Once a server is compromised, the malware can install an AI agent that receives instructions through Telegram. The agent can then execute commands, collect information, and send the results back to the attackers.

The campaign starts with a simple security mistake: Docker services exposed to the internet without authentication.

Researchers from ThreatDown discovered the activity after finding an unauthenticated Docker registry that had been exposed since May 2026. The registry contained dozens of repositories and hundreds of image tags, providing researchers with a detailed look at the operation.

CARBONATO Adds an AI Agent

The attackers use the open-source Hermes Agent framework as part of the operation.

Rather than changing the framework itself, they replace its configuration instructions with a short set of commands telling the agent to maintain access, search for sensitive information, and follow instructions received through Telegram.

When an operator sends a task, the AI model processes the request and determines which terminal commands should be used. The commands are then executed on the compromised server, with the results sent back to the attackers.

The agent searches for valuable information such as:

• AI API keys
• SSH credentials
• Access tokens
• Database information

This makes the compromised server useful for more than simply running malware. It can also become a source of credentials that may help attackers access additional systems.

How the Botnet Spreads

CARBONATO looks for Docker daemons that accept unauthenticated connections.

After finding one, the malware can launch a privileged container with access to the host’s files, processes, and network. It then establishes access and creates several persistence mechanisms.

The malware uses methods including:

• Cron jobs
• Systemd timers
• Startup scripts
• OpenRC
• Reverse SSH tunnels

It can also disguise some of its files and processes as normal Linux activity.

Every few minutes, CARBONATO checks networks connected to the compromised server and scans /24 ranges for other exposed Docker services.

When another vulnerable Docker daemon is discovered, the same deployment process can be repeated.

Importantly, the AI agent is not responsible for the automated spreading. Traditional scripts handle the scanning and deployment.

What Security Teams Should Do

The operation highlights the danger of exposing Docker management interfaces directly to the internet.

Organizations should:

• Keep Docker daemon APIs off public networks
• Require authentication for container registries
• Look for unexpected privileged containers
• Investigate unusual Telegram traffic from servers
• Check for unexpected persistence mechanisms
• Rotate exposed AI API keys and other credentials
• Review Docker configurations for unauthorized access

The main lesson is simple: an exposed Docker service can become the starting point for a much larger compromise. Securing container infrastructure should be treated as part of the organization’s overall security strategy.

IoCs

The post Botnet Uses AI Agent to Control Compromised Servers appeared first on First Hackers News.

Instead of downloading a ready-made miner, the attackers built the mining software directly on the compromised computer. This unusual step created activity that security tools could detect.

The incident was discovered in early September 2026 during an investigation of a MagicINFO Premium system. After gaining access, the attackers installed a remote access tool, created an administrator account, disabled Microsoft Defender, and used the machine to mine Monero.

Huntress researchers found the activity while investigating a managed endpoint. The case involved one confirmed system and shows how a vulnerable internet-facing service can lead to long-term access and unauthorized use of computing resources.

Attackers Exploited a MagicINFO Vulnerability

The initial access was linked to CVE-2025-4632, a vulnerability in MagicINFO that allows attackers to write files with system-level privileges.

Samsung released a fix for the flaw in May 2025.

After the initial alert, the customer was advised to address the issue. However, investigators observed new activity eight days later through the same access route.

The attackers attempted to install AnyDesk, a legitimate remote access application, three times.

The first two attempts were blocked by Microsoft Defender. The attackers eventually succeeded and configured a password so they could reconnect to the machine.

They then created a local administrator account and disabled Microsoft Defender, giving themselves a more reliable way to maintain access.

The Miner Was Built on the Infected PC

Once the system was under their control, the attackers launched a Monero miner builder from the user’s Documents folder.

The process started several development tools and C compilers to create the mining software directly on the machine.

This approach helped the attackers avoid simply dropping a finished miner onto the system, but it also created a noticeable trail.

The unsigned builder generated unusual compiler activity that could stand out in endpoint monitoring.

Afterward, investigators observed the miner connecting to a public mining pool and using the compromised system’s computing resources.

The mining activity also appeared to involve Windows Explorer, making the behavior even more suspicious.

What Security Teams Should Watch For

The incident highlights why patching internet-facing MagicINFO installations is important.

Security teams should pay attention to:

• Unexpected remote access software
• New administrator accounts
• Microsoft Defender being disabled
• Unusual compiler activity
• Unknown processes using high CPU resources
• Unexpected connections to cryptocurrency mining pools

Removing the miner is not enough. Teams should also determine how the attacker gained access and whether the vulnerable entry point is still exposed.

The post Samsung Flaw Turns Devices Into Cryptominers appeared first on First Hackers News.

The malware uses a fake document-signing or verification page to trick users into running a command themselves. What looks like a routine security check can instead download and execute malicious code on the computer.

The campaign uses a technique similar to ClickFix-style attacks, where victims are instructed to copy and paste a command into their system.

Researchers from Varonis Threat Labs found AvisLoader on an exposed staging server containing the malware, supporting files, and an operator dashboard.

AvisLoader Uses Peer-to-Peer Communication

Many malware campaigns depend on a fixed website or server to send commands to infected computers. Taking down that infrastructure can disrupt communication.

AvisLoader takes a different approach.

The malware includes the Tox peer-to-peer messaging system inside its Windows executable. This allows infected computers to communicate without depending on a single fixed control domain.

A cybercrime forum seller also claimed that the malware’s controller could be moved by transferring a Tox save file, allowing clients to continue communicating with the same operator identity.

Researchers did not confirm an actual takedown followed by recovery, so this resilience remains a designed capability and seller claim, rather than confirmed real-world behavior.

The malware still leaves signs that security teams can investigate. Its infrastructure uses a Cloudflare tunnel to deliver code, while Tox handles later communication.

The recovered dashboard could display infected-system information such as devices, security software, and administrator status. It also included options for sending commands and additional files.

Malware Can Modify Windows Shortcuts

The recovered AvisLoader sample is a 64-bit Windows executable of about 3.4 MB and runs with the privileges of the user who launches it.

Researchers found code capable of modifying desktop and taskbar shortcuts. A changed shortcut could start the malware before opening the application the user expected, helping the activity blend into normal behavior.

The sample also contained a helper associated with a known Windows privilege-bypass technique and another library capable of hiding selected processes from process listings.

However, these findings show potential capabilities, not confirmed successful attacks against victims.

How to Detect and Avoid the Attack

Users should be cautious of websites that ask them to paste commands into PowerShell, Command Prompt, Terminal, or the Windows Run dialog as part of a verification process.

Security teams should investigate:

• Unexpected command or script execution
• Suspicious peer-to-peer network traffic
• Modified desktop or taskbar shortcuts
• Unusual cloud-hosted connections
• Unknown helper files and backup artifacts

Cloud services should not automatically be blocked because they can have legitimate uses. Instead, security teams should correlate the website, command execution, system changes, and network activity to identify suspicious behavior.

A fake verification step may look harmless, but asking users to execute commands manually can turn them into an active part of the infection process.

IoCs

The post AvisLoader Malware Stays Active After Server Takedowns appeared first on First Hackers News.

The malware hides behind websites that look like Google Play pages. However, the streaming app being promoted is not actually available on Google Play.

In one campaign targeting Italy, the malicious download was shown only to Android users with Italian IP addresses. Researchers from Group-IB identified RemControl in samples dating back to July 2026.

More than 30 banking institutions across Europe, the Middle East, and Canada were found to have matching fake login screens. Italy and France were among the main targets observed, although the exact number of victims is not known.

RemControl is not limited to stealing banking details. It can also monitor the device screen, record user input, and give attackers remote control.

Fake Banking Screens Trick Users

When a targeted banking app is opened, RemControl displays a fake version of the bank’s screen on top of the real application.

The victim may enter sensitive information such as:

• Banking PINs
• Mobile banking codes
• Card expiry details
• Other login information

After the information is submitted, the fake screen disappears and the legitimate banking app appears again.

The fake screens are downloaded from an attacker-controlled server instead of being permanently stored inside the malware. This allows criminals to change the targeted banks without requiring victims to install another application.

Researchers also found signs that an AI assistant may have been used during the development of parts of the criminal platform. However, the malware itself does not appear to use AI on the infected device.

Fake Streaming App Leads to Remote Control

The infection begins with a fake streaming app update page. During installation, the malware can request VPN access and interfere with network traffic from the Play Store.

After installation, RemControl asks the victim to enable Android Accessibility permissions.

With these permissions, the malware can:

• Read information displayed on the screen
• Take screenshots
• Perform taps and swipes
• Record typed text
• Monitor on-screen controls
• Interfere with attempts to remove the malware

This gives attackers much more control than simply stealing a banking PIN.

Users Should Be Careful With App Downloads

RemControl can obtain its command-and-control address through Telegram, allowing attackers to change the server used by infected devices.

The operation also includes a control panel that can help manage infected devices, create malware builds, and view stolen information.

Android users should avoid downloading apps through unfamiliar websites or links, even when the page looks like an official Google Play listing.

Be especially careful if an app unexpectedly asks for VPN or Accessibility permissions. Never enter banking information into a screen that appears unexpectedly.

If you suspect your banking information has been exposed, contact your bank through its official channels immediately.

IoCs

The post New Android Trojan Steals Banking PINs appeared first on First Hackers News.

The malware can steal Mac passwords, browser data, Keychain information, cryptocurrency wallet details, Git settings, and sensitive files.

The latest campaign also uses a more advanced delivery method, making the malware harder to analyze and remove.

Fake Wavel Wallet Delivers the Malware

The attack starts with a fake website pretending to offer a cryptocurrency wallet called Wavel.

When users click “Download for macOS,” they receive a malicious disk image containing a compiled AppleScript file with a .scpt extension.

The file uses embedded JXA code to launch a shell command. Instead of keeping the entire malware directly inside the script, the attacker uses an encoded Base64 payload that is decoded and passed to /bin/zsh.

The next stage downloads a Mach-O utility called pkgunpack. It supports both Apple Silicon and Intel Macs and uses encryption techniques including X25519, SHA-256, and AES-256-GCM to unlock the next-stage payload.

A fresh key pair is generated for every infection, while the attacker’s server provides the key needed to decrypt the payload. This means the encrypted payload cannot simply be recovered through static analysis.

PamStealer Adds Multiple Persistence Methods

After decryption, the malware installs a fake Wavel.app inside:

~/Library/Application Support/System/Finder.app

It then creates a LaunchAgent called:

com.apple.finder.agent

This allows the malware to start when the user logs in, restart after a crash, and run repeatedly.

PamStealer also uses additional methods to survive removal attempts, including changes to:

• ~/.zshrc
• Global Git hooks
• Local repair scripts
• LaunchAgent configuration

The malware also attempts to hide background-item notifications while setting up persistence.

This layered approach means removing one malicious component may not be enough to completely remove the infection.

Malware Steals Passwords and Browser Data

The main stealer, identified as MacClient, displays a fake macOS password request followed by a misleading damaged-application warning.

The entered password is checked locally using macOS authentication mechanisms before being sent to the attackers.

PamStealer also targets data from 17 different browsers, including Chrome, Edge, Brave, Opera, Firefox, Arc, Zen, Waterfox, LibreWolf, Yandex Browser, and CocCoc.

The malware can also look for:

• Keychain information
• Cryptocurrency wallet data
• Browser extensions
• Shell history
• Git configuration
• Login Keychain data
• System information
• The macOS account photo

The stolen information is compressed into a ZIP archive and uploaded to attacker-controlled infrastructure.

How to Stay Protected

Organizations should look for suspicious Finder.app files, unexpected com.apple.finder.agent LaunchAgents, unusual Git hooks, and unexpected .zshrc changes.

Security teams can also block the domains associated with the campaign and investigate suspicious network traffic containing the identified upload header.

For Mac users, the safest approach is to download cryptocurrency wallet applications only from verified vendor websites and avoid opening unexpected .scpt files, especially when they arrive inside disk images.

A fake wallet application can look legitimate while quietly giving attackers access to highly sensitive information.

The post Fake Crypto Wallet Spreads PamStealer on Mac appeared first on First Hackers News.

Tracked as CVE-2026-94545, the vulnerability affects the Node.js version of the ImageResponse feature in the next/og package. It can become dangerous when applications use untrusted data inside SVG images.

The issue affects Next.js 16.2.0 through versions before 16.3.6. Developers should upgrade to Next.js 16.3.6, which includes the fix.

How the Attack Can Happen

ImageResponse is commonly used to generate Open Graph images, social media previews, and other graphics directly from a Next.js application.

The problem appears when user-controlled information is placed into SVG content, attributes, or styles during image generation.

For example, an application might take information from a URL parameter, form, or API request and insert it into an SVG before generating an image.

An attacker could send specially crafted input that reaches the vulnerable image-rendering process. If the application is configured in a vulnerable way, this could result in remote code execution on the server.

The potential impact depends on the application’s permissions and what resources the server can access. A compromised environment could potentially expose sensitive information, modify content, disrupt services, or provide access to other connected systems.

Who Is Affected?

Not every Next.js application is vulnerable.

According to the provided advisory information, applications using the Edge implementation of ImageResponse are not affected.

Applications using the Node.js implementation may also be unaffected if they never place attacker-controlled data into SVG content, attributes, or CSS styles.

The vulnerability has been rated Critical and can be exploited remotely without authentication or user interaction.

Update to Next.js 16.3.6

Developers should review applications that generate images through next/og, especially Open Graph image endpoints that accept URL parameters or other external input.

The recommended action is to:

• Upgrade affected Next.js installations to 16.3.6.
• Check image-generation routes for untrusted input.
• Review SVG content, attributes, and styles that use user-controlled data.
• Avoid passing untrusted input directly into SVG processing.
• Review internet-facing image-generation endpoints.

If an immediate upgrade is not possible, removing attacker-controlled input from SVG processing can reduce the risk.

The vulnerability was reported by security researchers RaghavMaheshwari124 and rafabd1. Given that image-generation endpoints can be exposed to the internet, organizations using the affected Node.js ImageResponse implementation should review and patch their applications promptly.

The post Critical Next.js Bug Puts Applications at Risk appeared first on First Hackers News.

The email address contains a long-lived incoming-email token. GitLab documentation says this token must remain private because anyone who has it can perform actions as the token owner, including creating issues and merge requests.

The problem becomes more serious because the feature can also be used to send code changes into a repository.

A Private Email Address Can Trigger Code Changes

Aikido found that email addresses created for different projects can contain the same account-level token.

An attacker who obtains the address can reportedly change the email format from an issue address to a merge-request address and include a Git patch. By specifying a source branch in the email subject, GitLab can apply the patch using the permissions of the token owner.

This means the feature is not limited to creating unwanted issues.

For example, an attacker could modify a project’s .gitlab-ci.yml file. If the change triggers a CI/CD pipeline, attacker-controlled commands could potentially run within the victim’s project.

Depending on the user’s permissions and pipeline setup, this could expose source code, CI/CD variables, job tokens, or other sensitive information.

Network Restrictions May Not Stop It

The research also found that GitLab’s incoming email workflow can bypass assumptions about IP-based restrictions.

Aikido reported testing a private project that allowed access only from a specific IP address. While browser access and Git cloning were blocked, the emailed patch was still accepted and resulted in a commit to the main branch.

GitLab now documents that incoming email is not covered by IP restrictions, meaning an IP allowlist should not be considered a complete security control for this feature.

An attacker does not necessarily need to spoof the sender either, because GitLab does not currently require the email to come from an address verified on the token owner’s account.

What GitLab Users Should Check

GitLab has treated the behavior as part of the feature’s design rather than a traditional vulnerability. The company has nevertheless updated its interface and documentation to better explain the risks and the capabilities of incoming email addresses.

Organizations should search repositories, documentation, tickets, logs, and public pages for exposed glimt- email addresses and older incoming-mail token formats.

If an address has been exposed, the associated incoming email token should be reset, which invalidates the related project email addresses.

Security teams should also review:

• User permissions
• Protected branch settings
• CI/CD pipelines
• CI/CD variables
• Recent commits
• Audit events

The main takeaway is simple: GitLab project email addresses containing incoming-mail tokens should be treated like credentials and kept secret.

The post GitLab Flaw Lets Attackers Push Code to Private Repos appeared first on First Hackers News.

The vulnerability is tracked as CVE-2026-65660 and has a CVSS score of 8.8. It affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

Since SharePoint environments can contain sensitive company documents and operate with powerful service accounts, a successful attack could potentially lead to credential theft, data theft, movement across the network, or continued access.

A Problem With SharePoint Security Checks

The vulnerability was discovered by Dinh Ho Anh Khoa from Viettel Cyber Security.

The issue involves SharePoint’s SafeControls protection, which is designed to prevent potentially unsafe server-side classes from being loaded while processing Web Part and page content.

The problem occurs when the ToolPane component handles specially crafted Register directives. An attacker can manipulate the way certain values are reconstructed, potentially changing the directive after SharePoint has already performed its security validation.

This can allow dangerous .NET classes to be registered and used as part of a code-execution chain.

The research demonstrated an attack chain involving XamlServices.Parse(), ExpandedWrapper, ObjectDataProvider, and LosFormatter.

The technique can also create an in-memory webshell, meaning an attacker may not need to leave a traditional webshell file on the server.

What Organizations Should Do

Microsoft released fixes for the vulnerability on August 11, 2026.

The affected SharePoint builds mentioned in the provided advisory are:

• SharePoint 2016: 16.0.5565.1001
• SharePoint 2019: 16.0.10417.20198
• SharePoint Subscription Edition: 16.0.19725.20522

Microsoft requires organizations to install all applicable update packages. SharePoint 2016 administrators may need to install both listed packages.

The research also points to a possible connection with an authentication weakness in ToolPane. Under certain configurations that allowed anonymous access, the vulnerabilities could potentially be chained to achieve pre-authentication remote code execution. The provided information says Microsoft addressed that anonymous-access route in its June 9, 2026 update.

Security teams should patch affected SharePoint servers, reduce unnecessary anonymous or internet-facing access, and review activity for suspicious Web Part requests.

During an investigation, teams should also examine IIS logs, ULS logs, Windows events, PowerShell activity, endpoint telemetry, unexpected processes, unusual assemblies, and memory activity.

SharePoint 2013 was also reportedly affected by the underlying technique, but that version reached end of support in 2023. Organizations still running it should consider migration or isolation rather than relying on a future security update.

The post SharePoint Vulnerability Enables Remote Code Execution appeared first on First Hackers News.

The vulnerability is particularly concerning because it can be exploited without authentication. An attacker who reaches a vulnerable Management Server may be able to upload and execute malicious scripts and load arbitrary Java classes.

Since these systems are used to manage security policies and collect information across enterprise networks, a successful compromise could give an attacker access to a highly privileged part of the security environment.

How the Zero-Day Works

CVE-2026-93616 involves a combination of directory traversal and unsafe file-upload behavior in the Check Point Management web service.

An attacker can manipulate file paths to make the service access files from unintended locations. According to Check Point, the vulnerability can also allow an attacker to load an arbitrary Java class without first logging in.

Check Point said it has observed a small number of targeted attacks. The company reported that the activity began before the vulnerability was publicly disclosed, which is why it is classified as a zero-day. The vendor has not publicly identified the attackers or disclosed the full objectives of the observed attacks.

Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent.

Which Versions Are Affected?

Check Point lists several affected releases, including older and currently supported versions. Administrators should check their exact release and Jumbo Hotfix level against the vendor’s advisory before deciding whether their systems are vulnerable.

Check Point says the fix is included in:

• R82.10 Take 45
• R82 Take 127
• R81.20 Take 170
• R81.10 Take 192

The company has also released an R82.20 Security Hotfix. Smart-1 Cloud is not affected because the required fix has already been applied.

What Security Teams Should Do

Organizations running affected Check Point Management products should prioritize applying the appropriate security update.

Until systems can be patched, Check Point recommends keeping Management Servers behind a Security Gateway or firewall and restricting TCP port 19009 to trusted IP addresses. Trusted Clients configured in SmartConsole should also be limited to known internal addresses.

Security teams should also review logs for signs of exploitation rather than checking only internet-facing systems. Check Point provides indicators and investigation guidance that can help identify suspicious activity.

If a vulnerable Management Server shows signs of compromise, teams should preserve relevant logs and forensic data, investigate activity that occurred after the initial access, and contact Check Point Support.

The active exploitation of this vulnerability shows why management infrastructure deserves the same patching priority as internet-facing security appliances. A compromised management server can potentially provide an attacker with access to a central administrative layer of an organization’s security environment.

The post Active Attacks Target Check Point 0-Day appeared first on First Hackers News.

Researchers at Checkmarx found that the package uses a different approach from many malicious npm campaigns. It does not need to execute anything when it is installed.

Instead, the malicious code can remain inactive until an application actually uses the library. This allows the package to collect information about the system and potentially download additional malicious code.

The discovery highlights a growing software supply-chain problem: checking only what happens during installation may not be enough to detect malicious dependencies.

Malware Activates When the Package Is Used

The package does not contain the usual preinstall or postinstall scripts that often attract security checks. This can make it appear less suspicious during an initial review.

The malicious code was reportedly hidden inside a normal B-tree function called BTree.prototype.set. When an application calls this function, the hidden code can begin its activity.

The malware can collect details such as:

• Operating system and architecture
• Computer name
• Processor information
• Available memory
• System uptime

This information is then sent to infrastructure controlled by the attackers.

Researchers also found that the malware uses an Ethereum Sepolia testnet smart contract as part of its communication process. The contract can provide information needed to locate another stage of the attack.

Designed to Hide Its Activity

The malware reportedly uses encryption and additional techniques to retrieve and run a second-stage payload.

Another concerning feature is its ability to remove traces of its activity. Researchers found code designed to delete malicious files and remove the original trigger from the affected function.

This could make investigation more difficult after the package has already executed.

The campaign also reportedly used a convincing repository and developer account history, helping the package appear legitimate to developers searching for a normal dependency.

Why npm Supply-Chain Security Matters

This incident shows why organizations should not rely only on installation-script checks when reviewing npm packages.

Security teams should also examine what a dependency does after installation and during normal application use.

Organizations should:

• Check source code and lockfiles for the affected package.
• Review developer machines, CI systems and build environments.
• Remove suspicious packages and versions.
• Rotate credentials if sensitive information may have been exposed.
• Monitor unexpected network connections and child processes.
• Use isolated environments to test unfamiliar dependencies.
• Keep software inventories and SBOMs up to date.
• Review sudden changes in package ownership, releases or code.

The most important question for organizations is whether the package was simply downloaded or actually executed.

If it was used by a running application, security teams should examine endpoint, network and process logs for signs of system profiling, outbound connections or additional payload activity.

The incident is another reminder that software dependencies can become an entry point for attackers even when they look like ordinary developer tools.

The post Malicious npm Package with 2M Downloads Exposed appeared first on First Hackers News.