30
30
35
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.
Manifold Security found 77 extensions uploaded to the Open VSX marketplace between July 26 and August 1, 2026 that impersonate real Microsoft VS Code Marketplace tools, with all 77 sending data to mangorbit.com. 58 lightweight variants exfiltrate the hostname, while 19 recon variants collect editor details, OS username, Git remote hosts, CI environment variables (GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, Codespaces, Gitpod), and installed extension IDs. The recon variant retries for up to seven days and can fall back to a DNS TXT record for exfiltration if the primary domain is blocked. The extensions were removed from Open VSX by August 3, 2026; the disclosure follows a separate npm supply chain campaign, ChainDrop, which compromised 450 packages with a Shai-Hulud worm variant.
40
35
45
35
35
CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.
CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.
35
30
30
30
30
35
30
30
Russian suspect in bank account takeovers is extradited to US
Russian web developer Sergei Filimonov was extradited from Georgia to the US to face charges in a multimillion-dollar bank account takeover fraud.
Sergei Anatolyevich Filimonov, 36, appeared in an Atlanta federal court on September 4 and pleaded not guilty to bank fraud, wire fraud, access device fraud, and aggravated identity theft charges. Prosecutors say that from November 2023 to October 2025 his group bought sponsored search-engine links that diverted online banking customers to spoofed login pages, stole their credentials, and initiated unauthorized wire transfers. The FBI linked the scheme to the December 2025 seizure of the domain web3adspanels.org, identifying at least 19 victims, roughly $14.6 million in confirmed losses, and about $28 million in attempted losses.
45
Investigation of banking hack leads to arrests in Europe, Brazil
German and Brazilian police arrested seven suspects over a 2023 hack that drained an estimated 30 million euros from German bank accounts.
Germany's BKA said three suspects were arrested in Europe and charged with fraud, while Brazil's federal police arrested four others and executed 21 search warrants under Operacao Klonen (Operation Clone). The November 2023 attack exploited a vulnerability at a payment provider and used cloned payment cards to make unauthorized withdrawals from German online banking users, draining an estimated 30 million euros (34.7 million dollars). Funds were laundered through Brazil and four European countries, and courts ordered seizure of assets worth more than 20 million dollars. Brazilian media identified the affected bank as Commerzbank, which said customers suffered no financial loss.
45
35
30
30
30
35
30
30
30
30
30
30
30
30
45
30
30
30
30
30
30
30
30