VulnHub

The Security Affairs Malware Newsletter discusses recent malware threats, including a backdoor introduced through compromised RubyGems like SleeperGem, Dendreo, and fastlane. These malicious packages can allow attackers to maintain persistent access to affected systems. Additionally, the report highlights the chaos caused by over 800 fake AI skills and MCP servers that delivered malware to unsuspecting users. The newsletter also mentions a ransomware variant called msaRAT that poses further risks. These developments are significant as they illustrate the evolving tactics used by cybercriminals, affecting developers and users who rely on these tools. Companies and users should remain vigilant and ensure their software sources are secure to prevent such incidents.

Hackers have taken advantage of compromised hotel Wi-Fi gateways to trick users into entering their Microsoft 365 credentials on fake login pages. According to research from ReliaQuest's threat team, attackers have targeted hotels and conference centers, redirecting guests without their knowledge. This method avoids traditional phishing tactics like emails or attachments, making it particularly sneaky. Anyone using hotel Wi-Fi could be at risk, especially business travelers who often access sensitive accounts. This incident serves as a reminder for users to be cautious when logging into accounts over public networks and to verify the authenticity of login pages.

Iran-linked actors have been identified as targeting critical infrastructure in the United States, specifically focusing on water and energy control systems. This escalation raises alarms about the security of essential services that millions rely on. The attacks pose significant risks, as breaches in these systems could lead to disruptions in water supply and energy distribution, impacting daily life and public safety. The involvement of state-sponsored groups highlights the ongoing geopolitical tensions and the potential for cyber warfare to affect civilian infrastructure. Organizations managing these essential services need to enhance their security measures to defend against such sophisticated threats.

AI applications face significant security challenges at three critical points: system prompt integrity, output handling, and runtime visibility. These weaknesses can lead to various vulnerabilities, including data leaks or malicious outputs that could mislead users or systems. Organizations deploying AI solutions need to address these issues to protect sensitive information and ensure reliable performance. Failure to secure these aspects can result in serious consequences, including loss of trust from users and potential regulatory scrutiny. It’s crucial for companies to implement robust security measures at these control points to mitigate risks associated with AI deployment.

Last week, it was reported that a pre-authentication remote code execution (RCE) vulnerability in ServiceNow was actively exploited in the wild. This vulnerability allows attackers to execute arbitrary code on affected systems without needing to authenticate, posing significant risks to organizations using the platform. In a separate incident, Hugging Face, a popular AI community, experienced a data breach, although details about the extent of the breach and the data compromised have not been fully disclosed. These incidents highlight ongoing security challenges for companies leveraging AI and cloud services, as they must remain vigilant against potential exploits that can have serious consequences for their operations and data integrity.

Gamers using Steam forums are facing a new threat from ClickFix attacks, where attackers pose as helpful users offering solutions to game or computer issues. However, these purported fixes actually contain XMRig cryptominers, which secretly install on victims' devices to mine cryptocurrency without their consent. This not only affects the performance of users' computers but can also lead to increased electricity costs and potential hardware damage. Anyone who frequents these forums should be cautious and avoid downloading or executing unknown files, as this type of malware can significantly degrade their system's performance. The situation highlights the need for vigilance in online communities, especially where users seek help for technical problems.

US federal agencies have issued a warning about Iranian cyber actors targeting critical water and energy control systems in the United States. These attackers are not merely observing; they are actively making changes within these systems, raising concerns over potential disruptions to essential services. The Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, NSA, and Department of Energy, updated their advisory to alert organizations about these intrusions. This situation highlights the vulnerability of vital infrastructure to foreign cyber threats, emphasizing the need for robust security measures to protect against such attacks. As water and energy systems are crucial for daily life and national security, any successful breach could have serious implications for public safety and operational stability.

A large-scale malvertising campaign is targeting internet users by creating fake websites that mimic popular platforms like Solana, Luno, and TradingView. These sites contain malicious JavaScript code that instructs web browsers to construct malware directly in memory, bypassing traditional security measures. This method makes it difficult for security software to detect or block the malware, increasing the risk for unsuspecting users who visit these sites. As a result, individuals looking to trade or invest in cryptocurrencies are particularly vulnerable. The campaign not only threatens individual users but also raises concerns about the overall security of online financial platforms.

The ShinyHunters extortion group has leaked email addresses from various data breaches, which are now being exploited in a sextortion scam. Attackers are sending emails to individuals, claiming to have compromising information and demanding $2,000 in Bitcoin to avoid sharing it. This scam is particularly concerning because it targets people whose email addresses were exposed in previous breaches, making the threats more credible. Victims may feel pressured to comply due to fear of reputational damage or privacy violations. As these tactics become more prevalent, individuals should be cautious about sharing personal information online and consider using additional security measures to protect their data.

Attackers are exploiting a serious vulnerability in Fastjson, a JSON library developed by Alibaba for Java applications, particularly those using Spring Boot. This flaw, identified as CVE-2026-16723, allows unauthorized code execution with the privileges of the Java process, posing significant risks to affected systems. The vulnerability has a high severity rating of 9.0, indicating it could lead to severe consequences if not addressed. Currently, there are no patches available to fix this issue, which increases the urgency for developers and organizations using Fastjson to take immediate protective measures. Security firms have reported that this vulnerability is being actively exploited, making it critical for users to assess their systems and implement necessary safeguards.

Security researchers have released exploit code for a vulnerability in GitLab that allows authenticated users to execute commands as the 'git' user on certain self-managed servers. This flaw affects GitLab version 18.11.3 and earlier, which had a patch issued on June 10, 2023. If a user can push to a project, they can exploit the vulnerability by committing a specially crafted Jupyter notebook. This action reveals sensitive heap memory data, enabling unauthorized command execution. Organizations using vulnerable versions of GitLab should prioritize applying the patch to prevent potential abuse of this exploit, especially in environments where multiple users have access to project repositories.

Recent research from CTM360 reveals a troubling shift in phishing tactics targeting the insurance sector. Traditionally, attackers would trick victims into providing their login credentials, then use this information to compromise accounts later. However, the new approach involves real-time account hijacking, where attackers act immediately upon obtaining credentials. This evolution poses a significant risk not only to individuals but also to insurance companies, as it allows for quicker financial exploitation and potentially greater losses. Users must remain vigilant against these sophisticated phishing schemes, which are becoming increasingly effective at bypassing security measures.

Rockwell has released patches for its Arena simulation software after researchers identified serious code execution vulnerabilities. These flaws could allow attackers to exploit the software, potentially impacting industrial organizations that rely on it for simulation and modeling. If left unaddressed, these vulnerabilities could lead to unauthorized access and manipulation of critical systems. Users of Arena are urged to apply the patches promptly to safeguard their operations and data. This situation serves as a reminder for companies to regularly update their software to protect against emerging threats.