VulnHub

A new Windows botnet known as x47.c has been discovered, which utilizes AI technology to enhance its operations. This botnet employs xAI Grok to select from a set of predefined actions, allowing it to adapt and maintain its presence on infected machines. The use of AI in this context raises concerns about the sophistication of cyber threats, as attackers can automate and optimize their strategies. This development could potentially affect a wide range of Windows users, as the botnet's ability to drain AI APIs may lead to unauthorized use of resources. Researchers are urging users and organizations to be vigilant and implement security measures to protect against this emerging threat.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged two vulnerabilities affecting Microsoft SharePoint and MikroTik RouterOS, noting that they are currently being exploited in the wild. The first vulnerability, CVE-2026-65660, has a CVSS score of 8.8 and allows for code injection in Microsoft Office SharePoint. This vulnerability poses a significant risk as it can enable attackers to execute arbitrary code on affected systems. The second vulnerability relates to MikroTik RouterOS, although specific details about it were not disclosed in the article. Organizations using these platforms should prioritize patching and securing their systems to mitigate potential attacks. The active exploitation of these vulnerabilities underscores the importance of timely updates and vigilance in cybersecurity practices.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting the urgent need for federal agencies to address them due to active exploitation. The first vulnerability, CVE-2026-65660, affects Microsoft SharePoint and allows for code injection, potentially giving attackers control over affected systems. The second, CVE-2026-67279, pertains to Mikrotik RouterOS and involves improper enforcement of behavioral workflows. These vulnerabilities pose significant risks, especially to federal agencies, which are now required to prioritize patching them. While the directive primarily targets federal agencies, CISA encourages all organizations to adopt similar practices to manage vulnerabilities effectively.

A recent cybersecurity campaign, known as TeamFiltration and codenamed UNK_CondorFiltration, has compromised over 5,700 Microsoft 365 accounts across 28 tenants, mainly affecting retail and financial institutions in Chile. Researchers from Proofpoint reported that the attackers used default passwords to gain unauthorized access to these accounts. The campaign originated from nearly 1,500 unique IP addresses linked to Amazon Web Services. This incident underscores the risks associated with weak password practices, especially in sectors handling sensitive data. Organizations must prioritize password security to prevent similar breaches in the future.

Threat actors have compromised two legitimate MemTensor packages on the npm and PyPI repositories to distribute a malicious program called sckit. This implant targets Windows, Linux, and macOS systems and is designed to steal credentials. Researchers from Aikido, SafeDep, Socket, and StepSecurity have reported on the affected libraries, particularly the @memtensor/memos-cloud-openclaw-plugin versions. This incident raises significant security concerns for developers and users who may have unknowingly installed these compromised packages. It's crucial for affected users to take immediate action to safeguard their systems.

A Chinese hacking group known as UTA0565 has been exploiting a recently discovered exploit chain affecting Google Chrome and Microsoft Windows. The attacks, which took place on September 3 and 4, 2026, take advantage of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one in Windows (CVE-2026-85880). By using fake websites, the attackers are able to deploy a malware variant named CLEANGULP. This is concerning as it indicates a coordinated effort to target users of these widely-used platforms, potentially compromising sensitive information and system integrity. Users of both Chrome and Windows should be vigilant and consider updating their systems promptly to mitigate the risks associated with these vulnerabilities.

Cybercriminals are using deceptive tactics to distribute a new remote access trojan (RAT) named ChainScript. This malware disguises itself as popular software applications like Spotify, Zoom Workplace, and Microsoft Teams, making it more likely for users to download it unknowingly. ChainScript has been seen under various names, such as ComponentTask33 and OrchidViolet66. The threat actors are employing ClickFix-like lures to rotate their command and control (C2) infrastructure, which complicates detection and mitigation efforts. This situation poses a significant risk to both individuals and organizations, as it can lead to unauthorized access to sensitive information and systems.

Last week, Revolut confirmed a data breach involving sensitive customer records. The breach occurred when an attacker impersonated a government agency, using an email address from that agency's domain to gain unauthorized access to the bank's systems. This incident raises significant concerns about the security of customer data and the effectiveness of identity verification processes in preventing such impersonation attacks. Meanwhile, Cisco released a patch for a zero-day vulnerability in its email gateway that had been actively exploited. This highlights ongoing challenges in cybersecurity, where organizations must remain vigilant against both social engineering tactics and technical vulnerabilities.

Microsoft has addressed a serious security flaw in Azure AI Foundry, identified as CVE-2026-85889, which has been assigned a maximum severity score of 10.0. The vulnerability stems from a lack of authentication for critical functions, allowing unauthorized users to escalate their privileges over a network. This flaw could potentially let attackers gain higher-level access than intended, posing significant risks for organizations using the platform. Fortunately, Microsoft has implemented fixes, and users do not need to take any additional action to secure their systems. However, the incident emphasizes the importance of vigilance in cloud security practices.

Schneider Electric has identified vulnerabilities in its PowerChute Serial Shutdown software, which is used for managing uninterruptible power supplies (UPS) and ensuring proper system shutdowns. The affected versions include PowerChute Serial Shutdown version 1.5 and earlier, as well as version 1.6, which is associated with CVE-2026-13348. This vulnerability allows unauthorized access through excessive authentication attempts, potentially disrupting operations and compromising system data. Users are urged to upgrade to version 1.6, which includes a fix for these issues. Failure to address this vulnerability could leave systems exposed, emphasizing the need for timely updates and adherence to cybersecurity best practices.

Researchers have identified a new malware family named BambooToken that targets both Windows and Linux systems. This malware uses the MQTT protocol to communicate with compromised devices, making it a versatile threat for cybercriminals. Active since at least February 2023, BambooToken has been used in attacks primarily against organizations in Asia and South America. The use of MQTT allows attackers to maintain control over infected systems effectively, which raises concerns for businesses relying on these platforms. Companies should be vigilant and take necessary precautions to protect their networks from this evolving threat.

A group of hackers associated with a China-aligned espionage unit is taking advantage of a serious vulnerability in Tencent's Sogou Input Method for Windows, identified as CVE-2026-51990. This flaw allows attackers to install the GrayRabbit backdoor, which can give them unauthorized access to infected systems. The Sogou Input Method is widely used for typing Chinese characters, meaning a large number of users could be at risk. It's crucial for Tencent to address this vulnerability quickly to protect users from potential data breaches and espionage activities. Organizations using this software should prioritize patching and monitoring their systems for any unusual activity.

Microsoft has reported two recent phishing campaigns where attackers exploited third-party email services to send out fraudulent messages. Between August 3 and 5, 2026, more than a million scam emails were dispatched, impersonating CEOs to deceive recipients. These campaigns utilized social engineering tactics focused on passkeys to gain unauthorized access to Microsoft cloud accounts, leading to potential data breaches. As a result, both individuals and organizations using Microsoft cloud services could be at risk of financial fraud and data exfiltration. This incident underscores the ongoing challenges in cybersecurity, particularly in safeguarding sensitive information against increasingly sophisticated phishing attempts.