 2: Blinding the Defender — Trusted Infrastructure, Trusted Identity, Trusted Code
Stories
🗞️ Python Implant Hides C2 Traffic Inside Microsoft 365 and Azure (Ontinue) — TWINLOOT runs its entire C2 through SharePoint, Teams, and Edge, authenticating via an attacker-controlled Azure tenant. SharePoint acts as a dead drop and Teams TURN servers provide reverse tunnels, so nothing lands in the victim’s Entra ID logs and signature-based tooling has nothing to match on. 🔎 Threat Hunting Package
🗞️ Project CAV3RN Espionage Framework Upgrades Stealth with Google Apps Script & DNS-Based C2 Selection (Kaspersky) — The framework now switches between HTTPS and a Google Apps Script relay to bury traffic inside trusted Google infrastructure. C2 selection runs off DNS A-record queries that fetch configuration and rotate channels on the fly, which breaks monitoring built around a fixed egress path. 🔎 Threat Hunting Package
🗞️ Advanced Data Theft Campaign Hits Salesforce and ServiceNow Portals (Reco) — The “City-Forum” campaign pulls data out of Salesforce and ServiceNow portals by abusing permissive guest user configurations, with no credentials and no exploit. There’s no zero-day here — custom Go tooling hits Salesforce’s Lightning Web Runtime UI-API layer and an undocumented ServiceNow search endpoint that nobody was monitoring. 🔎 Threat Hunting Package
🗞️ Russian Espionage Clusters Abuse Legitimate Auth Flows to Target High-Profile Individuals (Google Threat Intelligence Group) — Three clusters (UNC6293, UNC7005, UNC5976) abuse OAuth flows, Application-Specific Passwords, and device-linking to hold persistent access to personal accounts. Because every step runs through a legitimate identity workflow, the activity sails past anti-phishing controls and conventional MFA. 🔎 Threat Hunting Package
🗞️ HoneyMyte Deploys ‘CoolClient’ Driver Rootkit for Advanced Evasion (Kaspersky) — Mustang Panda now pairs its CoolClient backdoor with a kernel-mode driver rootkit against government and diplomatic targets. Kernel-space execution lets the rootkit blind EDR and stop anti-malware from terminating the backdoor underneath it, which makes the defence prevention at load time rather than detection afterwards. 🔎 Threat Hunting Package
Recommendations
☑️ Stop treating Microsoft and Google traffic as safe by default. Hunt anomalous SharePoint, Teams, and Graph API behaviour, and flag Apps Script relays initiated by non-browser background processes.
☑️ Build DNS visibility for C2 selection: high volumes of A-record queries to repetitive or unusually structured subdomains used for config pulls and freshness checks.
☑️ Audit SaaS guest permissions across Salesforce Experience Cloud and ServiceNow portals. Strip object and field read rights, disable guest public API access, tighten sharing rules, and check logs for traffic from 158.220.87.79 or hits on /api/now/sp/search.
☑️ Sweep and revoke unauthorised OAuth consents and Application-Specific Passwords, require admin approval for third-party app grants, and move at-risk personnel to FIDO2 keys. Tell them plainly: never type an ASP into a web form, never scan a QR code to “link a device”.
☑️ Enforce Driver Signature Enforcement and HVCI/Memory Integrity, back it with ASR rules and a vulnerable-driver blocklist, and monitor for unexpected service creation or driver registration.
☑️ Disable Edge headless mode and alert on Python executions or Graph API calls originating from the browser.
Theme 3: Developer Pipeline & AI Assistants Targeted
Stories
🗞️ Massive npm Supply Chain Attack Exposes Credentials via Self-Propagating Worm (Microsoft Security Research) — ‘ChainDrop’ infected 400+ npm packages with the ‘Mini Shai-Hulud’ worm, using preinstall hooks to steal cloud and infrastructure credentials. It’s genuinely worm-like: stolen publishing tokens let it pull a maintainer’s latest package, inject itself, bump the patch version, and republish, with no source commit anywhere. 🔎 Threat Hunting Package
🗞️ Wiz Research Uncovers CI/CD Flaw in Snowflake Copilot AI Environment (Wiz) — A flaw in Snowflake Copilot’s CI/CD environment allowed unauthorised command execution, exposing build tokens, environment variables, and source. The gap is sandboxing: when prompt execution and the build runner share an environment, the assistant becomes a path to code execution and credential harvesting.
🗞️ The ‘CoSnitch’ Vulnerability Turns AI Assistants Against Themselves (Varonis) — CVE-2026-24301, a one-click flaw in Microsoft Copilot Personal that silently exfiltrates cloud data through URL summarisation requests. The technique is “meta-hacking” where researchers got Copilot to describe its own guardrails, then built an injection that base64-encodes context data into HTTP GETs to an attacker webhook.
🗞️ Cryptographic Context Injection: How Hidden Encryption Tricks AI into Exfiltrating Private Data (Adversa AI) — Malicious web pages steal Grok users’ context and conversation history using encrypted payloads. AES-256-GCM ciphertext reads as noise to static classifiers; once the model decrypts it in its own sandbox, it treats the output as trusted internal content rather than untrusted web input.
Recommendations
☑️ Move the npm CLI to v12 and turn on min-release-age so freshly published versions can’t be pulled straight into a build; purge npm and yarn caches on every developer endpoint and build host, then walk dependency trees and artifact repos for compromised versions.
☑️ If a bad version was ever resolved, rotate everything (e.g. cloud keys, GitHub tokens, npm publishing tokens) from a known-clean host, because the worm enumerates and exfiltrates exactly those.
☑️ Scope AI integration credentials to individual build stages instead of granting broad runner permissions, and run agents and build containers as ephemeral sandboxes with restricted egress.
☑️ Confirm Microsoft’s 18 August 2026 patches for CVE-2026-24301 are deployed everywhere, and restrict what user context an agent can reach while it’s browsing or summarising external URLs.
☑️ Put approval gates in front of agent outbound requests and URL fetches, and quarantine fetched content in tool-less sandboxes so decrypted or injected text never inherits trust.
☑️ Log for the exfil pattern: outbound URLs carrying base64-encoded parameters from trusted AI platforms, plus routine audits of CI/CD and agent tool-chain logs for anomalous command invocations.
Theme 4: The Extortion Economy & Its Infrastructure
Stories
🗞️ Mass Extortion Campaign Exploits Enterprise Zero-Days with Custom Implants (ReliaQuest) — Clop is back, abusing zero-days in ERP and MFT platforms to deploy web shells and exfiltrate at scale. Clop doesn’t run continuous opportunistic operations; it runs planned, vulnerability-led bursts designed to drain data before defenders can patch. 🔎 Threat Hunting Package
🗞️ Medusa Ransomware Operations Escalate (CISA, FBI, HHS) — Updated advisory on the Medusa RaaS variant, now past 500 victim organisations with a heavy Healthcare and Public Health skew. Affiliates weaponise newly disclosed vulnerabilities inside 24 hours and use out-of-band Interactsh URLs to confirm initial access, which means your patch window is one day rather than one month. 🔎 Threat Hunting Package
🗞️ The “Ransomware Rescuer” Illusion: Unmasking the ‘Ransom Busters’ Extortion Scheme (GuidePoint Security) — A rogue affiliate double-extorting victims by posing as a recovery service, charging 20,000–60,000 to “delete” stolen data. The tell is timing: they contact victims before the breach is public, claiming they hacked the RaaS admin panel to intercept the data.
🗞️ CISA Warns of Attacks Targeting Siemens S7 Series PLCs (CISA, NSA and partners) — Joint advisory AA26-231A on active targeting of Siemens S7 programmable logic controllers. Actors aren’t stopping at the IT network any more; they’re going after the controllers themselves to manipulate operational logic and cause physical disruption.
Recommendations
☑️ Treat internet-facing app patching as a 24-hour SLA, not a monthly cycle. Prioritise MFT, ERP, ScreenConnect, and Fortinet, since that’s where both crews start.
☑️ Remove direct exposure wherever you can: IP allowlists or zero-trust gateways in front of enterprise apps, and Siemens S7 PLCs off the internet entirely, behind authenticated gateways with MFA.
☑️ Segment for blast radius on both sides of the house. ERP and MFT servers away from domain controllers, file shares, and backups; a hard IT/OT boundary so a compromised corporate box can’t reach a control zone.
☑️ Extend telemetry to catch the two things that matter: file-export staging and outbound volume from application servers, and unauthorised PLC logic changes, rogue engineering workstation connections, or unexpected controller resets.
☑️ Keep immutable offline backups and sign an IR retainer with a verified firm before you need it, so recovery never depends on negotiating with anyone.
☑️ Route every unsolicited “we can recover your data” approach through that retained IR firm and ignore it otherwise. Paying a self-appointed rescuer buys another extortion round, not deletion.
Theme 5: Fraud at Scale — Where the Target Is the Person, Not the Perimeter
Stories
🗞️ WhatsApp Deploys New Anti-Scam Tools as 6.8 Million Malicious Accounts Are Dismantled (Meta) — Meta banned 6.8m+ accounts tied to organised scam centres and shipped in-app safety features to give users context before they engage. The scam economy is deliberately cross-platform (AI-generated lures over SMS, “tasks” on Telegram or TikTok, theft finalised on a crypto platform) so no single provider ever sees the full chain.
🗞️ Fake TikTok Rewards Scams Promise Massive Payouts You’ll Never See (Malwarebytes Labs) — TikTok-branded fake sites promise big payouts for daily check-ins, then trap victims in an endless loop of new requirements. Inflated fake balances and countdown timers keep victims emotionally invested in tasks whose only real output is cost-per-action revenue for the operators.
🗞️ 40 Malicious Firefox Extensions Caught Draining Crypto Wallets and Harvesting Credentials (Socket) — 77 interconnected extensions built to drain crypto wallets and exfiltrate credentials, using modified open-source wallet code to slip past marketplace review. They ship as “sleepers” (harmless utilities and sports-score trackers) then pull config from a remote database to swap in phishing forms or wallet code that grabs 12- and 24-word seed phrases before local encryption. 🔎 Threat Hunting Package
🗞️ Manic Malware Blends Android Banking Trojan with Spyware and Mesh Exfiltration (ThreatFabric) — Android family combining device takeover with full spyware surveillance, hitting Ukrainian eID services, messaging apps, and financial institutions. There are no fake login screens: a transparent overlay sits on the real app’s keypad capturing tap coordinates while input passes through, and if C2 fails it store-and-forwards over a Wi-Fi mesh of nearby infected devices. 🔎 Threat Hunting Package
Recommendations
☑️ Teach the pause: unexpected group adds, unknown numbers, guaranteed returns, countdown timers, and inflated on-screen balances are all engineered urgency. WhatsApp’s new group safety overview lets people review and leave silently, without tipping off the actors.
☑️ Verify out of band, always. Ring the supposed friend or family member on a different channel before moving money, and confirm any rewards programme inside the official app rather than a third-party site.
☑️ Never hand PII, card, or banking details to an unverified rewards site, and never install an app to “verify identity” for a payout. If that already happened, uninstall and run a full mobile scan.
☑️ Allow-list browser extensions across the enterprise; uninstall unknown Firefox add-ons and treat any exposed seed phrase or private key as burned. Move funds to a brand-new wallet, ideally hardware-backed, so keys never touch the browser.
☑️ Audit Android fleets for high-risk Accessibility Service grants, block sideloading of unverified apps, and watch for overlay hooks and anomalous peer-relay network behaviour.
☑️ Require out-of-band or hardware-key confirmation for high-risk banking actions so an intercepted PIN or SMS code isn’t enough on its own and push mobile threat intelligence SDKs into financial and identity apps to catch runtime keypad manipulation.
Feature Livestream
MISP tells you what you know. It doesn’t come with a built-in workflow system to get there.
That gap is where most CTI teams live.
🧑💻 You pull an event, triage it, task someone, chase the enrichment, and write the deliverable. None of that is in MISP. It’s in Jira, or Notion, or a spreadsheet named final_v3.
Flowintel was built to fill that gap!
Same taxonomies. Same galaxies. A case you tag in one speaks the vocabulary of the other, so nothing gets lost in translation between where you work and where you publish.
👉 Flowintel case -> CTI analysis in the platform -> stored in the MISP backend
I’m running it live this week. Standing it up in Docker from nothing, wiring it to a real MISP instance, enriching a case with MISP modules, then pushing that case back into MISP as an event.
Whole loop, start to finish, including the bits that break.
If you’ve been managing CTI cases in a tool that was built for software sprints, this one’s for you.
Feature Course
Learning Resources
Cyber Training
- Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.
- TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.
- Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.
Tools
- Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!
