CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
CloudSEC researchers got inside the admin panel of BigBear 2.0, an Evilginx2-based phishing-as-a-service operation run by someone known as 'General Boss'. The panel contained 5,137 records tied to 461 organizations: 1,032 plaintext passwords and 4,148 session cookies, with 474 complete MFA-bypassed authentications. The adversary-in-the-middle proxy captures Microsoft 365 session cookies that can be replayed to access email, Teams, SharePoint, and OneDrive, potentially pivoting into Entra ID and federated SaaS. The operation was still active, used custom JavaScript to disable FIDO2/WebAuthn on phishing pages, and routed logins through a residential proxy pool spanning 69 countries.
The BigBear 2.0 phishing-as-a-service framework bypassed MFA to steal 5,000+ Microsoft 365 credentials across 258 organizations, CloudSEK researchers found.
CloudSEK researchers gained administrator access to the BigBear 2.0 control panel, finding the phishing-as-a-service operation ran 42 VPS nodes all configured to target Microsoft 365. The framework has been used to bypass multi-factor authentication at 258 organizations and harvest more than 5,000 credentials, indicating an active credential-theft campaign against enterprise tenants.
CloudSEK found the BigBear 2.0 phishing-as-a-service platform bypassed MFA at 258 organizations and captured over 5,000 Microsoft 365 credentials.
CloudSEK researchers gained administrator access to the BigBear 2.0 phishing-as-a-service control panel and found it had exfiltrated 5,137 credential records, including 474 completed MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies across 3,331 victim IPs in 40+ countries. The Evilginx2-based AitM proxy intercepts credentials and authenticated session cookies, and custom JavaScript interferes with FIDO2/WebAuthn to force weaker authentication. The panel is leased to at least five affiliate operators via Telegram exfiltration bots, and geo-matched residential proxies cover 69 countries to evade detection.
Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.
Palo Alto Networks Unit 42 tracks two ongoing intrusion clusters, CL-CRI-1131 (Mexican transportation, federal ministries, municipal water utilities) and CL-CRI-1163 (Brazilian financial sector), both using living-off-the-land techniques, SOCKS5 relays, and custom RATs. The attackers appear to orchestrate operations via commercial LLMs like Claude and GPT-4.1, evidenced by iterative batch scripts and AI-generated tunneling tool naming. The Mexican campaign (also reported as Operation Escaneo by CloudSEK) exfiltrated sensitive data via dynamic-DNS infrastructure with rotated multi-SAN TLS certificates between February and June 2026. This signals broader adoption of AI-enhanced operations by diverse threat groups in the region.
Australian Federal Police charges two men with 14 offences over TeamPCP supply chain backdoors in Trivy, Checkmarx KICS, and LiteLLM affecting 1,000+ organizations.
The Australian Federal Police charged two Western Australian men, aged 21 and 23, with 14 offences for their alleged principal roles in TeamPCP's March 2026 supply chain attacks; they appeared in Perth Magistrates Court on August 27, 2026. The group stole publishing credentials from trusted open-source projects and pushed poisoned releases across five ecosystems - GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX - with LiteLLM's unpinned Trivy install enabling token theft and backdoored LiteLLM releases. The FBI said the malicious code potentially compromised more than 1,000 organizations, enabled theft of over 500,000 credentials, and exfiltrated at least 300 GB of data. Oligo Security linked the group's infrastructure to activity back to 2020, previously tracked as TA-NATALSTATUS and IronErn.
CISA added actively exploited CVE-2026-21962, a CVSS 10.0 unauthenticated flaw in Oracle HTTP Server and WebLogic Proxy Plug-in, to KEV with an August 27 deadline.
CISA added CVE-2026-21962 (CVSS 10.0), an improper access control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by August 27, 2026. The unauthenticated flaw allows remote attackers with network access to create, delete, or modify critical data, potentially gain broad access, and cause a scope change to other systems; affected versions are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. CloudSEK honeypot data from January-February 2026 showed widespread exploitation of the flaw alongside older WebLogic RCEs including CVE-2020-14882/14883, CVE-2020-2551, and CVE-2017-10271.
153GB archive from the LiteLLM supply chain attack exposes secrets from about 2,500 companies, including AWS, Samsung, Cisco and Salesforce.
Hudson Rock obtained and analyzed a 153GB archive stolen in the LiteLLM supply chain attack, containing 433,909 files with secrets attributed to 2,488 corporate domains, including AWS, Samsung, Cisco, Salesforce, NVIDIA, Microsoft and Siemens. TeamPCP compromised Trivy on March 19, 2026, stole LiteLLM's PyPI publishing tokens through the build pipeline, and published malicious LiteLLM versions 1.82.7 and 1.82.8 on March 24. CloudSEK separately estimated close to 2,500 exposed organizations, and Kevin Beaumont confirmed the data is legitimate. Hudson Rock is running a global ethical disclosure effort and urges organizations to rotate secrets before the trove leaks publicly.
Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.
CloudSEK reported that two malicious LiteLLM releases on PyPI (versions 1.82.7 and 1.82.8, live about 40 minutes on March 24) harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords, with captured loot files mapping potential exposure to more than 2,500 organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. The campaign is part of TeamPCP (tracked by Google as UNC6780), linked to the Aqua Security Trivy scanner compromise tracked as CVE-2026-33634 and added to CISA's Known Exploited Vulnerabilities catalog on March 26. The payload used a litellm_init.pth file executed at Python interpreter startup and exfiltrated secrets to models.litellm[.]cloud; the FBI's FLASH-20260702-01 advisory urged rotation of CI/CD, publishing, and cloud credentials.
Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in
CVE-2026-21962 is an improper access control flaw (CWE-284) in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in (components: the plug-in for Apache HTTP Server and the plug-in for IIS), part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can trivially exploit it, and the scope-change designation means a successful attack can significantly impact additional products beyond the plug-in itself. The attacker gains unauthorized access to critical data (potentially all accessible data) as well as the ability to create, delete, or modify critical data, reflected in the maximum CVSS 10.0 score with high confidentiality and integrity impacts and no availability impact. Organizations running the affected versions - 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 for Oracle HTTP Server and the Apache plug-in, and 12.2.1.4.0 only for the IIS plug-in - especially those with internet-facing Apache/IIS/OHS front ends proxying WebLogic applications, are exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-24, and EPSS assigns a 42% probability of exploitation within 30 days, though no public proof-of-concept is known.
· Oracle HTTP Server (Oracle Fusion Middleware) 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 · Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 KEVlarge
CVE-2020-14882 is a remote code execution vulnerability in Oracle WebLogic Server; its relationship to CVE-2020-14750 (a WebLogic administration console flaw) indicates it is reachable over the network, likely without authentication. An attacker who can reach a vulnerable WebLogic instance can trigger the flaw and execute arbitrary code in the context of the server. Successful exploitation can yield full control of the affected host, enabling data theft, lateral movement, and potentially ransomware deployment (ransomware use is currently unknown). Any organization running Oracle WebLogic Server is affected; WebLogic is widely deployed as a Java application server in large enterprises and government networks, and instances are frequently exposed to the internet. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a maximum EPSS score of 100%, indicating confirmed in-the-wild exploitation.
Unauthenticated Remote Code Execution in Oracle WebLogic Server via IIOP
CVE-2020-2551 is a critical flaw in the WLS Core Components of Oracle WebLogic Server that allows an unauthenticated attacker with network access to the IIOP protocol to remotely compromise the server. An attacker sends crafted IIOP requests directly to a listening WebLogic instance and gains takeover of the server, with high impact to confidentiality, integrity, and availability (CVSS 9.8). Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0 are affected, spanning widely deployed enterprise and government middleware environments. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2023-11-16, and EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), indicating active and likely broad targeting. Because exploitation requires only network reachability to the IIOP listener and no credentials or user interaction, internet-exposed WebLogic servers are the primary targets.
Embedded Malicious Code in Aquasecurity Trivy, trivy-action, and setup-trivy Releases
CVE-2026-33634 is an embedded malicious code (supply chain) vulnerability in which a threat actor using compromised Aquasecurity credentials published a backdoored Trivy v0.69.4 release on March 19, 2026, force-pushed 76 of 77 version tags in the aquasecurity/trivy-action GitHub Action to credential-stealing malware, and replaced all 7 tags in aquasecurity/setup-trivy with malicious commits. The malicious code executes when CI/CD pipelines pull or run the affected Trivy Go module/container image or when workflows resolve the compromised mutable version tags, including runs on March 19-20, 2026 that referenced tags instead of pinned commit SHAs. An attacker gains code execution in developer CI environments and can steal secrets (cloud, registry, and other credentials accessible to affected pipelines), with a repository named 'tpcp-docs' appearing in an organization indicating the fallback exfiltration mechanism fired and secrets were taken. Anyone who pulled or executed Trivy 0.69.4 or referenced affected trivy-action (0.0.1-0.34.2) or setup-trivy (0.2.0-0.2.6) tags is affected, and related malicious LiteLLM releases tied to the same campaign may have exposed 2,100+ organizations. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on March 26, 2026, EPSS estimates a 59.2% probability of exploitation within 30 days, and the FBI reports the TeamPCP actor compromised developer tools to steal cloud credentials.
· Aquasecurity (Aquasec) Trivy (Go module / container image) 0.69.4 (known safe: 0.69.2 and 0.69.3) · Aquasecurity (Aquasec) trivy-action (GitHub Action) 0.0.1 through 0.34.2 (76 of 77 tags force-pushed with malicious commits; known safe: 0.35.0) KEV PoC ×2large
Unauthenticated Remote Code Execution in Oracle WebLogic Server
Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue.
· Oracle WebLogic Server KEV ransomware PoC ×3large
High-Privilege Console Flaw in Oracle WebLogic Server Enables Full Takeover
CVE-2020-14883 is a vulnerability in the Console component of Oracle WebLogic Server that is exploitable over HTTP by a high-privileged attacker with network access; a successful attack results in complete takeover of the WebLogic Server, with high impact to confidentiality, integrity, and availability (CVSS 3.1 score 7.2). Oracle rates it as easily exploitable (low attack complexity, no user interaction required), and public reporting on the actively exploited WebLogic flaws describes unauthenticated attackers accessing critical data, typically because the required privileged console access is first obtained via the related unauthenticated console flaw fixed in the same October 2020 Critical Patch Update. All supported WebLogic versions listed by Oracle are affected - 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 - wherever the administration console is network-reachable. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with applying vendor updates as the required action, EPSS assigns a 97.9% probability of exploitation within 30 days (100th percentile), and public reporting describes malware campaigns against exposed WebLogic servers, including the 8220 gang exploiting older WebLogic flaws to deliver infostealers and cryptominers.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.