View Ridge Security
Back to Cyber HoseThreat Research & Deep Dives

Operation Jackal IV arrests 58 suspects in global cybercrime crackdown

🕵️ RESEARCH & DEEP DIVES

  • Operation Jackal IV arrests 58 suspects in global cybercrime crackdown
    Operation Jackal IV led to 58 arrests linked to West African cybercrime networks.

    • West African cybercrime networks and the Black Axe syndicate were targeted across 22 countries.
    • Authorities identified 263 suspects and arrested 58 people between November 2025 and June 2026.
    • Criminal groups ran romance, cryptocurrency, investment, and business email compromise scams.
    • Networks used call centers, dark-web Crime-as-a-Service providers, shell companies, remittance services, and cash withdrawals.
      📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

  • Unit 42 Finds Most AI-Enabled Malware Samples Are Not Operational
    Unit 42 found that most AI-enabled malware samples have not reached production environments.

    • Unit 42 analyzed 405 AI-enabled malware samples from research and threat-intelligence sources.
    • Only 12 samples appeared on Cortex XDR-protected endpoints across organizations in three countries.
    • The observed malware included FunkSec ransomware, Oyster, Rhadamanthys, a trojanized AI application and a COM-hijacking DLL.
    • Seven FunkSec variants used Rust code and disabled Windows Defender through PowerShell and registry changes.
    • AI primarily changed how malware was authored or branded, while conventional execution behavior remained detectable.
      📄 Source: thehackernews.com · 📎 Coverage: unit42.paloaltonetworks.com · 👁 via Palo Alto Unit 42

  • Fake Codex ads trick Mac developers into running AMOS-like malware
    Cato Networks found a fake Codex campaign delivering macOS infostealer malware.

    • Mac developers searching for OpenAI Codex downloads are targeted.
    • Fake Codex pages deliver an AMOS-like infostealer in universal Mach-O binaries for Intel and Apple Silicon Macs.
    • Sponsored Google ads lead to Google Sites pages that embed attacker-controlled iframe content.
    • ClickFix instructions trick users into pasting a command that decodes a URL, pipes a shell script into zsh, and launches /tmp/helper.
    • Observed indicators include sites[.]google[.]com/view/codex-desktop-app/, bright-links[.]com, trekmesh15[.]com, and grove-12[.]com.
      📄 Source: catonetworks.com · 📎 Coverage: siliconangle.com · 👁 via Cyber Security News

  • EvilTokens Hijacks Microsoft 365 Sessions for AI-Assisted Fraud
    EvilTokens hijacks Microsoft 365 sessions to enable targeted financial fraud.

    • Microsoft 365 organizations were targeted across 344 organizations in five countries.
    • The platform steals valid Microsoft 365 access and refresh tokens without capturing passwords.
    • Attackers use OAuth 2.0 device-code phishing through Microsoft’s legitimate login portal and MFA flow.
    • AI-assisted mailbox analysis identifies invoices, suppliers, payment approvers, and fraud opportunities.
    • EvilTokens generates targeted business email compromise messages from compromised mailbox data.
      📄 Source: flare.io · 📎 Coverage: gbhackers.com · 👁 via Cyber Security News, cryptika.com (discovered)

  • Malicious Rust Crates Delivered Build-Time Malware Across Developer Environments
    A compromised Rust maintainer account published three crates that executed malware during builds.

    • Rust developers using arrayref, internment, or append-only-vec were affected.
    • Malicious releases were arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9.
    • The releases added the typosquatted proc-macro1 dependency, whose build script downloaded and executed a payload.
    • The malware ran during cargo build, cargo check, or cargo test across Windows, macOS, and Linux.
    • The implant used 23.254.165.112:9089 for payload delivery and 23.254.165.112:443 for C2, and could steal browser credentials.
      📄 Source: rustsec.org · 📎 Coverage: thehackernews.com · 👁 via securityboulevard.com (discovered)

  • How to Generate and Verify SLSA Build Provenance for Artifacts
    Clear Path Security explains how SLSA provenance links software artifacts to their build origins.

🔓 CVEs & KEV

  • CVE-2026-66897 — CVSS 9.9 — Instance template path traversal allows arbitrary host file write as rootA pa...

  • CVE-2026-77136 — CVSS 9.5 — Server-Side Template Injection in extension "powermail" (powermail)The extens...

  • CVE-2026-77138 — CVSS 9.3 — Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5v...

  • CVE-2026-77141 — CVSS 8.8 — Broken Access Control in extension "Club Directory" (clubdirectory)The extens...

  • CVE-2026-77140 — CVSS 8.7 — Broken Access Control in extension "Telephone Directory" (telephonedirectory)...

  • CVE-2026-12878 — CVSS 8.6 — In affected versions of the Codefresh platform an authenticated user can util...

  • CVE-2026-77134 — CVSS 8.3 — Broken Access Control in extension "femanager" (femanager)The extension fails...

  • CVE-2026-77135 — CVSS 8.2 — Information Disclosure in extension "femanager" (femanager)The extension's us...

  • CVE-2026-56095 — CVSS 7.7 — Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Sea...

  • CVE-2026-77129 — CVSS 7.7 — Server-Side Template Injection in extension "Event management and registratio...

  • CVE-2026-77137 — CVSS 7.7 — SQL Injection in extension "Forms Export" (frp_form_answers)The extension fai...

  • CVE-2026-56092 — CVSS 7.6 — Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search...

  • CVE-2026-56093 — CVSS 6.3 — Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search...

  • CVE-2026-56094 — CVSS 6.3 — Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Searc...

  • CVE-2026-56096 — CVSS 6.3 — Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Searc...

  • CVE-2026-77128 — CVSS 6.3 — Broken Access Control in extension "Event management and registration" (sf_ev...

  • CVE-2026-77133 — CVSS 6.0 — Broken Access Control in extension "femanager" (femanager)The extension fails...

📋 ADVISORIES

  • 📄 Source for Attackers Target miniOrange SAML Flaws to Access WordPress Admin Accounts — patchstack.com

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check