VulnHub

Cofense researchers have identified a new tactic employed by the Global Group ransomware gang that targets large enterprises. The group uses payment-themed phishing emails to lure victims into downloading malicious ISO files. Once these files are executed, they deploy WinMerge, a legitimate file comparison tool, to facilitate the encryption of files on the victim's system. This technique allows attackers to bypass some security measures, making detection more difficult. The implications of this attack are significant, as it highlights the evolving methods ransomware groups are using to infiltrate corporate environments and extort money from organizations.

Cybercriminals are exploiting ChatGPT's Custom GPTs feature to trick users into visiting harmful websites. These sites use ClickFix lures to deliver Remote Access Trojans (RATs), which can take control of victims' devices. This tactic was observed by Huntress in late September 2026 and represents a concerning trend where trusted AI platforms are manipulated to spread malware. Users who interact with these malicious GPTs may unknowingly expose their systems to significant risks. This incident serves as a reminder for individuals and organizations to be cautious when engaging with AI-driven tools and to verify the legitimacy of any offerings before clicking links.

Cybersecurity experts have reported that attackers are exploiting a zero-day vulnerability in Citrix NetScaler, identified as CVE-2026-88772. This vulnerability allows hackers to deploy custom web shells and tunneling malware, which can lead to root access on affected systems. Once inside, attackers can steal credentials and move laterally across internal networks, posing a significant risk to organizations that rely on Citrix products. This incident is particularly concerning given the potential for widespread credential theft and internal network compromise. Organizations using Citrix NetScaler should take immediate action to assess their security posture and apply any available patches or mitigations.

RatHat's command and control (C2) panel has been upgraded to build malware and utilize artificial intelligence to rank potential victims. This system is currently operational across nearly 100 deployments, indicating a significant expansion in its capabilities. The use of AI in this context suggests that attackers are becoming more sophisticated, enabling them to target victims more effectively. This development poses a serious risk to organizations, as it may lead to more tailored and damaging attacks. Companies and individuals should be aware of these evolving threats and take appropriate cybersecurity measures to protect themselves.

Researchers have discovered 101 malicious npm packages that have been exploiting the 'Baileys' open-source project to add developers to WhatsApp groups without their consent. This campaign, known as PhantomSub, targets users by tricking them into subscribing to unwanted group chats. The malicious packages can affect any developer using the npm ecosystem, potentially leading to unwanted notifications and privacy concerns. This incident raises significant alarm about the security of open-source projects and the need for developers to scrutinize packages before installation. As such tactics become more common, developers must remain vigilant about the software they use.

Hackers have been using customized versions of ChatGPT to impersonate legitimate products in a scheme known as ClickFix attacks. These attackers trick users into running PowerShell commands by masquerading as trustworthy software. This method takes advantage of the growing familiarity and trust users have with AI tools, making them more susceptible to deception. The implications are significant, as this method could lead to unauthorized access to systems and sensitive data loss. Companies and users alike need to be vigilant about the authenticity of software they interact with, especially when prompted to execute commands.

A new Android banking trojan called RatHat is being controlled through a web console used by its operators to manage infected devices. Security firm Cleafy has identified nearly 100 instances of this console being deployed since April 2026. This malware operates on a malware-as-a-service model, allowing different customers to run their own versions of the trojan. The console collects various data from compromised phones, which can include sensitive financial information. The use of this malware poses significant risks to users, particularly those with banking applications on their Android devices, as attackers can steal personal and financial information with relative ease.

A popular Chrome extension called 'Poper Blocker,' which claims to block ads, has been found to be harvesting sensitive user data. Researchers reported that the extension, despite being downloaded millions of times and having Google’s approval, is actually functioning as spyware. It collects extensive information from users, raising serious privacy concerns. This incident highlights a significant risk for millions of users who may have trusted the extension for its advertised functionality. The situation calls into question the vetting process for applications in the Chrome Store and the potential for malicious software masquerading as legitimate tools.

This week saw a notable rise in cyber threats, including a $387 million cryptocurrency hack that has raised alarms in the crypto community. Attackers registered a previously harmless domain that appeared in about 1,700 repositories and began using it to distribute malicious content. This incident illustrates how old assumptions about security can be exploited by cybercriminals. Additionally, weak service accounts, outdated vulnerabilities, and exposed systems continue to provide attackers with easy access points. Companies and users alike need to remain vigilant and update their security measures to protect against these ongoing threats.

Researchers have identified a new botnet named Carbonato that is specifically targeting exposed Docker daemons. This malware deploys an AI framework called Hermes Agent, which is open-source. Once installed, Carbonato modifies the framework's persona file to execute tasks sent through Telegram. This is concerning because it allows attackers to remotely control compromised systems, potentially leading to unauthorized access and exploitation of Docker environments. Organizations using Docker should ensure their daemons are properly secured to prevent unauthorized access and deployment of such malware.

The latest Security Affairs Malware newsletter covers significant developments in the malware landscape, including a case where a Malware-as-a-Service platform exploited GitHub to distribute malicious software across forty different companies. One notable threat discussed is the PAYLOAD ransomware, which has been found to weaponize Active Directory Group Policy Objects (GPO), making it easier for attackers to infiltrate and control networks. Additionally, researchers are tracing a Node.js Remote Access Trojan (RAT) named ChainScript, which is being used in various cyber attacks. These incidents highlight the evolving tactics of cybercriminals and the need for organizations to stay vigilant against sophisticated malware techniques that can compromise their systems and sensitive data.

Researchers at Manifold Security discovered a significant issue involving placeholder domains that were found in 359,000 GitHub files and linked to 349 AI agent skills. These domains are being used to redirect users to various scams, which could lead to financial losses and data theft. This situation raises concerns about the security of AI integrations and the potential for users to fall victim to these scams. It highlights the importance of scrutinizing third-party skills and applications, especially those that rely on external domains. Users and developers need to be vigilant about the sources of the tools they use to avoid being exploited by malicious actors.

A new malware called Lunex, which is part of a broader malware-as-a-service model, is targeting Ukrainian-speaking users through compromised websites. The attack involves a four-stage process starting with a fake CAPTCHA page designed to lure victims. Once engaged, the malware exploits an AMD driver to disable security monitoring, making it easier to steal sensitive information, such as browser credentials. This is particularly concerning as it highlights the tactics used by cybercriminals to bypass security measures and compromise user data. The findings from the cybersecurity firm Ontinue emphasize the need for increased vigilance among users, especially in regions facing heightened cyber threats.

Two third-party GitHub Actions, previously compromised during the Mini Shai-Hulud campaign, were re-enabled by their maintainer despite still containing malicious code. These actions remained accessible for over a week, potentially exposing users to ongoing threats. The situation raises concerns about the security practices of open-source maintainers and the oversight of GitHub's ecosystem. Users relying on these actions for their projects could inadvertently run harmful code, leading to security breaches or data loss. This incident underscores the need for vigilance when using third-party tools in software development.

Two GitHub Actions repositories, actions-cool/issues-helper and actions-cool/maintain-one-comment, were recently disabled after they were found to be compromised. This incident follows a previous breach during the Mini Shai-Hulud campaign in May 2026. The repositories were briefly accessible again, which allowed the execution of malware before being taken offline. Users who relied on these actions for their projects could be at risk of having their systems compromised. GitHub's swift action to disable the repositories underscores the ongoing challenges of securing open-source tools and the importance of vigilance among developers.