INJ3CTOR3 malware steals FreePBX SIP credentials for phone fraud
An updated installer uploads 17 configuration files every minute to two staging servers, Cyble reported on October 28.
64
Vendor
Sangoma
- Mentions · 7d2
- Mentions · 30d2
- All mentions9
- First seenSep 1, 2026
- Last mentioned1d ago
Timeline
9 articles · newest firstINJ3CTOR3 FreePBX implant now steals SIP trunk and admin credentials
Cleaning the host no longer ends exposure: stolen trunk secrets let the operator place calls from anywhere.
66
Week in review: Claude accounts compromised through infostealer, Patch Tuesday forecast
Help Net Security week-in-review roundup: Claude infostealer lockouts, record Patch Tuesday, McKesson breach, SonicWall zero-days, PaperCut attacks.
28
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.
85
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
72
Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
Attackers exploit unauthenticated SQL injection CVE-2026-9586 in Sangoma Switchvox to run PostgreSQL commands and deploy reverse shells.
70
Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)
Attackers actively exploit SQL injection flaw CVE-2026-9586 in unauthenticated Sangoma Switchvox endpoints, dropping reverse shells and second-stage cryptominer malware.
58
CVE-2026-9586 | Sangoma Switchvox Unauthenticated SQL Injection Remote Code Execution Vulnerability
CVE-2026-9586, a critical unauthenticated SQL injection to RCE in Sangoma Switchvox, is being actively exploited against internet-facing systems per honeypot observations.
64
Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586
Horizon3 disclosed CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox leading to RCE, now under active exploitation in the wild.
72
Related CVEs
by mentions- CVE-2026-958619%9.3Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-498692%10.0Authentication bypass leading to unauthenticated RCE in Kestra OSS
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-59822<1%8.8Unauthenticated MCP Endpoint Authentication Bypass in BerriAI LiteLLM
- CVE-2026-4871070%6.5HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)
- CVE-2026-45312<1%9.9RAGFlow: In 0.24.0 and earlier, a Jinja2 template injection in the prompt generator (rag/prompts/generator.py) allows any authenticated…
- CVE-2026-247701%9.8RAGFlow: In version 0.23.1 and possibly earlier versions, the MinerU parser contains a "Zip Slip" vulnerability, allowing an attacker to…
- CVE-2026-62911<1%8.0Capture-Replay Authentication Bypass in Microsoft Exchange Server
Appears with
- Switchvoxproduct · 5
- Sangomaorganization · 3
- CISAorganization · 3
- SonicWallvendor · 3
- Horizon3.aivendor · 2
- Issabelproduct · 2
- Sangoma Switchvoxproduct · 2
- Defused Cybervendor · 2
- FreePBXproduct · 2
- Horizon3organization · 2
- Asteriskproduct · 2
- JFrogvendor · 2
- Horizon3vendor · 2
- JOMANGYmalware · 2
- Kestravendor · 2
- Elastixproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.