Attackers are turning stealth into a weapon, using new ransomware “killers” to quietly overwrite security tool memory and encrypt files while dashboards stay green. Cyware highlights how these payloads exploit kernel drivers and advanced process injection, leaving incident responders with a dangerous illusion of safety as enforcement mechanisms are silently disabled.

A critical zero-day in Adobe ColdFusion, tracked as CVE-2026-48282, is being exploited within hours of disclosure, with up to 800 servers exposed online. Attackers use path traversal to gain code execution, and defenders must act fast to patch and monitor for opportunistic scanning from geolocated IPs.

Enterprise Linux infrastructure in Japan is under siege as BlackTech deploys a new BlueShell RAT-based backdoor, embedding itself in core authentication and routing systems. This campaign demonstrates how a single foothold can ripple across critical services, with defenders urged to watch for ephemeral binaries and unusual outbound connections.

Top Malware Reported in the Last 24 Hours

Ransomware “killers” blind security tools

Ransomware “killers” are a new breed of payload classified as stealth ransomware, designed to encrypt systems while security dashboards remain falsely “green.” Ransomware “killers” abuse vulnerable kernel drivers for arbitrary memory access and selectively tamper with the structures and hooks that security products use to detect and block attacks. Ransomware “killers” employ techniques from families like SynAck and BlackMatter, including Process Doppelgänging, advanced process injection, transactional file system abuse, and stack overwrites to hide malicious execution inside legitimate modules. Ransomware “killers” are delivered by abusing driver vulnerabilities, allowing attackers to overwrite security-process memory without shutting down applications. Ransomware “killers” target enterprise environments where incident response teams may be misled by normal-looking dashboards. The report recommends stricter driver allow-listing, monitoring kernel memory access for anomalous IOCTL use and callback deregistration, and proactive threat hunting to identify compromised systems.

Saphire Sleet poisons popular npm packages

Saphire Sleet is a North Korea-linked malware group specializing in supply-chain attacks that compromise widely used JavaScript dependencies. Saphire Sleet spreads malicious workflows across multiple npm packages, using AES-GCM encrypted blobs and RC4-style string arrays to evade detection. Saphire Sleet behaves like legitimate maintainers for extended periods, then leverages social engineering to convince maintainers to publish malicious updates. Saphire Sleet delivers its payloads through compromised packages such as axios, debug, and chalk, and uses slopsquatting to exploit AI-generated package-name mistakes. Saphire Sleet targets cloud environments, with approximately 10% of environments affected according to reporting.

ClickFix uses fake macOS updates

ClickFix is a Node.js-based remote access trojan (RAT) campaign linked to DPRK’s UNC5342, designed to compromise macOS users through a fake update experience. ClickFix traps victims in a full-screen browser flow, prompting them to run a clipboard command in Terminal, which installs the RAT and additional components. ClickFix hides its command-and-control configuration using EtherHiding techniques that pull data from Ethereum smart contracts. ClickFix includes an infostealer module targeting 157 cryptocurrency wallets and uses a Chrome extension disguised as “Google Drive Offline” to exfiltrate information. ClickFix targets cryptocurrency users and businesses, resulting in compromised wallets, stolen secrets, and persistent remote access. Recommended actions include blocking campaign infrastructure and monitoring for suspicious Terminal commands, unexpected Node.js processes, and unauthorized Chrome extensions.

Top Vulnerabilities Reported in Last 24 hours

CVE-2026-48282: ColdFusion zero-day quickly turns into RCE

CVE-2026-48282 is a critical remote code execution vulnerability in Adobe ColdFusion (CVSS 10.0) that allows unauthenticated attackers to execute arbitrary code via path traversal. Successful exploitation of CVE-2026-48282 can turn an exposed ColdFusion server into an entry point for data theft or broader network compromise. CVE-2026-48282 is already being exploited in the wild. Exploitation attempts have been traced to an India-geolocated IP address (defanged: India-geolocated IP address), with an estimated 750-800 ColdFusion servers exposed online. A fix is available via Adobe’s APSB26-68 updates, and a related file-read flaw (CVE-2026-48318) affects the same ColdFusion versions: ColdFusion 2025 through Update 9 and ColdFusion 2023 through Update 20.

CVE-2026-16232: Check Point admins hit by auth bypass

CVE-2026-16232 is an authentication bypass vulnerability in Check Point SmartConsole (severity score 9.1/10) that allows attackers to gain full administrative control, change security policies, alter VPN settings, and disable logging. Exploiting CVE-2026-16232 can turn a perimeter defense tool into a covert control panel for intruders. CVE-2026-16232 is already being exploited in the wild. Check Point discovered the issue during an internal review, and CISA has added it to the Known Exploited Vulnerabilities catalog. A fix is available via Check Point’s jumbo hotfix, which also addresses CVE-2026-62144 and CVE-2026-62145.

CVE-2026-63030 & CVE-2026-60137: WordPress Core RCE opens door to backdoors

CVE-2026-63030 and CVE-2026-60137 are critical, unauthenticated remote code execution vulnerabilities in WordPress Core that allow attackers to run code, create new admin accounts, and plant persistent web shells. Exploiting CVE-2026-63030 or CVE-2026-60137 can let attackers steal data, redirect visitors, or serve malware and ransomware. Both vulnerabilities are already being exploited in the wild, with public proof-of-concept exploits available following the July 29, 2026 advisory. The advisory lists affected versions as WordPress 6.9.0 to 7.1 Beta, impacting both production and pre-release installs. A fix is available in WordPress 6.9.5 and 7.0.2 or later.

Top Threat Actors Reported in Last 24 hours

BlackTech plants Linux backdoor in Japan

BlackTech (suspected China-aligned, also tracked as Circuit Panda) is a threat actor group with a primary motive of cyber espionage. BlackTech has recently deployed a new Linux backdoor based on BlueShell RAT, using post-compromise tactics to maintain persistence and lateral movement within Japanese organizations. BlackTech leverages environment variable-based configuration and proxy-centric command-and-control, exfiltrating host details such as usernames, UIDs, local IPs, and process information. BlackTech targets Japanese businesses, focusing on core Linux systems that underpin authentication, routing, and internal access. The campaign involves launching the backdoor as a kernel-like process from ephemeral file paths, with defenders advised to monitor for short-lived binaries in /tmp and unusual outbound connections into cloud IP ranges.

UNC5342 ClickFix tricks Mac users

UNC5342 (suspected DPRK-linked, also tracked as ClickFix) is a threat actor group motivated by financial theft targeting cryptocurrency holders. UNC5342 uses a fake macOS update screen to pressure victims into pasting a clipboard command into Terminal, resulting in installation of a Node.js-based RAT and additional components. UNC5342 obscures communications using EtherHiding, fetching configuration via XOR-decoding and eth_call queries against Ethereum smart contracts. UNC5342 targets individuals and teams holding crypto assets, with the malware’s infostealer module aimed at 157 wallets and a Chrome extension disguised as a legitimate tool to exfiltrate data. The campaign blends social engineering with blockchain-based infrastructure, and defenders are advised to watch for unexpected “system update” lock screens and suspicious Terminal-driven installs.

Frequently Asked Questions

1. What is ClickFix? ClickFix, linked to DPRK’s UNC5342, uses a fake macOS update experience to trap users in a full-screen browser flow that makes the machine seem frozen until they run a clipboard command in Terminal. Once the victim complies, it installs a Node.js-based RAT and additional components, then hides its command-and-control configuration using EtherHiding techniques that pull data from Ethereum smart contracts.

2. What is Saphire Sleet? Saphire Sleet, a North Korea-linked group, has been blamed for a string of npm supply-chain compromises that booby-trap widely used JavaScript dependencies, including packages associated with axios, debug, and chalk. Instead of a single obvious “bad” release, it spreads malicious workflows across multiple packages and layers in heavy obfuscation, including AES-GCM encrypted blobs and RC4-style string arrays, to keep scanners and reviewers guessing.

3. What is CVE-2026-48282? A critical remote code execution flaw in Adobe ColdFusion (CVE-2026-48282, CVSS 10.0) is being exploited fast enough that defenders had only hours between public disclosure and real-world attacks. The bug uses path traversal to let an unauthenticated attacker run arbitrary code, turning an exposed ColdFusion server into an entry point for data theft or wider network compromise.

4. What is CVE-2026-16232? An authentication bypass in Check Point SmartConsole (CVE-2026-16232, severity score 9.1/10) can hand attackers full administrative control, allowing them to change security policies, alter VPN settings, and even disable visibility features like logging. In practical terms, that means a perimeter defense tool can be turned into a quiet control panel for an intruder.

5. What is CVE-2026-63030? A critical, unauthenticated RCE issue dubbed WP2Shell in WordPress Core (associated with CVE-2026-63030 and CVE-2026-60137) can let attackers run code on a site and plant persistent access, including new admin accounts and web shells. For site owners, the real-world impact is straightforward: a compromised WordPress server can be used to steal data, redirect visitors, or serve malware and ransomware.

6. What is BlackTech? BlackTech, a China-aligned APT group, has been caught pushing a new Linux backdoor based on BlueShell RAT into Japanese organizations, reflecting a broader shift toward enterprise Linux infrastructure. After getting inside, they use the malware in post-compromise stages where Linux servers and internal proxies matter most, helping them stay embedded and move around.

7. What is UNC5342? UNC5342, a DPRK-linked threat actor, is behind the ClickFix campaign that uses a fake macOS update screen to pressure victims into pasting a clipboard command into Terminal—turning a moment of confusion into a compromise. Once the victim runs the command, they install a Node.js-based RAT and additional components, with communications obscured via EtherHiding: configuration is fetched using XOR-decoding and eth_call queries against Ethereum smart contracts.