Weekly Cyber Threat Roundup: VMware Exploits, Windows Zero-Day, MCP Attacks, Browser Hijacks & More

Key Takeaways

• Attackers are exploiting readily available access rather than relying on sophisticated, novel techniques.
• Recent incidents show a pattern: patched flaws are quickly weaponized, exposed services are abused, and supply‑chain compromises spread far beyond the initial breach.
• macOS and Windows zero‑days are being used for crypto‑mining, espionage, and backdoor deployment, often as a distraction from deeper intrusions.
• Emerging threats such as GhostSplice and CDP‑based browser hijacking demonstrate how attackers manipulate trusted channels (AI coding assistants, DevTools) to bypass defenses.
• Organizations must prioritize patching high‑severity CVEs, restrict unnecessary internet‑facing services, monitor for abnormal credential use, and maintain vigilance over seemingly “boring” assets like configuration files and open‑source components.

Introduction
The past week’s cybersecurity landscape reinforced a sobering truth: many of the most damaging attacks do not require zero‑day ingenuity; they thrive on overlooked openings, stale credentials, and misconfigurations that defenders assume are low risk. From a newly patched VMware vulnerability turned into a ransomware smokescreen to a macOS flaw hijacked for cryptocurrency mining, the common thread is the exploitation of access that was already present. Below is a concise rundown of the most notable developments, grouped by theme to help security teams prioritize where to focus their efforts.

VMware vCenter Exploitation
A suspected China‑nexus advanced persistent threat (APT) leveraged CVE‑2026-59310, a critical directory‑traversal flaw in VMware vCenter (CVSS 9.8), to gain arbitrary code execution. In at least one compromised environment, the attackers deployed a backdoor, a reverse SSH binary, and ultimately Babuk‑derived ransomware. Researchers note that the ransomware likely served as a diversion—intended to obscure the true intrusion and impede forensic analysis—rather than being the primary goal. The incident underscores how quickly a freshly disclosed vulnerability can be weaponized when organizations delay patching or rely on default configurations that expose management interfaces to the internet.

macOS Crypto‑Miner via Screen Sharing Flaw
Apple’s emergency update for macOS Tahoe, Sequoia, and Sonoma addressed CVE‑2026-65400 (CVSS 9.8), an authentication bypass in the Screen Sharing service. Despite the patch, threat actors began actively abusing the flaw on systems where port 5900 remained reachable from the internet. In observed cases, attackers gained root privileges and installed a Monero cryptocurrency miner. The Netherlands NCSC‑NL warned that the vulnerability’s rapid exploitation highlights the danger of leaving remote‑desktop services exposed, even when a fix exists, because attackers often strike before administrators can apply updates.

Lazarus Group’s Windows Zero‑Day
The North Korean Lazarus crew was linked to CVE‑2026-68820 (CVSS 7.0), a privilege‑escalation flaw in the Windows Ancillary Function Driver (AFD.sys). Exploiting this zero‑day, Lazarus delivered a novel backdoor dubbed Troy and the previously seen ForestTiger malware, targeting defense and aerospace firms in France, Germany, Brazil, and India as part of its long‑running Operation Dream Job campaign. The attacks began with convincing fake job offers, demonstrating how social engineering combined with a freshly patched vulnerability can yield persistent footholds in high‑value sectors.

GeoServer SQL‑Injection Patch
GeoServer issued urgent patches for versions 3.0.1, 2.28.5, and 2.27.6 to fix a critical SQL‑injection vulnerability that could lead to remote code execution. Although the flaw has not yet received a CVE identifier, watchTowr reported active exploitation within hours of public disclosure, with hundreds of attempts originating from a small set of IPs. The maintainers confirmed the issue was responsibly disclosed and slated for a regular release cycle, underscoring the importance of timely patch management for widely used open‑source GIS platforms.

Amnesia Stealer’s Browser‑Hijack Capability
A new macOS stealer family, Amnesia Stealer, spreads via ClickFix lures and steals data from 16 Chromium‑based browsers, cryptocurrency wallets, Apple Notes, iCloud Keychain, and more. Its standout feature is a streaming module that clones the victim’s Chromium profile, loads it into a headless browser, and establishes a WebSocket channel using the Chrome DevTools Protocol (CDP). This grants attackers live, interactive control of the victim’s authenticated sessions at roughly 3 frames per second, enabling navigation, clicks, and tab management without needing to steal cookies directly. The technique represents a significant evolution from pure data theft to real‑time session hijacking on macOS.

GhostSplice: Bypassing AI Coding Assistant Guardrails
Researchers disclosed GhostSplice, a cross‑channel trust‑fragmentation technique that subverts safety mechanisms in AI coding assistants. By splitting a malicious request across benign‑appearing tool‑channel inputs—such as an MCP tool description, a tool result, and a sampling message—the assistant reassembles the pieces into a harmful instruction because it treats all incoming content as a single undifferentiated block. The attack illustrates how reliance on superficial content checks can fail when attackers exploit the absence of source‑based demarcation in the model’s memory.

Abusing Chrome DevTools Protocol for Data Theft
SpecterOps demonstrated a post‑exploitation method that enables the Chrome DevTools Protocol inside a live Chromium process on Windows, provided the attacker already has code execution. Once CDP is active, operators can bypass cookie‑based protections (e.g., ABE, device‑bound session cookies) and directly access authenticated web applications, harvest saved data, and exfiltrate session material without stealing the cookie database. The finding signals that future credential‑theft strategies may focus on manipulating live browser interfaces rather than persisting credential stores.

Trending CVEs of the Week
The vulnerability landscape remained dense with high‑severity issues actively targeted in the wild. Notable entries include:

• CVE‑2026-68820 (Microsoft Windows AFD.sys privilege escalation) – exploited by Lazarus.
• CVE‑2026-65400 (Apple macOS Screen Sharing authentication bypass) – used for crypto‑mining.
• CVE‑2026-59310 (VMware vCenter directory traversal) – leveraged by a China‑linked APT.
• CVE‑2026-58231 (SAP Commerce Cloud) – widely scanned.
• CVE‑2026-48362, CVE‑2026-71398, CVE‑2026-27302 (Adobe), CVE‑2026-20349 (Cisco Secure Firewall), CVE‑2026-20337‑20348 (ClamAV), CVE‑2026-53413‑53415 (Zoom), CVE‑2026-66147/66145 (SonicWall), CVE‑2026-6726/6727 (TPM 2.0), CVE‑2026-26035, CVE‑2026-70468/70465 (Fortinet), CVE‑2026-65640 (WordPress), CVE‑2026-65321 (PyAthena), CVE‑2026-43637 (Cornac), CVE‑2026-63720 (datamodel‑code‑generator), an unnamed SQL‑injection in GeoServer, and multiple WireShark flaws.
  Prioritizing patches for these CVEs—especially those already seen in exploitation—should be a immediate focus for security teams.

Upcoming Webinars
Two webinars address emerging challenges:

1. “How to Control the Open‑Source Security Debt Created by AI Coding Tools” – explores measuring remediation debt from AI‑generated code, linking it to breach risk, and identifying governance models that curb unvetted open‑source use without hindering development.
2. “AI Can Build Exploits in Minutes. Can Your Security Team Keep Up?” – provides a framework for gaining visibility, context, and rapid response to keep pace with AI‑driven exploit generation and chaining.

Around the Cyber World
A handful of additional stories merit attention:

• FileRun – CVE‑2026-14863 (CVSS 8.7) allows authenticated uploaders to achieve OS command injection via malicious filenames, leading to RCE.
• ClickFix‑Delivered ACR Stealer & GhostPipe – a fake CAPTCHA triggers a PowerShell chain that drops an advanced stealer and a secondary proxy‑based AiTM payload aimed at harvesting Google credentials, even bypassing MFA.
• Citrix NetScaler – a silently patched heap overflow (likely CVE‑2026-8452) can be turned into a persistent PHP web shell granting root‑level command execution.
• Ethereum‑Based Malware Loader – targets Portuguese‑speaking users via EtherHiding, using the BNB Smart Chain testnet to host C2 infrastructure free of gas fees, illustrating attackers’ shift to cost‑less blockchain testnets.
• Exposed Fuel Gauges – BitSight reported a >55% decline in U.S.‑based Automatic Tank Gauge systems exposed online from March to June 2026, suggesting successful remediation or takedown efforts.
• PhantomEnigma Campaign in Brazil – leverages compromised government sites and fake police notices to deliver a modular Node.js backdoor capable of data theft, persistence, and secondary malware deployment.
• FBI Agent Charged – an FBI counterintelligence officer faces allegations of stealing roughly $1 M in cryptocurrency using a seed phrase obtained during an investigation.
• Ukrainian Call‑Center Takedown – authorities dismantled 94 fraudulent call centers, seizing thousands of devices and approximately $2 M in cash, crypto, and valuables tied to bank‑impersonation and investment scams.
• North Carolina Cyber Extortion – Cameron Curry received a 24‑month prison sentence for exploiting his former employer’s access to conduct an extensive extortion scheme against a D.C. tech firm.
• ExfilSquad Data Exposure – analysis indicates the group accessed D365 instances via misconfigured Power Page portals, exporting Dataverse‑style data from at least 13 organizations.
• OpenAI’s Computer History – replaces Chronicle in ChatGPT, storing interaction events (clicks, keystrokes, app switches) rather than screenshots, with privacy cautions about unencrypted history files and prompt‑injection risk.
• LightSpy Expansion – the modular implant now operates in over 13 countries, adding router‑level surveillance that can persist across device resets and OS upgrades, suggesting a commercialized espionage platform.
• Trivy Supply‑Chain Fallout – SOCRadar found 95% of organizations affected by the LiteLLM supply‑chain incident were already exposed through frameworks like DSPy, MLflow, CrewAI, OpenHands, and Arize Phoenix, highlighting the far‑reaching ripple effects of compromised scanners.
• Massive Azure Exfiltration – TheHatman campaign allegedly harvested millions of enterprise records from Azure/Entra portals using compromised credentials, impacting sectors from IT services to hospitality and logistics, with victims including McDonald’s, TCS, Vodafone, and Wyndham Hotels.

Conclusion
The week’s events paint a clear picture: attackers frequently succeed not by inventing wholly new exploits but by exploiting existing gaps—unpatched flaws, exposed services, stale credentials, or overly permissive configurations. Whether it is a ransomware smokescreen hiding a deeper intrusion, a cryptocurrency miner leveraging a macOS Screen Sharing bypass, or a stealer that hijacks live browser sessions via Chrome DevTools, the underlying theme is the abuse of access that defenders assumed was innocuous or already mitigated.

Defenders should therefore prioritize:

• Rapid patching of high‑CVSS vulnerabilities, especially those already seen in exploitation.
• Reducing the attack surface by disabling or restricting unnecessary internet‑facing services (e.g., Screen Sharing, vCenter management ports, GeoServer admin consoles).
• Enforcing least‑privilege access and monitoring for anomalous credential use, as many attacks begin with stolen or misused logins.
• Investing in visibility into post‑exploitation techniques such as CDP abuse, AI‑assisted prompt injection, and supply‑chain compromise vectors.
• Continuing to educate users about phishing and social‑engineering lures (fake CAPTCHAs, job offers) that often precede technical exploitation.

By concentrating on these fundamentals—patching, configuration hardening, credential hygiene, and vigilant monitoring—organizations can blunt the effectiveness of both the “clever” and the “cheap” attacks that continue to dominate the threat landscape.