# Threat Intelligence Snapshot Week 37 2026: FortiGate CVE-2025-25249 Exploitation (PivotC2), StyleSmuggler Magento/Adobe Commerce Zero-Day (CVE-2026-75650), BigBear 2.0 AiTM and Related Campaigns

> QuoIntelligence's week 37 2026 snapshot reports active exploitation of FortiOS CVE-2025-25249 (CAPWAP daemon heap overflow, used to deploy the PivotC2 Node.js RAT) and the StyleSmuggler unauthenticated RCE zero-day (CVE-2026-75650) against Magento and Adobe Commerce. It also covers the BigBear 2.0 Evilginx2 AiTM PhaaS against Microsoft 365, PREY-0058 help-desk vishing, the Shai-Hulud npm worm payload resurfacing, rogue ScreenConnect clients spreading a four-stage VBScript chain, and a phishing campaign using invisible Unicode tag characters.

- **Published:** 2026-11-01T06:36:48Z
- **Last reviewed:** 2026-11-01T06:36:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4969
- **ID:** TL-2026-4969
- **Severity:** HIGH (CVSS 7.4)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UNC6671
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-25249, CVE-2026-75650, CVE-2026-84869

## Description

The QuoIntelligence snapshot (coverage 3-9 September 2026, published 10 September 2026) is a weekly roundup; the public page is a headline summary and the full detail is behind a newsletter subscription. This record therefore combines the snapshot with the primary and secondary sources for each item it names.

FortiGate / CVE-2025-25249: a heap-based buffer overflow in the CAPWAP Wireless Aggregate Controller Daemon (cw_acd) of FortiOS and FortiSwitchManager lets a remote unauthenticated attacker execute arbitrary code or commands through crafted requests. Fortinet disclosed and patched it on 2026-01-13 (FG-IR-25-084). SecurityWeek and SOCRadar report exploitation since at least July 2026 to deploy PivotC2, a Node.js post-exploitation RAT for FortiGate offering an interactive shell, traffic tunneling, network scanning and configuration harvesting. Reported scale is over 30,000 targeted IP addresses and 178 confirmed infected devices, mainly US entities, with at least two data-exfiltration incidents. The suspected operator is a Russian-speaking cybercrime group and the malware may be AI-assisted. CISA added the CVE to KEV on 2026-09-09 (federal remediation deadline of 3 days under BOD 26-04 per SecurityWeek). Sources disagree on CVSS (7.4 per SecurityWeek, 9.8 per aggregators); no public IOCs were published for PivotC2.

StyleSmuggler / CVE-2026-75650: an unauthenticated RCE in Magento Open Source and Adobe Commerce (2.4.4-2.4.9 supported lines; B2B 1.3.3-1.5.3; unsupported 2.2, 2.3 and 2.4.0-2.4.3 also vulnerable), CVSS 10.0 per Sansec. PHP is injected into Magento's template system through 'styles' properties, via a generated failure report and execution through a failed-payment email or direct GraphQL requests reaching poisoned files in var/report or var/log. Sansec saw exploitation from 2026-09-04. A Rust backdoor masquerades as [kworker/u:8:0] (first variant), fc-cache (second variant, 2026-09-06) or chronyd and disguises its C2 traffic as NTP replies over UDP 123. The fc-cache variant copies itself to ~/.cache/fontconfig/fc-cache, installs a cron entry (13,43 * * * *) and writes a /tmp/.fc_<8hex>.lock PID file. Secondary tooling includes gs-netcat and WraithC2. Adobe released APSB26-146 with hotfix VULN-39341 on 2026-09-07.

BigBear 2.0 is an Evilginx2-based PhaaS ('General Boss') against Microsoft 365 using the 'offy' phishlet, with JavaScript injections that disable FIDO2/WebAuthn, block Microsoft anti-phishing telemetry and force Keep-Me-Signed-In. CloudSEK counted 5,137 records (4,148 session cookies, 1,032 plaintext passwords) across 461 organizations in 40+ countries, 42 Vultr VPS nodes, and Telegram bot exfiltration. PREY-0058 (Arctic Wolf; overlaps UNC6671) calls executives while impersonating IT help desk, directs them to passkey/MFA-themed AiTM domains, then replays stolen tokens from residential proxies (NodeMaven in all cases) to take data from Exchange Online, SharePoint and OneDrive for extortion.

The remaining items: Shai-Hulud npm worm payload resurfaced on 2026-09-07 in four packages, slipping past npm publish-time scanning; Huntress-reported rogue ScreenConnect clients (August 2026) run a worm-like 1.vbs-4.vbs chain on newly connected hosts, with payloads including a ScreenConnect backdoor, UAC-bypass tooling, tunneling utilities and XMRig (ConnectWise fixed CVE-2026-84869 in client 26.6.5); and a Microsoft-reported finance-themed phishing campaign inserting invisible Unicode Tags-block characters into keywords to defeat keyword filters (peak about 2.37 million messages per day, 148 sender domains). The QuoIntelligence snapshot itself gives no attribution, CVSS or IOCs; all values here come from the cited secondary sources and are not independently verified.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.002 Spearphishing Link
- T1566.004 Spearphishing Voice
- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1053.003 Cron
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1213.002 Sharepoint
- T1114.002 Remote Email Collection
- T1095 Non-Application Layer Protocol
- T1219 Remote Access Tools
- T1090 Proxy
- T1583.003 Virtual Private Server
- T1583.001 Domains
- T1496.001 Compute Hijacking

## Sources

- [QuoIntelligence - Threat Intelligence Snapshot: Week 37, 2026](https://quointelligence.eu/2026/09/threat-intelligence-snapshot-week-37-2026/)
- [SecurityWeek - Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks](https://www.securityweek.com/fortinet-code-execution-flaw-exploited-in-pivotc2-rat-attacks/)
- [SOCRadar - CVE-2025-25249 PivotC2 FortiGate RAT](https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/)
- [Arctic Wolf - CVE-2025-25249 Security Bulletin (Fortinet FG-IR-25-084)](https://arcticwolf.com/resources/blog/cve-2025-25249)
- [Sansec - StyleSmuggler: Magento/Adobe Commerce 0-day (CVE-2026-75650)](https://sansec.io/research/stylesmuggler-0day)
- [SecurityWeek - Adobe Commerce Zero-Day Exploited to Backdoor Online Stores](https://www.securityweek.com/adobe-commerce-zero-day-exploited-to-backdoor-online-stores/)
- [CloudSEK - Tracking BigBear 2.0 Evilginx2 Phishing Campaign](https://www.cloudsek.com/blog/tracking-bigbear-2-0-evilginx2-phishing-campaign)
- [Arctic Wolf - Active Cloud Data Theft and Extortion Campaign Targeting Microsoft 365 and SaaS (PREY-0058)](https://arcticwolf.com/resources/blog/security-bulletin-active-cloud-data-theft-and-extortion-campaign-targeting-microsoft-365-and-saas-platforms/)
- [Help Net Security - IT help-desk vishing tricks executives into handing over Microsoft 365 access](https://www.helpnetsecurity.com/2026/09/08/vishing-microsoft-365-data-theft-extortion/)
- [The Hacker News - Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain (Huntress)](https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html)
- [SC Media - Shai-Hulud npm worm resurfaces, bypassing security scans](https://www.scworld.com/brief/shai-hulud-npm-worm-resurfaces-bypassing-security-scans)
- [BleepingComputer - Attackers conceal phishing lures using invisible Unicode characters](https://bleepingcomputer.com/news/security/attackers-conceal-phishing-lures-using-invisible-unicode-characters)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4969