Key Takeaways
- Attackers increasingly abuse trusted‑looking channels—NuGet packages, installers, Chrome sync, and legitimate RMM tools—to deliver malware.
- Ransomware can move from initial breach to network‑wide encryption in under a day, highlighting the need for rapid detection and containment.
- Recently added CVEs (Oracle E‑Business Suite and KNX protocol) are already being exploited, underscoring the danger of “old” or seemingly minor flaws.
- A joint CISA‑NSA‑JPCERT/CC‑NCSC‑NL‑NCSC‑UK guide stresses the value of coordinated vulnerability disclosure programs for improving product security.
- Large‑scale fraud operations—ranging from a 700‑person call‑center scam in the Netherlands to a €140 million money‑laundering network in Europe—demonstrate the financial motive behind many cyber campaigns.
- Windows bind‑link features can be hijacked by administrators to hide malicious files and evade EDR, AMSI, and AppLocker controls.
- Over 290 fraudulent GitHub repositories mimic legitimate vendors to spread an in‑memory infostealer that exfiltrates crypto‑wallet and browser credentials to Russian‑hosted C2 servers.
- A U.S. indictment charges five Russian nationals and two bulletproof‑hosting firms for cybercrimes causing tens of millions in losses, with sanctions already applied by multiple jurisdictions.
- Chrome’s legitimate sync feature can be turned into a surveillance tool with only brief physical access to a victim’s device.
- SeasonalInvite phishing uses AI‑generated eCard lures to abuse commercial RMM solutions (ConnectWise ScreenConnect, LogMeIn Resolve, etc.) on Windows and macOS.
- The Jalisco toolkit automates OAuth device‑code phishing, pairing with the OmegaLord credential harvester to defeat MFA protections.
- Threat‑intelligence mapping shows >3,900 malicious servers hosted by Eastern European providers, with groups like Cloud Atlas APT relying heavily on this infrastructure.
- A financially motivated campaign deploys both Vidar stealer (for credential and crypto‑wallet theft) and XMRig miner (for Monero generation), creating a dual revenue stream from each infection.
- The overarching lesson: stop granting trust in bulk; verify repositories, installers, accounts, and exposed services, patch “boring” bugs, tighten defaults, and monitor handoffs closely.
Malicious NuGet Packages Disguised as Game Cheats Deploy Stealer
Researchers uncovered eleven malicious NuGet packages masquerading as .NET command‑line tools for game utilities, bots, and panels. Each package acts as a first‑stage downloader that fetches a second‑stage Python payload named pepesoft.exe from GitHub Releases and Hugging Face under the username “pepegit666.” The payload uses supplied AWS‑style keys to pull remote configuration, authenticates to Google Sheets, binds activations to hardware IDs, and honors a remote HWID/UUID ban‑list. In three variants, the game‑automation component also exposes Telegram bot commands capable of exfiltrating screenshots to an attacker‑controlled chat.
Trojanized Installers Spread Starland RAT and WLDR Agent
UAT‑11795, a Russian‑speaking, financially motivated group, has been distributing trojanized installers for popular software such as MobaXterm, WebEx, Zoom, DBeaver, and FaceIT since at least June 2025. The installers deliver Starland RAT (a Python‑based remote access tool) and the WLDR agent—a PowerShell‑based C2 memory implant featuring encrypted beaconing, task queuing, and a Runspace execution engine. The attack chain begins with ClickFix lures that drop HTA scripts, which then run the trojanized installer; Starland RAT subsequently uses curl.exe to fetch and decrypt the WLDR agent. The malware targets credentials, cryptocurrency wallets, and Active Directory data, with most infections observed in the U.S. and scattered cases in Germany, Romania, and Venezuela. UAT‑11795 has also been linked to CastleStealer and Remcos RAT deployments.
Rapid Ransomware Outbreak: Spirals Ransomware Hits South Asian IT Firm
In June 2026, an IT services company in South Asia fell victim to a previously undocumented ransomware family called Spirals. The Rust‑based payload encrypted files on the network less than 24 hours after the initial breach. Attackers gained entry via an exposed IIS web server, uploaded an ASP.NET web shell, and within three hours established persistence, performed reconnaissance, disabled endpoint security, dumped the SAM hive, and set up covert remote access. PsExec was used to push the ransomware laterally. The ransom note threatens to publish stolen data after six days unless payment is made and directs victims to a Tor portal for negotiation; the threat actor remains unidentified.
Newly Exploited Vulnerabilities Added to CISA KEV Catalog
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE‑2026‑46817, an improper privilege management flaw in Oracle E‑Business Suite, and CVE‑2023‑4346, an overly restrictive account lockout mechanism in the KNX Association’s Protocol Connection Authorization Option 1. Federal agencies must patch the Oracle issue by July 18 2026 and the KNX issue by July 29 2026. While active exploitation of the Oracle CVE has been reported, the manner and actors abusing the KNX flaw remain unknown.
Joint Guidance on Coordinated Vulnerability Disclosure Released
CISA, together with the NSA, JPCERT/CC, NCSC‑NL, and NCSC‑UK, published joint guidance to help software manufacturers and online service providers work with security researchers. The document outlines how a well‑defined coordinated vulnerability disclosure (CVD) program enables vendors to assess risk, improve vulnerability‑management processes, and make informed decisions that enhance product security for customers. The agencies encourage adopters to implement clear reporting channels, timelines, and remediation workflows.
Large‑Scale Fraud Networks Dismantled in Netherlands and Spain
Dutch police arrested a 46‑year‑old man of Israeli‑Polish citizenship who allegedly headed an international criminal organization employing over 700 people across roughly 20 fraudulent call centers. Posing as financial advisors, the group built trust with victims over months, luring them into small initial deposits that appeared profitable before persuading larger investments—often in cryptocurrency—that were siphoned off by the scammers. Four additional “financial advisors” were also detained.
Separately, Spain’s National Police disrupted a cybercrime network accused of stealing and laundering about €140 million via fake investment platforms, CEO fraud, invoice fraud, and adversary‑in‑the‑middle attacks. Four suspects were apprehended (two in Portugal, one in Spain, one in Panama). The group operated over 800 bank accounts to receive illicit funds, which were quickly dispersed through layered transactions and money‑mule accounts in third countries to conceal the proceeds.
Windows Bind Link Abuse Techniques to Evade EDR Defenses
Bitdefender Labs demonstrated three techniques that abuse Windows’ bind‑link feature (implemented by the bindflt.sys minifilter driver) to bypass endpoint detection and response (EDR), AMSI, and AppLocker. By running as a local administrator, an attacker can redirect a trusted file or DLL path (File‑Binding), a trusted executable path (Process‑Binding), or a user‑defined Windows silo (Silo‑Binding) to malicious content without leaving persistent filesystem artifacts. Although the techniques require admin rights, Microsoft rates them low severity because legitimate uses (Store apps, Windows Sandbox, containers) already rely on the same mechanism.
Brand‑Jacking Campaign Floods GitHub with Fake Repos Distributing Infostealer
A financially motivated actor created more than 290 fraudulent GitHub repositories impersonating trusted vendors—including Arctic Wolf, security tooling firms, fintech services, crypto wallets, developer tools, secure email providers, macOS utilities, and gaming software. The repositories deliver a Windows infostealer sharing code with BoryptGrab. The malware harvests data from 41 cryptocurrency‑wallet paths and 19+ browsers, packages the stolen information into a ZIP, and exfiltrates it to a Russian‑hosted C2 server. It operates as a pure in‑memory smash‑and‑grab tool, avoiding persistence to maximize data collection in a single run. The campaign is attributed to a Russian‑speaking operator.
U.S. Indictment Targets Russian Cybercrime Syndicate and Hosting Providers
The U.S. Department of Justice unsealed a December 2024 indictment charging three Russian nationals—Alexander Alexandrovich Volosovik, Kirill Andreevich Zatolokin, Yulia Vladimirovna Pankova—and two bulletproof‑hosting firms, Media Land LLC and ML.Cloud LLC, for cybercrimes that caused tens of millions of dollars in losses against U.S. victims. The State Department’s Rewards for Justice program offers up to $10 million for information leading to the apprehension of foreign‑government‑linked associates of the defendants or their hosting services. The individuals and companies have already been sanctioned by the U.S., U.K., and Australia (November 2025), and the EU added sanctions against the hosting firms and Volosovik in its first joint cyber‑sanctions package against Russia.
Chrome Sync Feature Turned into Surveillance Tool by Stalkers
Legitimate Chrome synchronization—designed to keep bookmarks, tabs, history, autofill, and passwords consistent across devices—can be abused for surveillance. If an attacker gains brief physical access to a victim’s phone, opens Chrome, adds a Google account under their control, and enables sync for that account, the victim’s browsing activity is silently copied to the attacker’s Google account. The attacker can then review the victim’s history from any device with internet access, turning a convenience feature into a powerful spy tool.
SeasonalInvite Phishing Abuses Legitimate RMM Tools via eCard Lures
Since January 2026, the SeasonalInvite campaign has used AI‑generated eCard‑themed domains to lure victims to phishing pages that abuse commercial Remote Monitoring and Management (RMM) solutions such as ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr. The campaign employs a traffic distribution system (TDS) with thousands of gate pages to funnel victims while blocking automated scanners. Forescout observed 959 eCard domains and noted that the phishing kit contains indicators of AI‑generated code, suggesting the threat actor leveraged large language models to rapidly produce and adapt lures.
AI‑Powered Device‑Code Phishing Toolkit (Jalisco) Bypasses MFA
Researchers identified Jalisco, an AI‑driven device‑code phishing toolkit that generates fresh OAuth codes in real time, defeating the time‑based controls defenders rely on. It works in tandem with the credential harvester OmegaLord, which masquerades as a PDF reader to collect passwords and phone numbers—a step aimed at intercepting or hijacking multi‑factor authentication (MFA) codes. Once inside a compromised Microsoft 365 account, attackers enroll multiple attacker‑controlled devices to the victim’s Entra ID tenant to extend exfiltration windows and steal SaaS data for extortion. Over five devices have been linked to a single compromised account in observed attacks.
Mapping of Threat‑Enabling Servers Reveals Eastern European Hub
Hunt.io’s analysis uncovered more than 3,900 threat‑activity‑enabling servers hosted by 302 Eastern European providers over the past three months. Keitaro accounted for the largest share (1,277 unique IPs), followed by Tactical RMM (232) and Acunetix (173). Cloud Atlas APT infrastructure was observed across multiple Eastern European hosts, confirming the group’s continued reliance on the region. Notably, Proton66 OOO was linked to active exploitation of CVE‑2026‑35273, a critical Oracle PeopleSoft zero‑day attributed to the ShinyHunters group, with the threat‑enabling infrastructure traceable directly to this Russian provider.
Dual‑Monetization Campaign Deploys Vidar Stealer and XMRig Miner
In April 2026, a financially motivated campaign was observed delivering both Vidar stealer and the XMRig cryptocurrency miner to consumer and small‑/medium‑business victims worldwide. Victims are lured via malvertising to pages offering cracked versions of copyrighted software; executing the loader drops and runs Vidar (which harvests browser credentials, cookies, and crypto‑wallet data) and XMRig (which mines Monero using the victim’s CPU). The loader uses the Factory‑v3 malware‑as‑a‑service framework. Telegram notifications for each new infection include the tag “X3D MINER,” indicating a dual‑revenue model: stolen credentials are sold on criminal markets, while the miner provides passive income from hijacked compute cycles.
Conclusion: Re‑evaluating Trust and Prioritizing Basics
The week’s incidents illustrate a common theme: attackers exploit the implicit trust we place in familiar software repositories, installers, synchronization features, and legitimate administrative tools. Whether it is a seemingly innocuous NuGet package, a trojanized installer for a popular utility, or the built‑in Chrome sync mechanism, a small shortcut can become a full‑blown attack chain. Simultaneously, long‑known vulnerabilities are being dusted off and weaponized, proving that “old” bugs are far from harmless.
Defenders must therefore shift from blanket trust to rigorous verification: inspect third‑party packages, validate installer signatures, enforce least‑privilege on sync and RMM tools, and monitor for anomalous bind‑link usage. Prompt patching of even modest CVEs, tightening default configurations, and maintaining visibility over credential‑access hand‑offs are essential. Finally, recognizing that financially motivated actors often pursue multiple revenue streams—combining data theft with cryptocurrency mining—helps prioritize defenses that protect both information and system resources. By treating every convenience feature as a potential vector and consistently applying basic security hygiene, organizations can reduce the attack surface that adversaries rely on.