VulnHub

A new malware called 'PCPJack' has emerged, specifically designed to target web applications and cloud environments, such as AWS, Docker, and Kubernetes. This worm not only removes existing infections from a group known as TeamPCP but also steals user credentials. The dual functionality makes it particularly dangerous as it can both cleanse systems of one threat while introducing a new one. Organizations utilizing these cloud services should be vigilant and assess their security measures to prevent unauthorized access and data breaches. The presence of such malware underscores the need for continuous monitoring and robust security practices in cloud environments.

Researchers have identified a new phishing technique that exploits Amazon's Simple Email Service (SES) to send fraudulent emails that appear legitimate. By using this widely trusted cloud email service, attackers can bypass traditional email security measures. Victims may struggle to distinguish these phishing emails from real communications, making them more susceptible to scams. The implications are significant, as this method could lead to increased identity theft and financial loss for individuals and organizations alike. Users are advised to be vigilant and verify the authenticity of unexpected emails, especially those requesting sensitive information or prompting urgent actions.

A significant credential harvesting campaign has been detected, utilizing the React2Shell vulnerability (CVE-2025-55182) to gain access to sensitive data from 766 Next.js hosts. Attackers are stealing various credentials, including database logins, SSH private keys, AWS secrets, Stripe API keys, and GitHub tokens. This operation has been linked to a threat group that Cisco Talos is monitoring. The widespread nature of this breach is concerning, as it affects a range of developers and companies using Next.js, potentially compromising their applications and user data. Companies need to be vigilant and take immediate steps to secure their systems against this threat.

The latest ThreatsDay Bulletin highlights a range of pressing cybersecurity threats impacting various systems. Researchers are reporting on the alarming trend of chaining together minor vulnerabilities to create significant backdoors, which could allow attackers to gain unauthorized access. Additionally, there are ongoing concerns about Android rootkits and methods for evading AWS CloudTrail logging, raising red flags for cloud security. These developments underscore the need for organizations to stay vigilant and proactive in patching software and monitoring their systems for unusual activity. With cyber threats evolving quickly, it’s crucial for companies to keep their defenses updated and educate their teams on the latest risks.

Amazon Threat Intelligence has issued a warning regarding an active ransomware campaign known as Interlock, which is exploiting a significant vulnerability in Cisco's Secure Firewall Management Center (FMC) Software. This vulnerability, identified as CVE-2026-20131, has a maximum severity score of 10.0 and stems from an insecure deserialization of user-supplied Java byte streams. This flaw could allow attackers to gain root access without authentication, posing a serious risk to organizations using affected Cisco products. The exploitation of this vulnerability is concerning as it enables unauthorized access, potentially leading to data breaches and system compromises. Companies using Cisco FMC Software must take immediate action to protect their systems from this ongoing threat.

Cofense researchers have identified a new phishing scam where attackers use LiveChat to impersonate customer service agents from Amazon and PayPal. This tactic enables them to interact with victims in real-time, making the scam appear more convincing. The goal is to extract sensitive information such as credit card details and multi-factor authentication (MFA) codes. This type of scam poses a significant risk to users who may inadvertently share their financial information with these impersonators. As online shopping and payment services continue to grow, consumers need to be more vigilant about verifying the identity of customer service representatives to avoid falling victim to such schemes.

A recent social engineering campaign is targeting individuals by impersonating well-known companies like PayPal and Amazon. Attackers are using customer support interactions through LiveChat to trick users into revealing sensitive information, including credit card details and personal data. This type of phishing attack takes advantage of the trust that users place in these popular services, making it easier for the criminals to manipulate their victims. It's crucial for users to stay vigilant and verify the authenticity of any communication claiming to be from these companies, especially when asked for personal information. As these tactics become more sophisticated, both consumers and companies must be cautious about sharing sensitive data online.

A recent security flaw in the AWS Bedrock Code Interpreter has raised concerns among cloud users. This vulnerability involves a DNS-based attack that allows AI sandboxes to exfiltrate sensitive data from cloud environments. The issue affects AWS Bedrock's AgentCore, which is crucial for running AI applications in a secure environment. Companies using AWS Bedrock services need to be aware of this vulnerability as it could potentially expose their data to unauthorized access. This incident underscores the need for enhanced security measures in cloud-based AI applications.