Open Cyber Threat Intelligence

North Korean threat actors associated with the Contagious Interview campaign have compromised over 30,000 devices across more than 100 countries since at least 2022, targeting software developers and IT professionals in cryptocurrency, blockchain, and Web3 sectors. The attackers pose as recruiters on platforms like LinkedIn, offering fake job opportunities that lead to multi-stage malware infections. Malware families deployed include BeaverTail, InvisibleFerret, and RATatouille, enabling credential theft, cryptocurrency theft, and lateral movement into corporate networks. A related operation uses Western proxies recruited via Discord to bypass sanctions and identity checks, with North Korean IT workers using AI-generated identities to secure remote jobs and steal funds.

A malicious fake LastPass Authenticator installer distributed via a spoofed GitHub repository uses DLL side-loading to execute a malicious payload that disables antivirus and EDR solutions by loading a Microsoft-signed kernel driver. The driver, named Alinubx.sys, is a renamed version of the known CcProtect.sys driver from CnCrypt, signed through Microsoft's Windows Hardware Compatibility Publisher program. Once loaded, it terminates over 140 security processes from kernel mode, enabling a password stealer—identified as Rapuncel, related to BoryptGrab—to harvest credentials from browsers, cryptocurrency wallets, and messaging apps. The malware evades detection by renaming a known vulnerable driver, bypassing VirusTotal and Microsoft's driver blocklist due to hash changes.

A pre-authenticated remote code execution vulnerability in WordPress Core, dubbed 'Click2Shell', allows attackers to force-install a theme from the WordPress.org catalog and execute arbitrary PHP code via a Customizer preview. The exploit chain does not require attacker authentication but relies on a logged-in administrator visiting a crafted URL. The vulnerability was patched in WordPress 7.1.1, which fixes improper escaping of the theme slug in jQuery selectors and restricts selector scope to legitimate theme cards. Successful exploitation could lead to full server compromise, including access to database credentials and creation of rogue admin accounts.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert warning of active exploitation of three Linux kernel vulnerabilities. One of the flaws, CVE-2025-39964, has existed for 14 years and was demonstrated to enable privilege escalation and container escape. Public exploits exist for CVE-2025-39682 and CVE-2026-53266, with the latter having a potential privilege escalation path inferred from prior vulnerabilities like Dirty Pipe. Federal agencies are ordered to patch affected systems immediately and conduct forensic triage to detect prior compromise.

A privilege escalation vulnerability in Windows, tracked as CVE-2026-66804, stems from a dangling COM object registration for the CrossDevice COM object. The registration points to a non-existent DLL in a user-writable directory (%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll), enabling DLL planting. An attacker can exploit this by creating a malicious DLL and triggering its load via custom COM marshaling. A specific COM service, 'Shell Create Object Handler' (CLSID {135fd325-45b7-4c30-89f8-4386961669f0}), running as SYSTEM and allowing custom marshaling, is abused to achieve privilege escalation by passing a crafted OBJREF referencing the dangling CLSID.

Threat actors are using ClickFix-style social engineering lures to distribute a new remote access trojan (RAT) named ChainScript, which provides extensive remote control capabilities including command execution, file operations, screenshot capture, and cryptocurrency wallet theft. The malware uses a malicious Windows installer disguised as legitimate software (e.g., Spotify) to deploy a Node.js-based JavaScript agent via PowerShell and VBScript stages, establishing persistence through scheduled tasks and Registry Run keys. ChainScript employs a novel C2 discovery mechanism leveraging a Polygon blockchain smart contract to dynamically rotate WebSocket-based command-and-control infrastructure, enhancing resilience against takedowns. This campaign overlaps with another abuse of HBO Max's Reddit account, distributing macOS and Windows malware such as MacSync, Atomic Stealer, and Amatera Stealer under the PasteSwitch operation.

Security researchers discovered two sandbox escape vulnerabilities in OpenAI's Codex that allowed untrusted code to execute commands on the host system. The more severe, named Heapjack, exploited shared memory in a Node.js process to steal a UUID token and gain unauthorized access to a privileged parent process, enabling remote code execution without user interaction. The second flaw, Overpatch, abused a patch utility in Codex CLI to escalate file write permissions and modify files outside the intended directory via symlink manipulation. Both vulnerabilities were fixed by OpenAI within eight days of disclosure.

A malicious npm campaign distributed counterfeit packages, including 'indexed-btree', designed to mimic the legitimate 'sorted-btree' library. The threat evades npm's install-script restrictions by embedding malicious logic in runtime code—specifically within the BTree.prototype.set() method—triggering execution only when called with a specific key. The malware collects system information, exfiltrates it via Slack and Telegram, and communicates with a C2 server through an Ethereum smart contract on the Sepolia test network using encrypted payloads. The attackers also created nine additional malicious packages with fabricated repositories and commit histories to appear legitimate.

North Korean threat actor WaterPlum conducted a global campaign from December 2025 to July 2026, compromising over 30,000 devices and stealing more than $10.7 million in cryptocurrency. The group targeted job seekers by impersonating legitimate companies and delivering malware through malicious npm packages and Visual Studio Code projects. WaterPlum deployed multiple malware families including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal credentials, cryptocurrency keys, and conduct espionage. The actors are linked to North Korea's 313 General Bureau and operate alongside fraudulent IT worker operations using stolen identities and AI face-swapping during fake interviews.

Security researcher Gal Weizman discovered a new attack technique called BragJack that hijacks AI browser agents through malicious browser extensions. The proof-of-concept targets AI assistants in Chromium-based browsers including Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome by exploiting trust relationships and browser extension capabilities. The attacks use declarativeNetRequest (DNR) rules to manipulate trusted components, enabling unauthorized access to sensitive data and control over AI agents without user interaction. The technique, dubbed 'Prompt Forcing,' allows attackers to send full prompts and instructions to the AI agent, leveraging its legitimate privileges to perform malicious actions.