hacker-news Sep 14, 2026 · Crawled Sep 15, 2026

⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits

3 IoCs 1 Malware 2 CVEs

AI Summary

Multiple threat actors are exploiting a new vulnerability chain involving flaws in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) to deploy an undocumented exploit kit called BlueMoon. The campaigns, primarily attributed to China-aligned groups, have targeted fewer than 20 organizations globally. Separately, a zero-click worm dubbed WeWorm exploits a vulnerability in WeChat (patched in August 2026) to hijack accounts and spread via incoming calls on Android and iOS without user interaction, requiring only that the attacker be on the victim's friends list. Additionally, hackers are deploying a fileless Linux rootkit on compromised F5 BIG-IP APM devices, leveraging CVE-2025-53521 to inject a web shell into memory via PHP eval() calls, tracked by ESET as PoisonedRefresh.

AI-extracted · verify before operational use

Extracted Entities 3 found

Malware GRAYRABBIT → CVE CVE-2026-85046 → CVE CVE-2021-38003 →

Indicators of Compromise 3 extracted

Type	Value	Detail
Domain	xibipay[.]com	Details →
Domain	safewtech[.]com	Details →
GitHub Repo	ctx/nightly-build	Details →

MITRE ATT&CK TTPs 22 techniques

T1005 Data from Local System · Collection T1021 Remote Services · Lateral Movement T1048 Exfiltration Over Alternative Protocol · Exfiltration T1055 Process Injection · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1087.001 Local Account · Discovery T1204.002 Malicious File · Execution T1027 Obfuscated Files or Information · Defense Evasion T1053.005 Scheduled Task · Execution T1055.012 Process Hollowing · Defense Evasion T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071 Application Layer Protocol · Command And Control T1085 T1085 T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1189 Drive-by Compromise · Initial Access T1190 Exploit Public-Facing Application · Initial Access T1203 Exploitation for Client Execution · Execution T1566 Phishing · Initial Access