Major Incidents or Breaches

  • Microsoft has disclosed a new ClickFix malware variant called TerminalFix, which uses fake Cloudflare CAPTCHA pages to trick users into executing malicious commands in Windows Terminal or PowerShell, resulting in the deployment of a reverse-tunnel backdoor[1].

Newly Discovered Vulnerabilities

  • Critical security vulnerabilities have been identified in several widely used WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, which could allow attackers to take over affected sites or achieve remote code execution[2].

Notable Threat Actor Activity

  • The TerminalFix campaign leverages social engineering tactics by presenting users with fraudulent Cloudflare CAPTCHA challenges to facilitate the execution of malicious PowerShell commands[1].

Trends, Tools, or Tactics of Interest

  • Brave browser version 1.94 has introduced an ‘Email Aliases’ feature, enabling users to generate disposable email addresses to help evade tracking when registering for online services[4].
  • YARA-X version 1.20.0 has been released, delivering 14 new improvements and 13 bug fixes to the malware identification and classification tool[7].

Sources#

  1. TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor - thehackernews.com
  2. Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE - thehackernews.com
  3. Brave browser adds email aliases to help users evade tracking - bleepingcomputer.com
  4. YARA-X 1.20.0 Release, (Sun, Aug 30th) - isc.sans.edu