🚨 ACTIVE EXPLOITATION
- Active WordPress XSS campaign exploits WPC Product Bundles and Ninja Forms to hide admin accounts
Attackers are exploiting stored XSS flaws in two WordPress plugins to deliver a shared JavaScript payload from imgcdn1.com that installs hidden admin accounts and backdoors.- Affects WordPress sites running WPC Product Bundles for WooCommerce (≤8.6.6, CVE-2026-93836, ~30K installs) and Ninja Forms (≤3.15.3, CVE-2026-94504, ~500K installs), both unauthenticated stored XSS with CVSS 7.1
- The payload https://imgcdn1.com/fz/x.js runs in a logged-in administrator's browser, scrapes CSRF nonces, and rides the admin's authenticated session without stealing cookies
- It installs a malicious plugin with an unauthenticated file manager behind seven layers of packing, creates an administrator hidden from the Users screen, and sets a backdoor login URL authenticating as the site owner
- Delivery vectors include the woosb_ids[...][qty] parameter and Ninja Forms' admin-ajax.php endpoint (action=nf_ajax_submit); the malware checks in with https://imgcdn1.com/fz/c.php?xa=check&site=<origin> and tracks state in Local Storage keys starting with _xp_v9
- First observed October 4, 2026, with active exploitation ongoing; persistence files are backdated to look older than the WordPress install
💥 BREACHES & INCIDENTS
Nikkei discloses breaches of employee Microsoft 365 and Google Workspace email accounts
Nikkei disclosed that attackers breached two employee email accounts and used one to send 9,000 phishing emails.- Applies to Nikkei employees, business partners, journalistic sources, and external contacts who corresponded with staff
- A Google Workspace account accessed from late July may have exposed names and email addresses of 1,646 employees and business partners; discovered in early August via a Google alert
- A Microsoft 365 account compromised in September was used on September 30 to send roughly 9,000 phishing emails with links to malicious websites to staff and interviewees
- Spoofed emails were sent from legitimate Nikkei accounts, making them hard to identify by sender address; recipient names, email addresses, and some email content may have been exposed
- Incidents reported to Japan's Personal Information Protection Commission; not attributed to any threat actor and not confirmed to be connected
Hackers hijack Asos app push notifications to claim Snowflake breach, threaten leak
Attackers sent a push notification via Asos's own iOS app claiming they fully compromised its Snowflake instance and threatening to leak data.- Affects Asos customers using the mobile app; Asos has ~17 million customers in 150+ countries and is investigating without confirming a breach.
- The notification, addressed to Asos's DPO and IT, read 'we have fully compromised the Snowflake instance. Engage with us or we will leak it' and linked to a Telegram channel.
- The Telegram channel was created by an unknown group calling itself the 'Xuanye Group', previously unseen on hacker forums; no specific demand was made.
- Sending the push required access to Asos's notification system, separate from Snowflake, suggesting credentials giving access to multiple systems; experts see it as a ransom pressure tactic.
- Asos shares fell nearly 10% on the London Stock Exchange after the notification; the site and app remained online.
Engineer sentenced to 32 months for locking 3,000+ devices on employer's network
A former infrastructure engineer was sentenced to 32 months in prison for a ransomware-style extortion plot that locked over 3,000 devices on his employer's network.- Applies to a New Jersey-headquartered industrial company whose network was attacked by its own core infrastructure engineer, 57-year-old Daniel Rhyne of Kansas City, Missouri.
- Rhyne used an administrator account to reset the domain admin password to 'TheFr0zenCrew!', delete 13 domain admin accounts, and change passwords for 301 user accounts and multiple local admin accounts, blocking access to 254 servers and 3,284 workstations.
- He also deleted claimed server backups and shut down random servers and workstations over several days in December 2023.
- He demanded a 20 bitcoin ransom (~$750,000) in an email titled 'Your Network Has Been Penetrated', threatening to shut down 40 random servers daily for ten days.
- While planning the plot, he used a hidden virtual machine to research changing domain passwords, deleting accounts, clearing Windows logs, and remotely shutting down computers via command line.
🔓 CVEs & KEV
CVE-2026-42415 — p-themes Porto Theme - Functionality — CVSS 9.3 — Porto Theme Unauthenticated SQL Injection Exposes Web Applications
CVE-2026-105985 — craftcms cms — CVSS 8.7 — Authenticated RCE via render-components Entry Type overridesCraft CMS 5.10.13...
🕵️ RESEARCH & DEEP DIVES
Midnight Blizzard's Storm-2945 Resumes CaptiveCrunch, Abusing Hotel Wi-Fi Captive Portals to Deploy CornFlake RAT
Russia-linked Midnight Blizzard subcluster Storm-2945 has resumed the CaptiveCrunch campaign, abusing hotel Wi-Fi captive portals to deliver malware and steal traveler credentials.- Targets travelers on hospitality Wi-Fi networks; ~70 affected IPs tied to three North American managed service providers serving seven of the ten largest U.S. hotel chains.
- Attackers manipulate DNS and HTTP traffic on captive-portal networks, redirecting users during routine connectivity checks to fake browser/OS update and network repair prompts using ClickFix-style techniques.
- A Rust variant of the CornFlake infostealer masquerades as 'Cloud Sync Service' (persisting at %APPDATA%\svchost32\svchost32.exe), with keylogging, screenshot, mic/webcam capture, credential theft, and remote command capabilities; ChocoShell PowerShell stealer harvests cookies, saved passwords, Microsoft 365 tokens, and Wi-Fi credentials in memory.
- Some landing pages abuse Microsoft Entra device code phishing to authorize attacker sessions, and Android users are prompted to install APK files.
- Recent IOCs include domains cdn-gstat[.]com, sslcdnhost[.]com, network-privacy[.]com and IPs 154.29.75[.]245, 149.3.170[.]186; renewed activity observed September 29, 2026.
Iran-linked Blinder Tunnel campaign targets Iraqi critical infrastructure via fake Dubai Airports job lures
An Iranian state-aligned actor tracked as CL-STA-1178 ran the Blinder Tunnel campaign against Iraqi critical infrastructure using fake Dubai Airports recruitment lures.- Targets high-value critical infrastructure, including telecom, aviation and other entities across Iraq, Israel and the UAE; activity staged from November 2025 and activated in March 2026.
- Attackers impersonated the Dubai Airports IT department, delivering an Inno Setup installer posing as a career portal with a trojanized Visual Studio coding challenge.
- Infection chain weaponizes a .csproj build file to trigger AppDomainManager hijacking and DLL sideloading, deploying ShelbyLoader V2 and the ShelbyC2 V2 RAT.
- C2 abuses GitHub repositories and issues, including AES-256-CBC encrypted dead-drop resolvers, and runs the open-source Chisel tunneling utility in memory via a custom tool called Blackwood.
- OpSec mistakes — Persian-language MP3 metadata, an Iranian-hosted C2 IP, and tunneling infrastructure — linked the campaign to Iran and to a parallel credential-harvesting operation against an Israeli entity using fake Google Drive lures.
Sources 📄 Source: clearskysec.com · 📎 Coverage: unit42.paloaltonetworks.com · 👁 via Palo Alto Unit 42SANS ISC details phishing campaign installing Action1 RMM for attacker remote access
SANS ISC documents a phishing campaign that installs the legitimate Action1 RMM tool to give attackers persistent remote access.- Targets Windows users receiving phishing emails with fake PDF invoice attachments
- PDF uses OpenAction/URI to redirect to a VBS file at up-theta-rose.vercel[.]app, which shows a decoy PDF and downloads action1.msi
- Action1 agent installs as service 'A1Agent' (C:\Windows\Action1\action1_agent.exe), persisting via HKLM\Software\Action1\Agent
- Files are signed with an Action1 Corporation certificate expired May 2026; CustomerId 49b18106-681d-456a-b098-092e2818c09a connects to server[.]na-2.action1[.]com
- Attacker likely abuses Action1's cloud infrastructure via a free/test account, following a similar ScreenConnect abuse case
📋 ADVISORIES
- Google pauses OSS bug bounty product vulnerability reports amid flood of invalid AI-generated submissions
Google has suspended product vulnerability submissions to its Open Source Software Vulnerability Reward Program after a surge of invalid automated reports.- Affects researchers reporting flaws in Google-maintained open-source projects including Go, Angular, Flutter, Bazel, Protocol Buffers, and Fuchsia.
- Product vulnerability submissions to the OSS VRP are paused effective October 1, 2026; supply chain reports and pre-October 1 filings are unaffected.
- Google cited 'a significant rise in automated submissions, the vast majority of which are not valid,' many containing hallucinated vulnerability details.
- Listed rewards for product vulnerabilities ($500-$7,500 flagship, $101-$3,133.7 important tiers) were removed from the rules on September 30.
- Google promises an update in Q1 2027 and directs researchers to the Cloud VRP, AI VRP, and Patch Rewards Program (up to $15,000).
Sources 📄 Source: bughunters.google.com · 📎 Coverage: thehackernews.com · 👁 via <https://thehackernews.com/2026/10/google-pa