Summary
A single ad impression can now open the door to surveillance-grade compromise, as the AdFection campaign leverages targeted advertising to deliver zero-click spyware. Discover-Tech’s platform, Controlium, has enabled infections across more than 120,000 websites and 70,000 mobile apps, reaching sensitive networks like Al Jazeera, the U.S. Department of Defense, and NATO. Cyware highlights how routine browsing has become a silent entry point for attackers, with no click or download required.
A critical flaw in Fortinet FortiClient EMS, tracked as CVE-2026-35616, is letting unauthenticated attackers bypass authentication and seize administrative API access. Attackers are already exploiting this bug in the wild, using public proof-of-concept code to push actions across fleets of enterprise devices. The vulnerability affects versions 7.4.5 through 7.4.6, with a fix available in 7.4.7 or later.
TAG-193, also known as Silent Lynx, is quietly infiltrating government institutions across Central Asia and the CIS to collect sensitive state information. The group exploits the WinRAR flaw CVE-2025-8088 and uses compromised email accounts and public services like GitHub to stage malicious scripts. Their focus on agriculture, environmental management, and diplomacy puts critical regional data and negotiations at risk.
Top Malware Reported in the Last 24 Hours
BYOVD services help ransomware kill EDR
Bring Your Own Vulnerable Driver (BYOVD) has shifted from a one-off trick into a service economy that helps ransomware crews shut down endpoint defenses before encryption begins. Tools sold and reused across groups—such as Terminator, AvNeutralizer, and EDRKillShifter—let attackers disable EDR by abusing vulnerable drivers, turning a technical edge into something that can be bought and scaled. SentinelOne describes an emerging supply chain with shared infrastructure, code reuse, and a steady driver supply, which lowers the barrier for multiple crews to run the same EDR-killing playbook. The activity has been associated with ransomware groups including Medusa Locker, LockBit, Black Basta, AvosLocker, BlackCat, and Trigona. For victims, the consequence is straightforward: once monitoring is blinded, attackers can operate longer inside networks and launch ransomware with fewer alarms.
PEERSTITCH implant hits FortiGate memory
PEERSTITCH is a stealthy FortiGate implant that Unit 42 says was used in a telecom intrusion after attackers exploited CVE-2024-47575 and CVE-2025-61624. Instead of relying on obvious files on disk, it is memory-resident ARM64 malware designed to minimize forensic traces while keeping control of the device. Unit 42 reports the intruders used Apache mod_md to establish reverse shells and impersonated the FortiManager platform to issue commands to managed firewalls. The toolset included named components such as lldprx, pM.js, index.js, index.wasm, and ipssem.js as part of its operation. For a telecom environment, that kind of covert firewall access can translate into prolonged network visibility and the ability to pivot deeper without the usual perimeter controls stopping them.
AdFection ads deliver zero-click spyware
AdFection is a spyware campaign that uses targeted advertising as a delivery channel, with reporting describing infections that can happen through zero-click ads. The operation is tied to Discover-Tech and its platform Controlium, which the report says supports de-anonymization and automated infection as part of the adtech workflow. Cyberscoop reports the campaign involved mercenary spyware partners including Candiru, Bindecy, and Intelos, with Candiru-style capabilities ranging from data theft to microphone and camera access. The same reporting says Discover-Tech ads appeared across more than 120,000 websites and 70,000 mobile apps, reaching sensitive networks such as Al Jazeera, the U.S. Department of Defense, and NATO. For people inside targeted organizations, the danger is that routine browsing and ad delivery can become a silent entry point for surveillance-grade compromise without a click or download.
Top Vulnerabilities Reported in Last 24 hours
Fortinet EMS bug opens admin APIs
A critical authentication bypass in Fortinet FortiClient EMS (CVE-2026-35616) lets unauthenticated attackers reach protected API endpoints and gain administrative API access, a path that can ripple into unauthorized code execution across managed enterprise endpoints. In practical terms, an intruder who reaches these management controls could push actions across fleets of devices and disrupt business operations at scale. Attackers are already exploiting this in the wild, and a public proof-of-concept is available. Bishop Fox tied the issue to certificate-based authentication handling, where attackers can spoof the X-SSL-CLIENT-VERIFY header to appear trusted. The public GitHub repository "CVE-2026-35616 FortiClient EMS Pre-Auth Bypass" includes a Python exploit script named cve_2026_35616[.]py, and Fortinet says affected versions are 7.4.5 through 7.4.6. A fix is available in FortiClient EMS 7.4.7 or later.
Ivanti zero-day chain leads to root
An authentication bypass in Ivanti Connect Secure (CVE-2026-104935, CVSS 8.6) is being used to let remote, unauthenticated attackers execute arbitrary commands and move toward full device takeover. Once inside, attackers can steal credentials and data, then use the edge appliance as a foothold to pivot deeper into a victim’s network. Attackers are already exploiting this in the wild. Security reporting links exploitation to threat actors including UTA0576, which has been described as chaining this issue with other bugs to reach root control of the appliance. The affected versions listed are 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, and the report also highlights how AI is increasingly used to accelerate vulnerability discovery and exploitation.
Cisco email gateways hit by root bug
A critical zero-day in Cisco Secure Email Gateway (CVE-2026-76519) is being exploited to give attackers root access, potentially handing over full control of affected email security appliances. The attack arrives via specially crafted email attachments that the gateway processes, meaning the security tool meant to stop malware can be turned into an entry point. Attackers are already exploiting this in the wild. The issue is reported in the product’s Advanced Malware Protection (AMP) feature and affects both physical and virtual appliances running vulnerable AsyncOS software; Cisco Secure Email and Web Manager and Secure Web Appliance are not affected. A fix is available in AsyncOS 15.5.5-014 or 16.5.0-780, or by updating Content Scanner Tools to 25.3.0.5525 or later.
Top Threat Actors Reported in Last 24 hours
TAG-193 spies on Central Asian governments
TAG-193 (also known as Silent Lynx), a suspected Kazakhstan-based espionage group, is quietly burrowing into government institutions across Central Asia and the CIS to collect sensitive state information. They have leaned on compromised government email accounts and trusted public services like GitHub to stage malicious scripts, helping their activity blend into normal workflows. In a recent shift, they adopted an infection chain that exploits the WinRAR flaw CVE-2025-8088 and pairs it with lightweight reverse shells to keep access simple and hard to spot. The focus on agriculture, environmental management, and diplomacy puts resource decisions and regional negotiations at risk, because those agencies hold data that can shape everything from land use to cross-border policy. Recorded Future said language artifacts and working-hour patterns align with Kazakhstan.
Discover-Tech ad network pushes zero-click spyware
The AdFection campaign centers on Discover-Tech, a company accused of using targeted advertising as a zero-click delivery channel for mercenary spyware tied to firms including Candiru, Bindecy, and Intelos. Its ads reportedly appeared on more than 120,000 websites and 70,000 mobile apps, with targeting that included sensitive networks such as Al Jazeera, the U.S. Department of Defense, and NATO. The operation leans on adtech plumbing to enable de-anonymization and automated infection via Discover-Tech’s platform, Controlium, turning routine ad impressions into a potential compromise path without user interaction. Another component, DARK CARTOGRAPHER, is described as exploiting mobile carrier weaknesses to link advertising IDs to phone numbers, enabling mass deanonymization at scale. Google and IAB Europe removed Discover-Tech from their vendor lists following the reporting.
CoGUI phishing kits fuel billion-message scams
Microsoft says it disrupted three phishing kits—CoGUI, Haozi, and Iron Man System—tied to a Chinese-language cybercriminal ecosystem that pushed more than one billion scam messages. The campaign used the YAM Store marketplace to sell and distribute kits that impersonated brands including Amazon, Apple, and Rakuten, supporting high-volume credential theft across multiple countries. They also abused compromised Microsoft and Google cloud environments and automation that hunted for expired environments, letting them scale operations with app-only admin panels rather than hands-on setup. To keep victims moving through the trap, the kits used evasive flows like fake CAPTCHA gates, IP blocklists, Telegram alerts, and real-time tracking of stolen data via WebSocket. Microsoft said it worked with Health-ISAC, JC3, and private-sector partners as part of the disruption.
Frequently Asked Questions
What is Bring Your Own Vulnerable Driver (BYOVD)? Bring Your Own Vulnerable Driver (BYOVD) has shifted from a one-off trick into a service economy that helps ransomware crews shut down endpoint defenses before encryption begins. Tools sold and reused across groups—such as Terminator, AvNeutralizer, and EDRKillShifter—let attackers disable EDR by abusing vulnerable drivers, turning a technical edge into something that can be bought and scaled.
What is PEERSTITCH? PEERSTITCH is a stealthy FortiGate implant that Unit 42 says was used in a telecom intrusion after attackers exploited CVE-2024-47575 and CVE-2025-61624. Instead of relying on obvious files on disk, it is memory-resident ARM64 malware designed to minimize forensic traces while keeping control of the device.
What is AdFection? AdFection is a spyware campaign that uses targeted advertising as a delivery channel, with reporting describing infections that can happen through zero-click ads. The operation is tied to Discover-Tech and its platform Controlium, which the report says supports de-anonymization and automated infection as part of the adtech workflow.
What is CVE-2026-35616? A critical authentication bypass in Fortinet FortiClient EMS (CVE-2026-35616) lets unauthenticated attackers reach protected API endpoints and gain administrative API access, a path that can ripple into unauthorized code execution across managed enterprise endpoints. In practical terms, an intruder who reaches these management controls could push actions across fleets of devices and disrupt business operations at scale.
What is CVE-2026-104935? An authentication bypass in Ivanti Connect Secure (CVE-2026-104935, CVSS 8.6) is being used to let remote, unauthenticated attackers execute arbitrary commands and move toward full device takeover. Once inside, attackers can steal credentials and data, then use the edge appliance as a foothold to pivot deeper into a victim’s network.
What is CVE-2026-76519? A critical zero-day in Cisco Secure Email Gateway (CVE-2026-76519) is being exploited to give attackers root access, potentially handing over full control of affected email security appliances. The attack arrives via specially crafted email attachments that the gateway processes, meaning the security tool meant to stop malware can be turned into an entry point.
What is TAG-193? TAG-193 (also known as Silent Lynx), a suspected Kazakhstan-based espionage group, is quietly burrowing into government institutions across Central Asia and the CIS to collect sensitive state information. They have leaned on compromised government email accounts and trusted public services like GitHub to stage malicious scripts, helping their activity blend into normal workflows.
What is AdFection? The AdFection campaign centers on Discover-Tech, a company accused of using targeted advertising as a zero-click delivery channel for mercenary spyware tied to firms including Candiru, Bindecy, and Intelos. Its ads reportedly appeared on more than 120,000 websites and 70,000 mobile apps, with targeting that included sensitive networks such as Al Jazeera, the U.S. Department of Defense, and NATO.
What is CoGUI? Microsoft says it disrupted three phishing kits—CoGUI, Haozi, and Iron Man System—tied to a Chinese-language cybercriminal ecosystem that pushed more than one billion scam messages. The campaign used the YAM Store marketplace to sell and distribute kits that impersonated brands including Amazon, Apple, and Rakuten, supporting high-volume credential theft across multiple countries.