Open Cyber Threat Intelligence

Low-cost Android smartphones, primarily built on MediaTek platforms, have been found shipping with preinstalled malware named 'Midnight Mimosa' by Bitdefender. The malware, disguised as 'com.android.system.lite', runs with system-level privileges and enables remote operators to silently install and uninstall apps, conduct ad fraud, and turn devices into residential proxies. It communicates with external command-and-control servers to download additional payloads and has been linked to at least 13 apps on Google Play that exhibit similar behavior. The campaign has affected thousands of devices across over 150 countries, with a majority located in Mexico, and is believed to stem from a supply chain compromise involving firmware signed by Shenzhen Zediel Co., Ltd.

GitLab has patched a critical vulnerability, CVE-2026-97229, with a CVSS score of 10.0, affecting its Community and Enterprise Editions. The flaw is an integer overflow issue that could allow unauthenticated users to execute arbitrary code on the GitLab server by exploiting insufficient validation of regular expressions in CI/CD configurations. The vulnerability impacts multiple versions prior to 19.4.2, 19.3.5, and 19.2.8, and users are urged to update immediately to remediate the risk.

Attackers remotely hijacked Danfoss AK-SM and AK-SC series refrigeration controllers used in French supermarkets, raising fridge temperatures to as high as 50°C and causing significant food spoilage. The attack affected hundreds of stores across major retail chains including Intermarché, Carrefour, and Monoprix. CERT-FR issued an alert urging operators to disconnect or tightly filter access to these controllers, which are often exposed to the internet. While no specific vulnerability or intrusion method was confirmed, older unsupported models (AK-SM 800, AK-SC 355) were primarily targeted, and Danfoss had previously disclosed CVEs in newer models that could allow authentication bypass and remote code execution.

Multiple active threats were reported this week, including exploitation of a critical Atlassian Data Center vulnerability (CVE-2026-21589) within hours of disclosure. A new variant of the DarkSword iOS exploit kit, P7 DarkSword, enables on-device keychain and crypto-wallet theft via watering hole attacks. The Russia-aligned threat actor UAC-0099 continues to evolve its MATCHBOIL malware for persistent execution and payload updates. Google disclosed unauthorized HTTPS certificates were issued after attackers hijacked ccTLDs for .gh, .as, and .sl by compromising third-party operators. A vulnerability in GoBalance allowed attackers to hijack TOR .onion sites, including the darknet forum Dread. Additionally, the FBI disrupted infrastructure linked to the China-aligned Flax Typhoon group.

Retail giant Ahold Delhaize confirmed a cybersecurity incident that forced the company to take some systems offline to protect its infrastructure. The attack disrupted internal systems, affecting employee access to schedules and pay stubs at Stop & Shop in the U.S., and customer-facing platforms including websites, apps, and customer service at several European brands. This is the second major cyber incident for Ahold Delhaize in recent years, following a 2024 ransomware attack by INC Ransom that compromised over 2.2 million individuals' personal and financial data.

AvisLoader is a Windows malware loader discovered by Varonis Threat Labs that uses the Tox encrypted peer-to-peer (P2P) network for command-and-control (C2) communications, making takedowns more difficult. The infection begins with a ClickFix lure hosted on Cloudflare Workers, mimicking a DocuSign signing request, which tricks users into pasting and executing a malicious command. The loader employs shortcut modification for persistence, includes a UAC bypass helper referencing UACME technique 41, and uses a DLL to hook system calls for process hiding. The associated AvisLoader Command Center allows operators to manage clients, execute remote commands, and distribute payloads over Tox.

A cyberattack targeted Danfoss refrigeration controllers used by multiple French supermarket chains, including Intermarché, Carrefour Market, Leclerc, and Coopérative U, disrupting cold storage systems and causing food spoilage. Attackers exploited vulnerable, internet-exposed Danfoss AK-SM 8xxA Series controllers, potentially leveraging known authentication bypass (CVE-2025-41450) and command injection vulnerabilities (CVE-2025-41451) to trigger unauthorized defrost cycles. The attack affected 250 to 350 stores, prompting investigations by French authorities and raising concerns about the security of critical infrastructure in the food retail sector.

Ledger has confirmed a supply-chain attack involving hardware wallet devices compromised with a spy chip implant, distributed through the unauthorized Southeast Asian reseller CryptoBilis. The malicious implants, found in Ledger Nano X devices, capture the device's display output and button presses to exfiltrate seed phrases via LTE using an embedded eSIM. Researchers from Tibane Labs and Mark Karpelès identified two variants of the implant, one more advanced and concealed under the OLED display, both using custom PCBs and hidden LTE modules for data transmission.

A critical vulnerability, CVE-2026-85097 (CVSS 10.0), in the Bricksforge WordPress plugin is under active exploitation, enabling unauthenticated remote code execution (RCE). Attackers exploit a flaw in file upload validation by uploading a GIF/PHP polyglot file and manipulating the 'temporaryFileUploads' parameter to execute PHP code via mismatched URL extensions. Exploitation targets the '/wp-json/bricksforge/v1/form_submit' or '/wp-admin/admin-ajax.php' endpoints with crafted payloads, using techniques like alternate PHP extensions, case manipulation, and URL encoding to bypass filters. At least 63 unique IPs have been observed in attack campaigns, with six responsible for nearly half of all requests, indicating automated, distributed exploitation. Users are urged to update to version 4.0.1 and audit for suspicious form submissions and unexpected PHP files in upload directories.

A critical pre-authenticated server-side request forgery (SSRF) vulnerability, CVE-2026-102255 (CVSS score: 10.0), in SonicWall SMA 1000 appliances is being actively exploited shortly after public disclosure. Patches were released on October 6, 2026, but exploitation attempts began as early as October 8, with 135 observed attempts originating from two unique U.S.-based IP addresses. The flaw allows remote attackers to force the appliance to make unauthorized internal requests, potentially leading to initial access, credential theft, and lateral movement into internal corporate networks.