Full Daily Digest

The exploitation of CVE-2026-34926 demonstrates a targeted attack path: adversaries first compromise admin credentials, then abuse directory traversal to modify server tables and deploy malicious code to agents. This aligns with historical APT tradecraft targeting Trend Micro products. While the on-premises restriction reduces exposure, organizations using Apex One must treat this as a credential hygiene wake-up call. The lack of public attribution suggests either ongoing investigations or sensitive geopolitical implications. Mitigations should include privileged access reviews, table modification monitoring, and agent integrity checks beyond basic patching. The inclusion in CISA's KEV catalog confirms operational impact, though the medium CVSS score may cause some enterprises to deprioritize remediation—a dangerous oversight given the exploit's low technical barriers post-credential theft.

SecurityWeek · 2026-05-22 · Vulnerability: TrendAI patches Apex One zero-day (CVE-2026-34926) exploited for code injection, requiring admin access; CISA mandates federal patching by June 4.

The introduction of CISA's nomination form marks a strategic shift toward greater collaboration with the private sector in vulnerability management. By enabling external submissions, CISA aims to accelerate the identification and remediation of exploited vulnerabilities, particularly those leveraged by advanced threat actors using AI-driven exploit development. The KEV catalog serves as a prioritized list for federal defenders, with deadlines tightening to as little as three days in response to escalating threats. However, the effectiveness of this initiative hinges on robust verification mechanisms to prevent false positives and ensure only validated exploits are included. Defenders should leverage this resource to prioritize patching efforts, focusing on vulnerabilities with active exploitation. Additionally, organizations should establish internal processes for timely vulnerability reporting to CISA, ensuring alignment with federal mitigation timelines.

The Record by Recorded Future · 2026-05-23 · Vulnerability: CISA now allows external researchers to report vulnerabilities for its Known Exploited Vulnerabilities catalog to improve early detection and mitigation.

Kali365 represents a significant evolution in phishing-as-a-service platforms, offering sophisticated capabilities like AI-generated lures and automated campaign templates. The attack path involves sending phishing emails that direct victims to legitimate Microsoft verification pages, where they unknowingly authorize attacker access via OAuth tokens. This bypasses MFA, granting persistent access to Microsoft 365 services. The platform’s modular design, including branded phishing lures and multi-language support, makes it accessible to less-skilled attackers. Mitigation strategies include educating users on phishing tactics, implementing conditional access policies, and monitoring for unusual token activity. Organizations should also consider restricting OAuth token permissions and leveraging threat intelligence to detect and block Kali365-related campaigns.

The Record by Recorded Future · 2026-05-22 · Incidents: Kali365, a phishing-as-a-service platform, enables attackers to bypass MFA and capture OAuth tokens for Microsoft 365 access.

The lawsuit against Meta underscores a broader trend of legal challenges targeting social media platforms for their role in fostering addiction and mental health issues among youth. Platforms leverage algorithms, push notifications, and infinite scrolling to maximize user engagement, exploiting psychological vulnerabilities. This design strategy not only drives profits but also imposes significant costs on educational institutions, which must allocate resources to address the fallout, including cyberbullying, suicides, and academic decline. Mitigation efforts should focus on implementing stricter platform regulations, promoting digital literacy programs, and fostering collaboration between tech companies and educational bodies to develop healthier user engagement models.

The Record by Recorded Future · 2026-05-22 · Policy: Meta settles lawsuit over addictive design practices allegedly harming students' mental health, amid rising legal scrutiny of social media platforms.

The vulnerability stems from a failure in Drupal's API designed to sanitize PostgreSQL database queries, allowing crafted requests to bypass protections. Attackers can exploit this without authentication, escalating privileges or executing arbitrary code. While only PostgreSQL-backed Drupal sites are affected, the rapid weaponization post-disclosure highlights its severity. Imperva's data shows reconnaissance efforts are widespread, suggesting attackers are mapping vulnerable targets before deploying payloads. Mitigations include immediate patching, monitoring PostgreSQL query logs for anomalies, and restricting database permissions. Organizations should also consider WAF rules to block suspicious SQL patterns, as this vulnerability is a prime candidate for automated exploitation frameworks.

SecurityWeek · 2026-05-22 · Vulnerability: Drupal's CVE-2026-9082 PostgreSQL flaw is under active exploitation, enabling SQL injection and RCE.

The recognition of Microsoft as a leader in workforce identity security underscores the escalating importance of integrated identity systems in mitigating credential-based attacks, which remain a dominant threat vector. Fragmented identity systems create exploitable gaps, slowing response times and increasing operational overhead. Microsoft Entra's Access Fabric model consolidates identity signals, policies, and workflows into a continuous loop, enabling real-time risk evaluation. This is critical as AI-driven identities proliferate, expanding the attack surface. Organizations should prioritize solutions that enforce consistent policies across hybrid environments, reducing visibility gaps and improving control. Mitigations include adopting zero-trust principles, automating response workflows, and integrating identity with broader security ecosystems.

Microsoft Security Blog · 2026-05-22 · Tools: Microsoft leads in workforce identity security with Entra, addressing fragmentation and enabling continuous risk management.

The attack begins with the exploitation of an F5 BIG-IP load balancer, a common edge appliance, to gain SSH access to a Linux host. From there, the threat actor pivots to a vulnerable Confluence server, using its credentials to conduct relay-style authentication attacks against Active Directory. This multi-stage approach underscores the increasing sophistication of attacks targeting identity systems and trusted relationships. Organizations must prioritize patching edge devices, segmenting networks to limit lateral movement, and implementing robust monitoring for non-Windows systems. Additionally, enforcing multi-factor authentication and regularly rotating credentials can mitigate the risk of credential-based attacks.

Microsoft Security Blog · 2026-05-22 · Incidents: Attackers exploit edge appliances and trusted relationships to pivot internally, bypassing security controls and leveraging identity systems for lateral movement.

The breach underscores systemic issues in contractor oversight and credential management. The attack path began when a CISA contractor disabled GitHub’s protective mechanisms, allowing sensitive AWS GovCloud keys and internal credentials to be published publicly. The repository, initially created in November 2025, served as a personal synchronization tool, bypassing CISA’s visibility. Malicious actors monitoring GitHub’s public feeds likely accessed these credentials, posing a significant risk to national security. Mitigation efforts should focus on enforcing strict access controls, implementing robust monitoring of public repositories, and conducting regular audits of contractor activities. Organizations must also educate contractors on secure coding practices and the risks of using personal accounts for work-related tasks.

Krebs on Security · 2026-05-22 · Incidents: A CISA contractor leaked sensitive credentials on GitHub, prompting congressional scrutiny and exposing critical security lapses.

The browser has become the primary attack surface for SaaS and AI tool exploitation, with traditional network controls failing to monitor post-authentication activity. Attackers increasingly target browser sessions for credential theft (via malicious extensions) or data exfiltration through unmonitored AI tool usage. LayerX's pre-encryption monitoring provides visibility into shadow IT adoption, particularly for generative AI services. Integration with ZTNA creates a feedback loop where browser-level violations can trigger network access revocation. Enterprises should prioritize deployment in phased rollouts: first for high-risk teams using AI tools, then expanding with customized DLP policies for SaaS data flows.

Dark Reading · 2026-05-22 · Tools: Akamai's LayerX acquisition signals strategic focus on browser-level security controls for SaaS and AI tool governance.

The Chatrie case exposes critical gaps in digital consent frameworks where users unknowingly surrender granular location data through opaque permissions during device setup. Attack paths emerge when law enforcement leverages this data through geofence warrants covering broad areas over extended periods, effectively conducting dragnet surveillance. The technical scope affects all Android users who enabled Google Assistant, with location accuracy down to 3-meter precision recorded every two minutes. Mitigations include implementing granular consent controls, requiring judicial review of warrant scope proportionality, and educating users about location data implications. Organizations should audit their data retention policies to minimize exposure to similar warrant requests.

The Record by Recorded Future · 2026-05-22 · Policy: Supreme Court's Chatrie case may redefine Fourth Amendment protections for location data collected via geofence warrants.

The KimWolf botnet represents a significant evolution in DDoS threats by leveraging compromised IoT devices behind firewalls, such as digital photo frames and web cameras. This attack path bypasses traditional perimeter defenses, making mitigation challenging. The botnet's scale—over a million devices—and its ability to generate 30 Tbps attacks highlight the growing risk of IoT-based DDoS campaigns. Defenders should prioritize segmenting IoT networks, updating device firmware, and monitoring for unusual traffic patterns. Collaboration with DDoS mitigation firms like Cloudflare can provide additional protection layers. The case underscores the need for international law enforcement cooperation to dismantle such infrastructures.

The Record by Recorded Future · 2026-05-22 · Incidents: Canadian man arrested for running KimWolf botnet, a DDoS-for-hire service infecting over a million devices and launching record 30 Tbps attacks.

The exploitation of unprotected ATG systems at gas stations underscores the persistent risks of exposed IoT devices in critical infrastructure. Attackers leveraged default or missing credentials, a common oversight in industrial systems, to manipulate display readings, potentially masking hazardous conditions like fuel leaks. The Four-Faith router vulnerability (CVE-2024-9643) demonstrates how hardcoded credentials in industrial devices can be weaponized for botnet recruitment, emphasizing the need for firmware updates and credential rotation. The CISA credential exposure incident highlights third-party risks, where lax GitHub repository permissions could have facilitated lateral movement into government systems. Mitigations include enforcing strict access controls, regular credential audits, and adopting zero-trust principles for third-party vendors.

SecurityWeek · 2026-05-22 · Incidents: Iranian hackers exploit gas station monitors, Four-Faith routers targeted by botnets, and CISA contractor exposes sensitive credentials.

The research underscores a critical shift in vulnerability discovery, driven by AI automation. Attackers leveraging similar pipelines can exploit WordPress plugins at minimal cost, targeting poorly maintained codebases. The attack path involves static analysis to identify potential flaws, dynamic verification to confirm exploitability, and automated environment setup to streamline the process. This approach scales rapidly, producing hundreds of findings per second, overwhelming traditional triage systems. Defenders must prioritize automation in vulnerability management, focusing on dynamic verification and environment setup to reduce false positives. Organizations should also adopt stricter disclosure models, such as invite-only programs, to filter out low-quality submissions. Additionally, hardening enterprise codebases and reducing reliance on unmaintained plugins can mitigate risk.

Help Net Security · 2026-05-22 · Vulnerability: AI-driven systems can uncover WordPress plugin zero-days at $20 per vulnerability, signaling a shift in vulnerability discovery and exploitation.

The healthcare sector's vulnerability to social engineering is exacerbated by legacy systems, high-value data, and the critical need for uninterrupted care. Attackers now use AI to analyze organizational communication patterns, crafting personalized phishing emails and malicious documents. This evolution includes pretexting, executive impersonation, and credential theft, targeting human trust over technical flaws. Mitigation strategies must focus on identity verification, rapid incident response, and security awareness training to disrupt the attack lifecycle. The shift to multichannel social manipulation demands a proactive defense posture, integrating behavioral analytics and zero-trust principles.

Dark Reading · 2026-05-22 · Incidents: AI-driven social engineering attacks are escalating in healthcare, exploiting trust and urgency to bypass defenses.

The TeamPCP threat actor has exploited leaked credentials from Grafana, GitHub, and Mistral AI to orchestrate a series of supply chain attacks. This attack chain began with the compromise of Mistral AI and Grafana, leading to the infiltration of the Nx Console VS Code extension, which subsequently impacted GitHub. The concentration of credentials in private repositories, which contain six times more secrets than public ones, significantly amplifies the risk. Threat actors can leverage these credentials to poison additional services or software, creating a domino effect. Furthermore, private code leaks provide attackers with unfiltered access to internal operations, enabling the discovery and exploitation of 0-day vulnerabilities. Mitigation efforts should focus on scanning private repositories for secrets, enforcing least privilege access, and deploying honeytokens to detect unauthorized access early.

GitGuardian Blog · 2026-05-22 · Incidents: Leaked private code credentials enable cascading supply chain attacks, exposing organizations to 0-day vulnerabilities and amplifying breach impacts.

Screening Serpens’ recent campaigns reveal a sophisticated attack path involving highly tailored social engineering lures, often impersonating trusted brands and hiring platforms to deceive targets. The group’s use of AppDomainManager hijacking marks a significant evolution in their tactics, enabling them to manipulate initial execution environments for malware deployment. The six newly discovered RAT variants, grouped into two malware families, were deployed in coordinated attacks across multiple regions. These campaigns align with geopolitical tensions, suggesting strategic timing and intent. Defenders should prioritize employee awareness training, implement robust email filtering, and monitor for unusual AppDomainManager activity to mitigate risks. Additionally, organizations should analyze network traffic for indicators of compromise (IOCs) associated with the identified malware variants.

Palo Alto Unit 42 · 2026-05-22 · Incidents: Screening Serpens deployed six new RAT variants in targeted espionage campaigns across the U.S., Israel, UAE, and Middle East, leveraging advanced social engineering and AppDomainManager hijacking.

The Kimwolf botnet represents a significant evolution in DDoS attack infrastructure, leveraging residential proxy networks to expand its reach and ensnare millions of devices. Its Android-focused design highlights the growing targeting of mobile platforms for botnet recruitment. The botnet’s connection to Aisuru, another high-profile botnet, underscores the persistence of threat actors in refining their tools. The attack path typically involves exploiting vulnerable IoT devices, often through weak credentials or unpatched firmware, to recruit them into the botnet. Mitigation strategies include enforcing strong authentication, regularly updating IoT firmware, and monitoring network traffic for unusual patterns indicative of botnet activity. Additionally, organizations should consider deploying DDoS protection services to mitigate the impact of such attacks.

SecurityWeek · 2026-05-22 · Incidents: Canadian man arrested for operating Kimwolf botnet, a DDoS network linked to a record-breaking 31.4 Tbps attack.

The persistence of deleted Google API keys poses a significant security risk, particularly in scenarios where keys are leaked or compromised. Attackers can exploit this window to make unauthorized API calls, incurring costs or accessing sensitive data, such as Gemini AI conversations or BigQuery datasets. The root cause lies in Google Cloud's eventual consistency model, designed for scalability but inadvertently delaying key revocation. Misleading UI messaging exacerbates the issue by falsely assuring immediate invalidation. While newer key formats demonstrate faster revocation (5 seconds to 1 minute), Google has no plans to address the broader delay, citing it as a system property. Organizations should treat key deletion as a 30-minute operation, actively monitoring API usage during this period to detect and respond to unauthorized activity.

Help Net Security · 2026-05-22 · Vulnerability: Deleted Google API keys remain active for up to 23 minutes, enabling potential misuse and unauthorized access.

The collaboration between Trail of Bits and zizmor maintainers focused on addressing vulnerabilities in GitHub Actions workflows, particularly those involving YAML anchors. Misconfigurations in workflows, such as the pull_request_target exploit, can lead to severe supply-chain attacks, as seen in the Trivy compromise. By analyzing a vast corpus of real-world workflows, the team identified and fixed parsing bugs, deserialization edge cases, and expression evaluator discrepancies. These improvements ensure zizmor can now detect and prevent risky configurations before attackers exploit them. The methodology of using real-world inputs to test and refine static analysis tools is a best practice that can be applied broadly to enhance CI/CD security.

Trail of Bits Blog · 2026-05-22 · Vulnerability: Enhanced zizmor static analyzer now fully supports YAML anchors, fixing critical vulnerabilities in GitHub Actions workflows.

The Kore.ai Agent Platform represents a significant advancement in enterprise AI by addressing critical governance and scalability challenges. The platform's ABL standardizes agent definitions, while Arch translates business objectives into actionable blueprints. The dual-brain architecture ensures both agentic reasoning and deterministic flows operate in parallel, enhancing reliability. For security teams, the platform's logging and traceability features mitigate risks associated with AI behavior unpredictability. However, reliance on Microsoft Azure for initial deployment may limit flexibility for non-Azure enterprises. Mitigations include evaluating multi-cloud support timelines and ensuring integration with existing security frameworks.

Help Net Security · 2026-05-22 · Tools: Kore.ai's AI-native platform enables enterprises to deploy governed, scalable multiagent systems with built-in observability and operational control.

The KimWolf botnet exemplifies the growing threat of IoT-based botnets, leveraging poorly secured devices like digital photo frames and web cameras. Attackers exploited these devices to create a botnet rented out for DDoS attacks, including against critical infrastructure like the DoDIN. The botnet’s attacks reached 30 Tbps, causing significant financial losses. Mitigation requires securing IoT devices through firmware updates, strong passwords, and network segmentation. Organizations should monitor for unusual traffic patterns and implement DDoS protection services. This case underscores the importance of international law enforcement collaboration in disrupting cybercrime-as-a-service operations.

Help Net Security · 2026-05-22 · Incidents: Jacob Butler arrested for operating the KimWolf botnet, a DDoS-for-hire service infecting over one million IoT devices globally.

The integration of zero trust principles into AI workflows marks a significant advancement in securing agentic AI systems. Traditional security frameworks were not designed to handle the high-volume, autonomous nature of AI agents, which can misinterpret prompts or execute unintended actions, leading to potential security breaches. Versa’s solution mitigates these risks by validating every AI-generated action against predefined policies, requiring human approval when necessary, and logging all actions for auditability. This approach not only enhances security but also maintains operational efficiency. Enterprises adopting AI-driven operations must prioritize such architectures to prevent AI from becoming a liability. Implementing role-based access controls, continuous monitoring, and anomaly detection are critical steps in mitigating risks associated with agentic AI.

Help Net Security · 2026-05-22 · Tools: Versa introduces zero trust architecture for AI agents, ensuring validated actions and policy-driven control in AI-driven operations.

GitLab 19.0’s advancements address critical security gaps in AI-driven development workflows. The GitLab Secrets Manager mitigates credential exposure risks by centralizing secrets storage and access control within the platform, eliminating the need for separate permission models. This reduces attack paths where credentials could be leaked or misused. Enhanced CI pipeline visibility and supply chain security, including Dependency Scanning with SBOM, enable teams to audit third-party components effectively, reducing the risk of vulnerabilities in builds. Self-hosted open-source model support ensures compliance in regulated environments, preventing sensitive code from being sent to external APIs. Organizations should adopt these features to streamline security workflows and reduce operational overhead.

Help Net Security · 2026-05-22 · Tools: GitLab 19.0 enhances AI workflows, secrets management, and self-hosted model support to improve code security and compliance in AI-driven environments.

The introduction of AI access tokens in Proton Pass represents a strategic move to balance functionality and security in password management. By restricting AI agents to read-only access within designated vaults, Proton mitigates risks of unauthorized modifications or data exfiltration. The activity logging feature provides transparency, enabling users to audit AI interactions. However, potential attack paths include token leakage or misuse by compromised AI agents. To mitigate these risks, users should enforce strict expiration periods and regularly review activity logs. Organizations leveraging this feature should also vet AI agents for security compliance and limit token scope to minimize exposure.

Help Net Security · 2026-05-22 · Tools: Proton Pass enhances security with monitored credential sharing for AI agents via access tokens, ensuring controlled and logged access to sensitive data.

The 2026 DBIR data reveals a critical gap in phishing defense strategies, as attackers increasingly exploit voice and SMS channels. Voice cloning technology has lowered the barrier for realistic impersonation, while pretexting has become a mainstream tactic. The MGM breach demonstrated how a single phone call can lead to massive financial losses, shifting the perception of voice phishing from an individual to a corporate threat. Security teams must now account for multi-channel attacks, where email sets the stage, SMS builds trust, and voice calls seal the compromise. Mitigations should include regular voice and SMS phishing simulations, help desk training, and real-time verification protocols to counter these advanced social engineering techniques.

Help Net Security · 2026-05-22 · Incidents: Voice and SMS phishing now show a 40% higher click rate than email, demanding updated security awareness programs.

ROADtools represents a significant threat to cloud security, particularly within Microsoft Entra ID environments. Its ability to interact with legitimate APIs and customize user-agent strings allows attackers to blend in with normal traffic, complicating detection. The toolkit’s focus on token acquisition and manipulation enables attackers to maintain persistence and escalate privileges. Recent campaigns highlight its use in targeted phishing, where token management capabilities facilitate broader access. Defenders should prioritize monitoring Microsoft Graph API logs for high-volume enumeration of users, groups, and applications, which often signals malicious activity. Implementing Conditional Access policies and reviewing enterprise application permissions are critical steps to mitigate risks. Additionally, organizations should consider leveraging Palo Alto Networks’ Cortex Cloud and Unit 42 Cloud Security Assessments to identify and address vulnerabilities.

Palo Alto Unit 42 · 2026-05-22 · Tools: Nation-state actors exploit ROADtools for cloud attacks, leveraging Entra ID APIs and evasion techniques.

The introduction of CISA's KEV nomination form represents a strategic enhancement to the agency's vulnerability management framework. By enabling direct submissions from researchers and vendors, CISA can more rapidly identify and validate actively exploited vulnerabilities, reducing the window of exposure for affected systems. This initiative addresses a critical gap in the KEV catalog's update cycle, which has been criticized for delays. The requirement for submissions to include an assigned CVE, confirmed exploitation, and remediation guidance ensures that only high-impact vulnerabilities are prioritized. This approach not only streamlines the reporting process but also fosters collaboration between CISA and the broader cybersecurity community, reinforcing the collective defense against emerging threats.

Help Net Security · 2026-05-22 · Vulnerability: CISA's new KEV nomination form enables direct reporting of exploited vulnerabilities, accelerating threat identification and response.

First VPN’s disruption highlights the growing focus on dismantling cybercrime-as-a-service infrastructure. The service facilitated ransomware operations by providing anonymized access through 32 exit nodes, enabling reconnaissance, botnets, DoS attacks, and intrusions. Attackers likely leveraged First VPN to obscure their identities while conducting initial network scans and deploying payloads. The takedown’s success underscores the importance of cross-border collaboration and intelligence sharing. Defenders should prioritize monitoring IoCs provided by the FBI, enhance network segmentation to limit lateral movement, and implement robust logging to detect anomalous VPN traffic. Additionally, organizations should assess their exposure to ransomware by reviewing third-party VPN usage and updating incident response plans to address VPN-related threats.

SecurityWeek · 2026-05-22 · Incidents: First VPN, a cybercrime service used by ransomware groups, was disrupted by international law enforcement, leading to the arrest of its administrator and identification of 500+ users.

Cloud Atlas demonstrates a refined attack chain, starting with phishing emails containing ZIP archives. The LNK files within these archives execute PowerShell scripts, which drop secondary payloads and establish persistence via registry keys. The group's use of third-party tools like Tor and SSH ensures redundancy in command-and-control channels. Notably, the exploitation of CVE-2018-0802 underscores the group's reliance on unpatched vulnerabilities. Defenders should prioritize email filtering for ZIP attachments, monitor for unusual PowerShell activity, and patch legacy Office installations. The campaign's focus on government and commercial targets in Russia and Belarus suggests geopolitical motivations, warranting heightened vigilance in these sectors.

Kaspersky Securelist · 2026-05-22 · Incidents: Cloud Atlas resumes operations with updated phishing tactics, leveraging malicious LNK files and old Office vulnerabilities to target Russian and Belarusian entities.

The Kali365 attack exploits the device code phishing technique, leveraging legitimate Microsoft authentication flows to capture OAuth tokens. This method bypasses MFA by tricking users into authorizing malicious devices, granting attackers persistent access without requiring credentials. The attack begins with phishing emails impersonating trusted services, directing victims to enter a device code on a legitimate Microsoft page. Once authorized, attackers gain access to Outlook, Teams, and OneDrive. The FBI highlights the need for user education and enhanced monitoring of OAuth token usage. Mitigations include disabling unused OAuth applications, enforcing conditional access policies, and monitoring for unusual token activity. The rise of PhaaS platforms like Kali365 and EvilTokens underscores the growing sophistication of phishing campaigns, requiring proactive defense strategies.

Help Net Security · 2026-05-22 · Incidents: Kali365 PhaaS bypasses MFA by stealing OAuth tokens via device code phishing, enabling persistent access to Microsoft 365 services.

The TanStack supply chain attack exploited vulnerabilities in NPM and PyPI projects, deploying Mini Shai-Hulud malware to propagate across systems. Grafana detected malicious activity on May 11 and rotated GitHub workflow tokens, but one token remained active, enabling unauthorized access to its repositories. The attackers exfiltrated Grafana’s codebase, internal operational data, and business contact details, though no customer systems or Grafana Cloud operations were compromised. Grafana’s response included token rotation, GitHub posture hardening, and law enforcement notification. This incident underscores the critical need for comprehensive supply chain security, including rigorous token management, continuous monitoring, and rapid incident response to mitigate such threats.

SecurityWeek · 2026-05-22 · Incidents: Grafana's GitHub repositories were breached via the TanStack supply chain attack, exposing source code and internal data, though customer systems remained secure.

Webworm's operational shift to Europe marks a strategic expansion, targeting high-value governmental assets in Belgium, Italy, Serbia, Spain, and Poland. The group's adoption of legitimate tools like SoftEther VPN and custom proxies (WormFrp) demonstrates a move toward stealthier, harder-to-detect techniques. By leveraging Discord's API for data exfiltration and Microsoft Graph for command delivery, Webworm bypasses traditional security controls. Initial access likely stems from unpatched vulnerabilities, emphasizing the criticality of timely updates. Defenders should scrutinize non-standard communications to Discord, OneDrive, and S3 buckets, and implement strict egress filtering to detect anomalous data flows.

Dark Reading · 2026-05-22 · Incidents: Webworm APT targets EU governments using Discord and Microsoft Graph for stealthy command-and-control operations.