Coverage: Last 24 hours

Today’s Highlights

Rapid exploitation of vulnerabilities and targeted supply chain attacks were prominent in the past day, with defenders facing increased operational risk from credential theft, RAT delivery, and software supply chain compromise. The weaponization of new exploits is shortening defenders’ response windows and highlights persistent attacker focus on popular tools and social platforms. Themes include active exploitation of RCE vulnerabilities, increasing sophistication in supply chain attacks, growth of social engineering via mainstream platforms, trust challenges with AI infrastructure, and detection capability gaps that affect organizations globally.

Table of Contents

1. International Operation Targets Multimillion-Dollar Crypto Theft Schemes
2. CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads
3. Fake Claude Website Distributes PlugX RAT
4. Your MTTD Looks Great. Your Post-Alert Gap Doesn’t
5. North Korea’s APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware
6. The Dumbest Hack of the Year Exposed a Very Real Problem
7. Critical Marimo pre-auth RCE flaw now under active exploitation

Top Stories

International Operation Targets Multimillion-Dollar Crypto Theft Schemes

Source: SecurityWeek | Risk: Medium | Impacted: Crypto exchanges, Blockchain infrastructure providers, High-net-worth crypto holders

Law enforcement in the US, UK and Canada identified more than $45 million in cryptocurrency and froze $12 million. The post International Operation Targets Multimillion-Dollar Crypto Theft Schemes appeared first on SecurityWeek.

Why it matters: International Operation Targets Multimillion-Dollar Crypto Theft Schemes

Practitioner Perspective

The takedown of large cryptocurrency theft operations shows both the ongoing risk to crypto assets and the increasing ability of law enforcement to intervene at scale. Defenders at financial institutions and exchanges should take note: attackers continue to develop new techniques for multi-million dollar thefts, and global coordinated response is now a reality. This changes the calculus for managing incident disclosure and cooperation with authorities. Be ready to proactively communicate with both regulators and law enforcement during high-value breaches.

Recommended Actions

• Review response plans for theft and fraud events involving digital assets
• Update contact protocols with law enforcement and regulatory bodies
• Enhance monitoring for anomalous large transactions
• Harden internal controls against insider threats

CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads

Source: SecurityWeek | Risk: High | Impacted: IT operations teams, Users of CPU-Z and HWMonitor, Organizations with broad software installation rights

Download links were replaced by a Russian-speaking threat actor to distribute a recently emerged malware named STX RAT. The post CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads appeared first on SecurityWeek.

Why it matters: CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads

Practitioner Perspective

The compromise of CPUID’s legitimate download infrastructure to distribute the STX RAT demonstrates that even widely trusted utilities are viable vectors for malware delivery. Threat actors replaced download links, putting organizations that automate software deployment or permit end-user tool downloads at risk for silent RAT infections. This should prompt a reassessment of software sourcing policies and enforcement down to checksum verification and repository whitelisting. The critical point: trust in legitimate-looking downloads is now a tangible exploit path.

Recommended Actions

• Block or restrict downloads from compromised sources
• Verify integrity of recent downloads of affected software
• Deploy signatures and hunting rules for STX RAT
• Conduct retrospective analysis for infections tied to CPUID utilities

Fake Claude Website Distributes PlugX RAT

Source: SecurityWeek | Risk: High | Impacted: Organizations evaluating or deploying AI solutions, End-users attracted to AI utility sites, Security teams monitoring for RATs

The malware mimics the legitimate Anthropic installation, relies on DLL sideloading, and cleans up after itself. The post Fake Claude Website Distributes PlugX RAT appeared first on SecurityWeek.

Why it matters: Fake Claude Website Distributes PlugX RAT

Practitioner Perspective

A phishing campaign using a fake Claude website highlights attacker focus on mimicking legitimate AI services to lure victims and sideload PlugX RAT. The use of DLL sideloading and clean-up techniques signals a push for stealth and persistence, which can easily bypass casual endpoint detection. Organizations rolling out or considering public AI tools must update user awareness and expand threat models to include such tailored lures. The essential message is that attackers are dynamically adapting to popular platforms—defenses must do the same.

Recommended Actions

• Block access to known malicious clone AI service URLs
• Enhance endpoint monitoring for DLL sideloading and PlugX behaviors
• Conduct security awareness campaigns focused on AI-related phishing
• Hunt for evidence of stealth RATs using persistence and clean-up traits

Emerging Signals

Your MTTD Looks Great. Your Post-Alert Gap Doesn’t

Source: The Hacker News | Risk: High | Impacted: SOC teams, Incident response analysts, Enterprises running vulnerable software, Organizations dependent on MTTD metrics

Anthropic restricted its Mythos Preview model last week after it autonomously found and exploited zero-day vulnerabilities in every major operating system and browser. Palo Alto Networks’ Wendi Whitmorewarned that similar capabilities are weeks or months from proliferation. CrowdStrike’s 2026 Global Threat Report puts average eCrime breakout time at 29 minutes. Mandiant’s M-Trends 2026

Why it matters: Your MTTD Looks Great. Your Post-Alert Gap Doesn’t

Practitioner Perspective

The shrinking breakout time for eCrime activity and the emerging risk of AI-driven zero-day exploitation signal that detection speed alone is not enough. Adversaries are automating post-compromise actions, emphasizing the importance of rapid, methodical containment and thorough post-alert investigation. Security teams relying solely on fast MTTD metrics should re-evaluate whether their response and containment capabilities can withstand a well-timed, automated adversary. The critical takeaway: tighten post-detection playbooks to address the whole kill chain, not just initial alerting.

Recommended Actions

• Augment detection pipelines with automated containment workflows
• Benchmark and improve response time from detection to remediation
• Review and test incident response procedures for AI-driven attack scenarios
• Ensure EDR and XDR solutions have fast, reliable endpoint lockdown capabilities

North Korea’s APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware

Source: The Hacker News | Risk: High | Impacted: Social media users within targeted sectors, Organizations with high-profile staff, Administrators monitoring user endpoints

The North Korean hacking group tracked as APT37 (aka ScarCruft) has been attributed to a fresh multi-stage, social engineering campaign in which threat actors approached targets on Facebook and added them as friends on the social media platform, turning the trust-building exercise into a delivery channel for a remote access trojan called RokRAT. “The threat actor used two Facebook

Why it matters: North Korea’s APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware

Practitioner Perspective

North Korea’s APT37 has broadened its use of social engineering, exploiting trusted social networks like Facebook to deliver the RokRAT malware in a multi-stage campaign. This highlights the persistent risk from state-aligned actors leveraging widely used platforms to bypass technical controls and target high-value individuals. Given the prevalence of personal and professional use of social media, defenders must consider user education and advanced monitoring beyond endpoint solutions. The main point: your attack surface now includes all platforms used by your workforce—even those you do not centrally control.

Recommended Actions

• Alert users to ongoing social engineering threats via mainstream platforms
• Deploy behavioral analytics for unusual social media-driven malware delivery
• Update EDR signatures for RokRAT and related techniques
• Harden email and endpoint controls against secondary infection vectors

The Dumbest Hack of the Year Exposed a Very Real Problem

Source: WIRED Security | Risk: Medium | Impacted: Municipal IT and OT administrators, Vendors supporting city infrastructure, Organizations responsible for public safety systems

Last April, a hacker hijacked crosswalk announcements to mimic Mark Zuckerberg and Elon Musk. Records obtained by WIRED reveal how unprepared local authorities were.

Why it matters: The Dumbest Hack of the Year Exposed a Very Real Problem

Practitioner Perspective

The crosswalk hijack, though unconventional, exposes the persistent lag in municipal and OT security preparedness. Despite benign outcomes this time, the hack shows that basic security hygiene and incident response maturity are often lacking in local government systems. OT teams should treat this as a warning: threat actors regularly probe for low-hanging fruit among poorly secured city infrastructure. The core issue is that the weakest links are not hypothetical—they’re network-connected and exposed.

Recommended Actions

• Conduct access reviews and patch unsupported OT and civic systems
• Update incident response processes for city-owned connected devices
• Train staff on recognizing and escalating unexpected system behaviors
• Perform red team assessments against city infrastructure to uncover weak points

Exploits & CVEs

Critical Marimo pre-auth RCE flaw now under active exploitation

Source: BleepingComputer | Risk: Critical | Impacted: Marimo server administrators, Credential stores accessed by Marimo, Organizations with public Marimo endpoints

A critical pre-authentication remote code execution (RCE) vulnerability in Marimo is now under active exploitation, leveraged for credential theft.

Why it matters: Critical Marimo pre-auth RCE flaw now under active exploitation

Practitioner Perspective

Organizations running Marimo are now prime targets for RCE-based intrusions, with attackers exploiting a pre-auth flaw to steal credentials. Given the flaw does not require authentication, any exposed instance is vulnerable, making perimeter-based controls alone insufficient. This is yet another example of how quickly public-facing RCE vulnerabilities become weaponized, and defenders need to prioritize threat-hunting and active patch management over passive monitoring. The top concern: patch or isolate vulnerable systems immediately before attackers escalate access beyond credential theft.

Recommended Actions

• Apply vendor patches or mitigations immediately
• Search for indicators of compromise specific to Marimo RCE exploit
• Reset credentials linked to exposed Marimo instances
• Monitor for unusual logins or privilege escalation following Marimo access
• Isolate or restrict network access to Marimo servers

Defensive Actions

• Apply vendor patches or mitigations immediately for critical vulnerabilities such as the Marimo RCE.
• Search for indicators of compromise after public exploit disclosures, especially for widespread tools.
• Reset credentials linked to systems exposed to active exploit campaigns.
• Monitor for unusual logins or escalation after suspected or confirmed breaches.
• Isolate or restrict network access to vulnerable or exploited systems to prevent lateral movement.
• Review and enhance incident response workflows for speed and completeness following alerts.
• Augment detection pipelines with automated containment and lockdown.
• Block or restrict downloads from compromised or newly suspicious software sources.
• Deploy or update signatures for emerging RATs and exploit payloads in endpoint protection tools.
• Conduct targeted user security awareness campaigns around the newest phishing and social engineering threats.

What We’re Watching

• Whether the Marimo RCE campaign expands to include lateral movement and ransomware payloads.
• Potential follow-on attacks from the CPUID compromise into automated software deployment environments.
• Evolutions in fake website and supply chain attacks targeting AI and productivity software users.
• The response time improvements of organizations to zero-day and supply chain incidents given shrinking breakout windows.
• Municipal and OT security maturity as further details emerge from high-profile, if initially low-consequence, infrastructure hacks.

Categories: Cybersecurity Blog, Cybersecurity News

Tags: cybersecurity, daily briefing, Malware, patching, RCE, Social Engineering, Supply Chain