Open Cyber Threat Intelligence

An unauthorized relay service has been observed reconfiguring legitimate OpenAI Codex and Anthropic Claude Code CLI tools on enterprise systems to route traffic through third-party infrastructure, disabling sandbox protections and replacing user API credentials with relay-controlled tokens. The attack relies on fileless PowerShell or bash scripts delivered via lookalike domains, which users execute manually after installing the official CLIs via npm. The reconfigured tools allow full access to prompts, files, and system commands, posing significant security risks even though no abuse has been observed yet. The activity has impacted organizations primarily in mainland China and parts of Asia across sectors including industrial automation, semiconductors, and petrochemicals.

A previously unknown advanced persistent threat (APT) group is conducting targeted attacks against government entities in Asia using a sophisticated .NET-based malware framework dubbed NetamLoader. The attack begins with a malicious CAB file placed in the Windows update directory, which leverages AppDomainManager injection and a chain of XAML-based payloads to load malicious .NET assemblies. The infection chain includes AMSI bypass techniques, process hollowing via COM objects, and encrypted C2 communication using AES-CBC with HMAC. The malware targets a custom Windows 10 build used by Asian governments and communicates with a C2 server hosted behind Cloudflare infrastructure.

Kaspersky discovered a real-world attack campaign leveraging an open-source AI-powered C2 framework called CyberStrikeAI, which uses a server-side LLM orchestrator to automate post-exploitation activities. The attacks targeted educational organizations in Africa and Latin America, achieving full domain compromise through automated reconnaissance, lateral movement, credential access, and data exfiltration. The implant, deployed after initial access via a compromised SQL Server, executes commands generated by the LLM, enabling rapid progression from initial foothold to domain dominance within 3–4 days. The campaign demonstrates the emerging use of AI to lower operator skill requirements while using known TTPs, making detection reliant on behavioral analysis rather than novel signatures.

A cluster of malicious Firefox extensions impersonating popular cryptocurrency wallets—Phantom, Jupiter, and Bitget—has been identified, stealing recovery phrases and private keys from users. The extensions use Unicode homoglyphs to mimic legitimate wallet names and deploy both bundled stealers and remote payload loaders to exfiltrate credentials. Stolen data is sent to subdomains of the command-and-control domain bonto[.]io, with infrastructure indicating targeting of additional wallets like Coinbase and Exodus. One variant also includes a Node.js-based drainer backend that automatically sweeps stolen funds across multiple blockchains.

Hackers have exploited a critical vulnerability in BTCPay Server versions 2.4.1 and earlier to steal Bitcoin and Litecoin from hot wallets by obtaining .macaroon credential files used to control LND nodes. The vulnerability allows unauthenticated remote attackers to access sensitive authentication files, enabling fund theft. BTCPay Server recommends users upgrade to version 2.4.7 or later, move funds to new wallets, and treat compromised systems as fully compromised. Two cryptocurrency wallet addresses linked to the attacks have been disclosed.

Russia-aligned threat actor Gorbag has been targeting Ukrainian organizations, particularly in law enforcement, justice, and defense sectors, since at least February 2025. The group exploits the WinRAR vulnerability CVE-2025-8088 to deploy GIFTEDCROOK and later shifted to using BeautyStealer, a data-stealing malware that harvests browser data, VPN configurations, and sensitive documents. Attacks are initiated via spear-phishing emails with malicious macro-enabled Excel attachments, and the stolen data is exfiltrated through Telegram or FastAPI-based C2 servers, indicating potential use as an initial access broker.

A critical use-after-free vulnerability in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432, has been patched by Red Hat and is under testing by Ubuntu. The flaw, rated 9.8 on the CVSS scale, allows remote, unauthenticated attackers to achieve remote code execution by exploiting a race condition when handling TCP connection requests with IPv4 options such as Record Route or Timestamp. The vulnerability has existed since Linux 4.4 and affects multiple distributions, including Red Hat Enterprise Linux 8, 9, and 10, as well as Ubuntu's newer LTS releases. While no active exploitation in the wild has been reported, Anthropic disclosed that an internal AI model successfully generated a working exploit proof-of-concept, achieving root access within minutes on vulnerable systems.

An attacker hijacked the cPGuard update channel by compromising OPSSHIELD's infrastructure credentials, distributing a malicious script through versions 5.88.12 to 5.88.19 released on November 2, 2026. The script backdoored Linux servers, collected sensitive files including /etc/shadow, /etc/passwd, root's SSH and database configuration files, and uploaded them to OPSSHIELD's own licensing server via a compromised account. The attacker exfiltrated at least 32 customer data files. OPSSHIELD has since revoked access, released a clean version (5.88.25), and advises password and key rotation for potentially affected systems.

Google has warned of a growing threat called LLMjacking, where attackers hijack enterprise access to Large Language Models (LLMs) by stealing API keys or cloud credentials, leading to fraudulent cloud charges reaching up to $1 million. The attacks leverage exposed credentials, misconfigured service accounts, and session tokens to gain unauthorized access, with threat actor UNC6993 identified in multiple intrusions. Attackers escalate privileges, conduct reconnaissance, and abuse cloud identity permissions to maintain persistence and monetize access through illicit proxy services like Jet Night and a grey market relay service repurposing legitimate AI CLIs. These operations bypass regional restrictions and rate limits by reconfiguring CLI tools to route requests through third-party infrastructure, creating a growing underground economy for stolen LLM access.

Barracuda disclosed two vulnerabilities in its products that can be chained to bypass authorization and gain root access. The first is a pre-authentication authorization bypass vulnerability (CVE-2026-116606), and the second is a command injection vulnerability (CVE-2026-111560). When exploited together, these flaws allow an attacker to obtain root access to affected devices. Barracuda advises customers to restrict administrative interface access and apply the latest firmware updates to mitigate the risk.