Summary
Attackers are turning trusted developer tools into weapons, as cyware.com tracks a campaign where fake security utilities on GitHub have compromised over 2,000 Windows systems. By disguising backdoors and infostealers as scan automation or log analysis scripts, adversaries are gaining persistent access to the very workstations used by cybersecurity teams.
A critical authentication flaw in SonicWall SonicOS SSLVPN, tracked as CVE-2026-19868, is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities Catalog. Organizations relying on single-factor authentication face the risk of attackers gaining unauthorized access and full control of exposed assets, with urgent patches now available.
Threat actors are quietly bypassing familiar defenses in U.S. state, local, tribal, and territorial organizations by abusing OAuth 2.0 device code flows. Using phishing-as-a-service kits like Kali365 and EvilTokens, adversaries trick users with access PINs, register rogue devices, and exfiltrate sensitive data while blending in with normal cloud activity.
Top Malware Reported in the Last 24 Hours
Fake GitHub tools backdoor security teams
Fake security tools on GitHub are being used to trick cybersecurity professionals into installing backdoors and information stealers, a campaign that has already compromised over 2,000 Windows systems. The lure is repositories pitched for scan automation, security testing, and log analysis, but the infection chain starts when PowerShell retrieves an encrypted download link and pulls a modular Electron-based loader named Microsoft.exe. Once running, it establishes persistence, elevates privileges, and injects malicious code into legitimate processes, turning a developer workstation into a foothold for broader access and data theft. The loader also works to stay hidden by making explorer.exe appear as the parent process, disabling Smart App Control, and patching memory to suppress event tracing and antivirus scanning, while attempting to remove ESET, McAfee, and Malwarebytes. The article’s guidance emphasizes blocking and monitoring identified IOCs, conducting thorough scans for suspicious scripts and executables tied to Visual Studio, Python, and Go projects, and using strict code review before trusting GitHub-hosted security tooling.
Malicious strutil-core gem drops credential worm
strutil-core, a malicious Ruby gem, was caught installing a credential-stealing worm during installation—turning a routine dependency pull into a supply-chain infection. Published as version 1.0.1 on November 1, 2026 at 04:05:04 UTC, it was flagged as malware 70 seconds later and removed by 09:13 UTC, leaving about a five-hour public exposure window. It targets credentials and access tokens that can unlock developer pipelines and cloud environments, and it attempts to spread through npm, PyPI, JFrog Artifactory, GitHub, and GitLab using stolen SSH and Git credentials. Socket reports it also drops a Python backdoor for persistence, raising the stakes for organizations where a single compromised developer machine can cascade into poisoned repos, stolen cloud secrets, or tampered build systems. The techniques listed include T1195.002 (Compromise Software Supply Chain), T1027 (Obfuscated Files or Information), T1105 (Ingress Tool Transfer), T1562.001 (Impair Defenses), and multiple scripting interpreters such as T1059.007 (JavaScript), T1059.006 (Python), and T1059.004 (Unix Shell).
Sogou keyboard attacks spread via DNS hijack
Sogou keyboard users were hit with malware after attackers used DNS hijacking to intercept the app’s traffic and push malicious downloads, echoing a man-in-the-middle incident reported two years earlier. ESET observed infections on July 1 across several countries and tied them to a weakness in the app’s HTTP communication that allowed requests to be modified in transit. For people and organizations using the input method editor on Windows, the impact is practical and immediate: attackers can install malware that collects information and can then deploy additional malicious software. The exact mechanism behind the DNS hijacking remains uncertain, with possibilities ranging from hacked routers to ISP-level interception. Tencent released an updated version on October 30 that moved requests to HTTPS and added certificate pinning.
Top Vulnerabilities Reported in Last 24 hours
Hackers exploit SonicWall SSLVPN login weakness
Attackers are exploiting an authentication weakness in SonicWall SonicOS SSLVPN (CVE-2026-19868) that can lead to unauthorized access and control of affected systems, prompting CISA to add it to the Known Exploited Vulnerabilities (KEV) Catalog. The risk stems from environments relying on single-factor authentication, where an intruder can gain a foothold that can escalate into full control of exposed assets. Attackers are already exploiting this in the wild. CISA highlighted the issue in the context of Binding Operational Directive 26-04, which drives risk-based prioritization of urgent fixes. A patch is available.
WordPress update flaw enables site hijacking
A WordPress core vulnerability (CVE-2026-119977, CVSS 8.1) allows attackers to hijack websites during updates and achieve remote code execution, according to a CISA warning. In plain terms, an attacker who can reach the right temporary update files at the right moment can redirect a site to attacker-controlled infrastructure and take over how it runs. CISA warned about exploitation activity targeting this weakness. Reporting traced the underlying issue back to WordPress 2.7 (released in 2008), underscoring how long-lived update mechanisms can become an attack surface. Fixes are available for WordPress versions 4.7 through 7.1.3.
Plex2Shell attacks breach QNAP NAS devices
A critical vulnerability chain dubbed Plex2Shell is being used to compromise Plex Media Server on NAS devices, letting attackers break into systems that may store years of personal or business data. QNAP says the chain combines four Plex Media Server bugs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) and does not impact QTS, QuTS hero, or other QNAP operating systems directly. Attackers are already exploiting this in the wild. QNAP PSIRT confirmed the issues and said exploitation began after full technical details were published on October 16, with CISA adding the chain to KEV on October 20. A fix is available in Plex Media Server version 1.43.3.10861 or later.
Top Threat Actors Reported in Last 24 hours
Fake GitHub security tools backdoor Windows
A still-unidentified, financially motivated threat actor has spent roughly two years seeding fake security tools on GitHub, recently shifting from crypto wallet users to the cybersecurity professionals who download scripts for scanning and testing. They lure victims with repositories that appear to automate scans, security testing, or log analysis, but instead trigger a PowerShell-driven infection chain that retrieves an encrypted download link. That link pulls down a modular Electron-based loader named ‘Microsoft.exe’, which establishes persistence, elevates privileges, and injects malware into legitimate processes. For security teams, the consequence is blunt: a routine “helper tool” can become an internal foothold for backdoors and infostealers on the very machines used to investigate incidents. The malware also hides code inside Visual Studio project files, Python scripts, and Go source files using long stretches of whitespace, and uses evasion tricks such as spoofing explorer.exe as the parent process, disabling Smart App Control, and suppressing event tracing and antivirus scanning—while attempting to remove ESET, McAfee, and Malwarebytes. Researchers report the campaign has compromised over 2,000 Windows systems, and organizations are urged (per the source) to block and monitor identified IOCs, conduct scans for suspicious scripts/executables, and educate teams on the risks of unverified GitHub tools.
Device code phishing hits U.S. SLTTs
Threat actors are increasingly using device code phishing to quietly take over accounts in U.S. state, local, tribal, and territorial (SLTT) organizations by abusing legitimate OAuth 2.0 sign-in flows. Instead of stealing a password, they trick users with device codes presented as “Access PINs,” which can sidestep familiar defenses such as MFA prompts tied to login forms. After they gain access, the adversary can register additional malicious devices, change email handling rules, and exfiltrate sensitive information—then reuse compromised accounts to launch more phishing and financial fraud. For public-sector teams and the people they serve, that can translate into prolonged mailbox access and downstream fraud that looks like normal cloud activity. The CIS write-up says phishing-as-a-service kits such as Kali365 and EvilTokens are helping scale the technique, and the approach is likely to persist as attackers adapt.
Frequently Asked Questions
What is Microsoft.exe? Fake security tools on GitHub are being used to trick cybersecurity professionals into installing backdoors and information stealers, a campaign that has already compromised over 2,000 Windows systems. The lure is repositories pitched for scan automation, security testing, and log analysis, but the infection chain starts when PowerShell retrieves an encrypted download link and pulls a modular Electron-based loader named Microsoft.exe.
What is strutil-core? strutil-core, a malicious Ruby gem, was caught installing a credential-stealing worm during installation—turning a routine dependency pull into a supply-chain infection. Published as version 1.0.1 on November 1, 2026 at 04:05:04 UTC, it was flagged as malware 70 seconds later and removed by 09:13 UTC, leaving about a five-hour public exposure window.
What is Sogou keyboard? Sogou keyboard users were hit with malware after attackers used DNS hijacking to intercept the app’s traffic and push malicious downloads, echoing a man-in-the-middle incident reported two years earlier. ESET observed infections on July 1 across several countries and tied them to a weakness in the app’s HTTP communication that allowed requests to be modified in transit.
What is CVE-2026-19868? Attackers are exploiting an authentication weakness in SonicWall SonicOS SSLVPN (CVE-2026-19868) that can lead to unauthorized access and control of affected systems, prompting CISA to add it to the Known Exploited Vulnerabilities (KEV) Catalog. The risk stems from environments relying on single-factor authentication, where an intruder can gain a foothold that can escalate into full control of exposed assets.
What is CVE-2026-119977? A WordPress core vulnerability (CVE-2026-119977, CVSS 8.1) allows attackers to hijack websites during updates and achieve remote code execution, according to a CISA warning. In plain terms, an attacker who can reach the right temporary update files at the right moment can redirect a site to attacker-controlled infrastructure and take over how it runs.
What is Plex2Shell? A critical vulnerability chain dubbed Plex2Shell is being used to compromise Plex Media Server on NAS devices, letting attackers break into systems that may store years of personal or business data. QNAP says the chain combines four Plex Media Server bugs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) and does not impact QTS, QuTS hero, or other QNAP operating systems directly.
What is Kali365? Threat actors are increasingly using device code phishing to quietly take over accounts in U.S. state, local, tribal, and territorial (SLTT) organizations by abusing legitimate OAuth 2.0 sign-in flows. Instead of stealing a password, they trick users with device codes presented as “Access PINs,” which can sidestep familiar defenses such as MFA prompts tied to login forms.
What is EvilTokens? Threat actors are increasingly using device code phishing to quietly take over accounts in U.S. state, local, tribal, and territorial (SLTT) organizations by abusing legitimate OAuth 2.0 sign-in flows. Instead of stealing a password, they trick users with device codes presented as “Access PINs,” which can sidestep familiar defenses such as MFA prompts tied to login forms.