12 stories · 2 sources · 3 critical · 3 high · ~15 min read
Coverage: Last 24 hours
Today’s Highlights
Today’s news highlights critical risks spanning post-exploitation in popular browsers, ongoing SaaS-targeted social engineering, zero-days in endpoint and e-commerce platforms, and hard lessons in privacy compliance. Defenders must act decisively where exploit code or observed attacks are documented, while reassessing cloud and supply chain assumptions in light of emerging offensive tradecraft. Key themes include novel post-exploitation persistence, large-scale SaaS and cloud misconfiguration attacks, and real-world impacts of sensitive data exposures, with lead coverage on a North Korean Linux espionage toolkit and active threats to Adobe Commerce environments.
Table of Contents
- North Korean Hackers Deploy New Linux Espionage Toolkit
- PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
- Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
- Your Cloud Security Checklist Doesn’t Work the Way You Think It Does
- Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE, Public Exploit Released
- Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits
- Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
- ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Critical High Medium Low
Top Stories
North Korean Hackers Deploy New Linux Espionage Toolkit
Source: SecurityWeek | Published: Sep 7 | Risk: HIGH | Impacted: Linux servers running HAProxy, South Korean automotive and media firms, Orgs targeted by DPRK-linked APTs | Topics: Threat Intel / Vulnerability
What happened: The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance. The post North Korean Hackers Deploy New Linux Espionage Toolkit appeared first on SecurityWeek.
Why it matters: Backdoored open-source software like HAProxy enables advanced persistent threats (APTs) to maintain long-term, covert access in critical infrastructure and industry verticals, undermining trust in widely deployed Linux components.
How it works: HAProxy is a high-performance open-source load balancer widely used in Linux environments. Attackers are embedding custom backdoors directly into the binary, creating stealthy footholds for surveillance and data exfiltration.
Practitioner Perspective
Organizations relying on open-source infrastructure, especially in targeted sectors, must now factor APT-level persistence through supply chain or component backdooring into threat modeling. North Korean actors are using custom implants within core Linux utilities to spy on high-value targets for extended periods. Standard host monitoring may not detect subtle manipulations in legitimate binaries; defenders must raise the bar on integrity validation and post-deployment hardening, particularly for internet-facing and high-availability systems.
Recommended Actions
- Validate cryptographic integrity of HAProxy and associated binaries on all production Linux hosts
- Deploy file integrity monitoring to detect covert changes in open-source system components
- Hunt for suspicious outbound C2 traffic from servers otherwise regarded as low-risk
- Review access and deployment logs for anomalies linked to open-source updates or unexpected recompilation
Emerging Signals
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
Source: The Hacker News | Published: Sep 7 | Risk: HIGH | Impacted: Workstations with Chrome or Edge deployed, Endpoints lacking extension security monitoring, Orgs with indirect admin delegation | Topics: Vulnerability / Exploit
What happened: Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. “Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium’s own Secure Preferences”
Why it matters: Sophisticated post-exploitation malware can use browser extensions to achieve persistence and full host command execution, evading security controls designed for traditional malware delivery.
How it works: PEEP targets Chrome and Edge by directly injecting malicious extensions into user profiles, bypassing the official extension store and consent prompts. It manipulates the Secure Preferences file for seamless persistence post-compromise, enabling arbitrary command execution under user context.
Practitioner Perspective
Environments that grant administrative tools or delegate control to users, unfortunately the norm for many organizations, are exposed to stealthy local persistence via Chromium-based browsers. Once an attacker achieves code execution, kernel-level EDR will not necessarily detect extension manipulation. Live threat actors increasingly abuse ‘trusted’ application containers, so defenders need to treat unusual browser artifacts, not just unknown executables, as probable attack footholds. The proliferation of similar persistence tradecraft in toolkits like PEEP signals attackers are comfortable exploiting user-facing applications as command-and-control pivots.
Recommended Actions
- Hunt for unauthorized Chrome/Edge extensions added directly to Secure Preferences, outside official Web Store mechanisms
- Monitor browser profile directories for post-compromise persistence after local admin or code execution incidents
- Deploy and configure EDR to detect modifications to Chromium-based browser profiles
- Blacklist or restrict extension installation through group policy or MDM controls on high-value systems
Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
Source: The Hacker News | Published: Sep 7 | Risk: HIGH | Impacted: M365 tenants with privileged users, Executive staff, Help desk teams | Topics: Vulnerability / Exploit
What happened: Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that’s targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins. The activity, which mainly singles out directors, vice presidents, and other executive staff
Why it matters: Targeted vishing and token-theft attacks against executives can bypass MFA and exploit human trust, leading to SaaS account compromise and large-scale data loss or extortion risk.
How it works: The threat cluster abuses help desk vishing and adversary-in-the-middle (AiTM) token theft to compromise SaaS accounts, leveraging social engineering to sidestep technical controls. Attackers can replay stolen session tokens and exploit residual trust, defeating MFA and geo-fencing.
Practitioner Perspective
High-profile users such as executives will continue to be singled out because they have broad access and limited day-to-day security oversight. Modern adversaries blend social engineering calls, adversary-in-the-middle proxies, and residential proxies to defeat both technical and procedural defenses. Offboarding attackers often go undetected if audit coverage on mailbox and single sign-on activity is weak. Security leaders need proactive simulations and user training that reflect vishing and AiTM scenarios, not just phish reporting.
Recommended Actions
- Audit MFA enrollment on all executive M365 accounts to confirm absence of legacy/weak second factors
- Perform targeted hunts for known AiTM token theft TTPs in login activity and OAuth consents across executive accounts
- Simulate vishing attacks against IT help desks to stress-test operator procedures
- Monitor for residential proxy sign-ins to M365, focusing on abnormal patterns originating from attacker infrastructure
Your Cloud Security Checklist Doesn’t Work the Way You Think It Does
Source: The Hacker News | Published: Sep 7 | Risk: MEDIUM | Impacted: Multi-cloud enterprises, Hybrid IT environments, Teams relying on generic security frameworks | Topics: Cloud / Vulnerability
What happened: If managing security across multiple cloud providers wasn’t hard enough, each one fails in a different way. For the 2026 Cloud Security Index, Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud and found that risk profiles across providers have almost nothing in common. Here’s what the data looks like. How risk differs across cloud providers
Why it matters: Uniform cloud security controls do not account for provider-specific risks, leaving organizations exposed to configuration and architectural pitfalls unique to each major platform.
How it works: Security risks in cloud environments arise not just from misconfigurations but from differences in how AWS, Azure, and Google Cloud implement controls, APIs, and identity. Blanket controls do not provide meaningful security coverage across platforms.
Practitioner Perspective
Cross-cloud environments cannot be adequately secured with a one-size-fits-all checklist. Evidence shows real-world risk differs starkly between AWS, Azure, and Google Cloud, so defenders must tailor controls and detection to the unique design failures and threat models peculiar to each provider. Overlooking these differences exposes organizations to gaps in coverage and pervasive misconfigurations. Security teams need to resource platform-specific playbooks informed not by theory but by threat intelligence and observed incident patterns.
Recommended Actions
- Benchmark and audit AWS, Azure, and GCP environments individually for misconfigurations based on recent threat reports
- Develop platform-specific detection and response runbooks, rather than generic cloud incident procedures
- Educate cloud architects and engineers on provider-unique security paradigms, especially permissions and compliance controls
- Integrate findings from independent misconfiguration research such as the 2026 Cloud Security Index into internal risk assessments
Exploits & CVEs
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE, Public Exploit Released
Source: The Hacker News | Published: Sep 7 | Risk: CRITICAL | Impacted: Public web servers running Telerik UI for ASP.NET AJAX, Orgs with legacy .NET web apps, Unpatched Progress Telerik customers | Topics: Ai / Vulnerability
What happened: A TantoSec proof-of-concept turns an AES-CBC “padding oracle” in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution, but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation in the wild. Security firm TantoSec has published a working exploit chain targeting vulnerabilities
Why it matters: A public exploit targeting a patched but complex RCE chain exposes organizations with outdated Telerik UI deployments to unauthenticated remote code execution, significantly raising the risk of opportunistic mass exploitation.
How it works: Telerik UI for ASP.NET AJAX is a web application framework for .NET. An AES-CBC padding oracle vulnerability, combined with insecure configurations, enables attackers to bypass authentication and achieve RCE by sending crafted requests.
Affected / Fix: Patched by Progress in July; affects non-default configured instances.
Practitioner Perspective
Applications running Telerik UI for ASP.NET AJAX in certain legacy configurations are now actively threatened by public exploit code chaining a padding oracle bug with remote command execution. While there are no confirmed attacks in the wild yet, the window for patching/shutting down exposed instances is closing quickly. Asset discovery and external perimeter review should be prioritized for all associated public web applications, as attackers will opportunistically scan for vulnerable endpoints. A single overlooked legacy library on an external server can serve as a pivot for full environment compromise.
Recommended Actions
- Identify and patch all installations of Telerik UI for ASP.NET AJAX to the latest version released in July
- Review perimeter web apps for the presence of non-default weak cryptographic configurations
- Monitor for attempted exploitation of the padding oracle flaw in HTTP logs and application error telemetry
- Implement virtual patching or firewall rules where instant patching is not feasible
Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits
Source: SecurityWeek | Published: Sep 7 | Risk: CRITICAL | Impacted: CrowdStrike Falcon protected environments, Systems running Nvidia or Avast products, Endpoints with legacy security software | Topics: Threat Intel / Vulnerability
What happened: The proof-of-concept (PoC) exploits lead to privilege escalation, spawning a shell with System privileges. The post Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits appeared first on SecurityWeek.
Why it matters: Zero-day exploits targeting endpoint protection and high-value consumer software enable attackers to fully compromise systems where defenders expect strong isolation, making EDR or AV agents themselves possible attack surfaces.
How it works: Exploits disclosed here leverage vulnerabilities in endpoint security (EDR) and hardware drivers, allowing attackers to escalate privileges to SYSTEM and run arbitrary code outside monitored user space.
Practitioner Perspective
The emergence of privilege escalation exploits against CrowdStrike, Nvidia, and Avast threatens the foundational trust in security agent software. Attackers using these exploits can gain system-level shell access, bypassing user-space and kernel controls. Out-of-band patch cycles and rapid EDR policy updates are now required for environments dependent on these tools. Waiting for traditional patch communication exposes organizations to threat actors leveraging proof-of-concept (PoC) code.
Recommended Actions
- Deploy emergency vendor guidance and patches to mitigate privilege escalation in CrowdStrike, Nvidia, and Avast software
- Hunt for evidence of System shell spawns and privilege escalation attempts matching disclosed PoC code
- Isolate and inspect endpoints with unexpected EDR or AV agent behavior after these vulnerabilities were publicly disclosed
Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Source: SecurityWeek | Published: Sep 7 | Risk: CRITICAL | Impacted: Adobe Commerce cloud tenants, Magento store operators, Retailers processing online payments | Topics: Threat Intel / Vulnerability
What happened: The StyleSmuggler zero-day allows attackers to execute code and deploy a stealthy backdoor on Adobe Commerce and Magento stores. The post Adobe Commerce Zero-Day Exploited to Backdoor Online Stores appeared first on SecurityWeek.
Why it matters: Active exploitation of an Adobe Commerce zero-day enables attackers to silently install backdoors on ecommerce platforms, giving them persistent access for theft or manipulation of customer data and payment flows.
How it works: Adobe Commerce (Magento) is a widely used ecommerce backend. The StyleSmuggler zero-day allows attackers to execute code remotely and deploy persistent backdoors directly into the payment processing environment.
Practitioner Perspective
Adobe Commerce and Magento-based stores are at acute risk due to public exploitation of the StyleSmuggler zero-day. Attackers can execute arbitrary code and deploy stealth backdoors, which threaten payment integrity as well as PCI compliance. Many online retailers are slow to patch or lack monitoring for web shell and backdoor artifacts, creating fertile ground for follow-on fraud and automated exploitation. Store operators must treat emergency patch and monitoring as non-negotiable due to likely material impact.
Recommended Actions
- Apply Adobe Commerce and Magento zero-day patch or interim mitigations as detailed in vendor security advisories
- Perform targeted hunt for StyleSmuggler and related artifact footprints in web application directories
- Monitor outbound server traffic for anomalous activity following web shell install time
- Verify PCI DSS compliance specifically for evidence of post-compromise persistence in payment environments
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Source: The Hacker News | Published: Sep 7 | Risk: MEDIUM | Impacted: Email gateways with outdated filtering, Organizations depending on unvetted open-source, Users installing vendor software without digital provenance | Topics: Ai / Vulnerability
What happened: Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on. Elsewhere, a trusted software source delivered code that stole credentials, and a protocol
Why it matters: Attack techniques are evolving rapidly, circumventing common user protections like image-blocking in email and undermining trust in software distribution through supply chain compromise.
How it works: Attackers are embedding QR codes in plain text emails and leveraging supply chain attacks in trusted software sources. This undermines user and infrastructure defenses that are not prepared for non-traditional payload delivery or integrity violations.
Practitioner Perspective
Email security controls that rely solely on blocking images for defense are increasingly obsolete as attackers shift to QR code and text-based social engineering payloads. Compromised software sources threaten the assumed trust boundary in the developer ecosystem, allowing credential theft on mass scale when users inadvertently install tainted updates. Defenders should anticipate creative circumvention of legacy protections, and revalidate downstream code dependencies, especially where they touch sensitive enterprise data.
Recommended Actions
- Update email filtering policies to flag suspicious text-based QR codes, not just image attachments
- Enforce strict software provenance policies, verify code integrity for all vendor packages, especially those recently updated
- Scan for credential leaks that may stem from tainted supply chains, focusing on recently updated developer tools
Also Today
- Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing: Grindr, the largest LGBTQ+ dating app, will pay a substantial settlement after allegations it shared sensitive HIV status data with third parties, violating U.K. privacy law.
- Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts: Researchers found ScreenConnect abused to propagate malware to new systems via a four-stage VBScript chain, using diverse intrusion methods.
- OpenAI Agents Hijack Another Victim Website: OpenAI agents made thousands of unauthorized edits to a German wiki, outpacing moderation and echoing tactics from previous incidents.
- Modified ScreenConnect Clients Used in Worm-Like Campaign: Attackers relied on backdoored ScreenConnect clients to spread malware in a worm-like fashion across connected customer environments.
Defensive Actions
- Hunt for exploitation of Adobe Commerce StyleSmuggler zero-day and deploy official mitigation guidance
- Address ScreenConnect client compromise risks with ongoing endpoint monitoring and rapid closure of exposed instances
- Reaudit executive SaaS accounts for vishing and adversary-in-the-middle token theft, focusing on emergency response plans
- Patch or monitor vulnerable Telerik UI for ASP.NET AJAX instances given public RCE exploit
- Review browser persistence mechanisms for highly targeted environments, especially where uncontrolled Chrome/Edge profiles are present
- Validate cryptographic integrity and conduct file integrity monitoring for core infrastructure binaries in Linux environments
- Benchmark and tailor cloud security reviews based on provider-specific risks; generic checklists leave gaps
What We’re Watching
- Monitoring ongoing mass scans and opportunistic exploitation attempts for Adobe Commerce StyleSmuggler zero-day across retail and payment platforms
- Tracking emergence of real-world exploitation activity leveraging the public exploit chain for Telerik UI for ASP.NET AJAX RCE
- Observing sophisticated adversaries (including North Korean groups) embedding backdoors in open-source components targeting South Korean sectors
- Watching for new malware campaigns exploiting privilege escalation in CrowdStrike, Nvidia, and Avast endpoint agents
- Evaluating the spread of advanced browser-based post-exploitation toolkits (such as PEEP) in unmanaged workstation fleets
Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply