View Ridge Security
Back to Cyber Hose

Operation Jackal IV arrests 58 suspects in global cybercrime crackdown

Operation Jackal IV led to 58 arrests targeting West African cybercrime networks across 22 countries.

🕵️ RESEARCH & DEEP DIVES

  • Operation Jackal IV arrests 58 suspects in global cybercrime crackdown
    Operation Jackal IV led to 58 arrests linked to West African cybercrime networks.

    • West African cybercrime networks and the Black Axe syndicate were targeted across 22 countries.
    • Authorities identified 263 suspects and arrested 58 people between November 2025 and June 2026.
    • Criminal groups ran romance, cryptocurrency, investment, and business email compromise scams.
    • Networks used call centers, dark-web Crime-as-a-Service providers, shell companies, remittance services, and cash withdrawals.
    Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

  • Unit 42 Finds Most AI-Enabled Malware Samples Are Not Operational
    Unit 42 found that most AI-enabled malware samples have not reached production environments.

    • Unit 42 analyzed 405 AI-enabled malware samples from research and threat-intelligence sources.
    • Only 12 samples appeared on Cortex XDR-protected endpoints across organizations in three countries.
    • The observed malware included FunkSec ransomware, Oyster, Rhadamanthys, a trojanized AI application and a COM-hijacking DLL.
    • Seven FunkSec variants used Rust code and disabled Windows Defender through PowerShell and registry changes.
    • AI primarily changed how malware was authored or branded, while conventional execution behavior remained detectable.
    Sources 📄 Source: thehackernews.com · 📎 Coverage: unit42.paloaltonetworks.com · 👁 via Palo Alto Unit 42

  • Fake Codex ads trick Mac developers into running AMOS-like malware
    Cato Networks found a fake Codex campaign delivering macOS infostealer malware.

    • Mac developers searching for OpenAI Codex downloads are targeted.
    • Fake Codex pages deliver an AMOS-like infostealer in universal Mach-O binaries for Intel and Apple Silicon Macs.
    • Sponsored Google ads lead to Google Sites pages that embed attacker-controlled iframe content.
    • ClickFix instructions trick users into pasting a command that decodes a URL, pipes a shell script into zsh, and launches /tmp/helper.
    • Observed indicators include sites[.]google[.]com/view/codex-desktop-app/, bright-links[.]com, trekmesh15[.]com, and grove-12[.]com.
    Sources 📄 Source: catonetworks.com · 📎 Coverage: siliconangle.com · 👁 via Cyber Security News

  • EvilTokens Hijacks Microsoft 365 Sessions for AI-Assisted Fraud
    EvilTokens hijacks Microsoft 365 sessions to enable targeted financial fraud.

    • Microsoft 365 organizations were targeted across 344 organizations in five countries.
    • The platform steals valid Microsoft 365 access and refresh tokens without capturing passwords.
    • Attackers use OAuth 2.0 device-code phishing through Microsoft’s legitimate login portal and MFA flow.
    • AI-assisted mailbox analysis identifies invoices, suppliers, payment approvers, and fraud opportunities.
    • EvilTokens generates targeted business email compromise messages from compromised mailbox data.
    Sources 📄 Source: flare.io · 📎 Coverage: gbhackers.com · 👁 via Cyber Security News, cryptika.com (discovered)

  • Malicious Rust Crates Delivered Build-Time Malware Across Developer Environments
    A compromised Rust maintainer account published three crates that executed malware during builds.

    • Rust developers using arrayref, internment, or append-only-vec were affected.
    • Malicious releases were arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9.
    • The releases added the typosquatted proc-macro1 dependency, whose build script downloaded and executed a payload.
    • The malware ran during cargo build, cargo check, or cargo test across Windows, macOS, and Linux.
    • The implant used 23.254.165.112:9089 for payload delivery and 23.254.165.112:443 for C2, and could steal browser credentials.
    Sources 📄 Source: rustsec.org · 📎 Coverage: thehackernews.com · 👁 via securityboulevard.com (discovered)

  • How to Generate and Verify SLSA Build Provenance for Artifacts
    Clear Path Security explains how SLSA provenance links software artifacts to their build origins.

    • UK SMEs shipping software are the primary audience.
    • Software artifacts are tracked to their source, builder, and build inputs.
    • SLSA provenance provides machine-readable evidence about how an artifact was built.
    • Consumers verify the provenance to confirm an artifact’s origin and build history.
    Sources 📄 Source: slsa.dev · 📎 Coverage: clearpathsecurity.co.uk · 👁 via securityboulevard.com (discovered)

🔓 CVEs & KEV

  • CVE-2026-66897 — CVSS 9.9 — Instance template path traversal allows arbitrary host file write as rootA pa...

  • CVE-2026-77136 — CVSS 9.5 — Server-Side Template Injection in extension "powermail" (powermail)The extens...

  • CVE-2026-77138 — CVSS 9.3 — Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5v...

  • CVE-2026-77141 — CVSS 8.8 — Broken Access Control in extension "Club Directory" (clubdirectory)The extens...

  • CVE-2026-77140 — CVSS 8.7 — Broken Access Control in extension "Telephone Directory" (telephonedirectory)...

  • CVE-2026-12878 — CVSS 8.6 — In affected versions of the Codefresh platform an authenticated user can util...

  • CVE-2026-77134 — CVSS 8.3 — Broken Access Control in extension "femanager" (femanager)The extension fails...

  • CVE-2026-77135 — CVSS 8.2 — Information Disclosure in extension "femanager" (femanager)The extension's us...

  • CVE-2026-56095 — CVSS 7.7 — Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Sea...

  • CVE-2026-77129 — CVSS 7.7 — Server-Side Template Injection in extension "Event management and registratio...

  • CVE-2026-77137 — CVSS 7.7 — SQL Injection in extension "Forms Export" (frp_form_answers)The extension fai...

  • CVE-2026-56092 — CVSS 7.6 — Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search...

  • CVE-2026-56093 — CVSS 6.3 — Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search...

  • CVE-2026-56094 — CVSS 6.3 — Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Searc...

  • CVE-2026-56096 — CVSS 6.3 — Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Searc...

  • CVE-2026-77128 — CVSS 6.3 — Broken Access Control in extension "Event management and registration" (sf_ev...

  • CVE-2026-77133 — CVSS 6.0 — Broken Access Control in extension "femanager" (femanager)The extension fails...

📋 ADVISORIES

  • 📄 Source for Attackers Target miniOrange SAML Flaws to Access WordPress Admin Accounts — patchstack.com

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check