Breeze Comet on DanSec Daily

Cybersecurity Brief – 2026-09-03

Thu, 03 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

A BGP hijack was used to divert Softaculous traffic, enabling attackers to deliver a malicious Virtualizor update to some customers, resulting in persistent root access on affected systems ^[12].
Dropbox reported that attackers exploited a flaw in Lenovo’s email verification process to register fraudulent Lenovo IDs and access Dropbox accounts ^[20].
Cybercriminals are selling 153 million digital scans of US and Canadian driver’s licenses on the dark web, likely sourced from a breach at IDScan.net ^[32].
Brazilian government and educational institution web servers were compromised by the Gambling Goblin group, who installed malicious Apache modules to hijack traffic and redirect it to betting pages ^[11].

Newly Discovered Vulnerabilities

A privilege escalation zero-day vulnerability dubbed FalconFlank has been disclosed in CrowdStrike Falcon ^[6].
Seven new security flaws have been added to CISA’s Known Exploited Vulnerabilities catalog, including vulnerabilities being used to deploy reverse shells and crypto miners ^[7].
An unauthenticated SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox is being actively exploited for remote code execution ^[16].
A critical authentication bypass flaw (CVE-2026-82329) in JFrog Artifactory is under active exploitation, enabling attackers to forge admin tokens ^[18].
The All-in-One WP Migration and Backup plugin for WordPress contains an SQL injection flaw (CVE-2026-19949) that could allow unauthenticated remote code execution, affecting over 3 million sites ^[17]^[33].
Multiple vulnerabilities in Plex desktop clients and media servers prompted an urgent patch advisory from Plex ^[14].
SonicWall SMA 1000 devices are affected by zero-day vulnerabilities enabling unauthenticated remote code execution ^[23].
Cisco has issued patches for critical vulnerabilities in IOS XR and Nexus switches that could allow remote code execution and authentication bypass, and has warned of unpatched S/MIME flaws in its secure email products ^[34].
Rockwell Automation released patches for over a dozen vulnerabilities across several products, including RSLinx Classic and FactoryTalk ^[37].
An exploit has been published for a new Cleo Harmony vulnerability that allows remote authentication bypass via argument bearer manipulation ^[38].
Eight security flaws were disclosed across seven command-line AI coding agents, where malicious .git configurations could cause agents like Claude and Codex to execute attacker-controlled code ^[10].

Notable Threat Actor Activity

Threat actors are leveraging the Node.js runtime as a malware delivery tool in targeted attacks, abusing its trusted status to deploy malicious payloads ^[3].
The Shai-Hulud infostealer worm variant has expanded its credential theft capabilities, now scanning 469 locations across developer and CI/CD environments ^[4].
The “Spring Ring” threat group is targeting Microsoft Teams users with vishing attacks aimed at session hijacking, malware distribution, and infrastructure compromise ^[25].
The Gambling Goblin group, a Chinese-speaking cybercrime cluster, is responsible for malicious Apache module deployment on Brazilian government web servers ^[11].
The “Breeze Comet” threat group is conducting high-impact attacks on Brazilian and global financial systems ^[21].
A new Android banking trojan, StreamRat, was distributed to Spanish-speaking users through fake streaming campaigns on Meta ads, enabling near-complete device control ^[13].
NSO Group’s Pegasus spyware was used in a zero-click exploit to infect the iPhone of a Serbian student protest movement member ^[5].

Trends, Tools, or Tactics of Interest

Recruitment-themed phishing campaigns are using Browser-in-the-Browser (BitB) attacks to steal enterprise credentials ^[1].
The Balonx phishing kit uses generative AI to fully automate vishing attacks, including voice calls ^[2].
Active malware campaigns are distributing fake software installers that disable Windows Update and weaken Microsoft Defender, targeting users seeking popular software downloads ^[9].
Meta ads are being used as a distribution channel for Android malware, such as the StreamRat banking trojan ^[13].
Tech support scams are evolving, with scammers using new methods and targeting platforms more intelligently ^[40]^[41].
AI is being leveraged by cybercriminals to accelerate the speed and scale of attacks, providing significant time advantages ^[24].
Security tools for AI agents are emerging, such as OpenLeash, which adds human-in-the-loop checks for risky agent actions, and AIR Security’s firewall for AI skills and plugins ^[31]^[35].
Google, Anthropic, and OpenAI have released new cybersecurity-focused AI models, safeguards, and access programs to support defenders ^[8].

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced late amendments to the Cyber Security and Resilience Bill, granting ministers new powers to block high-risk technology suppliers from critical infrastructure in response to supply chain attack concerns ^[36].
California and Colorado will require operating systems to collect users’ ages for compliance, with open-source software like Linux likely exempt ^[39].

Sources

BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access - thehackernews.com
Dropbox accounts breached through Lenovo email verification flaw - bleepingcomputer.com
153 Million Driver License Images Offered on Dark Web - securityweek.com
Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages - thehackernews.com
Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon - thehackernews.com
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners - thehackernews.com
Hackers exploit Sangoma Switchvox flaw to deploy reverse shells - bleepingcomputer.com
Hackers exploit critical JFrog Artifactory flaw to forge admin tokens - bleepingcomputer.com
WordPress backup plugin flaw exposes millions of sites to takeover attacks - bleepingcomputer.com
Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability - securityweek.com
Plex warns users to patch security vulnerabilities immediately - bleepingcomputer.com
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE - darkreading.com
Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities - securityweek.com
Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products - securityweek.com
Exploit Published for Fresh Cleo Harmony Vulnerability - securityweek.com
Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code - thehackernews.com
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks - thehackernews.com
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means - thehackernews.com
Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users - darkreading.com
'Breeze Comet' Tears Into Brazilian & Global Financial Systems - darkreading.com
Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control - thehackernews.com
Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone - thehackernews.com
Recruitment-Themed Phishing Campaign Targets Enterprise Users - blog.knowbe4.com
New Phishing Kit Uses AI to Fully Automate Vishing Attacks - blog.knowbe4.com
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender - thehackernews.com
Tech support scams look different now. Here’s what to watch for - malwarebytes.com
Scammers are getting smarter about where they target you - malwarebytes.com
AI Gives Cybercriminals a Dangerous Time Advantage - darkreading.com
AI Agent Firewall Startup AIR Security Emerges From Stealth With $50 Million - securityweek.com
OpenLeash Adds a Human Check to Risky AI Agent Actions - securityweek.com
Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs - thehackernews.com
UK Moves to Block High-Risk Tech Suppliers From Critical Infrastructure - securityweek.com
Your phone or computer may soon ask how old you are - malwarebytes.com

Cybersecurity Brief – 2026-09-02

Wed, 02 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Aesto Health disclosed a data breach affecting over 9.5 million patients, exposing sensitive health information^[20].
Novocure reported a cyberattack in mid-August that exposed data of more than 1,400 US cancer patients and an undisclosed number of employees^[23].
A new dark web identity theft service is selling digital scans of over 153 million driver’s licenses from the US and Canada, with the FBI investigating a possible link to a breach at idscan.net^[35]^[50].
The US Department of Justice, in coordination with international law enforcement, dismantled the Sality peer-to-peer botnet, disrupting malware payload delivery^[10]^[17]^[42].
Attackers compromised the update infrastructure of Virtualizor VPS management software via BGP hijacking, serving malicious updates using a valid TLS certificate^[22]^[39].
An attack on the Philippines Nuclear Agency leveraged old, unpatched vulnerabilities in ownCloud, resulting in the theft of reactor databases, personnel records, and credential stores^[26].

Newly Discovered Vulnerabilities

SonicWall SMA 1000 series VPN appliances are affected by two chained zero-day vulnerabilities (CVE-2026-83549 and CVE-2026-83548) that allow unauthenticated remote code execution, which have been exploited in active attacks^[5]^[18]^[43].
GeoNetwork patched two vulnerabilities that can be chained for unauthenticated remote code execution, affecting government and agency geospatial portal backends^[6].
Sangoma Switchvox enterprise VoIP platform is being actively exploited via a critical vulnerability that allows unauthenticated remote code execution and reverse shell deployment^[9].
JFrog Artifactory is impacted by CVE-2026-82329, an authentication bypass flaw enabling admin-level access, which is being exploited days after disclosure^[11]^[27].
Langflow, an open-source AI application framework, is subject to active exploitation of CVE-2026-0768, an unauthenticated remote code execution vulnerability used to steal OpenAI and AWS credentials and tokens^[21]^[29].
Chrome and Firefox have released updates to address multiple vulnerabilities, including use-after-free, sandbox escape, and privilege escalation bugs; two critical Chrome flaws allow code execution via malicious websites^[41]^[49].
Nearly 22,000 Microsoft Exchange servers remain exposed online and unpatched against a high-severity authentication bypass vulnerability that allows mailbox hijacking^[25].

Notable Threat Actor Activity

A Russian national extradited from Cyprus has been charged in the US for operating a malware campaign that used 255 fake freelancer accounts to deliver malware-laced Excel attachments, infecting over 80,000 freelancers with TVRAT and DarkVNC^[7]^[16].
The Iranian threat group Nimbus Manticore has been linked to two new malware families and is using recruiter-themed social engineering to deliver cross-platform remote access trojans via coding tests^[14].
The financially motivated Breeze Comet group (formerly UNC5669) has been targeting Brazilian financial, retail, and e-commerce sectors with fraudulent transactions through Brazilian payment systems since 2024^[12].
Phishing actors are abusing the Faronics Deploy endpoint-management platform to install ScreenConnect remote support software for gaining remote administrative control^[19].
Chinese-speaking actors have weaponised Brazilian government sites for SEO poisoning campaigns, redirecting users to phishing and malicious content^[3]^[48].
The ClickFix campaign has compromised 31 organisations, dynamically updating its command-and-control infrastructure via the Polygon blockchain using EtherHiding^[31].
Thirteen malicious Composer theme packages were found on Packagist, injecting JavaScript to target unpatched iPhones and steal cryptocurrency wallet seeds via Vietnamese streaming sites^[13].

Trends, Tools, or Tactics of Interest

Phishing remains the leading initial access vector for cyberattacks, according to recent industry reporting^[2].
Cloaked SEO poisoning attacks, termed “Chameleon SEO poisoning,” surged by 40 percent in Q2 2026, leveraging search engine manipulation to spread phishing pages^[3].
Adversaries have begun exploiting AI development and deployment platforms, with attacks on AI frameworks like Langflow increasing in frequency and sophistication^[21]^[29].
Researchers demonstrated the use of Anthropic’s Claude AI to port a pre-authentication RCE exploit between different WAGO PLC models, highlighting the potential for AI-assisted exploit development^[8]^[47].
Ransomware groups are increasingly seeking insider assistance to bypass improved external security controls, with a rise in insider-facilitated attacks^[28].
Attackers are abusing legitimate administrative and endpoint management tools, such as Faronics Deploy, to install remote access software and maintain persistence^[19].
Threat actors are using blockchain technologies, such as Polygon, to dynamically update and obfuscate command-and-control servers, as seen in the ClickFix campaign^[31].

Regulatory or Policy Developments Affecting the Security Industry

The US Coast Guard has established an Office of Maritime Cybersecurity Policy, centralising cybersecurity policy for US ports, vessels, and maritime facilities^[46].
Anthropic announced the Enterprise Frontier Safeguards (EFS) system, combining zero data retention with automated misuse monitoring for enterprise AI deployments^[38].

Sources

Aesto Health says data breach affects over 9.5 million patients - bleepingcomputer.com
Novocure data breach affects more than 1,400 cancer patients - bleepingcomputer.com
FBI Probes Service Selling 153M+ Drivers Licenses - krebsonsecurity.com
153M+ driver’s licenses for sale on new dark web platform - malwarebytes.com
Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads - thehackernews.com
Sality botnet infrastructure dismantled in joint global takedown - bleepingcomputer.com
23-Year-Old Sality P2P Botnet Disrupted - securityweek.com
Hackers push malicious Virtualizor update in BGP hijacking attack - bleepingcomputer.com
Malicious Virtualizor Update Served via BGP Hijacking - securityweek.com
Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency - darkreading.com
Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain - thehackernews.com
SonicWall warns of actively exploited SMA1000 zero-day flaws - bleepingcomputer.com
SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks - securityweek.com
GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends - thehackernews.com
Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials - thehackernews.com
Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure - thehackernews.com
Attackers Pounce on Critical Artifactory Flaw Following Disclosure - darkreading.com
Critical Langflow flaw exploited to steal OpenAI and AWS keys - bleepingcomputer.com
Critical Langflow Flaw Exploited as Attacks on AI Platform Rise - darkreading.com
Chrome and Firefox Updates Patch Dozens of Vulnerabilities - securityweek.com
Two critical Chrome flaws put users at risk on malicious websites - malwarebytes.com
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks - bleepingcomputer.com
Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands - thehackernews.com
US charges Russian for infecting 80,000 freelancers with malware - bleepingcomputer.com
Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests - thehackernews.com
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems - thehackernews.com
Hackers abuse Faronics Deploy admin tool to install ScreenConnect - bleepingcomputer.com
Warning: Chameleon SEO Poisoning Spreads Phishing Pages - blog.knowbe4.com
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon - research.checkpoint.com
ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain - darkreading.com
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds - thehackernews.com
CyberheistNews Vol 16 #35 [New Report] Phishing Is Still the No. 1 Initial Threat Access Vector - blog.knowbe4.com
Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another - thehackernews.com
Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars - securityweek.com
Stronger Security Drives Ransomware Groups to Recruit From Within - darkreading.com
Coast Guard Establishes Office of Maritime Cybersecurity Policy - securityweek.com
Anthropic Details Response to Security Incidents, Unveils Enterprise Safeguards - securityweek.com