Summary & highlights
Chrome Extension Search-Hijacking Campaign ("Searchjacked"): 319 Extensions, 13.4M Installs, Queries Proxied via Operator Servers to Bing/Yahoo. Prediction Markets Emerge as a New Vertical for Traffer Teams (AtlasCore, PolyFucked, Magnetic Team). State of Ad Fraud 2026: AI-Assisted Schemes, Malicious iOS Scripts and Messenger Phishing Displace Cloaking.
Highlights
- TL-2026-4702 — Fake Phantom, Jupiter, and Bitget Firefox Extensions Target Cryptocurrency Wallets (bonto.io C2)
- TL-2026-4705 — ESET APT Activity Report Q2 2026–Q3 2026: China-, Iran-, North Korea-, Russia- and Belarus-aligned APT campaigns
- TL-2026-4707 — WordPress 7.1.4 Security Release Patches 22 Vulnerabilities Including Core-Update Race Condition RCE and Multiple Stored XSS
- TL-2026-4713 — Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 (macOS CoreAudio coreaudiod type confusion, PoC public)
- TL-2026-4714 — MadApe: Previously Undocumented Microsoft Device Code Phishing Kit Using Business-Themed PDF Lures and Fake Document-Sharing Pages
Theme of the day
AI-driven attacks surged as Yoba malware abused signed AI binaries for cryptomining and Anthropic models chained zero-days across platforms, while supply-chain and IoT botnet campaigns dominated severe threats.
- windows
- espionage
- linux
- cisa-kev
- credential-theft
Threats published
49 threat lines in the 2026-10-29 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.
- Wing FTP Server Path Traversal (CWE-22) in User Base Folder Handling - CVE-2026-105420CRITICAL
- Cybersecurity Black Week: LiteLLM 1.107.0 PyPI/Docker supply-chain compromise, PHP2Shell (CVE-2026-109618/109619), Node2Shell (CVE-2026-111497), GitLab CVE-2026-110264, KSMBD flaws and eMudhra emSign intermediate CA key compromiseCRITICAL
- Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127) Exploited by UAT-8616 and Tied to Volt Typhoon's 'Silent Train' Network; UAT-11473 KeyDrift/PolyFlame/LittleFilch ToolsetCRITICAL
- Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities (Campaign Classic APSB26-162, Connect APSB26-182, Veeam B365 8.6 / B&R 13.1.2, Juniper Session Smart Router JSA112183)CRITICAL
- CVE-2026-98432 - Linux Kernel IPv4 TCP SYN Race Condition / Use-After-Free (inet_opt / ireq_opt) Enabling Remote Kernel Memory Corruption and Reported Root Command ExecutionCRITICAL
- Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell (CVE-2026-109618/109619) chained with Fragnesia (CVE-2026-46300) to root firewallsCRITICAL
- ThreatsDay Bulletin: Fortinet Critical Firewall Updates (Details Embargoed), Gotenberg RCE CVE-2026-42589 Under Active Exploitation, PHP2Shell ScanningCRITICAL
- BlueMoon Exploit Kit Chains Chrome V8 Flaws CVE-2026-85046 and CVE-2026-87491 with Windows Kernel LPE CVE-2026-85880 (update)CRITICAL
- CVE-2026-97229: Critical GitLab Unauthenticated RCE via CI/CD Regex Compiler Integer Overflow (update)CRITICAL
- PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After Emergency PHP2Shell Patches (CVE-2026-109618/CVE-2026-109619) (update)CRITICAL
- Volt Typhoon 'Silent Train' Relay Framework Used to Conceal Zero-Day Exploitation (CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876, CVE-2024-39717) (update)CRITICAL
- CISA adds two KEVs: Broadcom VMware ESX CVE-2026-41709 (Insufficient Logging) and Linux Kernel CVE-2026-46300 (Fragnesia ESP-in-TCP page-cache LPE) (update)CRITICAL
- Fake Phantom, Jupiter, and Bitget Firefox Extensions Target Cryptocurrency Wallets (bonto.io C2)HIGH
- ESET APT Activity Report Q2 2026–Q3 2026: China-, Iran-, North Korea-, Russia- and Belarus-aligned APT campaignsHIGH
- WordPress 7.1.4 Security Release Patches 22 Vulnerabilities Including Core-Update Race Condition RCE and Multiple Stored XSSHIGH
- Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 (macOS CoreAudio coreaudiod type confusion, PoC public)HIGH
- MadApe: Previously Undocumented Microsoft Device Code Phishing Kit Using Business-Themed PDF Lures and Fake Document-Sharing PagesHIGH
- NetamLoader: Unknown APT Targets Government-Customized Windows 10 OS in Asia via Patch My PC-Themed XAML/.NET LoaderHIGH
- ARTEX China-developed agentic AI penetration-testing tool used in attacks on Japanese companies (and South Korean financial institutions)HIGH
- NIK C2: AI-enabled Go-based command-and-control framework with OpenAI API abuse, infostealer, HVNC and lock-screen ransomware modules (Cisco Talos)HIGH
- INJ3CTOR3 Campaign Targets FreePBX Servers with JOMANGY/ZenharR Webshells to Steal SIP Credentials for Phone FraudHIGH
- GitHub Issues/PR Comment Injection Supply-Chain Campaign Targeting 61 Public Repositories via Vulnerable WorkflowsHIGH
- China-nexus WARP PANDA exploits VMware ESXi insufficient-logging flaw (CVE-2026-41709) against law firmsHIGH
- GoldFactory Vwork: Weaponized Shelter Fork Enables App Cloning Alongside Gigabud Android Banking TrojanHIGH
- North Korean Threat Actors Operationalize AI Across Tradecraft (Jade/Coral/Jasper/Diamond/Onyx/Pearl/Sapphire/Emerald Sleet; ProcmacSteal)HIGH
- Polymarket Third-Party Script Compromise: Wallet-Draining Code Served via DebugBear RUM ScriptHIGH
- Clipbanker malware AnimateClipper (ZigClipper) and Efimer redirect crypto payments by swapping clipboard wallet addressesHIGH
- DefenderKiller: Open-Source PoC Abuses Legacy Microsoft Driver (KSLDriver.sys) to Terminate Endpoint Security ProcessesHIGH
- Amadey MaaS Backend Breached by Australian Signals Directorate; 180,000 Infected Computers Cut Off from Operator C2HIGH
- Hugging Face 'Load/Mine' Campaign: Malicious Qwen2 Model Repos Abuse trust_remote_code to Hijack GPUs for Pearl (PRL) Mining and Backdoor Xinference/GPUStack HostsHIGH
- VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global Espionage Campaign (BLOODALCHEMY)HIGH
- SonicWall SonicOS Management Interface Scanning Spike (May 2026) Echoing Pre-Disclosure Pattern of CVE-2026-0400HIGH
- Zimbra Collaboration stored XSS vulnerabilities CVE-2026-66911 and CVE-2026-66912 (fixed in 10.1.21)HIGH
- Szafir software vulnerabilities: XXE (CVE-2026-93570), path traversal (CVE-2026-93571), improper certificate validation (CVE-2026-106036)HIGH
- Prometei Botnet Linux Binary (Linux/Prometei.B) - Modular Monero Miner and Credential-Stealing Botnet, r2 + AI Reverse Engineering AnalysisHIGH
- Claude Mythos / Project Glasswing: Autonomous AI Vulnerability Discovery Compresses the Find-to-Exploit Timeline (CVE-2026-4747 and the AI-Scale Disclosure Problem) (update)HIGH
- Chrome Extension Search-Hijacking Campaign ("Searchjacked"): 319 Extensions, 13.4M Installs, Queries Proxied via Operator Servers to Bing/YahooMEDIUM
- Prediction Markets Emerge as a New Vertical for Traffer Teams (AtlasCore, PolyFucked, Magnetic Team)MEDIUM
- State of Ad Fraud 2026: AI-Assisted Schemes, Malicious iOS Scripts and Messenger Phishing Displace CloakingMEDIUM
- US Election Security: Voting Machine Patch Gaps and AI-Enabled Influence CampaignsMEDIUM
- Anthropic-Themed Phishing Campaign (Fake Private Preview Invites via GoTo Webinar) Steals Google and Microsoft Credentials and Bypasses Email Security GatewaysMEDIUM
- GreyNoise: Attack Surges Against Network Infrastructure Vendors Precede CVE Disclosure by a Median of 11 Days (Cisco CVE-2026-20127, Fortinet CVE-2026-24858, SonicWall CVE-2026-0400)MEDIUM
- Residential Proxy SDKs Embedded in Everyday Apps Expose Users and Enterprises (IPIDEA, Bright Data partners)MEDIUM
- Nanocore RAT delivered via math-obfuscated VBScript loader (CyberChef deobfuscation walkthrough)MEDIUM
- Obfuscated HTA Cobalt Strike Downloader Script (Double URL-encoded/Base64 layers, URLDownloadToFile, VBScript second stage)MEDIUM
- W32/SkyAI (Topozuy/Skynet) Windows malware embeds AI prompt injection to evade AI-assisted malware analysisMEDIUM
- Microsoft Entra ID Retires Microsoft-Provided SMS and Voice MFA (From Feb 2027): Passkeys Become Default, Admins Urged to MigrateLOW
- Cisco Open-Sources Quarry to Detect AI Agent Attacks Hidden in Individually Benign Steps (GTG-1002 and Mexican Government Claude Code Abuse Context)LOW
Techniques observed
238 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.
- AML.T0010.003
- AML.T0051
- AML.T0054
- T1003
- T1003.001
- T1003.003
- T1003.008
- T1005
- T1008
- T1012
- T1016
- T1021
- T1021.001
- T1021.004
- T1021.005
- T1027
- T1027.002
- T1027.004
- T1027.009
- T1027.010
- T1027.013
- T1033
- T1036
- T1036.004
- T1036.005
- T1037
- T1037.004
- T1040
- T1041
- T1046
- T1048
- T1053.003
- T1053.005
- T1055
- T1055.008
- T1055.012
- T1056
- T1056.001
- T1056.003
- T1057
- T1059
- T1059.001
- T1059.003
- T1059.004
- T1059.005
- T1059.006
- T1059.007
- T1068
- T1069.002
- T1070
- T1070.002
- T1070.003
- T1070.004
- T1070.006
- T1071
- T1071.001
- T1074.001
- T1078
- T1078.004
- T1082
- T1087
- T1087.002
- T1087.004
- T1090
- T1090.001
- T1090.002
- T1090.003
- T1098
- T1098.004
- T1098.005
- T1102
- T1102.001
- T1105
- T1106
- T1110
- T1110.003
- T1110.004
- T1111
- T1112
- T1113
- T1114
- T1114.002
- T1123
- T1125
- T1132.001
- T1133
- T1134.001
- T1136
- T1136.001
- T1136.002
- T1140
- T1176.001
- T1185
- T1189
- T1190
- T1195
- T1195.001
- T1195.002
- T1199
- T1203
- T1204
- T1204.001
- T1204.002
- T1204.004
- T1210
- T1211
- T1212
- T1213
- T1213.002
- T1213.003
- T1218.005
- T1219
- T1222.002
- T1406.002
- T1417.002
- T1418
- T1437.001
- T1451
- T1453
- T1480
- T1480.001
- T1484.001
- T1485
- T1496.001
- T1496.002
- T1497
- T1497.001
- T1497.003
- T1498
- T1499.002
- T1499.004
- T1505.003
- T1513
- T1516
- T1518
- T1518.001
- T1521.001
- T1526
- T1528
- T1530
- T1539
- T1543
- T1543.002
- T1543.003
- T1544
- T1546.004
- T1546.015
- T1546.018
- T1547.001
- T1548.001
- T1548.002
- T1550.001
- T1552
- T1552.001
- T1552.004
- T1552.005
- T1553.002
- T1555
- T1555.003
- T1556.003
- T1557
- T1557.001
- T1559
- T1559.001
- T1560.001
- T1562
- T1562.001
- T1562.012
- T1563.002
- T1564.001
- T1564.006
- T1565.001
- T1565.002
- T1566
- T1566.001
- T1566.002
- T1566.003
- T1567.002
- T1568.002
- T1569.002
- T1570
- T1571
- T1572
- T1573.001
- T1573.002
- T1574.001
- T1574.002
- T1574.006
- T1574.014
- T1583
- T1583.001
- T1583.003
- T1583.006
- T1583.008
- T1584.001
- T1584.004
- T1584.008
- T1585
- T1585.001
- T1585.002
- T1586
- T1587.004
- T1588.002
- T1588.005
- T1588.006
- T1588.007
- T1589
- T1589.001
- T1591
- T1592
- T1592.002
- T1593
- T1595
- T1595.001
- T1595.002
- T1596.005
- T1598
- T1598.003
- T1601.002
- T1602.002
- T1606.002
- T1608.001
- T1608.005
- T1611
- T1620
- T1622
- T1628.001
- T1651
- T1655.001
- T1656
- T1657
- T1660
- T1665
- T1684.001
- T1685
- T1685.005
- T1685.006
- T1686
Threat actors
11 named threat actors across the reports.
- AtlasCore
- IPIDEA proxy network operators
- GTG-1002
- INJ3CTOR3
- WARP PANDA
- GoldFactory
- Jade Sleet
- VAPOR PANDA
- Volt Typhoon - G1017
- APT31
- UAT-11473
Nation-state attribution
- Russia / Iran
- China
- China, Iran, North Korea, Russia, Belarus
- CN
- North Korea
Threat categories
- MALWARE
- PHISHING
- THREAT_INTEL
- APT
- VULNERABILITY
- SUPPLY_CHAIN
Severity breakdown
- critical13
- high24
- medium10
- low2
Indicator & detection coverage
Counts only: the indicator values and detection rule text behind them unlock with TL Creds.
1236 indicators of compromise · unlock with TL Creds. Compare plans
- network 378
- file 338
- behavioral 171
- entity 101
- malware 71
- infrastructure 69
- tool 64
- package 42
- technique 2
441 new detection rules (100% of the day’s threats covered) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)