Cyware Daily Threat Intelligence - August 24, 2026
A single malicious download can now trigger a chain of infections that quietly hands over credentials and system access, as seen in recent loader campaigns. Cyware spotlights how PavinLoader is leveraging fake installers and obfuscated scripts to prepare endpoints for follow-on payloads, with just one click escalating into full compromise.
Critical vulnerabilities are forcing mass updates across the web, with over 100,000 WordPress sites patched after attackers exploited the Pods plugin to seize admin control. Meanwhile, TeamCity servers face active exploitation in Australia, risking the integrity of software supply chains.
Mobile threats are evolving as ToxicPanda targets Android users by blocking Google Play defenses and capturing sensitive banking credentials through phishing overlays, highlighting the growing sophistication of financial malware.
Top Malware Reported in the Last 24 Hours
Operation QUICSILVER / QUICAgent
Operation QUICSILVER is a cyber-espionage campaign targeting Myanmar’s government and IT sector, deploying the QUICAgent backdoor. Operation QUICSILVER uses malicious LNK files that abuse ftp.exe to execute commands and reconstructs payloads by combining “header.doc” and “body.doc” via Windows’ copy /b. Operation QUICSILVER employs random delays and repeated SHA-256 hashing to evade sandboxes, supports remote command execution, file operations, and persistence through a Startup-folder shortcut. Operation QUICSILVER delivers its payloads using local-themed lures, such as public holiday calendars and graduation invitations. Operation QUICSILVER targets Myanmar’s government and IT sector, with researchers attributing the activity to a China-nexus group, Mustang Panda, also linked to the COOLCLIENT backdoor and a stealthy kernel-mode driver. The campaign’s traffic leverages QUIC over UDP port 443 to blend malicious communications into normal encrypted flows.
PavinLoader
PavinLoader is a multi-stage loader designed to prepare systems for follow-on payloads such as Amatera Stealer. PavinLoader arrives via Inno Setup or MSI installers that execute trojanized, obfuscated .NET DLLs, making initial infection appear as routine software activity. PavinLoader uses recognizable naming patterns like “TwoWords” or “TwoWordsNumber” and recurring scripts such as “prefetch_9a59.cmd” and “telemetry_55db.cmd,” while employing EtherHiding, anti-analysis, and anti-debugging techniques. PavinLoader is distributed through ClickFix and fake software download schemes, often requiring only a single convincing download or CAPTCHA step. PavinLoader targets users seeking software downloads, with campaigns resulting in credential theft or broader system compromise. The loader’s technical details and campaign patterns were documented in recent research.
ToxicPanda
ToxicPanda is an Android banking Trojan engineered to block Google Play and Google Play Services traffic by requesting VPN permissions. ToxicPanda leverages Accessibility Service access to place phishing overlays atop legitimate banking and cryptocurrency wallet apps, capturing logins and payment details. ToxicPanda can steal device unlock patterns, PINs, or passwords, enabling attackers to maintain control even on encrypted devices. ToxicPanda operates by aggressively prompting for permissions after installation, though its initial infection vector remains undisclosed. ToxicPanda targets Android users seeking financial services, with Zimperium reporting on its technical behavior. No patch or mitigation was specified in the report.
Top Vulnerabilities Reported in Last 24 hours
CVE-2026-18963 – Keycloak password reset flaw
CVE-2026-18963 is a critical password reset vulnerability in Keycloak (CVSS 9.1) that allows unauthenticated attackers to take over any user account, including administrators, without user interaction. CVE-2026-18963 enables account takeover by sending a specially crafted request to the reset-credentials endpoint, bypassing state validation. No active exploitation has been observed for CVE-2026-18963. James Paremain reported the issue. A fix is available in Keycloak 26.7.2, with unaffected releases including Red Hat build of Keycloak 26.4 (operator bundle 26.4.15-1; rhbk/keycloak-rhel9 and rhbk/keycloak-rhel9-operator images 26.4-23) and 26.6 (operator bundle 26.6.6-1; keycloak-rhel9 and operator containers 26.6-12).
CVE-2026-19598 – WordPress Pods plugin flaw
CVE-2026-19598 is a critical vulnerability in the WordPress Pods plugin (CVSS 9.8) that allows unauthenticated attackers to overwrite user and administrator passwords, granting full site control. CVE-2026-19598 enables attackers to execute arbitrary admin actions, delete files, and run arbitrary PHP code, escalating website compromise to a direct business risk. CVE-2026-19598 is under active exploitation, prompting WordPress.org to enforce a security update on over 100,000 websites. Wordfence disclosed the issue, crediting Nhien Pham via the Wordfence Bug Bounty Program. A fix was released on August 14 in version 3.3.9.1, with backports to 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2, 3.2.8.3, and 3.3.9.1.
CVE-2026-63077 – TeamCity authentication bypass
CVE-2026-63077 is a critical authentication bypass vulnerability in TeamCity servers that allows remote attackers to execute system commands on on-premises servers. CVE-2026-63077 grants attackers the same privileges as the TeamCity server process, exposing stored credentials, build configurations, and software release integrity. CVE-2026-63077 is being actively exploited in Australia, according to the Australian Signals Directorate (ASD). JetBrains released a security update on July 27, 2026, urging organizations to patch immediately. TeamCity is used for build and release workflows across a customer base of over thirty thousand, making exploitation a risk for tampered code and compromised downstream systems.
Frequently Asked Questions
What is Operation QUICSILVER? Operation QUICSILVER is a cyber-espionage campaign aimed at Myanmar’s government and IT sector, using local-looking lures like a Belgian–Myanmar public holiday calendar and a graduation invitation to slip in the QUICAgent backdoor. It starts with a malicious LNK that abuses ftp.exe to run commands, then rebuilds the payload by stitching together “header.doc” and “body.doc” with Windows’ copy /b trick.
What is PavinLoader? PavinLoader is a multi-stage loader showing up in ClickFix and fake software download schemes, where it quietly prepares a system to receive follow-on payloads such as Amatera Stealer. It commonly arrives through Inno Setup or MSI installers that run trojanized, heavily obfuscated .NET DLLs, making the early stages look like routine software activity.
What is ToxicPanda? ToxicPanda is an Android banking Trojan that asks for VPN permissions so it can block Google Play and Google Play Services traffic, reducing the chance its activity gets disrupted. After installation, it pushes for Accessibility Service access and uses it to place phishing overlays on top of legitimate banking and cryptocurrency wallet apps to capture logins and payment details.
What is CVE-2026-18963? A critical flaw in Keycloak’s password recovery flow can let an unauthenticated attacker take over any user account — including admins — without user interaction (CVE-2026-18963, CVSS 9.1). The weakness stems from how Keycloak validates state during the reset process, allowing account takeover by sending a specially crafted request to the reset-credentials endpoint.
What is CVE-2026-19598? A critical flaw in the WordPress Pods plugin allows unauthenticated attackers to overwrite user passwords — including administrator passwords — and take full control of affected sites (CVE-2026-19598, CVSS 9.8). Attackers can use the plugin’s privileged functions to execute arbitrary admin actions, including deleting files and running arbitrary PHP code, turning a website compromise into a direct business risk for any organization relying on WordPress.
What is CVE-2026-63077? A critical TeamCity server vulnerability is being exploited in Australia, letting remote attackers bypass authentication and execute system commands on on-premises servers (CVE-2026-63077). In practical terms, that can hand an intruder the same rights as the TeamCity server process, potentially exposing stored credentials, build configurations, and the integrity of software releases.