🕵️ RESEARCH & DEEP DIVES
101 Malicious npm Packages Secretly Add Developers' WhatsApp Accounts to Spam Groups
Researchers found 101 malicious npm packages that abuse the Baileys WhatsApp library to add developers to spam channels without consent.- Applies to developers using npm Baileys WhatsApp bot packages; 101 packages with ~490,000 total downloads (116,000 in the last 30 days).
- Packages subscribe victims' authenticated WhatsApp accounts to attacker-controlled groups and channels, and some inject the author's advertising URL into media sent by the bot.
- Three variants: fetching channel IDs from GitHub at runtime, embedding them in cleartext, or embedding them obfuscated; identified packages include ourin-baileys, @nexustechpro/baileys, @badzz88/baileys, and others.
- Campaign dubbed PhantomSub, tied largely to Indonesian bot-seller and 'market' channels selling game accounts, bot scripts, and boosting services; shared channel IDs and GitHub accounts link many packages to a common beneficiary.
Star Blizzard adopts RedFlick malware delivery technique in large-scale phishing campaigns
Microsoft reports Russian state-linked Star Blizzard has shifted to large-scale phishing and a new RedFlick malware delivery technique deploying its CosmicPulse backdoor.- Targets Ukrainian individuals and institutions, NGOs, think tanks, governments, and financial institutions supporting Ukraine; over 100 organizations affected, primarily in the US and UK
- RedFlick uses scheduled tasks to deploy the CosmicPulse backdoor, requiring only a single user interaction versus the multi-step ClickFix chain previously used
- Star Blizzard shifted from targeted spear-phishing to large-scale phishing campaigns of tens to hundreds of emails, using accounts on compromised websites and a mass-mailing platform
- Campaigns observed since January 2026, with lures such as fake tax audit notices and fine payment debits
- Attributed by CISA as subordinate to Russia's FSB Centre 18
CrowdStrike details ClickFix social engineering attacks used by STARDUST CHOLLIMA and VOODOO BEAR
CrowdStrike explains how ClickFix social engineering attacks trick users into running malicious commands themselves.- Applies to Windows users targeted via fake error messages, CAPTCHA lures, and meeting-repair pretexts
- ClickFix tricks victims into copying and pasting commands into the Windows Run dialog, making the user execute the attack
- Adversaries including STARDUST CHOLLIMA and VOODOO BEAR have used ClickFix in real-world operations
- CrowdStrike's 2026 Global Threat Report documented a 563% increase in incidents involving fake CAPTCHA lures in 2025
Hackers Hide OpenSUpdater Loader Inside Recompiled 7-Zip SFX Installers
Attackers are hiding a loader inside recompiled 7-Zip self-extracting installer code to deliver the OpenSUpdater malware.- Affects Windows users downloading 7-Zip SFX and NSIS installers; samples tracked as OpenSUpdater (ESET) / Snackarcin (Microsoft).
- Attackers rebuilt the open-source 7-Zip extraction component, inserting a loader call mid-routine in ExtractArchive() just before the progress bar starts.
- Each package embeds a genuine foobar2000 installer signed by Animated Productions, LLC, with padded certificates and odd version details as telltale clues.
- The loader contacts attacker C2 servers, downloads two DLLs and an encrypted blob, and loads the final payload in memory.
- IOCs: SHA-256 a7666e5aa3c6ecae0295caa7c3f49714eb561d6e1be6807cf1020b79f1902cd0, e99a053b9d6a414256177e1529417f85867d6ed355f6009300d626f63429753c, ba38916e82c47cff6de71791f179ce762e640e2975e40d6a1803d16ff591b752; C2s codeonicinc[.]com and setupsoftwarecenter[.]com.
📋 ADVISORIES
CISA: MikroTik RouterOS pre-auth RCE flaw CVE-2026-84411 affects versions below 7.24
CVE-2026-84411
CISA issued an ICS advisory for a critical pre-authentication RCE vulnerability in MikroTik RouterOS versions below 7.24.- Applies to MikroTik RouterOS devices running versions below 7.24, deployed worldwide across Communications and IT sectors.
- CVE-2026-84411 is an integer underflow (CWE-191) in the web management service's HTTP request body handling, reachable before authentication, CVSS 9.8 critical.
- An unauthenticated network attacker can send a single crafted request to execute arbitrary code as root or cause a denial of service.
- No known public exploitation targeting this vulnerability has been reported to CISA; MikroTik fixed it in RouterOS 7.23 or later.
Joomla 5.4.9 and 6.1.4 patch 16 core security issues, two rated High
Joomla has released 5.4.9 and 6.1.4 fixing sixteen core security issues including two rated High.- Applies to Joomla 5.x and 6.x sites; Joomla 3 sites get no fix, and five flaws reach back to Joomla 1.5 or 3.0
- High severity: arbitrary directory deletion via cache purge (CVE-2026-90915, affects 4.0.0+) and SSRF in several core extensions (CVE-2026-92222, affects 3.0.0+), both requiring a backend account
- CVE-2026-90907 lets any anonymous visitor create a Guest account even with registration switched off, affecting sites since Joomla 1.5
- MFA bypass (CVE-2026-92227) requires the password, then uses a Remember Me cookie to skip the second factor on later front-end logins
- Remaining fixes include seven XSS issues and six access control fixes; the 6.2.0 betas lacked the fixes at release time
CISA warns of critical command injection flaw (CVE-2026-22755) in VIVOTEK camera firmware
CISA issued an ICS advisory for a critical command injection vulnerability in firmware used by dozens of VIVOTEK network camera models.- Affects firmware across dozens of VIVOTEK network camera models (V, C, S Series, Dome, Panoramic, Bullet, and LPR cameras), deployed worldwide in government, transportation, energy, commercial, and financial sectors.
- CVE-2026-22755 is a command injection flaw (CWE-77) rated CVSS 10.0 Critical, exploitable remotely without authentication or user interaction.
- Successful exploitation enables remote command execution, potentially with root privileges, leading to full camera system compromise.
- CISA discovered a public proof of concept authored by indoushka and reported it to VIVOTEK; the vendor has released updated firmware.
📋 CVEs & KEV
CVE-2026-97689 — urllib3 — CVSS 8.9 — urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size...
CVE-2026-92370 — TeamViewer Full Client — CVSS 8.8 — Remote Session Access Control Bypass Leading to Remote Code ExecutionAn impro...
CVE-2026-92368 — TeamViewer Full Client — CVSS 7.8 — Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to ...
CVE-2026-19743 — TeamViewer Full Client — CVSS 7.8 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) ...
CVE-2026-92369 — TeamViewer Full Client — CVSS 7.3 — Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Insta...
CVE-2026-92371 — TeamViewer Full Client — CVSS 7.0 — Local Privilege Escalation via Improper Link Resolution in Cloud Session Reco...
📄 Source for x47.c Windows botnet sold with AI credit-drain, data theft, and DDoS attack toolkit — qrator.net