60
60
60
Coruna: Spy-grade iOS exploit kit powering financial crime
60
60
60
60
60
Decline in Rig Exploit Kit
Rig exploit kit activity dropped roughly 75% after the pseudo-Darkleech and EITest campaigns stopped using EKs, reflecting an overall decline in exploit kit activity.
Rig EK activity fell sharply in 2017: the pseudo-Darkleech campaign disappeared at the end of March, cutting Rig traffic about 50%, and the EITest campaign switched to tech support scams in late April, cutting another 50% in May. Broader causes include a shrinking browser target base, no major EK zero-day in over a year, and community takedowns of domain shadowing infrastructure. Criminals are shifting to malspam, social engineering schemes like fake HoeflerText notifications, and tech support scams.
15
57
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.
Socket researchers found 13 malicious Composer theme packages across five vendor namespaces (including vsmov, vsphim, and ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. On iPhones running iOS 18.4-18.6.x, the injected code fires a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529, pivoting through the GPU process and the AppleM2ScalerCSCDriver IOKit user client to gain kernel read/write. Since around August 12, 2026 the payload also steals cryptocurrency wallet seeds and mnemonics from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, alongside keychain databases, Wi-Fi passwords, SMS, photos, cookies, and location history, uploaded via HTTPS to rotating C2 domains. The group is believed to be Vietnamese-operated, hosts exploits on Funnull infrastructure, and Apple patched the kernel escape flaw in iOS and macOS 26.1.
75
60
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.
Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.
72
60
60
60
60
⚡ Weekly Recap: Fortinet Exploited, China's AI Hacks, PhaaS Empire Falls & More
60