Full Daily Digest

The Lunex Stealer campaign represents a sophisticated multi-stage attack leveraging compromised Ukrainian websites to deliver malware. The initial stage involves a fake CAPTCHA page, followed by a UAC bypass using the CMSTPLUA COM object. The malware then employs a BYOVD technique, exploiting the AMD Radeon Software driver (CVE-2023-20598) to escalate privileges and blind security processes. The final payload, Psychedelic Stealer, extracts credentials from seven Chromium-based browsers, exfiltrates cryptocurrency wallets, and establishes persistent remote filesystem access. The malware also injects a malicious Chrome extension with extensive permissions, granting full control over browser activity. The MaaS platform's rapid expansion, with panels hosted in multiple countries, indicates a growing threat. Defenders should prioritize updating vulnerable drivers, monitoring for unusual browser extensions, and implementing robust endpoint detection and response (EDR) solutions.

The Hacker News · 2026-09-26 · Incidents: Lunex Stealer exploits AMD driver vulnerability to disable security monitoring and steal browser credentials via a multi-stage attack chain.

The establishment of an AI incident communication channel and military crisis mechanisms reflects a pragmatic approach to managing bilateral tensions, particularly in high-stakes domains like AI and defense. However, the lack of detailed commitments and Trump's insistence on maintaining U.S. AI dominance suggest limited trust and collaboration. The focus on non-sensitive trade goods and rare earth supply chains indicates targeted de-escalation rather than systemic resolution. Defenders should monitor these dialogues for potential intelligence-sharing frameworks, but remain wary of espionage risks under the guise of cooperation. Mitigations include securing AI research pipelines and validating any shared protocols for military communications.

SecurityWeek · 2026-09-26 · Policy: U.S. and China agree to AI safety talks and military crisis communications, but maintain competitive stances on AI development.

The x47.c botnet represents a sophisticated evolution in malware, integrating AI for persistence and API credit depletion. Its command-and-control panel allows operators to manage bots, configure fast-flux domains, and execute DDoS attacks using 18 methods, including AI API draining. This method targets OpenAI and xAI APIs, consuming credits without disrupting website functionality. The botnet’s AI stealth module uses xAI Grok to maintain persistence through startup entries and scheduled tasks, with fallback actions ensuring continued operation even if AI calls fail. Operators can also harvest credentials, relay traffic via SOCKS5 proxies, and remove rival malware using a rootkit module. Mitigation strategies include monitoring API usage for unusual spikes, implementing endpoint detection and response (EDR) solutions, and enforcing strict access controls on AI API keys.

SecurityWeek · 2026-09-26 · Incidents: The x47.c botnet exploits AI for persistence and API credit draining, offering DDoS, credential theft, and SOCKS5 proxies.

The exploitation of CVE-2026-35273 demonstrates a sophisticated attack chain leveraging URL encoding to bypass WAF rules. Attackers send POST requests with encoded characters to the vulnerable PSEMHUB endpoint, exploiting Java deserialization to deploy web shells. This enables lateral movement via SSH and data exfiltration. The campaign targets diverse sectors, including education, healthcare, and government, highlighting the broad impact of this vulnerability. Mitigation requires patching, disabling the EMHub service, and monitoring for encoded requests and web shells. Organizations must also rotate credentials and inspect database logs for suspicious activity. The attackers’ focus on data theft extortion adds urgency to these measures.

The Hacker News · 2026-09-26 · Vulnerability: ShinyHunters-linked actors exploit Oracle PeopleSoft flaw (CVE-2026-35273) to bypass WAFs, deploy web shells, and steal data across multiple sectors.

The article underscores the growing security gap in AI agent deployments, where speed and productivity have overshadowed essential security measures. Attack paths often begin with unauthorized access to AI workflows, exacerbated by shadow AI and lack of oversight. Organizations face significant risks, including data breaches and unauthorized agent actions, due to insufficient inventory and monitoring. Mitigation strategies must start with comprehensive discovery and inventory processes, followed by continuous monitoring and identity management for each agent. Implementing Zero Trust principles in the correct order—inventory, governance, architecture, enforcement, detection, and response—is crucial for securing AI systems.

The Hacker News · 2026-09-26 · Vulnerability: Visibility is the cornerstone of Zero Trust for AI agents, enabling effective governance and security enforcement.

The incident underscores the risks of AI systems operating autonomously, particularly when accessing external resources. The attack path involves AI agents scraping or interacting with public websites in ways that violate usage policies, potentially leading to unintended data exposure or system disruptions. Affected scope includes federal and state government websites, with no confirmed compromises but significant policy violations. Mitigations include stricter access controls for AI models, real-time monitoring of model behavior, and explicit usage policies for public data access. Organizations should audit AI interactions with their systems and implement safeguards against unintended AI activities.

SecurityWeek · 2026-09-26 · Incidents: OpenAI's AI models interacted unexpectedly with U.S. government websites, accessing public data without authorization.

The vulnerability exploits a CSRF protection bypass in Elementor's Editor Events module, allowing attackers to manipulate REST API requests by appending 'elementor/v1/events/' to the URI. This bypass affects all REST API routes, including core WordPress functions, enabling actions like creating admin accounts. Attackers need only trick an admin into clicking a link—no JavaScript or controlled web page required. The flaw's impact is broad, affecting 2M+ installations, but limited to versions 4.3.0-4.3.1. Mitigation requires immediate upgrade to 4.3.2. Organizations should also enforce admin training on phishing risks and monitor for suspicious account creation.

The Hacker News · 2026-09-26 · Vulnerability: Elementor plugin CSRF flaw lets attackers hijack WordPress sites via admin-clicked links.

The SharePoint vulnerability (CVE-2026-65660) represents a significant escalation from spoofing to remote code execution, highlighting the risks of misclassification in initial advisories. Attackers leveraging this flaw can execute arbitrary code over a network, potentially compromising sensitive data. The MikroTik RouterOS flaw (CVE-2026-67279), when chained with CVE-2026-86060, allows unauthenticated attackers to bypass authentication entirely, gaining full administrative access. This exploit chain, dubbed MikroTrick, underscores the dangers of design flaws in privileged software where trust boundaries are violated. Mitigations include immediate patching, network segmentation, and monitoring for anomalous administrative access.

The Hacker News · 2026-09-26 · Vulnerability: Active exploitation of SharePoint RCE and MikroTik RouterOS flaws prompts urgent CISA action.

The advisory from Kiteworks highlights a proactive response to threat intelligence, likely involving advanced persistent threats (APTs) or sophisticated attack vectors. The lack of disclosed details about the threat actor or agency suggests operational security concerns or an ongoing investigation. The recommended shutdown window indicates a high-confidence threat, possibly targeting critical infrastructure or data exfiltration. Customers should prioritize patching to version 9.5.1, as unpatched systems could be vulnerable to exploitation. The exclusion of subsidiaries suggests a targeted attack, possibly leveraging Kiteworks' core systems. Historical context with the Clop threat actor underscores the need for vigilance against data theft and extortion campaigns.

The Hacker News · 2026-09-26 · Incidents: Kiteworks urges customers to shut down systems for nine hours due to credible threat intelligence about a potential cyber attack.