- within Strategy topic(s)
Malware Activity
Oracle Database Abuse and Blockchain-Based Malware Reveal New Evasion Tactics
Researchers have identified two (2) sophisticated cyberattack techniques that highlight how threat actors are increasingly abusing legitimate technologies to stay hidden. In the first case, attackers exploited a SQL injection vulnerability in a public-facing application connected to an Oracle database and used Oracle’s built-in Java functionality to create and store a custom toolkit called khunt directly inside the database. This allowed them to execute system commands, access files, harvest credentials, and ultimately gain SYSTEM-level access on a Windows server while avoiding many traditional endpoint security controls. In a separate campaign linked to North Korean threat actors, malicious npm packages were found using a new malware technique called NullReceiver, which hides command-and-control (C2) infrastructure inside Ethereum blockchain transactions rather than embedding server addresses in code. By retrieving and decoding blockchain transaction data, the malware could secretly locate attacker-controlled systems, making detection significantly more difficult. Together, these incidents demonstrate a growing trend of attackers leveraging trusted enterprise platforms and decentralized technologies to evade security monitoring, underscoring the importance of secure application development, stronger access controls, continuous monitoring, and proactive threat hunting across databases, software supply chains, and cloud-connected environments. CTIX analysts will continue to report on the latest malware strains and attack methodologies.
- BleepingComputer: Hackers Run Khunt Post-Exploitation Toolkit from Oracle Database article
- TheHackerNews: Attackers Compile khunt Inside Oracle to Turn SQL Injection into Windows SYSTEM Access article
- TheHackerNews: Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain article
Threat Actor Activity
ChatGPT-Powered Fraud and Scam Center in Cambodia Disrupted by OpenAI
OpenAI disrupted a Cambodia-based scam network operating out of Poipet that used ChatGPT to power a wide range of fraud and human trafficking-linked operations. Working with WhatsApp, OpenAI banned a coordinated cluster of accounts that used its models to create fake personas, draft and translate messages, generate forged documents (such as passports, legal notices, stock confirmations, gambling pages), and produce ads for “chatter” jobs targeting people in India and Bangladesh with false promises of high pay, free flights, and visas. The same tooling supported internal operations of drafting announcements, tracking “employee” debts, fines, and visa issues, and documenting situations consistent with forced labor and detention. The scam followed a “ping zing sting” pattern where initial outreach was made on WhatsApp/Telegram, trust-building via romance, investment, gambling, or law-enforcement narratives, then demands for deposits or “fines,” backed by fake screenshots. OpenAI says the network likely interacted with hundreds of victims, with some losing thousands of dollars, illustrating how criminal groups now use AI to automate and scale every stage of their scams. CTIX Analysts will continue to provide the newest developments around threat actor activities and campaigns.
- The Record: Combodia-linked AI Scam Article
- The Hacker News: Combodia-linked AI Scam Article
- OpenAI: Combodia-linked AI Fraud Operation Report
Vulnerabilities
Critical Paperclip Vulnerabilities Enable Remote Code Execution and Sensitive Data Exposure
Researchers disclosed three (3) critical vulnerabilities in the open-source AI agent control platform Paperclip that could allow attackers to execute arbitrary commands or access sensitive information, with the most severe flaw, tracked as CVE-2026-41679 (CVSS 10), enabling unauthenticated remote code execution (RCE) on internet-accessible deployments configured with default registration settings. By abusing Paperclip’s import functionality and process adapter, attackers could register a new account, self-authorize a board credential, import a malicious AI agent, and execute commands with the privileges of the Paperclip server, potentially exposing source code, credentials, secrets, and internal services. A second critical flaw, tracked as GHSA-x8hx-rhr2-9rf7 (CVSS 9.6), leverages a DNS rebinding attack against Paperclip’s default local_trusted mode, allowing a malicious webpage to execute commands on a developer’s local machine without requiring authentication or stolen credentials. A third vulnerability, tracked as GHSA-xfqj-r5qw-8g4j (CVSS 8.3) stems from insufficient authorization checks across several API endpoints, potentially exposing deployment details, agent documentation, and cross-company data. Although no in-the-wild exploitation has been confirmed as of August 5, 2026, Rapid7 has released a public Metasploit module for CVE-2026-41679 and CISA’s SSVC assessment classifies proof-of-concept exploitation as available, significantly increasing the likelihood of future attacks. CTIX analysts strongly advise any affected organizations to upgrade to Paperclip v2026.416.0 (0.3.1) or later, which introduces stricter import authorization, hostname validation to prevent DNS rebinding, improved authentication and access controls, and additional safeguards against malicious agent imports.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]