Summary & highlights
Infostealers Weekly Report 2026-10-26 to 2026-11-02: Generic Stealer, Warden Stealer, Acreed, Remus, Vidar. Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data. Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys.
Highlights
- TL-2026-5030 — Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets
- TL-2026-5032 — ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data Theft
- TL-2026-5039 — CyberStrikeAI: AI-orchestrated pentest/C2 framework used in real-world attacks on educational institutions in Africa and Latin America
- TL-2026-5042 — ChatGPT Web Frontend Cross-Frame Flaw (MathLive postMessage + srcdoc iframe + YouTube oEmbed JSONP CSP Bypass) Enables Account Hijack and Private Conversation Theft via Single Shared Link
- TL-2026-5044 — C3RB3R (Cerber-variant) Ransomware Campaign Against Internet-Exposed Synology NAS Devices (Unpatched / End-of-Life DSM; Disputed Entry Vector: CVE-2024-10441 vs CVE-2026-13639 / CVE-2026-13684)
Theme of the day
- remote-code-execution
- infostealer
- windows
- no-cve
- linux
Threats published
41 threat lines in the 2026-11-02 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.
- Critical Langflow Flaws (CVE-2026-93680, CVE-2026-110186) Allow Unauthenticated Attackers to Run Code on ServersCRITICAL
- BTCPay Server hot wallet thefts via unauthorized administrator access on outdated instances (v2.4.1 and earlier)CRITICAL
- Balancer V2 ComposableStablePool Rounding/Invariant Manipulation Exploit (Nov 2025)CRITICAL
- CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (CWE-94)CRITICAL
- NCSC CTO Weekly Summary (week ending 2026-09-13): actively exploited Cisco FMC (CVE-2026-20079/20316), PaperCut NG/MF (CVE-2026-81578/82078), MikroTik RouterOS and FortiGate (CVE-2025-25249) flaws; NetScaler SAML bypass (CVE-2026-19490); BlueMoon exploit kitCRITICAL
- CVE-2026-58115: Max-severity Node-RED unauthenticated flow-deployment flaw (Siemens SIMATIC IoT2050) exploited to deliver Linux malwareCRITICAL
- Ivanti Connect Secure Authentication Bypass by Spoofing Zero-Day (CVE-2026-104935) Exploited in the Wild (update)CRITICAL
- Node.js October 2026 Security Releases Fix 10 Vulnerabilities Including Brotli Decoder RCE and TLS Hostname Verification Bypasses (CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-105482) (update)CRITICAL
- Binance security incident: compromised DevOps engineer laptop leads to service container access and ~$6.3 billion in unauthorized withdrawals (update)CRITICAL
- CVE-2026-112816: CVSS 10.0 LXD and MicroCloud TLS Client Authentication Bypass (Impersonation Without Private Key) (update)CRITICAL
- Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD SecretsHIGH
- ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data TheftHIGH
- CyberStrikeAI: AI-orchestrated pentest/C2 framework used in real-world attacks on educational institutions in Africa and Latin AmericaHIGH
- ChatGPT Web Frontend Cross-Frame Flaw (MathLive postMessage + srcdoc iframe + YouTube oEmbed JSONP CSP Bypass) Enables Account Hijack and Private Conversation Theft via Single Shared LinkHIGH
- C3RB3R (Cerber-variant) Ransomware Campaign Against Internet-Exposed Synology NAS Devices (Unpatched / End-of-Life DSM; Disputed Entry Vector: CVE-2024-10441 vs CVE-2026-13639 / CVE-2026-13684)HIGH
- Public PoC for Windows Ancillary Function Driver for WinSock (afd.sys) Privilege Escalation - CVE-2023-21768HIGH
- XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by GoogleHIGH
- Bitter (TA397) Deploys PapRAT (C++ and Rust) via LNK, MSI/VHDX and RAR Chains Against South Asian OrganizationsHIGH
- DarkBlinders (CL-STA-1178 / REF8685, Iran state-aligned) Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment via ShelbyLoader V2, Blackwood and GitHub C2HIGH
- The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS, CVE-2026-40217)HIGH
- VOLTA-AUTODOXER: AI-Powered Windows Infostealer Ranks Stolen Data by Monetization ValueHIGH
- BYOD ransomware gang claims Michigan State University breach (1.3M current and former students)HIGH
- PixelSmash – FFmpeg MagicYUV Decoder Heap Out-of-Bounds Write (CVE-2026-8461)HIGH
- Bad Sushi: China-nexus phishing operations shift to residential proxy networks (Japan/Taiwan targeting)HIGH
- Infostealers Weekly Report 2026-10-26 to 2026-11-02: Generic Stealer, Warden Stealer, Acreed, Remus, VidarMEDIUM
- Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account DataMEDIUM
- Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API KeysMEDIUM
- ChatGPT Plus Billing Phishing Kit Uses Rotating WordPress Sites to Steal Payment Details and OTPsMEDIUM
- Structural Patch Gap from AI-Driven Vulnerability Discovery (Project Glasswing) - SOC ImplicationsMEDIUM
- iPhone BootROM Flaws (checkm8 CVE-2019-8900, usbliter8) Could Be Used to Undermine Cryptocurrency Wallet SecurityMEDIUM
- Ransomware Targeting of Small and Medium-Sized Businesses: Credential Theft, Unpatched Edge Devices, BYOVD and Backup TargetingMEDIUM
- ScarfaceStealer: Sandbox-Aware Anti-Analysis and Blockchain-Based C2 Configuration (Electron/NSIS Loader)MEDIUM
- NCSC Warning: AI-Powered Malware Highly Likely to Be Used in Ransomware Attack on UK Critical National Infrastructure by 2028MEDIUM
- Spamhaus Botnet Threat Update January–June 2026: Sliver Overtakes Cobalt Strike as Leading C&C FamilyMEDIUM
- Spamhaus Botnet Spotlight: Pressure Rises on Botnets (Threat Update July-December 2025) - VenomRAT, Latrodectus, CrazyRDP TakedownMEDIUM
- Spamhaus Botnet Threat Update July to December 2025: C&C Activity Up 24%, RATs 42% of Top 20 Botnet MalwareMEDIUM
- Spamhaus Botnet Threat Update January to June 2025: 26% Rise in Botnet C&C ActivityMEDIUM
- FreeBSoD: LLM-Assisted FreeBSD Kernel Exploit Development Yields Two Jail Escape Chains (CVE-2026-3038)MEDIUM
- SolarMarker: Actions-On-Target — On-Device Fraud via Custom VNC (Saturn) and Browser Data TheftMEDIUM
- Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other MalwareMEDIUM
- Microsoft Security Research: What Exploited Vulnerabilities Have in Common - Data-Driven Analysis of Real-World AttacksLOW
Techniques observed
210 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.
- T1003.001
- T1003.002
- T1003.006
- T1005
- T1008
- T1016
- T1016.002
- T1018
- T1020
- T1021
- T1021.002
- T1021.005
- T1021.006
- T1027
- T1027.010
- T1033
- T1036
- T1036.003
- T1036.005
- T1040
- T1041
- T1046
- T1047
- T1048.003
- T1053.003
- T1053.005
- T1055
- T1055.009
- T1056
- T1056.001
- T1057
- T1059
- T1059.001
- T1059.003
- T1059.004
- T1059.006
- T1059.007
- T1068
- T1070
- T1070.002
- T1070.004
- T1070.006
- T1071
- T1071.001
- T1074.001
- T1078
- T1078.004
- T1082
- T1083
- T1087
- T1087.002
- T1087.004
- T1090
- T1090.002
- T1098
- T1098.001
- T1098.003
- T1098.004
- T1102
- T1105
- T1106
- T1110.003
- T1111
- T1113
- T1114
- T1114.002
- T1119
- T1127
- T1132.001
- T1133
- T1134.001
- T1135
- T1136
- T1136.001
- T1136.003
- T1140
- T1176
- T1189
- T1190
- T1195
- T1195.001
- T1195.002
- T1195.003
- T1199
- T1202
- T1203
- T1204.001
- T1204.002
- T1204.004
- T1210
- T1211
- T1212
- T1213
- T1213.003
- T1218.007
- T1218.011
- T1219
- T1398
- T1404
- T1406
- T1407
- T1414
- T1418
- T1422
- T1426
- T1437.001
- T1486
- T1490
- T1491.001
- T1496.002
- T1496.004
- T1497
- T1497.001
- T1497.003
- T1499.004
- T1505
- T1505.003
- T1513
- T1516
- T1518
- T1518.001
- T1521
- T1526
- T1528
- T1539
- T1542
- T1544
- T1547.001
- T1550
- T1550.001
- T1550.002
- T1550.003
- T1550.004
- T1552
- T1552.001
- T1552.004
- T1553
- T1553.002
- T1555
- T1555.003
- T1556
- T1557
- T1558.001
- T1558.003
- T1560
- T1562
- T1564.001
- T1565.001
- T1566
- T1566.001
- T1566.002
- T1566.003
- T1567
- T1568
- T1571
- T1572
- T1573
- T1573.001
- T1573.002
- T1574.001
- T1574.006
- T1574.014
- T1575
- T1578.002
- T1580
- T1583
- T1583.001
- T1583.003
- T1583.004
- T1583.006
- T1584.005
- T1585
- T1585.001
- T1587
- T1587.001
- T1587.004
- T1588.002
- T1588.003
- T1588.005
- T1588.006
- T1588.007
- T1591
- T1595
- T1595.002
- T1595.003
- T1596.003
- T1598.003
- T1604
- T1608.001
- T1608.005
- T1608.006
- T1609
- T1610
- T1611
- T1620
- T1623.001
- T1624.001
- T1626
- T1629.003
- T1633.001
- T1643
- T1646
- T1649
- T1655.001
- T1656
- T1657
- T1665
- T1684.001
- T1685
- T1685.002
Threat actors
10 named threat actors across the reports.
- SolarMarker operators
- UNC7228
- Videostrong Technology Co.
- HAZY TIGER
- DarkBlinders
- UNC6993
- BYOD
- APT31
- UTA0576
- TraderTraitor
Nation-state attribution
- China
- IN
- Iran
- North Korea
Threat categories
- MALWARE
- DATA_BREACH
- THREAT_INTEL
- PHISHING
- VULNERABILITY
- RANSOMWARE
- SUPPLY_CHAIN
- APT
- CLOUD
- ICS_SCADA
Severity breakdown
- critical10
- high14
- medium16
- low1
Indicator & detection coverage
Counts only: the indicator values and detection rule text behind them unlock with TL Creds.
866 indicators of compromise · unlock with TL Creds. Compare plans
- network 241
- file 184
- entity 102
- behavioral 97
- infrastructure 73
- tool 63
- malware 57
- package 48
- vulnerability 1
369 new detection rules (100% of the day’s threats covered) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)