Brave on DanSec Daily

Cybersecurity Brief – 2026-08-30

Sun, 30 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Microsoft has disclosed a new ClickFix malware variant called TerminalFix, which uses fake Cloudflare CAPTCHA pages to trick users into executing malicious commands in Windows Terminal or PowerShell, resulting in the deployment of a reverse-tunnel backdoor^[1].

Newly Discovered Vulnerabilities

Critical security vulnerabilities have been identified in several widely used WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, which could allow attackers to take over affected sites or achieve remote code execution^[2].

Notable Threat Actor Activity

The TerminalFix campaign leverages social engineering tactics by presenting users with fraudulent Cloudflare CAPTCHA challenges to facilitate the execution of malicious PowerShell commands^[1].

Trends, Tools, or Tactics of Interest

Brave browser version 1.94 has introduced an ‘Email Aliases’ feature, enabling users to generate disposable email addresses to help evade tracking when registering for online services^[4].
YARA-X version 1.20.0 has been released, delivering 14 new improvements and 13 bug fixes to the malware identification and classification tool^[7].

Sources

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor - thehackernews.com
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE - thehackernews.com
Brave browser adds email aliases to help users evade tracking - bleepingcomputer.com
YARA-X 1.20.0 Release, (Sun, Aug 30th) - isc.sans.edu

Cybersecurity Brief – 2025-07-24

Thu, 24 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The US National Nuclear Security Administration was breached via exploitation of a Microsoft SharePoint zero-day vulnerability chain. At least three Chinese nation-state cyber-espionage groups are implicated in targeting older, on-premises SharePoint instances after a flawed patch attempt.
Clorox has filed a $380M lawsuit against Cognizant, alleging gross negligence after hackers successfully impersonated an employee and convinced the help desk to reset credentials, enabling a major August 2023 cyberattack.
Ongoing phishing campaigns are mimicking the US Department of Education’s G5 grant portal, exploiting recent layoffs and political turmoil to target users.
The npm package ‘is’, with 2.8 million weekly downloads, was compromised in a supply chain attack, injecting backdoor malware that gave attackers full device access.
npm accidentally removed the Stylus package, breaking builds and pipelines globally that depend on the library.
Ukraine arrested the suspected administrator of the Russian-language cybercrime forum XSS.is at the request of French authorities.

Newly Discovered Vulnerabilities

Sophos patched five critical vulnerabilities in Sophos Firewall that allowed for remote code execution by unauthenticated attackers.
CISA issued an alert regarding active exploitation of two vulnerabilities in SysAid ITSM software, which attackers are using to hijack administrator accounts.
Cisco reported active exploitation attempts of critical Cisco Identity Services Engine (ISE) vulnerabilities, which could lead to unauthenticated remote code execution.
Multiple high-severity memory safety vulnerabilities were patched in both Chrome and Firefox browsers.
Persistent exploitation of known Ivanti remote code execution vulnerabilities continues, particularly affecting Japanese organizations due to patching complications.

Notable Threat Actor Activity

Threat actor “Mimo” has shifted tactics to target Magento CMS and misconfigured Docker instances for crypto mining and proxyware deployment, expanding from previous campaigns against Craft CMS.
Chinese threat actors continue to exploit Ivanti RCE vulnerabilities in targeted attacks.
The Lumma Stealer malware re-emerged and resumed activity after a prior law enforcement takedown.
The Interlock ransomware group is actively targeting organizations through drive-by download attacks, prompting a government alert.
Hackers are using stolen credit cards and loyalty points to book travel for clients, with risks extending to remote workers, SMBs, and travel brands.

Trends, Tools, or Tactics of Interest

Researchers identified a new stealthy WordPress backdoor hidden in the “mu-plugins” directory, enabling persistent administrative access and evading standard detection.
The Coyote banking trojan is the first known malware to abuse the Windows UI Automation (UIA) accessibility framework to steal banking credentials, with attacks observed against banks and crypto exchanges in Brazil.
Kerberoasting attacks remain effective due to weaknesses in current detection methods; new approaches to detection and Active Directory hardening are being discussed.
Increased exploitation of SharePoint vulnerabilities is observed, with multiple exploit attempts and scanning activity detected shortly after public disclosure.
File integrity monitoring receives renewed focus with the release of the ficheck.py tool for forensic analysis.
Google launched the OSS Rebuild initiative to enhance security in open-source package ecosystems and address software supply chain attack risks.
Brave browser implemented a feature to block Windows Recall from capturing screenshots of browser activity by default.
Proton launched “Lumo,” a privacy-focused encrypted AI assistant that does not log user conversations or use prompts for training.
OpenAI is rolling out new ChatGPT features, including “personality” toggles and a “Study together” mode for exam preparation.
AI bot traffic is increasingly impacting website performance, with new mitigation strategies under discussion.
OpenAI CEO Sam Altman warned of the rising threat of AI voice fraud in banking, stating that voice clones are becoming indistinguishable from real voices and require new verification methods.

Regulatory or Policy Developments

The UK is considering a ban on ransomware payments, with debate over potential unintended consequences such as victims hiding incidents or attackers shifting tactics.
ISO 42001, a new international standard for AI governance, is being highlighted as a framework for responsible AI development and deployment.

Cybersecurity Brief – 2025-04-27

Sun, 27 Apr 2025 00:00:00 +0000

Major Incidents or Breaches

Microsoft has disclosed ongoing attacks by the threat actor Storm-1977, targeting cloud tenants in the education sector. The group has used password spraying techniques to compromise accounts and has deployed over 200 crypto mining containers within affected environments.

Notable Threat Actor Activity

Storm-1977 continues to focus on education sector cloud environments, utilising automated password spraying and deploying crypto mining infrastructure post-compromise, indicating a trend towards monetisation via illicit resource use.

Trends, Tools, or Tactics of Interest

Password spraying remains an effective attack vector against cloud-based accounts, particularly in sectors with broad user bases and potentially weaker password hygiene.
Brave has released “Cookiecrumbler,” an open-source tool leveraging large language models (LLMs) and community input to identify and block intrusive cookie consent notices, reflecting a trend towards AI-assisted privacy tools and community-driven content moderation.

Other Security Developments

Coinbase resolved a bug in its 2FA account activity logs that previously led users to mistakenly believe their accounts had been compromised.