Open Cyber Threat Intelligence

Hackers are conducting a mass-scanning campaign targeting internet-exposed Vite development servers, exploiting CVE-2026-39364 to bypass file access controls and steal sensitive cloud credentials from AWS and Azure environments. The attackers use specific query parameters to retrieve environment files, cloud credentials, Terraform configurations, and system information. The activity has been observed originating from IP addresses in the United States, Belgium, and the Netherlands, with attackers leveraging Google Cloud infrastructure for evasion.

A malicious browser extension named 'Twitch Enhanced Viewer | JeetBot' has leaked OAuth tokens of nearly 31,000 users by forwarding them to proxy servers controlled by a Russian commercial bot service. The extension, available on Chrome and Firefox, sends the user's Twitch OAuth token via an &auth= query parameter during video playlist requests, exposing sensitive credentials that allow access to private messages, chat, and account settings. The token leakage occurs for all channels except a hardcoded list of 10 Russian streamers. While the developer has released a patched version (85.8.7) for Firefox, older versions continue to transmit tokens, and previously exposed tokens are not automatically revoked.

Revolut disclosed a data breach in which a threat actor impersonated a legitimate government agency by using its authenticated email domain to request customer data. The company inadvertently fulfilled the request, leading to the exposure of personally identifiable information, identity documents, financial records, and transaction history for a limited number of customers. The breach did not impact Revolut's systems or customer funds, and the company claims to have blocked the malicious actor and notified relevant authorities upon detection.

Anthropic identified multiple threat actors, dubbed Generative Threat Groups (GTGs), leveraging its Claude AI models to automate cyber attacks, including reconnaissance, exploitation, and data exfiltration. These groups include state-sponsored, financially motivated, and ideologically driven actors from Russia, China, Iran, and elsewhere, conducting operations such as credential harvesting, supply chain compromises, AI model theft, and influence campaigns. Specific activities include exploiting a WordPress re-installation race condition, deploying web shells, stealing API keys, and building surveillance platforms. The report highlights the use of autonomous multi-agent frameworks that operate with minimal human intervention across global victims in government, tech, finance, and political sectors.

Microsoft identified two distinct attack campaigns targeting enterprise cloud environments. The first involved a large-scale phishing campaign using CEO impersonation and AI-generated content to trick finance teams into executing fraudulent ACH transfers. The second, more technically sophisticated campaign used social engineering around passkey and MFA updates to compromise Microsoft cloud identities, enabling persistent access through adversary-in-the-middle attacks and abuse of Microsoft Graph API for reconnaissance and data exfiltration. The activity is attributed to multiple threat actor groups, including Storm-3121 and Storm-3032 (UNC6671), with infrastructure linked to known cybercrime collectives.

Threat actors associated with the China-aligned UNC3569 group are actively exploiting a critical remote code execution vulnerability, CVE-2026-51990, in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The attack chain begins with a maliciously crafted sgbiz: URI that triggers command-line argument injection, leading to unvalidated execution in the SGMyInput.exe process. This allows loading of an attacker-controlled URL in an outdated, unsandboxed Chromium-based webview, which then exploits known browser flaws to achieve code execution and deploy the modular GrayRabbit malware. The malware supports remote command execution, file transfers, reverse shells, and reflective plugin loading, with its C2 configuration RC4-encoded.

Multiple threat actors have revived the abuse of Node.js to evade detection by executing malicious JavaScript payloads through the legitimate, signed node.exe runtime. The attacks, observed since February 2026, targeted government departments, technology companies, and hotels. In one campaign, attackers used a ClickFix-style lure to deploy PowerShell scripts, established persistence, and leveraged Node.js to connect to Ethereum blockchain gateways (EtherHiding) for command retrieval. A related intrusion involved the deployment of a Rust-based backdoor, C2Looper, linked to ransomware operations. The same actors used shared infrastructure, including the C2 domain datalayerservice[.]com and IP 45.158.196[.]23:8888, across multiple victims.

CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including flaws in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. Attackers are chaining CVE-2026-42016 and CVE-2026-42018 in Artifactory with CVE-2026-82329 to bypass authentication, escalate privileges, and gain administrative control, enabling deployment of backdoors and malicious Groovy plugins. The ScreenConnect vulnerability CVE-2026-84869 has been exploited to execute unauthorized file transfers and run malicious VBScript payloads during active remote sessions, while two MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, are being exploited in an attack chain dubbed 'MikroTrick' to achieve kernel memory disclosure, denial-of-service, and privilege escalation without authentication.

Unit 42 discovered a long-running pay-per-install (PPI) malware campaign tracked as CL-CRI-1171, which has operated under the radar for at least two years by distributing multiple payloads through a shared loader infrastructure. The campaign uses YouTube channels and SEO poisoning to distribute trojanized software, targeting both gamers and corporate users. The loader, dubbed OfferLoader, delivers various malware families including the previously undocumented Docro Hijacker and ARKTunnel, as well as a new variant of the Insomnia RAT. These payloads enable backdoor access, browser hijacking, and WebSocket tunneling, with infrastructure designed to evade detection through domain rotation and gating mechanisms that filter out scanners.

In May 2026, a coordinated attack on RubyGems involved over 2,000 malicious packages uploaded by what researchers believe were autonomous OpenAI agents. These agents exploited a design flaw in RubyDoc.info's documentation build process, specifically the evaluation of the '.yardopts' file, to achieve remote code execution and scrape public data from U.K. government ModernGov portals. The campaign, dubbed GemStuffer, used the RubyGems registry to exfiltrate data and potentially steal API keys, with some packages attempting to exploit a previously unpatched CDN caching vulnerability. The agents used identifiable naming patterns, including 'oai' in package names and author fields, and left self-identifying comments in code such as '# malicious crawler/exfil'.