Cyware Daily Threat Intelligence - August 05, 2026
A single poisoned npm package can now ripple through the entire JavaScript ecosystem, as seen in the ChainDrop worm’s compromise of 444 packages and 2,212 versions. On cyware.com, we track how attackers weaponize trusted publishing to steal credentials and republish malware at scale, leaving teams scrambling to audit lockfiles and downgrade dependencies.
Remote code execution is no longer theoretical for organizations running Langflow or Apache Tomcat. Attackers are actively exploiting CVE-2026-9198 and CVE-2026-34486, with CISA and Unit 42 linking these campaigns to Chinese-speaking actors and AI-enabled intrusion methods. A single unpatched server can become an attacker’s launchpad for deeper network access.
Phishing-as-a-service is evolving, with the Greatness toolkit now offering device code phishing to bypass MFA for Microsoft 365, iCloud, and Google Workspace. For $289 per month, operators can automate credential theft and register new devices, turning a single phish into persistent access to business email and files.
Top Malware Reported in the Last 24 Hours
ChainDrop worm weaponizes npm trusted publishing
ChainDrop is an npm worm that weaponizes trusted software publishing to execute rapid supply-chain attacks. ChainDrop compromises 444 packages and 2,212 versions, including keyv@6.0.0, flat-cache@6.1.24, and file-entry-cache@11.1.6. ChainDrop runs via a preinstall script that downloads the Bun runtime and executes an obfuscated credential-stealing payload. ChainDrop uses stolen npm and GitHub tokens to republish itself across additional projects. The campaign began on August 4, 2026, after attackers compromised GitHub repositories owned by Jared Wray, spreading automatically to 433 additional packages by 13:20 UTC and publishing malicious versions with valid SLSA provenance attestations. StepSecurity urged victims to audit lockfiles, downgrade to safe versions, and use StepSecurity's Threat Center to detect exposure.
Mini Shai-Hulud variant hits keyv
Mini Shai-Hulud is a worm variant previously used by TeamPCP that targets npm supply chains for credential and secret theft. Mini Shai-Hulud focuses on stealing npm and GitHub tokens, AWS credentials, Kubernetes secrets, and tokens for services such as Stripe and Slack. Mini Shai-Hulud also hunts for SSH keys, VPN configurations, and KeePass databases, enabling account takeovers. The worm spreads through compromised maintainer GitHub accounts, with the exact initial access method unknown. Mini Shai-Hulud impacted over 868 packages, including the widely used keyv library, as reported by Aikido and Socket.
EtherRAT hides C2 in Ethereum
EtherRAT is a Node.js-based backdoor that retrieves command-and-control destinations from Ethereum smart contracts, providing ransomware operators with resilient remote access. EtherRAT is delivered via MSI payloads and establishes persistence using scheduled tasks and Run-key entries. EtherRAT supports credential harvesting and lateral movement through PowerShell, while using randomized URL paths and extensions to evade detection. The campaign is attributed to a The Gentlemen ransomware affiliate, with researchers observing operations mid-execution. Victims face increased risk of data theft and ransomware deployment due to EtherRAT’s flexible C2 infrastructure.
Top Vulnerabilities Reported in Last 24 hours
CVE-2026-9198: Langflow bug lets attackers run code
CVE-2026-9198 is a remote code execution vulnerability in Langflow flagged by CISA as actively exploited. Successful exploitation allows attackers to take over exposed Langflow services and use them as footholds for further network access. Attackers are already exploiting CVE-2026-9198 in the wild. CISA publicly listed the issue alongside other high-priority flaws. A fix is available in version 1.10.1, and organizations running affected versions should update immediately.
CVE-2026-34486: Tomcat encryption logic flaw enables RCE
CVE-2026-34486 is a vulnerability in Apache Tomcat that enables unauthenticated remote code execution in deployments using clustering with the EncryptInterceptor option. Exploitation can result in system compromise and data theft. Attackers are already exploiting CVE-2026-34486 in the wild. Palo Alto Networks Unit 42 linked exploitation to a Chinese-speaking actor using the aliases knaithe and KnYuan, describing AI-enabled campaigns that also involved manual operations against Citrix NetScaler (CVE-2026-3055), Marimo (CVE-2026-39987), and IKE VPN (CVE-2026-33824) endpoints. Fixes are available in 11.0.21, 10.1.54, and 9.0.117.
Swiss federal agency hit via SharePoint
A cyberattack on Switzerland’s Federal Office for Information Technology and Communications (BIT) compromised about 200 accounts on its SharePoint servers due to exploitation of known vulnerabilities. Attackers extracted machine keys from Microsoft’s IIS to forge legitimate requests and maintain persistence even after patching. Attackers are already exploiting these SharePoint vulnerabilities in the wild, as confirmed by their addition to CISA’s Known Exploited Vulnerabilities catalog. CERT-EU and CISA issued mitigation guidance following the disclosures.
Top Threat Actors Reported in Last 24 hours
KnYuan exploits Tomcat with Hermes Agent
KnYuan (also tracked as knaithe) is a suspected Chinese-speaking threat actor focused on unauthorized access and data theft. KnYuan uses the Hermes Agent framework to scan and exploit internet-exposed Apache Tomcat systems, targeting CVE-2026-34486. KnYuan also exploits Langflow (CVE-2026-9198) and N-able N-central (CVE-2026-18556), combining automated and manual intrusion activity. KnYuan targets organizations running widely deployed internet-facing services. The campaign leverages both AI-enabled and hands-on operations, as observed by Palo Alto Networks Unit 42. CISA’s alert recommends immediate patching and monitoring for exploitation attempts.
The Gentlemen affiliate routes C2 via Ethereum
The Gentlemen ransomware affiliate is a suspected financially motivated actor leveraging blockchain-based C2 for resilience. The Gentlemen affiliate uses EtherRAT to pull command-and-control destinations from Ethereum smart contracts, delivering the Node.js-based backdoor via MSI payloads. The Gentlemen affiliate establishes persistence with scheduled tasks and uses PowerShell scripts for lateral movement. The Gentlemen affiliate targets businesses vulnerable to ransomware, seeking credential theft and expanding control. The campaign’s use of blockchain-based C2 allows it to outlast traditional infrastructure takedowns, as observed mid-execution by researchers.
Greatness PhaaS adds device-code phishing
Greatness is a phishing-as-a-service (PhaaS) toolkit suspected to be operated by a financially motivated group. Greatness now supports device code phishing to bypass MFA by tricking victims into approving sign-ins and handing over tokens. Greatness targets major identity ecosystems including Microsoft 365, iCloud, Yahoo, and Google Workspace, offering themed templates and lures such as AudioLogin and ChatAssistance. Greatness sells access via a Telegram channel with subscriptions starting at $289 per month, providing each operator with a domain and dashboard for credential and token theft. Once inside, Greatness registers new devices to generate a Primary Refresh Token (PRT) and delays follow-on actions to blend in, enabling persistent access to workplace email and files.
Frequently Asked Questions
What is ChainDrop? ChainDrop is an npm worm that turned trusted software publishing into a rapid-fire supply-chain attack, compromising 444 packages and 2,212 versions including keyv@6.0.0, flat-cache@6.1.24, and file-entry-cache@11.1.6. It runs via a preinstall script that pulls the Bun runtime and executes an obfuscated credential-stealing payload, then uses stolen access to republish itself across more projects.
What is Mini Shai-Hulud? Mini Shai-Hulud, a worm variant previously used by the criminal group TeamPCP, has been tied to a sweeping npm supply-chain incident impacting over 868 packages including the widely used keyv library. It focuses on stealing credentials and sensitive files that developers and CI/CD systems rely on, ranging from npm and GitHub tokens to AWS credentials, Kubernetes secrets, and tokens for services like Stripe and Slack.
What is EtherRAT? EtherRAT is a Node.js-based backdoor that pulls its command-and-control destinations from Ethereum smart contracts, giving ransomware operators a durable way to keep remote access alive even as infrastructure gets disrupted. It is delivered via MSI payloads and establishes persistence with scheduled tasks and Run-key entries, then supports actions that include credential harvesting and lateral movement through PowerShell.
What is CVE-2026-9198? Attackers are exploiting a flaw in Langflow that can allow remote code execution, tracked as CVE-2026-9198 and flagged by CISA as actively exploited. In practical terms, this can let an intruder take over an exposed Langflow service and use it as a foothold to access data or pivot deeper into a network.
What is CVE-2026-34486? A vulnerability in Apache Tomcat can enable unauthenticated remote code execution in certain deployments, tracked as CVE-2026-34486 and highlighted by CISA as actively exploited. The risk concentrates in environments using Tomcat’s clustering with the EncryptInterceptor option, where attackers can turn a server-side weakness into system compromise and potential data theft.
What is Switzerland’s Federal Office for Information Technology and Communications (BIT)? Switzerland’s Federal Office for Information Technology and Communications (BIT) disclosed a cyberattack that compromised about 200 accounts on its SharePoint servers, underscoring how quickly widely used collaboration systems can become an entry point for larger intrusions. The incident was tied to SharePoint vulnerabilities that were added to CISA’s Known Exploited Vulnerabilities catalog, signaling real-world abuse beyond isolated testing.
What is KnYuan? KnYuan (also tracked as knaithe), a Chinese-speaking threat actor, is being linked to in-the-wild exploitation of an Apache Tomcat vulnerability as part of what researchers describe as AI-enabled hacking campaigns. They have targeted CVE-2026-34486, using the Hermes Agent framework to scan and exploit internet-exposed systems, according to Palo Alto Networks Unit 42.
What is The Gentlemen? A The Gentlemen ransomware affiliate is tied to a campaign that hides command-and-control lookups in Ethereum smart contracts, using the EtherRAT backdoor to pull its next destination from the blockchain. They deliver the Node.js-based remote access trojan via MSI payloads and were observed mid-execution, suggesting the activity is operational rather than theoretical.
What is Greatness? Greatness, a phishing-as-a-service (PhaaS) toolkit, has expanded into device code phishing—a tactic designed to bypass MFA by tricking victims into approving sign-ins and handing over tokens. The service targets major identity ecosystems including Microsoft 365, iCloud, Yahoo, and Google Workspace, packaging campaigns with themed templates such as AudioLogin and ChatAssistance alongside lures like WindowsExplorer, Voicemail, OneDrive, QR, and VideoPlayer.