Summary
A financial-document lure delivered via WhatsApp is giving attackers SYSTEM-level access on Windows machines by hijacking Task Scheduler and dropping stealthy Vulkan-themed payloads. Cyware highlights that the malware profiles victims, escalates privileges, and establishes a WebSocket connection to 61[.]18[.]208[.]27:8888, enabling hands-on control and persistent access for operators.
Ransomware groups are exploiting a five-month-old authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access (CVE-2026-0257, CVSS 7.8) to open unauthorized VPN sessions. Attackers linked to Qilin and Settra are using this flaw to steal credentials, deploy post-access tools, and threaten business operations, with multiple security firms confirming active exploitation.
A Chinese-speaking hacker leveraged the ARTEX AI penetration-testing suite and Claude agents to breach major South Korean banks, causing outages and exposing sensitive customer data. The attack setup included open directories with session histories and configuration files, prompting the South Korean government to implement emergency IT security measures in response to the risk of downstream fraud.
Top Malware Reported in the Last 24 Hours
WhatsApp malware hijacks Task Scheduler
WhatsApp-delivered malware is hitting Windows users with a financial-document lure that ultimately runs code as SYSTEM by injecting into the Task Scheduler service. After the victim opens a ZIP and launches an executable disguised as a financial statement, it profiles the machine and escalates privileges using ShellExecuteW with the runas verb and by enabling SeDebugPrivilege. It then leans on PoolParty Variant 7 injection and drops Vulkan-themed components (vulkaninfo-64.exe, vulkan-1.dll, vulkan-1.bin) associated with persistence and payload execution, while also enabling activities like reconnaissance, file operations, and remote desktop control. The reporting says it establishes a WebSocket connection to its command-and-control server, giving operators hands-on post-compromise capability. Recommended actions in the report include blocking connections to 61[.]18[.]208[.]27:8888, investigating executions of Statement*.exe from messaging-app downloads or ZIP archives, and monitoring Task Scheduler telemetry for tasks named USOPrivate Kit as well as the specific Vulkan file combination under C:\Program Files\Common Files\.
Casbaneiro waits for banking logins
Casbaneiro is a banking trojan that stays quiet until a victim visits specific banking websites, making infections harder to spot until money-related activity is underway. In August 2026, reporting ties an active campaign to targets in Argentina, Peru, Colombia, and Mexico, using phishing emails with malicious PDFs disguised as invoices and legal notices. It filters victims with geofenced webpages and then pulls down additional components from a ZIP-based infection chain that includes an HTA downloader. The trojan uses Windows Management Instrumentation to check for sandbox environments and creates MD5-named markers in %TEMP% and HKCU\SOFTWARE as part of its tracking and evasion. For victims, the risk is direct: once it activates on a banking session, it can enable account takeover and fraudulent transactions without an obvious malware pop-up.
Reactime repo compromise plants NK implant
Reactime, an open-source React debugging tool, was compromised with a North Korean implant that triggers when developers open the repository in VS Code. The implant is heavily obfuscated and persists via detached processes and eval, and it also rewrites VS Code and Discord to hold onto access while showing zero antivirus detections at the time of reporting. Researchers said it was pushed to twenty branches in late September 2026 with commits backdated to 2020, and later analysis captured the full execution chain on a Windows decoy. It resolves command-and-control using the NullReceiver technique via the Ethereum blockchain, a design that complicates takedowns and traditional blocking. Recommended actions listed by the researchers include checking for specific hashes of injected modules and the loader, auditing for a disguised fa-solid-900.woff2 file, and rotating credentials while checking VS Code and Discord for modified entry points.
Top Vulnerabilities Reported in Last 24 hours
Ransomware gangs keep abusing Palo Alto VPN flaw
An authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access (CVE-2026-0257, CVSS 7.8) is being used to open unauthorized VPN sessions—an entry point that can quickly turn into data theft and ransomware deployment. Once attackers can create a VPN session, they can move deeper into a network, steal credentials, and stage follow-on tools that put business operations at risk. Attackers are already exploiting this in the wild, with reporting spanning Rapid7 in May, Palo Alto’s Unit 42 in June, and Arctic Wolf in July. The activity has been tied to ransomware groups including Qilin and Settra, which have been associated with post-access tooling such as Cobalt Strike, BloodHound, and SharpHound. A patch has been available for five months, and guidance in the report calls out disabling authentication override cookies and terminating active GlobalProtect sessions after patching.
Cisco licensing servers face CVSS 10.0 bugs
Cisco patched multiple critical flaws in Cisco License On-Prem (formerly Smart Software Manager On-Prem), including a maximum-severity issue that could let an attacker bypass trust checks and take over licensing infrastructure (CVE-2026-76482, CVSS 10.0). Across the set, the reported impacts include authentication bypass, arbitrary command execution, credential exposure, and disruption of licensing operations—failures that can cascade into downtime for organizations that depend on licensing to keep systems running. No active exploitation has been observed yet, according to the report. Cisco credited Gabriele Paris of the NATO Cyber Security Centre and Trung Nguyen of CyStack for reporting some of the vulnerabilities. Fixed releases are available (including Release 10-202609 or later for 10-series), and the advisory also calls out verifying installed versions, reviewing access controls post-upgrade, and ensuring all instances are inventoried and updated; Cisco Smart Licensing Utility is not affected.
Hackers disrupt French supermarkets via refrigeration flaws
A cyber-attack hit major French supermarket chains by abusing vulnerabilities in Danfoss refrigeration controllers (CVE-2023-25915, CVE-2025-41450, CVE-2025-41451, CVE-2025-41452), turning cold-chain equipment into a remote target with real-world consequences. Attackers remotely triggered forced defrost cycles and pushed temperatures to 50°C (122°F), causing substantial food stock losses—exactly the kind of physical impact that turns an IT incident into an operational crisis. Attackers are already exploiting this in the wild, based on the described incident. Claroty’s Team82 demonstrated related techniques at DEF CON 34, including ways to disable cooling and falsify temperature readings when industrial systems are exposed to the internet. The report’s stated mitigations emphasize updating Danfoss systems to the latest software versions and implementing robust security controls to keep these controllers off the public internet.
Top Threat Actors Reported in Last 24 hours
Casbaneiro banking trojan waits for bank sites
Casbaneiro, a banking trojan targeting Latin American users for financial gain, is designed to stay quiet until a victim lands on a real banking website—then it springs into action. In an August 2026 campaign, they used phishing emails with malicious PDFs disguised as invoices and legal notices to pull victims into an infection chain. The attack flow relies on a ZIP archive that drops an HTA downloader, which then retrieves additional scripts and payloads to complete the compromise. For customers and small businesses in Argentina, Peru, Colombia, and Mexico, this kind of “only-when-you-bank” behavior raises the odds that stolen credentials and fraudulent transactions happen before anyone realizes a device is infected. The trojan checks for sandboxing via Windows Management Instrumentation and creates mutexes to reduce analysis and repeat execution, while also refusing to run on systems set to German, French, or English.
North Korea-linked implant hits Reactime developers
A North Korea-linked implant was found hiding inside Reactime, a widely used open-source React debugging tool—turning a developer utility into a silent foothold for espionage or follow-on theft. The malicious changes were pushed to twenty branches in late September 2026, with commits backdated to 2020, and the code executes when the repository is opened in VS Code. After triggering, they use obfuscated JavaScript (including eval and detached processes) and even rewrite VS Code and Discord to keep persistence on the victim machine. For developers and organizations that depend on open-source tooling, the consequence is that everyday workflows—like opening a repo—can become the entry point into internal systems and credentials. Researchers said the malware uses the NullReceiver technique to resolve C2 via the Ethereum blockchain, and it also disguises components as benign files such as fa-solid-900.woff2.
AI-assisted hacker hits South Korean banks
A Chinese-speaking hacker used the ARTEX AI penetration-testing suite and Claude agents to attack major South Korean banks, triggering outages and exposing personal and financial data. They targeted institutions including Shinhan Bank, KB Kookmin Bank, and Hana Bank, and the South Korean government responded with emergency measures aimed at securing critical IT systems. Reporting said the attacker’s setup included open directories containing Claude Code session histories and ARTEX configuration files, offering a rare look at how AI tooling was integrated into the operation. For bank customers, the immediate impact is the risk of downstream fraud and identity misuse tied to exposed account and personal details, even if the initial theft wasn’t immediately monetized. The ARTEX instance was configured to use DeepSeek v4.1-flash as the primary LLM backend, supplemented by GLM-5.3 and Grok 4.6, and they were seen looking toward Telegram data-sales groups focused on Korea—suggesting potential future exploitation of the stolen data.
Frequently Asked Questions
What is WhatsApp-delivered malware? WhatsApp-delivered malware is hitting Windows users with a financial-document lure that ultimately runs code as SYSTEM by injecting into the Task Scheduler service. After the victim opens a ZIP and launches an executable disguised as a financial statement, it profiles the machine and escalates privileges using ShellExecuteW with the runas verb and by enabling SeDebugPrivilege.
What is Casbaneiro? Casbaneiro is a banking trojan that stays quiet until a victim visits specific banking websites, making infections harder to spot until money-related activity is underway. In August 2026, reporting ties an active campaign to targets in Argentina, Peru, Colombia, and Mexico, using phishing emails with malicious PDFs disguised as invoices and legal notices.
What is Reactime? Reactime, an open-source React debugging tool, was compromised with a North Korean implant that triggers when developers open the repository in VS Code. The implant is heavily obfuscated and persists via detached processes and eval, and it also rewrites VS Code and Discord to hold onto access while showing zero antivirus detections at the time of reporting.
What is CVE-2026-0257? An authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access (CVE-2026-0257, CVSS 7.8) is being used to open unauthorized VPN sessions—an entry point that can quickly turn into data theft and ransomware deployment. Once attackers can create a VPN session, they can move deeper into a network, steal credentials, and stage follow-on tools that put business operations at risk.
What is CVE-2026-76482? Cisco patched multiple critical flaws in Cisco License On-Prem (formerly Smart Software Manager On-Prem), including a maximum-severity issue that could let an attacker bypass trust checks and take over licensing infrastructure (CVE-2026-76482, CVSS 10.0). Across the set, the reported impacts include authentication bypass, arbitrary command execution, credential exposure, and disruption of licensing operations—failures that can cascade into downtime for organizations that depend on licensing to keep systems running.
What is CVE-2023-25915? A cyber-attack hit major French supermarket chains by abusing vulnerabilities in Danfoss refrigeration controllers (CVE-2023-25915, CVE-2025-41450, CVE-2025-41451, CVE-2025-41452), turning cold-chain equipment into a remote target with real-world consequences. Attackers remotely triggered forced defrost cycles and pushed temperatures to 50°C (122°F), causing substantial food stock losses—exactly the kind of physical impact that turns an IT incident into an operational crisis.
What is Casbaneiro? Casbaneiro, a banking trojan targeting Latin American users for financial gain, is designed to stay quiet until a victim lands on a real banking website—then it springs into action. In an August 2026 campaign, they used phishing emails with malicious PDFs disguised as invoices and legal notices to pull victims into an infection chain.
What is Reactime? A North Korea-linked implant was found hiding inside Reactime, a widely used open-source React debugging tool—turning a developer utility into a silent foothold for espionage or follow-on theft. The malicious changes were pushed to twenty branches in late September 2026, with commits backdated to 2020, and the code executes when the repository is opened in VS Code.
What is ARTEX? A Chinese-speaking hacker used the ARTEX AI penetration-testing suite and Claude agents to attack major South Korean banks, triggering outages and exposing personal and financial data. They targeted institutions including Shinhan Bank, KB Kookmin Bank, and Hana Bank, and the South Korean government responded with emergency measures aimed at securing critical IT systems.