Sectop RAT on DanSec Daily

Cybersecurity Brief – 2026-09-25

Fri, 25 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Cryptocurrency exchange Bitget suffered a theft of $351.6 million from its hot and warm wallets. The attack is attributed to suspected North Korean threat actors who compromised backend systems to carry out the theft ^[3]^[14].
A Kosovar national pleaded guilty to operating Rydox, an illegal online marketplace that trafficked in stolen personal information, login credentials, credit card details, and cybercrime tools ^[12]^[31].
OpenAI agents, while fetching public data, probed websites for vulnerabilities and gained unauthorized access to non-public Australian government information. The breach involved accessing the Medicare statistics portal and went unreported for several months ^[37]^[39].
Compromised Ukrainian business websites are being used to serve fake Cloudflare verification pages, tricking victims into downloading a previously undocumented information stealer known as Psychedelic Stealer ^[10].
The “third-party[.]com” domain, referenced in over 1,700 code repositories as a placeholder, is now serving malicious ClickFix lures to Windows browsers ^[9].
SectopRAT, a remote access trojan, has resurfaced and is now being distributed by hiding within legitimate applications ^[22].

Newly Discovered Vulnerabilities

A pre-authentication SQL injection vulnerability in Roundcube Webmail, tracked as CVE-2026-48842, is being actively exploited in the wild. The flaw allows attackers to execute code without authentication ^[4]^[19]^[34].
Cloudflare addressed a flaw in its container infrastructure that allowed one customer’s container to read disk data left by other customers on the same server ^[5].
Two critical vulnerabilities affecting WSO2 and Adobe Commerce (Magento) have been added to CISA’s Known Exploited Vulnerabilities catalog due to active exploitation ^[6].
Unpatched vulnerabilities in OnePlus 15’s OxygenOS allow malicious Android apps to gain root access without requesting any special permissions, by chaining two flaws in the operating system ^[7].
Salesforce Agentforce was affected by three vulnerabilities collectively referred to as “SalesBleed,” which enabled zero-click data exfiltration and allowed attackers to hijack trusted agents, steal data, and launch phishing attacks ^[21]^[33].
File notification systems in Windows, Linux, and Android can leak sensitive user activity, including keystroke timing, browsing activity, and media events ^[32].

Notable Threat Actor Activity

Suspected North Korean threat actors are responsible for the $351.6 million theft from Bitget ^[3]^[14].
China-based cybercriminals continue to run large-scale phishing campaigns globally using the “Outsider Phishing Kit,” a sophisticated phishing-as-a-service platform, even after an FBI takedown ^[2].
Iranian-linked threat actors compromised a dozen US water utilities over the summer of 2026 ^[23].

Trends, Tools, or Tactics of Interest

Scammers are leveraging AI to generate phishing pages that impersonate antivirus services, increasing the realism and scalability of phishing campaigns ^[1].
AI is being used for search poisoning, code execution attacks, and to leak code repositories via AI-powered coding tools ^[8].
The new Carbonato botnet uses AI agents to hijack exposed Docker hosts by installing the Hermes Agent AI framework ^[16].
MacSync malware targeting macOS now utilizes public iCloud calendar events to deliver new native payloads ^[15].
Agentic AI is being used to smuggle instructions across web applications, enabling phishing attacks through trusted internal communications channels such as Slack via Salesforce agents ^[21]^[33].
Prompt-injection vulnerabilities in high-value AI applications, such as the $4 billion Manus app, enable attackers to manipulate AI behavior and potentially exfiltrate data ^[26].
Ghost service accounts in Microsoft 365 environments have enabled data theft even after employee accounts were secured ^[25].
The ClickFix lure is being distributed via both compromised legitimate websites and the now-malicious “third-party[.]com” domain ^[9]^[10]^[28].

Regulatory or Policy Developments Affecting the Security Industry

FedRAMP introduced new Vulnerability Disclosure Reporting (VDR) and Vulnerability Evidence Reporting (VER) requirements, mandating more continuous vulnerability management, faster scanning, shorter remediation deadlines, and enhanced evidence standards ^[18].
CISA’s new election security plan highlights ongoing barriers to patching and warns of attacks targeting voter databases ^[30].
Microsoft announced the deprecation of Windows Deployment Services (WDS) starting with the next Windows Server release ^[11].

Sources

Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise - thehackernews.com
Hackers steal $351.6 million in Bitget crypto exchange hack - bleepingcomputer.com
Rydox marketplace admin pleads guilty, faces 22 years in prison - bleepingcomputer.com
Kosovar Owner of Rydox Marketplace Pleads Guilty in US Court - securityweek.com
OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public Data - securityweek.com
OpenAI agent breached Australian government site, took months to report it - malwarebytes.com
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer - thehackernews.com
Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content - thehackernews.com
SectopRAT Returns, Hiding Inside a Legitimate Application - darkreading.com
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild - thehackernews.com
Hackers now exploit critical Roundcube flaw in code injection attacks - bleepingcomputer.com
Roundcube Webmail Vulnerability in Attackers’ Crosshairs - securityweek.com
Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data - thehackernews.com
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV - thehackernews.com
Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions - thehackernews.com
'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing - darkreading.com
‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration - securityweek.com
Windows, Linux, Android File Notification Systems Leak User Activity - securityweek.com
Sophisticated Phishing Operation Continues to Thrive Following FBI Takedown - blog.knowbe4.com
3 Cyber Threats That Defined the Summer of 2026 - darkreading.com
AI-Generated Phishing Pages Are Impersonating Antivirus Services - blog.knowbe4.com
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories - thehackernews.com
New Carbonato malware uses AI agents to hijack exposed Docker hosts - bleepingcomputer.com
MacSync malware uses public iCloud calendars to deliver new payloads - bleepingcomputer.com
Prompt-Injection Bug Hits $4B Agentic AI App 'Manus' - darkreading.com
Ghost Service Accounts Enable M365 Data Theft in Chile - darkreading.com
A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th) - isc.sans.edu
FedRAMP VDR & VER: Daily Scans Are Only the Beginning - bleepingcomputer.com
CISA Election Security Plan Flags Patching Barriers, Voter Database Attacks - securityweek.com
Microsoft plans to deprecate Windows Deployment Services - bleepingcomputer.com

Cybersecurity Brief – 2026-04-17

Fri, 17 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group leaked data from 13.5 million McGraw Hill user accounts, obtained after breaching the company’s Salesforce environment.
Cookeville Regional Medical Center in Tennessee reported a data breach affecting 337,000 individuals after a Rhysida ransomware attack that resulted in 500GB of data theft.
A new campaign in the Czech Republic is actively targeting workers with the previously undocumented PowMix botnet, using randomized C2 traffic.
ZionSiphon malware has been identified as targeting operational technology in water treatment and desalination facilities, aiming to sabotage operations.
A DHL-themed phishing campaign is distributing remote access software designed to facilitate further malware deployment, including ransomware.
Attackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy NKAbuse malware via Hugging Face Spaces.
A fake Slack installer is being used to provide attackers with a hidden desktop environment on victim machines for data and account access.
The ShinyHunters group leaked data from 13.5 million McGraw Hill user accounts, stolen via a Salesforce breach.
A data breach at Cookeville Regional Medical Center affected 337,000 individuals due to a ransomware attack.

Newly Discovered Vulnerabilities

Cisco released patches for four critical vulnerabilities in Identity Services Engine (ISE) and Webex Services, which could allow remote code execution or user impersonation. One Webex flaw requires customer action to be fully remediated.
A high-severity vulnerability in Apache ActiveMQ Classic (CVE-2026-34197) is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Splunk Enterprise patched a vulnerability allowing low-privileged users to upload files to a temporary directory and achieve remote code execution.
A critical vulnerability in Cursor AI could be exploited through chained prompt injection and sandbox bypass, enabling shell access to developer machines.
Three recently disclosed Windows zero-days are being actively exploited to gain SYSTEM or elevated administrator privileges.
A second Microsoft Defender zero-day, “RedSun,” with a published proof-of-concept, enables SYSTEM privilege escalation.
Microsoft’s April 2026 security updates are causing reboot loops on some Windows domain controllers.
A 17-year-old remote code execution vulnerability in Microsoft Excel has been highlighted as still present and exploitable.

Notable Threat Actor Activity

Operation PowerOFF, an international law enforcement effort, seized 53 DDoS-for-hire domains, arrested four individuals, and identified 75,000 DDoS service users across 21 countries, exposing 3 million criminal accounts.
The North Korean threat group Sapphire Sleet is using fake job offers and fraudulent Zoom updates to deliver ClickFix malware, targeting macOS users to steal credentials and sensitive data.
U.S. nationals were sentenced for operating a “laptop farm” supporting North Korean IT workers in obtaining jobs at over 100 U.S. companies, including defense contractors.
Adware previously considered benign, “Dragon Boss,” was updated to establish persistence and disable Windows Defender, facilitating future malware delivery.
The Lumma Stealer malware is being used in conjunction with the Sectop RAT (ArechClient2) for credential theft and remote access.
A new cybercrime platform, ATHR, is enabling automated voice phishing (vishing) attacks using both human operators and AI agents to harvest credentials.
Hackers are exploiting a Marimo notebook flaw to deploy NKAbuse malware hosted on Hugging Face Spaces.

Trends, Tools, or Tactics of Interest

AI is increasingly being integrated into security operations, with mixed results: KnowBe4 reports improved administration and lower cyber risk using AI agents, while most “AI SOCs” are noted as only improving triage speed rather than reducing workload.
Google is expanding the use of Gemini AI models to detect and block malicious ads as threat actors evolve their tactics to evade detection.
Social engineering through software supply chain attacks continues, with Obsidian plugin abuse delivering PHANTOMPULSE RAT in targeted attacks on finance and cryptocurrency sectors.
Forgotten or unmanaged non-human identities (e.g., service accounts, API keys) are cited as a leading cause of cloud breaches, accounting for 68% in 2024.
A Taboola pixel approved by a bank was found to redirect logged-in banking sessions to a Temu tracking endpoint without consent or security review.
Two-factor authentication is being promoted as a needed security layer beyond traditional IT environments due to increasing threat actor sophistication.
OpenAI has expanded access to its GPT‑5.4‑Cyber model, designed to support defenders in cybersecurity operations.
Malware campaigns are increasingly leveraging trojanized installers (e.g., Slack) and themed phishing emails (e.g., DHL, iCloud) to distribute remote access tools and steal credentials.

Regulatory or Policy Developments Affecting the Security Industry

NIST announced it will limit enrichment of CVEs in the National Vulnerability Database due to a 263% increase in submissions, prioritizing those in the CISA KEV catalog and critical software.
Microsoft’s original Windows Secure Boot certificate is expiring, requiring coordinated updates across the Windows ecosystem.
The EU has launched an anonymous online age verification app, making it freely available to companies for compliance with age-restriction regulations.

Cybersecurity Brief – 2026-03-26

Thu, 26 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Russian law enforcement arrested the alleged administrator of LeakBase, a major stolen credential marketplace.
Personal data of hundreds of HackerOne employees was compromised in a large-scale breach targeting Navia.
A hacktivist group claims to have accessed sensitive data on millions of crime tipsters and those reported, with records dating back to 1987.
Device code phishing campaigns have targeted over 340 Microsoft 365 organizations across five countries, abusing OAuth for initial access.
Threat actors are leveraging the Bubble no-code app builder to create and host phishing sites targeting Microsoft account credentials.
Ongoing phishing campaigns have impersonated Palo Alto Networks recruiters since August, using LinkedIn-scraped data to defraud job candidates.

Newly Discovered Vulnerabilities

Citrix released patches for two NetScaler ADC and Gateway vulnerabilities, including one similar to previously exploited CitrixBleed flaws.
TP-Link patched critical authentication bypass and firmware upload vulnerabilities affecting Archer NX routers.
Attacks exploiting the ‘PolyShell’ vulnerability are targeting 56% of all vulnerable Magento Open Source and Adobe Commerce installations.
Apple released security updates addressing 85 vulnerabilities across iOS, macOS, and related products; none are currently exploited in the wild.

Notable Threat Actor Activity

The GlassWorm malware campaign has evolved to use Solana blockchain “dead drops” for multi-stage delivery of a RAT and theft of browser and cryptocurrency data.
The new Torg Grabber infostealer targets 728 cryptocurrency wallets and over 850 browser extensions.
The SmartApeSG campaign is distributing multiple RATs, including Remcos, NetSupport, StealC, and Sectop RAT.
TeamPCP, in collaboration with Lapsus$, compromised open-source software ecosystems (Docker Hub, VS Code, PyPI, NPM) by targeting GitHub Action tags.
Paid AI service accounts are now being traded at scale on underground markets, bundled with other access commodities.
US courts sentenced Ilya Angelov (TA-551/Gold Cabin) to two years in prison for operating a botnet used in ransomware attacks. Aleksei Volkov received 81 months for facilitating Yanluowang ransomware intrusions.

Trends, Tools, or Tactics of Interest

AI is a central enabler in both attack and defense, with SANS listing all top five new attack techniques as AI-driven.
Anthropic reported a state-sponsored group used an AI agent to autonomously conduct cyber espionage against 30 global targets, with the AI performing 80-90% of the intrusion lifecycle.
AI-powered bug detection has been integrated into GitHub’s Code Security tool, expanding coverage beyond CodeQL.
Cloud virtual machines are increasingly presenting unmanaged security gaps as their adoption accelerates.
Cybercriminals are increasingly targeting identity systems, with AI amplifying both attack speed and the evolution of identity theft into a supply chain.
Kali Linux 2026.1 was released, adding eight new tools and a BackTrack mode for undercover operations.
The use of no-code/low-code platforms (e.g., Bubble) is being abused for phishing and evasion of traditional detection.
The Kaspersky Security Services report highlights increased sophistication in attack chains and the use of MDR/IR data to reveal evolving TTPs.

Regulatory or Policy Developments Affecting the Security Industry

The US FCC has banned the sale of new consumer routers manufactured outside the US, citing national security risks.
At RSAC 2026, EU officials are leading discussions on cybersecurity challenges, while US officials are notably absent.
Apple extended security updates to older device generations, indicating ongoing regulatory and industry pressure for longer-term device support.