Today's cybersecurity round-up highlights actively exploited vulnerabilities and innovative new attack methods. Threat actors are leveraging sophisticated techniques, from browser-assembled malware to real-time account hijacking, to bypass traditional defenses.
New Malvertising Campaign Builds Malware in Browser MemoryThreat
A sophisticated malvertising operation, dubbed SourTrade, is distributing malware by having victims' web browsers assemble the malicious executable directly in memory. This method avoids serving a single, complete malicious file, making detection more challenging. The campaign has been active since late 2024, impersonating popular trading platforms like TradingView, Solana, and Luno to target retail traders.
Why it matters: Website owners and users should be vigilant about suspicious advertisements, as this technique bypasses traditional file-based security and could lead to system compromise even without a direct download.
Read more at The Hacker News ↗
Critical Fastjson 1.x RCE Vulnerability Under Active AttackVulnerability
Attackers are actively exploiting a severe vulnerability, CVE-2026-16723, in Alibaba's Fastjson 1.x library for Java, which lacks an official patch. This flaw allows unauthenticated remote code execution in vulnerable Spring Boot applications, granting attackers the same privileges as the Java process. The vulnerability has a CVSS score of 9.0 and requires a confirmed chain of exploitation.
Why it matters: If your website or application uses Fastjson 1.x, immediate action is crucial as this vulnerability is being actively exploited and can lead to full system compromise without authentication.
Read more at The Hacker News ↗
Cl0p Affiliates Exploit PTC Software for Data ExtortionRansomware
Threat actors associated with the Cl0p ransomware group are targeting internet-exposed PTC Windchill and FlexPLM deployments in a new data extortion campaign. They are chaining a pre-authentication information disclosure vulnerability with a server-side flaw in the Windchill login servlet. This allows them to achieve unauthenticated remote code execution and exfiltrate data.
Why it matters: Organizations using PTC Windchill or FlexPLM should verify their systems are not exposed to the internet and immediately apply any available patches to prevent data breaches and ransomware attacks.
Read more at The Hacker News ↗
GitLab RCE Exploit Published for Unpatched ServersVulnerability
A security researcher has released working exploit code for a GitLab vulnerability that GitLab patched six weeks prior, on June 10. The exploit allows any authenticated user with project push access to execute commands as the 'git' user on unpatched self-managed GitLab 18.11.3 servers. It leverages a crafted Jupyter notebook to leak heap information when its commit diff is opened.
Why it matters: If you operate a self-managed GitLab instance, ensure it is fully updated to protect against authenticated remote code execution by malicious users.
Read more at The Hacker News ↗
Ransomware-as-a-Service DevMan Offers Centralized PortalRansomware
The operators behind the DevMan ransomware-as-a-service (RaaS) scheme are utilizing a dedicated web portal to centralize their operations. This platform allows affiliates to generate ransomware payloads, monitor their earnings, and manage victim interactions efficiently. Swiss cybersecurity firm PRODAFT is tracking this centrally administered RaaS under the name Funky Mantis, noting its comprehensive features for affiliates.
Why it matters: The professionalization of RaaS through portals like DevMan makes ransomware more accessible to various threat actors, increasing the risk for all businesses. Implement robust backups and strong security measures.
Read more at The Hacker News ↗
Insurance Phishing Evolves to Real-Time Account HijackingThreat
New research indicates a shift in phishing tactics targeting financial institutions, particularly insurance companies. Rather than merely collecting credentials for later use, modern campaigns are designed for immediate account compromise. Attackers now initiate real-time hijacking sessions, using stolen credentials to access accounts while the victim is still engaging with the phishing site.
Why it matters: Traditional phishing awareness might not suffice; emphasize multi-factor authentication and educate employees about the immediate dangers of entering credentials on suspicious sites, as compromise can be instantaneous.
Read more at The Hacker News ↗
Steam Forums Abused for Cryptominer DistributionThreat
Malicious actors are exploiting Steam discussion forums to spread cryptomining malware through 'ClickFix' attacks. These attacks present themselves as solutions for game or computer issues, but instead, they infect users' devices with XMRig cryptominers. Gamers clicking on these fake fixes unknowingly allow their systems to be used for cryptocurrency mining.
Why it matters: Be cautious when seeking solutions or downloads on public forums. Verify sources and avoid clicking on suspicious links that promise quick fixes, as they can hide unwanted software.
Read more at BleepingComputer ↗
Sextortion Scams Fueled by ShinyHunters Data LeaksBreach
Threat actors are leveraging email addresses exposed in data breaches attributed to the ShinyHunters extortion group to conduct sextortion email scams. These emails demand payment, typically $2,000 in Bitcoin, from victims under false pretenses. The use of previously leaked data makes these scams appear more credible to recipients.
Why it matters: While directly preventing data breaches is challenging, ensure strong, unique passwords for all online accounts and be highly skeptical of any unsolicited emails demanding money.
Read more at BleepingComputer ↗
Rockwell Patches Code Execution Flaws in Industrial SoftwareVulnerability
Rockwell Automation has released patches for multiple code execution vulnerabilities found in its Arena Simulation Software. A security researcher detailed how an attacker could exploit these flaws to target industrial organizations. The vulnerabilities, if left unpatched, could allow malicious actors to compromise critical industrial systems.
Why it matters: If your business uses Rockwell Arena Simulation Software, it's critical to apply these patches immediately to prevent potential attacks on your industrial control systems.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.