Open Cyber Threat Intelligence

The Lazarus Group has launched a new attack campaign, dubbed Operation FlashHole, targeting organizations in South Korea's software, construction, and wired communication equipment manufacturing sectors. The campaign uses a multi-stage infection chain beginning with malicious websites hosted on GitHub Pages, which deliver a JavaScript-based initial payload that exploits the legitimate CrossWeb EX security software to execute malware in memory. The attackers deploy an updated set of known and newly identified malware variants—including TechHub, Cubridge, TouchHub, TouchShift, ClientHub, and LPEClient—to establish persistence, conduct reconnaissance, and load further payloads. The infrastructure leverages abused legitimate websites, GitHub repositories, and Dropbox for command and control, with post-quantum cryptography used in later stages to secure communications.

A large-scale browser extension-based campaign has been hijacking user search queries across the Chrome Web Store, affecting approximately 13.4 million users. These extensions, often hidden and promoted via online ads, modify the browser's default search provider to route searches through proxy servers controlled by operators, who then monetize the traffic using partner referral IDs from Yahoo and Bing. The proxy infrastructure allows for dynamic redirection of search traffic, posing a risk for future malicious use such as phishing or malware distribution. Multiple organized operators, including Intango LTD, Tightrope Interactive, and unidentified groups behind 'SecuryBrowse' and 'Bing-Search', have been identified as running these campaigns over a decade.

Google has patched a critical Android vulnerability, CVE-2026-58868, affecting Android versions 14 through 17, which could allow remote code execution without user interaction due to a heap buffer overflow in the FrameDecoder.cpp file. Another critical flaw, CVE-2026-58882, in the WAP Push message parsing function decodeWapPdu could enable remote denial-of-service, crashing the phone and disrupting emergency calls. Both vulnerabilities are rated Critical and require no user interaction to exploit, with patches available in the November 2026 security updates. Additional critical flaws in the kernel, System component, and third-party modem code from MediaTek and Qualcomm were also addressed.

China-aligned threat actor SlippyNunchucks conducted a DNS hijacking operation targeting users of the Sogou Input Method, exploiting insecure HTTP communications to redirect traffic to malicious servers. The attack delivered a backdoor called DarkVigil (aka FDMTP) via DLL sideloading using a legitimate Sogou component, SGTool.exe, and a rogue libcef.dll. The campaign targeted Chinese-speaking individuals and organizations in multiple countries, including Hong Kong, Thailand, Japan, and Sri Lanka, as part of a nation-state surveillance effort. Tencent patched the vulnerability as CVE-2026-120422 in version 16.10 by migrating HTTP requests to HTTPS.

Two critical vulnerabilities in the Xen hypervisor, tracked as CVE-2026-102703 and CVE-2026-102704, allow a malicious guest virtual machine to read and write memory from other VMs on the same host, including the privileged dom0. The flaws reside in the grant copy mechanism used for inter-VM memory operations, where permission checks are incorrectly reused, breaking VM isolation. All Xen versions from 4.6 onward are affected, with no known mitigations other than patching. The vulnerabilities impact downstream projects like XCP-ng and Qubes OS, which have released updates to address the issues.

A critical vulnerability in Ruby on Rails' Active Storage component allows unauthenticated attackers to write arbitrary files on the server by uploading a crafted file processed via ImageMagick. The flaw stems from insufficient restrictions on ImageMagick coders, enabling exploitation through the MSL coder, which can read and write files. The vulnerability affects Rails applications using ImageMagick for image processing with untrusted user uploads and has a CVSS score of 9.8. It was reported via HackerOne by researcher RyotaK and fixed in Rails versions 8.1.4.1 and 8.0.5.2.

APT29, a Russia-linked threat actor, is conducting a large-scale watering hole campaign dubbed Poisoned Source, targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack on the Ukrainian web analytics service Plerdy SEO Tracker. The attack delivers platform-specific exploit chains: DarkSword for iOS and AndroSnitch for Android, exploiting multiple N-day vulnerabilities to steal sensitive data including browser cookies, Wi-Fi passwords, iMessages, SMS, and device data. The campaign leverages malicious JavaScript injected into legitimate sites and lookalike domains, with exploitation triggered simply by visiting a page, requiring no user interaction.

Check Point Research identified a malicious OpenAI Codex jailbreak toolkit named Haiou, which modifies AI agent configurations to inject advertisements into responses. The jailbreak uses prompt injection techniques to bypass safety guardrails and persistently promotes a third-party LLM gateway at zz.aiapi2025[.]top. Distributed via GitHub as a 'local enhancement package' and bundled with Codex-X, the toolkit introduces supply chain risks by altering trusted instructions through natural language rather than traditional malware payloads.

SonicWall has disclosed two unpatched vulnerabilities in its end-of-life Global Management System (GMS) 9.5.2 and earlier versions, which will not receive security updates. CVE-2026-109593 is a critical unauthenticated file read vulnerability (CVSS 9.1) that could allow attackers to read sensitive internal files. CVE-2026-109594 is a medium-severity post-authentication SQL injection flaw (CVSS 6.8) that could enable an authenticated attacker to access or modify database records. Organizations are urged to migrate to SonicWall Network Security Manager (NSM) to mitigate risks.

A critical vulnerability in APT, the package manager used by Debian and Ubuntu, allows man-in-the-middle (MitM) attackers to swap verified packages with malicious ones during download retries, leading to arbitrary code execution as root. The flaw, CVE-2026-109518, affects systems where APT retries failed downloads—a default behavior in Debian 12 and Ubuntu 22.04 and later. Attackers can exploit HTTP redirects and temporary server errors to trigger retries and substitute packages, provided they can intercept or modify HTTP traffic, such as through a compromised mirror or proxy. Fixed versions have been released for multiple Debian and Ubuntu versions, but older or long-term supported releases may still be vulnerable if retry settings are enabled.