IntelDigest

// 50 items from 16 sources · newest 2026-10-01 22:42 UTC

// headlines only — every link goes to the original

1. BleepingComputer

   |Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

   //|2026-10-01 22:42 UTCindicators3 ip · 9 hashesactively exploitedFortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...]

2. Huntress

   |Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses

   //|2026-10-01 13:00 UTCindicators19 hashesClickFixThe Huntress Tragic Quadrant ranks the cyber threats hitting businesses most, from RMM abuse to AiTM, ClickFix, using real SOC data.

3. CISA

   |CISA Adds One Known Exploited Vulnerability to Catalog

   //|2026-10-01 12:00 UTCexploitedknown exploitedCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability This type of…

4. The Hacker News

   |OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates

   //|2026-10-01 10:42 UTCcampaigncampaignOpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models. A "core cluster of the…

5. Huntress

   |Defender Exclusion Abuse: How Attackers Hide Malware from MDAV

   //|2026-09-30 17:30 UTCindicators23 hashesmalwareSee how attackers like GootKit and WhisperGate abuse Windows Defender exclusions to hide malware from AV scans — and how Huntress detects it.

6. The Hacker News

   |Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

   //|2026-09-30 15:00 UTCindicators2 hashesmalwareThreat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed…

7. CISA

   |CISA Adds One Known Exploited Vulnerability to Catalog

   //|2026-09-30 12:00 UTCexploitedknown exploitedCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability This type of…

8. The Hacker News

   |US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access

   //|2026-09-30 10:45 UTCcampaigncampaignANY.RUN researchers traced a US-focused CSuite phishing campaign across 351 sandbox analyses, with 51% of submissions coming from the United States. Technology, manufacturing, government, and consulting organizations…

9. Microsoft Security

   |Star Blizzard refines phishing and malware delivery with the RedFlick technique

   //|2026-09-29 15:00 UTCindicators8 ip · 12 hashesthreat actorSince January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a…

10. CISA

    |CISA Adds One Known Exploited Vulnerability to Catalog

    //|2026-09-29 12:00 UTCexploitedknown exploitedCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-86950 Apple Multiple Products Out-of-Bounds Write Vulnerability This type of…

11. Huntress

    |Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

    //|2026-09-28 20:00 UTCindicators2 ip · 39 hashesmalwareHuntress researchers reveal how attackers are exploiting ChatGPT Custom GPTs to spread ClickFix lures and DLL-sideloaded malware. See the full breakdown.

12. The Hacker News

    |JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources

    //|2026-09-28 09:08 UTCcampaignthreat actorThe threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals. Microsoft, which is tracking the activity under the…

13. CISA

    |CISA Adds Two Known Exploited Vulnerabilities to Catalog

    //|2026-09-27 12:00 UTCexploitedknown exploitedCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability…

14. The Hacker News

    |Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

    //|2026-09-26 18:22 UTCindicators1 ipcompromisedThe Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings…

15. The Hacker News

    |SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

    //|2026-09-26 08:49 UTCexploitedactively exploitedThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, citing…

16. SANS ISC

    |A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

    //|2026-09-25 12:45 UTCindicators3 ip · 6 hashescampaignIntroduction

17. CISA

    |CISA Adds One Known Exploited Vulnerability to Catalog

    //|2026-09-25 12:00 UTCexploitedknown exploitedCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability This type of…

18. CISA

    |CISA Adds Two Known Exploited Vulnerabilities to Catalog

    //|2026-09-25 12:00 UTCexploitedknown exploitedCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability CVE-2026-67279…

19. Malware Traffic Analysis

    |2026-09-24: Files for an ISC Diary (Macfinger ClickFix activity)

    //|2026-09-25 06:36 UTCtechniqueClickFix

20. Huntress

    |The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

    //|2026-09-24 13:00 UTCindicators1 ip · 15 hashesthreat actorThreat actors exploited Samsung MagicINFO to install AnyDesk, disable Defender, and compile a Monero miner directly on a victim endpoint. Learn the detection signals.

21. CISA

    |CISA Adds Two Known Exploited Vulnerabilities to Catalog

    //|2026-09-24 12:00 UTCexploitedknown exploitedCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-71362…

22. Malware Traffic Analysis

    |2026-09-15: SmartApeSG ClickFix to unidentified RAT to MeshAgent

    //|2026-09-20 17:03 UTCtechniqueClickFix

23. ESET Research

    |Beware the SparroWock: The backdoor that bites, the commands that catch

    //|2026-09-17 08:50 UTCindicators18 ip · 2 hashesAPTESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group

24. Zscaler ThreatLabz

    |Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

    //|2026-09-16 15:13 UTCindicators1 ip · 13 hashescampaignIntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in…

25. Securelist

    |NightEagle targets Russian companies

    //|2026-09-16 10:00 UTCindicators8 hashescampaignKaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub. The group is also exploiting vulnerabilities in Active Directory and RDP.

26. Zscaler ThreatLabz

    |SloppyRAT: A New Tool For Ransomware Attacks

    //|2026-09-10 14:43 UTCindicators2 ip · 24 hashesthreat actorIntroductionIn June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. ThreatLabz observed SloppyRAT being delivered through a…

27. Cisco Talos

    |ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

    //|2026-09-08 10:00 UTCindicatorscampaignCisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and…

28. Rapid7

    |DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

    //|2026-09-04 12:00 UTCindicators30 hashescampaignOverview A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named…

29. Rapid7

    |Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

    //|2026-09-02 16:58 UTCindicatorsactively exploitedOverview On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and…

30. Huntress

    |Inside Knight Office, a New M365 AiTM Phishing Kit

    //|2026-09-02 13:00 UTCindicators2 ip · 14 hashesphishingAn inside look at Knight Office, a newly discovered AiTM phishing kit featuring custom control panels, Cloudflare Turnstile, and M365 Token theft.

31. Unit 42

    |Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

    //|2026-08-31 10:00 UTCindicators16 ip · 1 hashescampaignLearn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft…

32. Huntress

    |Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress

    //|2026-08-28 16:00 UTCindicators14 hashesphishingMove past basic credential harvesting. Discover how modern attackers use ClickFix, BitB, and OAuth consent phishing—and how to train your users with Huntress SAT.

33. Rapid7

    |PaperCut NG/MF Critical Zero-Day Exploited in the Wild

    //|2026-08-28 10:09 UTCindicatorsexploited inOverview On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed…

34. Elastic Security Labs

    |From 88 lines to 1: Detecting DLL hijacking with Elastic Defend

    //|2026-08-28 00:00 UTCindicators3 hashescampaignThe ClickFix campaign that sideloads a malicious mscoree.dll also ships a driver to kill Elastic Endpoint. We rebuilt that DLL as a NativeAOT library, dropped it beside a signed Microsoft binary, and Elastic Defend…

35. Malware Traffic Analysis

    |2026-08-21: SmartApeSG ClickFix campaign leads to two RATs

    //|2026-08-21 17:49 UTCindicators2 ip · 4 hashescampaign

36. Huntress

    |Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

    //|2026-08-19 13:00 UTCindicators3 ip · 20 hashescampaignHuntress researcher uncovers post-Black Hat & DEF CON phishing campaign using X DMs & malicious documents to deliver AMOS, NetSupport RAT, and other malware.

37. Zscaler ThreatLabz

    |C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

    //|2026-08-17 14:06 UTCindicators3 ip · 4 hashesthreat actorIntroductionIn July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with…

38. Huntress

    |Akira Hits Safe Mode: Ransomware Rebooting Around EDR

    //|2026-08-12 13:00 UTCindicators1 ip · 16 hashesaffiliateAn Akira affiliate rebooted into Safe Mode to kill EDR and Defender, then Safe Mode broke their own ransomware. Here’s the full attack chain.

39. Zscaler ThreatLabz

    |CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials

    //|2026-08-11 22:06 UTCindicators7 ip · 3 hashescampaignIntroductionOn July 31, Microsoft Threat Intelligence reported an ongoing credential theft campaign tracked as CaptiveCrunch. Microsoft attributes this activity to Storm-2945, a sub-cluster of Midnight Blizzard (also…

40. Huntress

    |Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking

    //|2026-07-28 13:00 UTCindicators5 ip · 14 hashescampaignThe Huntress SOC is tracking an active credential stuffing campaign targeting SonicWall devices, compromising dozens of organizations since July 25.

41. Zscaler ThreatLabz

    |Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor

    //|2026-07-27 14:51 UTCindicators8 ip · 12 hashesthreat actorIntroductionZscaler ThreatLabz has been tracking attacks from a threat actor that is likely an initial access broker for ransomware attacks since January 2026. The threat actor targets organizations by leveraging…

42. Huntress

    |Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

    //|2026-07-22 20:00 UTCindicators21 ip · 19 hashescampaignOn July 21 and July 22, Huntress observed a number of attacks that started with a malicious public Claude Artifact hosted on a legitimate Claude domain, and ended in organizations being infected by the SectopRAT stealer.

43. Elastic Security Labs

    |New North Korean campaign uses fake coding interviews to steal developer credentials

    //|2026-07-18 00:00 UTCindicators2 ip · 10 hashescampaignDPRK-aligned hackers hid malware inside SVG flag images to backdoor developer job interview coding tests. Not one antivirus vendor caught it.

44. Fortinet

    |The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

    //|2026-07-16 13:00 UTCindicators5 ip · 34 hashescampaignFortiGuard Labs analyzes a global phishing campaign using obfuscated JScript, disguised .ttf files, and Lua loaders to deliver RATs and infostealers.

45. Elastic Security Labs

    |TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

    //|2026-07-16 00:00 UTCindicators2 ip · 17 hashesmalwareTELEPUZ is a modular malware that emerged through CLICKFIX-VIDAR attacks in April. We reverse-engineered it to show you the infrastructure and evasion techniques that matter.

46. Zscaler ThreatLabz

    |ClaudeFix: Shared Claude Chats Meet ClickFix

    //|2026-07-15 14:39 UTCindicators1 ip · 10 hashesClickFixIntroductionClickFix is a widely employed attack technique, first seen in 2024, where a victim is instructed to paste-and-run instructions on their system to “fix” a problem or install software. The seemingly benign…

47. Huntress

    |Threat Actors Achieve Persistence After SQL Injection

    //|2026-07-13 13:00 UTCindicators15 hashesthreat actorSee how a threat actor used SQL injection and BadIIS to gain persistence, disable Windows Defender, and quietly install a cryptominer.

48. Elastic Security Labs

    |ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

    //|2026-07-08 00:00 UTCindicators3 ip · 30 hashesClickFixElastic Security Labs tracks REF6045, an active operator-assisted banking fraud operation targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges.

49. The DFIR Report

    |From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

    //|2026-06-29 13:07 UTCindicators11 ip · 9 hashesintrusionKey Takeaways This case was first reported to customers in a threat brief released in July 2025 and in a public flash alert in August 2025 in partnership with Swisscom B2B CSIRT, which observed another intrusion tied to…

50. The DFIR Report

    |Apache ActiveMQ Exploit Leads to LockBit Ransomware

    //|2026-02-23 14:09 UTCindicators2 ip · 5 hashesthreat actorKey Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible, & Amazon. This intrusion began in mid-February 2024 after a threat actor exploited a vulnerability (CVE-2023-46604) on an…