Open Cyber Threat Intelligence

In Q3 2026, mobile threats continued to evolve with notable attacks leveraging AI for fraud automation and image analysis. A malicious app disguised as Google Play Protect used DistilBERT to interpret C2 commands, potentially powered by LLM-generated input. Another Trojan analyzed device gallery images and screenshots using on-device AI to extract banking data like CVV codes. iOS users were targeted via malicious PHP packages in Packagist and a fake crypto tracker app, FomoPeek, in the App Store, both delivering the DarkSword exploit kit to steal keychain data, Wi-Fi passwords, SMS, photos, and crypto wallet seeds. Additional iOS attacks involved infected apps distributed via Telegram that required users to purchase developer certificates, enabling data exfiltration including screenshots and device information.

In Q3 2026, multiple ransomware groups were active, with Qilin being the most prolific, exploiting CVE-2026-0257 in Palo Alto Networks firewalls to bypass authentication. Several vulnerabilities were actively exploited by ransomware actors, including CVE-2026-15409/15410 in SonicWall devices, CVE-2026-45659 in Microsoft SharePoint, and CVE-2026-63077 in JetBrains TeamCity, enabling remote code execution. On macOS, supply chain attacks targeted npm, PyPI, and Cargo packages such as 'jscrambler', 'arrayref', and 'MemTensor', delivering infostealers and backdoors written in Rust and Go. New malware variants like PamStealer and Overlord targeted macOS with stealer and spyware capabilities, while Mirai's influence in IoT threats declined amid growth in other botnet families.

A threat actor abused cross-account IAM roles trusted to Qubole's AWS account (805246085872) to gain unauthorized access to multiple customer environments between October 14 and October 26, 2026. The actor used stolen IAM credentials from Qubole-associated accounts to assume roles in victim AWS environments, primarily originating from malicious IP addresses linked to Mullvad VPN and an OVH VPS. Once inside, the actor performed broad enumeration, harvested secrets from Lambda, Secrets Manager, and SSM Parameter Store, validated credentials using TruffleHog, and exfiltrated data from S3 buckets. A suspicious ISO file named sso_agent.iso was also identified on the attacker's infrastructure, indicating potential for further compromise.

Apple has released security updates to address multiple vulnerabilities, including two in iMessage that could allow a remote attacker to join a group chat and access messages sent prior to their addition. The vulnerabilities, tracked as CVE-2026-113961 and CVE-2026-113960, stem from authorization issues and were fixed through improved validation. Additionally, a Brotli compression library out-of-bounds write vulnerability (CVE-2026-111497) was patched, which could allow memory corruption from malicious input, and several Bluetooth and AirPlay flaws were resolved that could enable unauthorized pairing or memory corruption.

A sandbox escape vulnerability in iOS 26 and 27, dubbed 'worse_query', has been publicly released on GitHub by researcher forcequit in collaboration with 0xjohnny. This exploit allows malicious apps to read and modify data from other apps' containers without requiring jailbreak or kernel exploits, potentially exposing cryptocurrency wallet seed phrases and private keys. A file manager app called WQ Files, developed by Christoph Kolbicz and built on this exploit, demonstrates the risk through sideloaded installation via tools like AltStore and SideStore. Apple's recent iOS updates (26.7.3 and 27.2.1) do not appear to address the issue, and no official fix has been confirmed.

Fireworks AI confirmed a data breach that began with unauthorized access to internal credentials, leading to broader compromise of customer datasets, model weights, and billing information. Attackers accessed the company's development environment via a third-party cloud provider and ran unauthorized workloads between October 23 and October 25, 2026. The breach also impacted Notion AI, exposing chat transcripts from the Insights feature for fewer than 1% of workspaces. Fireworks AI attributed the activity to a financially motivated threat actor group conducting 'LLMjacking'—stealing access to large language models to resell illicitly.

The threat actor Blind Eagle, also known as APT-C-36, has launched a new campaign targeting organizations in Latin America using phishing emails with judicial and administrative-themed lures in Portuguese and Spanish. These emails deliver a malicious attachment containing a weaponized SVG file that performs HTML smuggling to deploy a JavaScript dropper, which then executes a Visual Basic Script to bypass AMSI and ETW while launching an AsyncRAT-based remote access trojan. The malware establishes persistence via the Windows Startup folder, conducts environment reconnaissance, and targets sensitive data in judicial, fiscal, and educational sectors, with a focus on Colombia.

Threat actors exploited two zero-day vulnerabilities, CVE-2026-105133 and CVE-2026-105134, in AhsayCBS to gain unauthorized access and execute arbitrary commands on backup servers. The attackers deployed multiple JSP web shells, cryptocurrency miners, and a custom Python-based backdoor designed to evade sandbox analysis by checking the host's MachineGuid and presence of a marker file. The backdoor loads an in-memory x64 DLL that communicates with a C2 server, while the attackers also deployed tunneling tools and remote access software to maintain persistence and potentially harvest credentials from backup systems, including Veeam servers.

A critical authentication bypass vulnerability in Xen Orchestra, tracked as VSA-2026-062 and not yet assigned a CVE, is being actively exploited in the wild. The flaw allows attackers to bypass authentication by sending a specially crafted cookie (authenticationToken=j:%7B%7D), leading to admin-level access and arbitrary code execution on managed XCP-ng nodes. Malicious activity has been linked to an IP address and a TOR domain used as a C2 server for RedLine Stealer. Indicators include specific virtual machine names, cron files, and configuration parameters. Patches are available in Xen Orchestra 6.9.1 and 6.10.0, and xo-server versions 5.211.2 and 5.213.1.

An attacker exploited a remote code execution vulnerability in the open-source SGLang inference engine to breach NEAR AI's infrastructure, gaining access to an inference server running within a trusted execution environment (TEE). Despite the TEE's design to protect confidential data, the flaw in SGLang allowed the attacker to access processed requests, including those in confidential mode. The attacker exfiltrated account details of about 100 users from a deprecated internal system called Private Chat and accessed data from 18 AI agents on an older non-TEE deployment, including chat history, settings, logs, and two exposed NEAR AI Cloud API keys, which have since been revoked.