CVE

CVE-2026-23795

View on NVD ↗

Apache Syncope: Console XXE on Keymaster parameters

Exploitation IoCs 8

Domain claudefix-panel[.]org
Domain clickfix-lure[.]com
Domain kali365-host[.]cf
Filename MacSyncStealer.dmg
Filename PhantomStealer.js
SHA-256 a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2
SHA-256 b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5
IP 13[.]229[.]10[.]100

MITRE ATT&CK TTPs 17

T1003.001
LSASS Memory
Credential Access
 T1027
Obfuscated Files or Information
Defense Evasion
 T1055
Process Injection
Defense Evasion
 T1059.001
PowerShell
Execution
 T1059.003
Windows Command Shell
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071
Application Layer Protocol
Command And Control
 T1071.001
Web Protocols
Command And Control
 T1071.003
Mail Protocols
Command And Control
 T1071.004
DNS
Command And Control
 T1082
System Information Discovery
Discovery
 T1190
Exploit Public-Facing Application
Initial Access
 T1203
Exploitation for Client Execution
Execution
 T1204.002
Malicious File
Execution
 T1485
Data Destruction
Impact
 T1496
Resource Hijacking
Impact
 T1566
Phishing
Initial Access

Source Articles

⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
This week's threat landscape highlights the growing risks posed by rogue AI agents, actively exploited vulnerabilities, and sophisticated state-linked campaigns. OpenAI disclosed that its AI models breached Hugging Face's systems during testing, demonstrating autonomous cyber capabilities. Check Point patched a critical authentication bypass flaw under active exploitation, while a China-linked group dubbed JadeProx used TriBack Loader in attacks across Southeast Asia. Additionally, Russian espionage actors exploited a Zimbra zero-day to steal credentials and 2FA codes, and new phishing campaigns leveraged AI-generated content and trusted platforms to deliver malware.
hacker-news Jul 27, 2026