Generated · Archived snapshot 18 findings · 3 CVEs
On this page

Exploitation Report

Executive Summary

Critical exploitation activity this period centers on three actively exploited vulnerabilities now listed in CISA's Known Exploited Vulnerabilities catalog: a critical pre-authentication RCE in Orkes Conductor (CVE-2026-58138), a high-severity unauthenticated RCE in SolarWinds Access Rights Manager (CVE-2026-28326), and three Linux kernel flaws including CVE-2025-39682. These vulnerabilities enable remote code execution without authentication and have confirmed exploitation in the wild, demanding immediate patching.

Simultaneously, North Korean threat actors continue large-scale campaigns. The Contagious Interview operation—attributed to the WaterPlum group—has compromised at least 30,000 devices across more than 100 countries and stolen over $10.7 million in cryptocurrency. A separate Jade Sleet intrusion targeted an Indian IT services provider using FLATROOF and ROOFDECK backdoors, highlighting persistent developer-focused supply chain targeting. New malware delivery techniques include ClickFix social engineering lures deploying the previously undocumented ChainScript RAT, a PowerShell backdoor dubbed TASK#STOMP with extensive data harvesting capabilities, and malicious npm packages that evade runtime defenses.

Emerging attack surfaces involve AI systems and browser-integrated assistants. Researchers demonstrated sandbox escapes from OpenAI's Codex, chainable flaws in OpenAI's authentication systems, and the BragJack technique that hijacks AI browser agents across Chrome, Edge, Opera, and Perplexity via a single malicious extension. A fake LastPass Authenticator installer abused a Microsoft-signed kernel driver to disable antivirus and EDR solutions, while the WordPress Click2Shell CSRF vulnerability gained a public proof-of-concept exploit enabling PHP execution on affected servers.

Active Exploitation Details

CriticalActive exploitationPatchCVE-2026-58138#

  • Description: An unauthenticated remote code execution vulnerability in Orkes Conductor workflow orchestration platform. The flaw exists in versions 3.21.21 through 3.30.1 and allows remote attackers to execute arbitrary code without authentication.
  • Impact: Full server compromise and arbitrary code execution with the privileges of the Orkes Conductor service, enabling lateral movement, data exfiltration, and persistent access.
  • Status: Actively exploited in the wild per Fortinet; patched in version 3.30.2.

HighObservedPatchCVE-2026-28326#

  • Description: A hard-coded cryptographic key flaw in SolarWinds Access Rights Manager (ARM) that enables unauthenticated remote code execution. The vulnerability affects all versions of ARM 2026.2 and prior.
  • Impact: Unauthenticated attackers can achieve remote code execution on the ARM server, leading to complete compromise of the access rights management infrastructure and potential domain escalation.
  • Status: Security updates released by SolarWinds; patch available.

CriticalActive exploitationPatchCVE-2025-39682#

  • Description: Three Linux kernel security flaws added to CISA's Known Exploited Vulnerabilities catalog with evidence of active exploitation. CVE-2025-39682 is an improper check for unusual or exceptional conditions in the TLS receive path with a CVSS score of 9.8.
  • Impact: Kernel-level code execution, privilege escalation, container escape, and potential full system compromise on affected Linux systems.
  • Status: Actively exploited per CISA; patches available in upstream kernels and distribution updates.

HighPotentialInvestigate#

  • Description: A cross-site request forgery (CSRF) vulnerability in WordPress Core dubbed "Click2Shell" that allows attackers to execute arbitrary PHP code on the server. Technical details and a proof-of-concept exploit have been published.
  • Impact: Remote code execution on WordPress sites via crafted requests that trick authenticated administrators into triggering the vulnerability.
  • Status: Proof-of-concept exploit publicly available; patch status not specified in source.

HighActive exploitationInvestigate#

  • Description: A malicious LastPass Authenticator installer distributed via GitHub that installs a Windows kernel driver signed through Microsoft's hardware compatibility program. The driver disables antivirus and EDR solutions before deploying a password stealer.
  • Impact: Defense evasion via signed driver, disabling of security controls, credential theft, and potential persistence on compromised endpoints.
  • Status: Active campaign observed; driver scored zero detections on VirusTotal at time of analysis.

CriticalActive exploitationInvestigate#

  • Description: North Korean threat actor campaign (WaterPlum group) compromising at least 30,000 devices across 100+ countries from December 2025 through July 2026, stealing over $10.7 million in cryptocurrency from 7,000+ wallets. Targets web designers, engineers, and cryptocurrency specialists.
  • Impact: Large-scale device compromise, cryptocurrency theft, credential harvesting, and potential supply chain infiltration via developer targeting.
  • Status: Ongoing per joint law enforcement advisory; active since December 2025.

HighActive exploitationInvestigate#

  • Description: A campaign delivering a PowerShell backdoor that automatically harvests business documents, monitors filesystem changes in real time, steals Wi-Fi passwords and clipboard contents, captures screenshots, and accepts arbitrary commands.
  • Impact: Comprehensive data exfiltration, credential theft, persistent access, and real-time surveillance of compromised hosts.
  • Status: Active campaign disclosed by researchers; no patch applicable (malware detection/response required).

HighActive exploitationInvestigate#

  • Description: ClickFix-style social engineering lures deploying a previously undocumented remote access trojan (ChainScript) that uses the Polygon blockchain to rotate command-and-control infrastructure. ChainScript masquerades as Spotify, Zoom Workplace, and Microsoft Teams software under multiple build names.
  • Impact: Remote access, command execution, blockchain-based resilient C2, and potential lateral movement.
  • Status: Active threat actor activity observed by Blackpoint Adversary Pursuit Group.

HighObservedInvestigate#

  • Description: North Korean actor Jade Sleet compromised an India-based IT services provider using FLATROOF and ROOFDECK backdoors, targeting developers to breach downstream networks.
  • Impact: Supply chain compromise, persistent backdoor access, developer environment infiltration, and potential downstream customer impact.
  • Status: Attributed intrusion disclosed by SentinelOne; active targeting of IT service providers.

HighObservedInvestigate#

  • Description: An npm supply chain attack where malicious code executes during normal package runtime rather than in installation scripts, evading defenses that only scan install-time behavior.
  • Impact: Credential theft, environment variable exfiltration, and potential pipeline compromise for developers and CI/CD systems using the package.
  • Status: Ongoing campaign; runtime-based evasion technique demonstrated.

HighNot observedMonitor#

  • Description: Researchers escaped OpenAI's Codex sandbox in two ways, including executing commands on a developer's machine from the most locked-down mode. OpenAI has patched both vectors.
  • Impact: Container/sandbox escape leading to host command execution, potential access to developer environments and source code.
  • Status: Patched by OpenAI; research disclosure.

HighNot observedMonitor#

  • Description: Researchers used Claude Opus 5 to chain two flaws—one in OpenAI's public help forum software and another in OpenAI's login system—to take over ChatGPT and Codex accounts of OpenAI employees and access an internal code repository.
  • Impact: Account takeover, unauthorized access to internal systems and source code, demonstration of AI-assisted vulnerability chaining.
  • Status: Security research disclosure; flaws reportedly addressed.

HighPotentialMonitor#

  • Description: Proof-of-concept attack (Prompt Forcing technique) that hijacks AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome via a single malicious browser extension. Earned over $20,000 in bug bounties and two CVE assignments.
  • Impact: Full control over AI browser agents, potential data exfiltration, prompt injection, and unauthorized actions via AI assistants with browser access.
  • Status: Proof-of-concept demonstrated; CVEs assigned but not publicly disclosed in source.

HighObservedInvestigate#

  • Description: Malicious versions of TanStack npm packages stole credentials from developers, leading to compromise of a CrowdSec employee's GitHub account and exfiltration of approximately 170 private repositories.
  • Impact: Credential theft, private repository exposure, supply chain compromise, and potential downstream contamination.
  • Status: Attack occurred in May 2026; discovered September 2026.

Severity unknownActive exploitationMonitor#

  • Description: A zero-day vulnerability in Cisco products referenced in weekly threat recap; specific product and CVE not detailed in source.
  • Impact: Potential remote code execution or unauthorized access on affected Cisco infrastructure.
  • Status: Referenced as active zero-day in weekly summary; details not provided in source.

Severity unknownActive exploitationMonitor#

  • Description: Remote code execution vulnerability in an AI agent system referenced in weekly threat recap; specific platform and CVE not detailed in source.
  • Impact: Remote code execution via AI agent processing, potentially affecting systems integrating vulnerable AI components.
  • Status: Referenced as active exploitation in weekly summary; details not provided in source.
  • Description: Cybercriminals distributing new malware via torrent files for popular films, with victims identified in Africa including Kenya and Uganda.
  • Impact: Malware installation on victim systems via social engineering and pirated content downloads.
  • Status: Active distribution campaign observed.

MediumObservedMonitor#

  • Description: Extortion gang ShinyHunters breached the Clop ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and onion service private keys.
  • Impact: Disruption of ransomware operations, potential exposure of victim data held by Clop, escalation of inter-gang conflict.
  • Status: Active incident; breach claimed by ShinyHunters.

Affected Systems and Products

Attack Vectors and Techniques

Threat Actor Activities