🚨 ACTIVE EXPLOITATION
- Working Exploit Published for Pre-Auth AnyDesk Linux Flaw That Grants Root Access
Researchers have published a working exploit for a pre-authentication remote code execution flaw in AnyDesk for Linux that gives attackers root access.- Affects AnyDesk for Linux, with published exploit offsets targeting version 8.0.2; earlier versions like 8.0.1 may share the vulnerable code path, while Windows and macOS are not affected.
- The flaw is a heap buffer overflow in AnyDesk's session protocol allowing pre-authentication RCE as root; AnyDesk patched it in version 8.0.3 in June, describing it only as a crash bug, with no CVE assigned and no security advisory.
- The exploit, called AnyPwn and released on GitHub on October 8, works over direct TCP connections on port 7070; the same code path may be reachable via AnyDesk relay servers, but the full chain was not demonstrated there.
- It exploits 32-bit arithmetic without overflow checking: a declared payload length of 0xFFFFFFF0 plus a 16-byte header wraps to zero, causing a tiny allocation followed by attacker data overflowing adjacent heap objects, then a ROP chain runs an arbitrary command as root.
- The exploit is probabilistic and requires a favorable heap layout, otherwise the service crashes; AnyDesk appears to have removed the 8.0.2 build from its download page after the PoC video was published.
💥 BREACHES & INCIDENTS
- Hackers hijack .gh, .sl, .as ccTLDs, obtain unauthorized HTTPS certificates for Google domains
Attackers hijacked the .gh, .sl, and .as ccTLD registries and obtained unauthorized HTTPS certificates for several Google domains and other organizations.- Domains in the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs were affected, including several Google domains and other global brands and online services; Google's own systems were not compromised
- Attackers compromised third-party ccTLD operators and modified authoritative DNS records, allowing them to pass CA domain validation and obtain valid TLS certificates for domains they did not own
- With DNS control, the attacker pointed affected domains to their own infrastructure, enabling impersonation of legitimate brands and serving arbitrary content to visitors
- Google blocked the unauthorized certificates in Chrome via CRLSets and worked with the issuing CAs to revoke them; CT log analysis revealed additional impacted organizations whose certificates were also proactively blocked
- Google says it may not have identified every affected domain, and Chrome's CRLSets protections do not cover users of other browsers
🔓 CVEs & KEV
CVE-2026-86405 — Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module — CVSS 9.8 — Critical PrestaShop Sipay Module Flaw Allows Signature Spoofing and Payment Bypass
CVE-2026-95702 — Google gVisor — CVSS 8.5 — Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFil...
🕵️ RESEARCH & DEEP DIVES
Rust-based Warden Stealer MaaS targets AI agent data from Claude, Codex, Grok and Cursor
Gen Threat Labs attributes the fast-growing Rust infostealer Warden Stealer, a malware-as-a-service that now steals AI agent and developer credentials.- Warden Stealer is a Rust-based malware-as-a-service infostealer targeting Windows 8 through Windows 11, promoted on Russian-language underground forums since August 2026 with about 110 active customers.
- It targets Chromium and Gecko browser data, over 200 crypto wallet extensions, and 360+ applications including messengers, password managers, 2FA tools and VPN clients, plus AI agent data from Claude, Codex, Grok and Cursor (officially added in v1.9, announced September 29, 2026).
- It ships with its own loader, which injects the payload into explorer.exe, and a built-in cryptocurrency clipper that replaces copied wallet addresses.
- Builds use AST/LLVM-based code morphing, per-sample encoding, dynamic API resolution, anti-VM checks, and an Application-Bound Encryption bypass that injects shellcode into Chrome to decrypt the v20 master key.
- Delivery comes via ClickFix fake CAPTCHA lures, malvertising, cracked software and fake game cheats; sample hashes include loader SHA-256 006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c.
CastleStealer infostealer adds Chromium App-Bound Encryption bypass and remote shell
Flashpoint reports that the CastleStealer infostealer has added Chromium App-Bound Encryption bypass, remote shell, and stealthier exfiltration capabilities.- Targets Windows users of Chromium-based and Firefox browsers, plus Steam, Discord, Telegram, and files with 'wallet' in the name.
- Newer samples use Chrome's IElevator COM interface to bypass Chromium App-Bound Encryption, unlocking previously protected browser data.
- Delivered via ClickFix social engineering (CastleLoader) and, since June, malicious ads leading to fake Node.js installer sites that drop the OXLOADER loader with self-decryption, sandbox checks, and in-memory execution.
- New remote shell lets operators run commands, execute supplied files, and download additional payloads on infected systems.
- Exfiltrates data in small AES-encrypted raw TCP packets (4-byte size field, IV, encrypted data) instead of one large archive, then self-deletes via a ping-delay technique.
Sources 📄 Source: flashpoint.io · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Rust-based Warden Stealer MaaS targets AI agent data, 200+ crypto wallets, and browser credentials
Gen Threat Labs identified the fast-growing Rust infostealer Warden Stealer (formerly CallbackBeaver), a malware-as-a-service that steals AI agent data, crypto wallets, and browser credentials.- Warden Stealer affects Windows 8 through 11 (Windows 7 support dropped in v1.9) and targets users of Chromium/Gecko browsers, crypto wallets, password managers, messengers, 2FA tools, and VPN clients.
- It steals data from over 200 crypto wallet extensions and 360+ applications across 13 categories, and is among the first infostealers harvesting AI assistant data from Claude, Codex, Grok, and Cursor — tokens, MCP configs, prompt histories, and conversation databases.
- Delivered via ClickFix fake CAPTCHA lures, malvertising, cracked software, and game cheats; subscription tiers range from $149 for three days to $1,500 monthly, with ~110 active customers.
- Its loader reconstructs the payload in memory and injects it into explorer.exe using VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread; builds are heavily obfuscated and morphed via AST parsing and LLVM IR passes.
- It bypasses Chromium Application-Bound Encryption by injecting into the browser process to decrypt the v20_master_key, performs anti-VM checks, and includes a built-in crypto clipper supporting Bitcoin, Ethereum, Solana, Litecoin, XRP, Cardano, and Bitcoin Cash.
📋 ADVISORIES
📄 Source for Max-severity SonicWall SMA1000 SSRF flaw (CVE-2026-102255) now exploited in attacks — previdian.com
📄 Source for Trojanized Terraform AWS provider delivers cross-platform FLATROOF/ROOFDECK malware to developers — zscaler.com
📄 Source for US seizes seven domains tied to China's Integrity Tech hacking infrastructure — reuters.com