Summary
Attackers are turning everyday Mac laptops into persistent footholds for credential theft and cloud account compromise. On cyware.com, researchers detail how a single infection with ICMacOS can drain cryptocurrency wallets, expose SSH keys, and unlock developer secrets, all while surviving system reboots and evading detection.
A critical SQL injection flaw in Arista VeloCloud Orchestrator, tracked as CVE-2026-114625 with a CVSS score of 9.9, is under active exploitation. Intruders can escalate from basic access to operator-level control, rerouting enterprise traffic and mapping network environments, with fixes available in three patched versions.
Qilin, a ransomware-as-a-service group, has struck Australia’s Bathurst RSL Club, exposing over 15,000 members and leaking 30 sensitive documents including passport scans. The attack highlights the ongoing risk of double extortion and identity fraud for organizations facing targeted ransomware campaigns.
Top Malware Reported in the Last 24 Hours
ICMacOS evolves into reboot-proof Mac RAT
ICMacOS has evolved from a password stealer into a remote access trojan (RAT) that can survive reboots and keep harvesting sensitive data long after an initial compromise. It targets browser credentials, password manager databases, cryptocurrency wallets, developer secrets (including SSH keys, AWS and Kubernetes configs, Git/package-manager credentials, and .env files), and messaging-related data. It uses WebSockets for command-and-control and persists by writing a property list under the user’s Library LaunchAgents path, designed to mimic Apple services. The campaign is attributed to GlowComa, described as a financially motivated, Russian-speaking actor, and it has also been promoted under the MADHASH crypto-draining affiliate banner. For individuals and businesses that rely on Macs for development work or financial activity, a single infection can translate into drained wallets, cloud account takeovers, and long-lived access that’s hard to spot. A noted defensive step in the report is checking for suspicious LaunchAgents such as com.apple.systemupdater.plist and investigating unusual outbound traffic flagged by the researchers.
DarkCore RAT promises passwordless account hijacks
DarkCore is a Windows RAT pitched on a cybercrime marketplace as a way to hijack live sessions for services like Gmail and WhatsApp without needing a password. It uses a reverse-proxy approach to impersonate legitimate access and also supports credential theft, file transfers, and hidden desktop control through HVNC, meaning victims may never see what the attacker is doing. The intrusion chain described starts with a malicious shortcut masquerading as a PDF launcher, which pulls down a second-stage payload and attempts to erase telltale Windows markings that flag internet-downloaded files. Researchers said they could not verify every advertised capability, but the tooling and service list show clear intent to monetize account takeovers. For victims, the practical impact is immediate: attackers can slip into email and messaging accounts, read conversations, and potentially pivot into other services that trust those sessions. The report’s defensive guidance centers on blocking known infrastructure, scanning for known file hashes, and revoking suspicious sessions.
Gheist abuses GitHub tokens to dump secrets
Gheist is an active campaign that uses stolen GitHub tokens to plant malicious “secret-dumping” workflows inside repositories, with especially heavy impact in private repos. It commits a workflow named sync-check that prints repository secrets in base32, a trick designed to bypass GitHub’s secret masking and expose production credentials and cloud access keys. Researchers identified two tooling variants behind the activity, suggesting an operation that is iterating and scaling rather than a one-off smash-and-grab. The campaign has also been linked to follow-on abuse such as cryptomining and malware distribution, turning a single token theft into a broader supply-chain and infrastructure risk. For engineering teams, the consequence is that compromised secrets can quickly become real-world outages, account takeovers, or unauthorized cloud spend. The report’s mitigation guidance includes hunting for telltale branch and commit patterns tied to the workflow, revoking compromised tokens, and rotating affected secrets.
Top Vulnerabilities Reported in Last 24 hours
Hackers exploit Arista SD-WAN control plane
Attackers are actively exploiting a critical SQL injection flaw in Arista VeloCloud Orchestrator on-premises that can be used to climb from basic access to operator-level control (CVE-2026-114625, CVSS 9.9). With operator privileges, an intruder could reroute enterprise traffic, weaken network segmentation, or map an organization’s environment from the SD-WAN management plane, raising the risk of outages and data exposure. Attackers are already exploiting this in the wild. Arista attributed the escalation path to a role model weakness where a basic login can be abused to gain higher privileges. A fix is available in versions 5.2.3.18, 6.1.3.10, and 6.4.2.12.
Android Authenticator bug enables token theft
A flaw in Microsoft Authenticator for Android can let a malicious app steal authentication tokens without requesting any device permissions, potentially opening the door to mailbox, files, SharePoint, and chat actions inside an organization (CVE-2026-80097, CVSS 8.6). The issue stems from an exported Android activity (AccountChooserActivity) that other apps can invoke to request tokens, combined with improper validation of the redirect URI that lets attackers impersonate trusted Microsoft apps. In the write-up’s demonstration, an attacker app masqueraded as Microsoft Teams to obtain delegated Microsoft Graph access and receive tokens under different permission scopes. The report also points out that Authenticator did not use getCallingActivity() in its security decisions, which could have helped identify the real caller. Microsoft has patched the issue in version 6.2606.4246.
Oracle Java bug risks silent data tampering
A vulnerability affecting Oracle Java SE and related GraalVM products could allow unauthenticated attackers to compromise systems and then create, delete, or modify critical data, while also accessing any reachable information (CVE-2026-91403). The issue is described as reachable over network protocols including HTTP and HTTPS through APIs in the JSSE component, making it relevant anywhere these runtimes sit behind exposed services. No active exploitation has been reported in the provided source. The affected Oracle Java SE versions listed are 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1, alongside Oracle GraalVM for JDK 17.0.21 and 21.0.13, plus GraalVM Enterprise Edition 21.3.20. Oracle has released security patches.
Top Threat Actors Reported in Last 24 hours
GlowComa turns ICMacOS into RAT
GlowComa, a financially motivated, Russian-speaking threat actor, is behind ICMacOS—a macOS malware family that has evolved from simple password theft into a remote access trojan (RAT) that can survive reboots. They use WebSockets for command-and-control and rely on LaunchAgents for persistence, letting them keep a foothold and continue harvesting data after the initial compromise. Beyond browser and password-manager data, they specifically go after developer and cloud secrets including SSH keys, AWS and Kubernetes configurations, Git and package-manager credentials, and .env files—assets that can unlock production systems and downstream environments. For teams that build or deploy software from Macs, the consequence is that one infected laptop can turn into a pipeline for account takeover, cloud access, and financial theft. The malware has been promoted on underground forums under the MADHASH crypto-draining affiliate banner, and was identified in September 2026 with two variants, including a newer build that adds remote-access functionality.
Qilin ransomware hits Bathurst RSL
Qilin, a ransomware-as-a-service group, has been linked to a cyber security incident at Australia’s Bathurst RSL Club, an organisation with more than 15,000 members. The group listed the club as a victim and reportedly leaked 30 documents including passport scans, with data publication expected within two days. For members and staff, that kind of exposure can translate into identity fraud risk and long-running privacy fallout, even if day-to-day operations continue. Qilin’s operators use a Golang-written ransomware strain with multiple encryption modes, giving affiliates flexibility in how they lock up systems. They also run double extortion, pressuring victims to pay both for decryption and to prevent stolen data from being released.
Gheist abuses GitHub tokens at scale
The Gheist campaign is an ongoing effort to abuse stolen GitHub tokens to plant secret-dumping workflows in repositories, with researchers observing heavy activity in private repos. They add a workflow named sync-check designed to print secrets in base32, a move that can bypass GitHub’s secret masking and expose production credentials and cloud access keys. For both individual developers and enterprises, the practical risk is that a single compromised token can cascade into wider account compromise, cloud access, and downstream breaches. The campaign’s telltale indicators include branches named ci-sync- followed by six characters, commit messages reading ci: sync config, and workflow blob SHAs including f3da2b8b357dcda02fd455d314be2a95007516a6, d09535857a741bbb976bdc084a9a021713133291, 1dc5af9cce950aad1eb1546ecce8565b117540c4, and c665b778b2d822453293003e7ca0bbb2cb08e39d. Wiz reported that the tooling has evolved across two variants, adding features such as timeouts and environment matrices while continuing to focus on extracting secrets at scale.
Frequently Asked Questions
What is ICMacOS? ICMacOS has evolved from a password stealer into a remote access trojan (RAT) that can survive reboots and keep harvesting sensitive data long after an initial compromise. It targets browser credentials, password manager databases, cryptocurrency wallets, developer secrets (including SSH keys, AWS and Kubernetes configs, Git/package-manager credentials, and .env files), and messaging-related data.
What is DarkCore? DarkCore is a Windows RAT pitched on a cybercrime marketplace as a way to hijack live sessions for services like Gmail and WhatsApp without needing a password. It uses a reverse-proxy approach to impersonate legitimate access and also supports credential theft, file transfers, and hidden desktop control through HVNC, meaning victims may never see what the attacker is doing.
What is Gheist? Gheist is an active campaign that uses stolen GitHub tokens to plant malicious “secret-dumping” workflows inside repositories, with especially heavy impact in private repos. It commits a workflow named sync-check that prints repository secrets in base32, a trick designed to bypass GitHub’s secret masking and expose production credentials and cloud access keys.
What is CVE-2026-114625? Attackers are actively exploiting a critical SQL injection flaw in Arista VeloCloud Orchestrator on-premises that can be used to climb from basic access to operator-level control (CVE-2026-114625, CVSS 9.9). With operator privileges, an intruder could reroute enterprise traffic, weaken network segmentation, or map an organization’s environment from the SD-WAN management plane, raising the risk of outages and data exposure.
What is CVE-2026-80097? A flaw in Microsoft Authenticator for Android can let a malicious app steal authentication tokens without requesting any device permissions, potentially opening the door to mailbox, files, SharePoint, and chat actions inside an organization (CVE-2026-80097, CVSS 8.6). The issue stems from an exported Android activity (AccountChooserActivity) that other apps can invoke to request tokens, combined with improper validation of the redirect URI that lets attackers impersonate trusted Microsoft apps.
What is CVE-2026-91403? A vulnerability affecting Oracle Java SE and related GraalVM products could allow unauthenticated attackers to compromise systems and then create, delete, or modify critical data, while also accessing any reachable information (CVE-2026-91403). The issue is described as reachable over network protocols including HTTP and HTTPS through APIs in the JSSE component, making it relevant anywhere these runtimes sit behind exposed services.
What is GlowComa? GlowComa, a financially motivated, Russian-speaking threat actor, is behind ICMacOS—a macOS malware family that has evolved from simple password theft into a remote access trojan (RAT) that can survive reboots. They use WebSockets for command-and-control and rely on LaunchAgents for persistence, letting them keep a foothold and continue harvesting data after the initial compromise.
What is Qilin? Qilin, a ransomware-as-a-service group, has been linked to a cyber security incident at Australia’s Bathurst RSL Club, an organisation with more than 15,000 members. The group listed the club as a victim and reportedly leaked 30 documents including passport scans, with data publication expected within two days.