Graphalgo Campaign Targets HashiCorp Terraform Registry via Malicious Go-Based Providers
The Graphalgo campaign involves the distribution of malicious Go modules and Terraform providers via the HashiCorp Terraform Registry. Threat actors, attributed to a DPRK-linked group, utilize fake job application lures to induce the initialization of compromised providers such as gocommunity-io/dockerd and kreuzwenker/terraform-provider-vault. These modules execute obfuscated init routines and goroutines to deploy a Go-compiled Remote Access Trojan (RAT) and establish reverse TCP shells. The campaign has affected over 120 organizations through 379 observed downloads, facilitating credential theft, persistence via cron, and lateral movement within CI/CD pipelines.
Weekly Roundup: Cisco ASA, Android, BragJack, and Anthropic/OpenAI AI Exploitation
A coordinated set of zero-day flaws and novel abuse techniques have impacted enterprise firewalls, mobile OS kernels, and browser-based AI agents. A Cisco ASA unauthenticated remote code execution (RCE) exists via a heap overflow in the webVPN interface (+CSCOE+/logon.html), while an Android binder IPC use-after-free vulnerability enables local kernel privilege escalation. Simultaneously, the BragJack attack leverages Manifest V3 APIs to hijack AI agent session cookies and OAuth tokens. Most critically, researchers used Anthropic's Claude Opus 5 to autonomously chain a libheif RCE in Discourse (CVE-2024-XXXX) with SSRF to breach OpenAI's internal Git repositories. Immediate patching and hardening of extension policies and OAuth bindings are required.
Lunex MaaS Platform Weaponizes AMD Driver CVE-2025-54517
The Lunex Malware-as-a-Service (MaaS) platform is deploying the Psychedelic Stealer by exploiting CVE-2025-54517 in the legitimate AMD driver amdhdl64.sys. This campaign utilizes a Bring Your Own Vulnerable Driver (BYOVD) technique to achieve unsigned kernel-mode code execution, allowing attackers to disable EDR sensors within approximately two minutes of infection. Following defense neutralization, the stealer harvests browser credentials, session cookies, and autofill data from Chrome, Edge, and Firefox. Targeting Ukrainian-speaking users via fake CAPTCHA/ClickFix social engineering prompts, the campaign has impacted approximately 12,000 endpoints, resulting in significant credential theft and an estimated $3.2M in financial losses.
ClickFix Malware Campaign: Decentralized Payload Hosting via WordPress Exploitation
A widespread cyberattack campaign has compromised over 5,400 WordPress websites to distribute multi-stage malware using the "ClickFix" social engineering technique. Attackers leverage critical RCE vulnerabilities in plugins—including CVE-2026-14894 (Super Forms) and CVE-2026-32475 (Elementor Pro)—to inject scripts that display deceptive Cloudflare CAPTCHAs or browser error prompts. These lures trick users into manually executing malicious PowerShell or Terminal commands. To ensure resilience, the campaign utilizes "EtherHiding," hosting payloads and C2 resolution on the Polygon and BNB Smart Chain blockchains. Impacted systems are infected with diverse payloads, including DeepLoad, KongTuke (ModeloRAT), and ACR Stealer, targeting both Windows and macOS environments for enterprise credential theft and network intrusion.