BITTER uses malicious VHDX files and WebDAV to deliver PapRAT
BITTER deploys PapRAT RAT via VHDX files and WebDAV links targeting South Asian organizations since at least 2013.
Stories per day · 30 days
2 RSS
13 stories, newest first · one card per story
Stories tagged #webdav
USN-8931-1: Apache HTTP Server vulnerabilities
Ubuntu patched Apache HTTP Server flaws that may leak data, misroute proxy requests, or allow denial of service or code execution.
CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
CVE-2026-92414 lets unauthenticated attackers hijack cached Apache Jackrabbit WebDAV sessions and is rated CVSS 9.3.
Multiple Apache HTTP Server Vulnerabilities Could Enable Code Execution Attacks
Apache HTTP Server 2.4.69 patches 20 flaws, including limited code execution and WebDAV crash risks.
11
CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow
Authenticated WebDAV clients can crash Apache HTTP Server and corrupt property data via CVE-2026-93546.
CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access
CVE-2026-58415 lets remote clients read WebDAV dead properties from Apache mod_dav_fs state files.
CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow
Moderate CVE-2026-42528 in Apache mod_dav lets WebDAV lock creators crash httpd child processes.
RedFlick Uses Scheduled Tasks and Password-Protected Archives to Deploy CosmicPulse Backdoor
Star Blizzard ran 13 RedFlick phishing campaigns in 2026, deploying CosmicPulse against more than 100 organizations.
2
The vulnpocalypse rains iBugs down on Apple with record-setting number of patches
Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.
ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools
Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.
Hackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential-Stealing Malware
Cisco Talos details ClickFix campaigns abusing fake Google CAPTCHA prompts, WebDAV and BNB Smart Chain to deploy the Amatera infostealer.
2
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos details ClearFake WebDAV chains delivering Amatera stealer to a Ukrainian government organization, with cryptocurrency and credential theft payloads.
ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body
A Chinese-speaking actor exploited ownCloud CVE-2023-49105 to steal 176 nuclear research files from Philippine organizations, prompting CISA to add the flaw to KEV.