Malware Activity
Cybersecurity Alert Misconfigured Portals and Compromised AI Tools Create Growing Enterprise Risk
Security researchers have identified two significant cyber threats that highlight how attackers are increasingly exploiting trust and configuration weaknesses rather than traditional software vulnerabilities. In the first campaign, known as City-Forum, threat actors are harvesting sensitive data from Salesforce Experience Cloud and ServiceNow portals by taking advantage of misconfigured guest-user permissions and publicly accessible settings. This allows anonymous users to access records that should not be exposed. At the same time, investigators discovered that malicious versions of the widely used AI gateway LiteLLM were briefly uploaded to PyPI. The malicious version contained hidden code designed to steal cloud credentials, API keys, database passwords, SSH keys, and other sensitive secrets. Although the malicious packages were removed quickly, thousands of organizations may have been exposed, and stolen credentials could remain usable for extended periods. Together, these incidents demonstrate the growing risks associated with cloud platform misconfigurations and software supply chain attacks, where legitimate systems and trusted tools can become pathways for large-scale data theft. Organizations are urged to immediately review portal access controls, remove unnecessary public exposure, identify affected LiteLLM installations, rotate potentially compromised credentials, and monitor for signs of unauthorized activity to reduce the risk of long-term compromise. CTIX analysts will continue to report on the latest malware strains and attack methodologies.
- BleepingComputer: “City-Forum” Data-Theft Attacks Target Salesforce, ServiceNow Portals article
- SecurityWeek.com: Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow with Custom Toolset article
- TheHackerNews: Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations article
Threat Actor Activity
Lazarus Group Using Windows Zero-Day and Fake Job Offers to Target Defense Firms
North Korea’s Lazarus Group is running a new wave of Operation Dream Job against defense, aerospace, and aviation organizations in Europe, India, Brazil, and Western Europe, using fake recruiter outreach and trojanized PDF tools to gain access and deploy advanced malware. Victims are approached with compelling job offers (at firms like Lockheed Martin or Enveil) and lured into opening malicious PDFs or installing a “SecurityPDF” viewer from fake Enveil-branded sites. The infection chain uses MISTPEN, an in-memory downloader that talks to attacker-controlled OneDrive files via Microsoft Graph API, then pulls a Windows zero-day exploit, CVE-2026-68820 (a use-after-free in AFD.sys) to gain SYSTEM privileges. That exploit is negotiated over a post quantum ML KEM (Kyber) key exchange and additional GOST/AES layers, delivering FudModule 3.1, a kernel rootkit that disables EDR telemetry, blinds ETW, and tampers with Smart App Control. Once elevated, Lazarus deploys Troy, a new backdoor with seventeen (17) commands for reconnaissance, file exfiltration, hidden command execution, process killing, in memory DLL injection, and configuration changes. For command-and-control (C2), the group largely uses “borrowed” infrastructure, including compromised Roundcube servers exploited via CVE 2025 49113 and PrestaShop sites, all running a PHP relay webshell called RelayShell. At least seventeen (17) relay servers have been identified. The campaign heavily targets firms working on surveillance sensors, drones, and robotics, and demonstrates Lazarus’s continued evolution toward stealthy, environment aware operations that hide behind trusted branding, top ranked search results, and legitimate web infrastructure, this making traditional “spot the phishing link” advice far less effective.
- Bleeping Computer: Lazarus Operation Dream Job Article
- The Hacker News: Lazarus Operation Dream Job Article
- InfoSecurity: Lazarus Operation Dream Job Article
- Microsoft: CVE-2026-68820 Secuirty Update Dashboard
Vulnerabilities
Public PoC Triggers Active Exploitation of Critical Microsoft SharePoint Authentication Bypass
Threat actors have begun actively exploiting a critical Microsoft SharePoint authentication bypass vulnerability, following Rapid7’s publication of technical details and proof-of-concept (PoC) exploit code. Patched in Microsoft’s July 2026 Patch Tuesday updates, the flaw, tracked as CVE-2026-55040 (CVSS 9.1), stems from multiple weaknesses in the JWT token validation pipeline and allows an unauthenticated remote attacker to forge a valid JWT, impersonate a SharePoint site user or administrator, access sensitive files, and modify data. Rapid7 determined that the exploit chains four (4) validation weaknesses involving unsigned JWTs, SharePoint’s STS certificate thumbprint, inadequate issuer validation, and an actor-token signature that is never properly verified. Its Python-based PoC can also query a target’s domain controller, enumerate users by SID, and identify a site administrator for impersonation. Defused Cyber observed attackers using Rapid7’s PoC against SharePoint honeypots shortly after its release, while KEVIntel recorded twelve (12) exploitation attempts since July 19, 2026, including eight (8) on August 12 – 13, originating from eight (8) IP addresses across five (5) countries and regions, suggesting the public PoC accelerated exploitation. The actors and their objectives remain unknown, and Microsoft has not yet formally classified CVE-2026-55040 as exploited in the wild, despite labeling it an attractive target. With Shadowserver tracking more than 8,500 Internet-exposed SharePoint servers, The U.S. Cybersecurity and Infrastructure Security (CISA) has urged organizations to patch promptly, minimize direct Internet exposure, restrict external access to SharePoint Central Administration, and place necessary Internet-facing deployments behind Layer 7 security controls. The activity reflects a broader pattern of sustained targeting against Microsoft SharePoint. The flaw is reportedly the fifth SharePoint vulnerability exploited in 2026, while CISA has tracked fourteen (14) actively exploited SharePoint flaws since November 2021. Eight (8) of those vulnerabilities have also been linked to ransomware attacks, including CVE-2026-45659, which was recently confirmed to be exploited by ransomware threat actors.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]