# Threat Intel Brief — August 8, 2026

TL;DR

  • Critical supply chain attack: Nearly 800 malicious npm packages delivered cross-platform RAT and infostealer malware via typosquatting, targeting developers on Windows, macOS, and Linux.
  • 18-year-old Linux kernel flaw: Use-after-free vulnerability in SCTP networking code enables local root escalation and container escape; patches released August 3.
  • WordPress pre-auth XSS: CVE-2026-64638 affects all WordPress versions, chainable to PHP code execution via admin interaction; patch released August 6.
  • UNC6671 vishing campaign: Data extortion group targeting financial services via voice phishing to steal SaaS credentials and exfiltrate payroll data.
  • Cisco critical vulnerabilities: Multiple critical-severity flaws in Catalyst SD-WAN and IOS XE platforms require immediate patching; three vulnerabilities rated CVSS 9.8+.

---

Critical Threats

npm Supply Chain Attack Delivers Cross-Platform Malware

What happened: Attackers published approximately 800 malicious packages to the npm registry using typosquatting and AI-generated names. The packages deliver WEL1DROPPER, which fetches platform-specific payloads including Sliver C2 framework and custom infostealers for Windows, macOS (x64/ARM64), and Linux. Unlike typical npm attacks using install hooks, these packages require developers to manually load them via require() statements per README instructions, reducing automatic infection but increasing dwell time if integrated into projects. Infrastructure is hosted on Cloudflare Workers and wel1[.]ru subdomains. Windows payloads patch ETW and AMSI for evasion; macOS variants establish LaunchAgent persistence; Linux payloads deploy UPX-packed ELF binaries.

Impact: High risk for development teams using npm. Payloads establish persistence, exfiltrate credentials, and enable remote command execution. Evidence suggests targeting of Russian financial institutions. The campaign represents an evolution of the April 2026 "Moika" campaign, escalating from 250 to 800 packages with enhanced anti-analysis capabilities.

Recommendations:

  • Audit package.json and lock files for typosquatted or unfamiliar package names; verify download counts and maintainer reputation.
  • Block network access to oob-worker.cf103-070.workers[.]dev, oob-worker.cf102-baf.workers[.]dev, oob-worker.cf99-9b3.workers[.]dev, and wel1[.]ru (including subdomains sdk.dl, ext.dl, pkg.dl, net.dl).
  • Scan endpoints for persistence mechanisms: Windows Registry Run keys, scheduled tasks, macOS LaunchAgents, and Linux cron jobs.
  • Enable npm audit in CI/CD pipelines and configure dependency scanning tools to flag packages with suspicious README instructions.
  • Monitor DNS queries for TXT record lookups to wel1[.]ru subdomains.

---

18-Year-Old Linux SCTP Vulnerability Enables Root Escalation

What happened: Tencent Zhuque Lab discovered a use-after-free vulnerability in Linux kernel SCTP networking code present since kernel 2.6.25 (2008). The flaw allows local attackers to escalate to root privileges and escape containers. Tencent demonstrated successful container escape to host in 6 of 8 test attempts. Patches released August 3 in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148. CVE: see source.

Impact: Local privilege escalation and container escape on systems with SCTP enabled. Primary risk to multi-tenant cloud environments where containers share kernel resources. Exposure limited by requirement for local access and SCTP protocol availability, though the 18-year presence represents significant historical exposure.

Recommendations:

  • Update to patched kernel versions immediately: 7.1.6, 6.18.42, 6.12.101, or 6.6.148.
  • Verify patch status via distribution security tracker (kernel version string alone insufficient due to backports).
  • If SCTP is not required, blacklist the sctp kernel module: add install sctp /bin/true to /etc/modprobe.d/.
  • Review container configurations for socket access policies and seccomp profiles.
  • Monitor for abnormal SCTP traffic or unexpected kernel module loads.

---

WordPress Pre-Authentication XSS Chainable to RCE

What happened: Security researchers at pwn.ai discovered CVE-2026-64638, a pre-authentication reflected XSS vulnerability affecting all WordPress versions prior to 7.0.3. The flaw exists on the WordPress login page and can be chained with social engineering to achieve PHP code execution when an administrator interacts with an attacker-controlled page. The attack chain leverages Same Origin Method Execution (SOME) techniques to invoke WordPress's Application Password approval control, creating API credentials without stealing primary passwords. This enables authenticated REST API plugin upload of malicious ZIP files containing PHP code. CVSS score: 8.9.

Impact: Pre-authentication XSS allows JavaScript execution in visitor browsers without credentials. When chained against logged-in administrators, attackers can create Application Password credentials, upload malicious plugins via REST API, and achieve PHP code execution with web server privileges. Successful exploitation exposes database credentials, enables persistent admin account creation, and permits OS command execution.

Recommendations:

  • Update all WordPress installations to version 7.0.3 immediately; verify automatic background updates completed successfully.
  • Audit Application Passwords in WordPress admin dashboard and revoke any unrecognized credentials created after July 26, 2026.
  • Review WordPress access logs for failed login attempts with unusual or malformed usernames containing HTML-like patterns between July 26 and patch deployment.
  • Monitor for unauthorized plugin installations, new administrator accounts, or unexpected file uploads in wp-content/plugins/ and wp-content/uploads/.
  • Implement web application firewall rules to detect malformed username parameters on wp-login.php.

---

Cisco Critical Vulnerabilities in SD-WAN and IOS XE

What happened: Cisco released patches for 12 security vulnerabilities affecting Catalyst SD-WAN and IOS XE Software, including three flaws with CVSS scores of 9.8+. The vulnerabilities impact SD-WAN devices regardless of configuration and IOS XE Software running in autonomous or controller mode. CVE-2026-20200 (Cisco Integrated Management Controller, CVSS 8.8) has a public proof-of-concept exploit and allows low-privilege attackers to gain root access below OS-level detection, compromising BIOS, SecureBoot, and the hardware trust anchor. CERT.BE issued critical-severity advisories urging immediate patching.

Impact: Unauthenticated remote attackers can exploit input validation, access control, and command injection flaws. Organizations running affected Cisco network infrastructure face potential unauthorized access, privilege escalation, and persistent compromise. The IMC vulnerability enables attackers to compromise the hardware trust anchor.

Recommendations:

  • Upgrade Cisco Catalyst SD-WAN Software to fixed versions: 20.9.10, 20.12.8.1, 20.15.6, 20.18.4, or 26.1.2.
  • Upgrade Cisco IOS XE Software to fixed versions: 17.9.10, 17.12.8, 17.15.6, 17.18.4/17.18.4a, or 26.1.2.
  • Patch Cisco Integrated Management Controller (IMC) immediately to address CVE-2026-20200 due to available PoC exploit.
  • Audit IMC access logs for unauthorized authentication attempts or privilege escalation activity.
  • Review Cisco security advisories for device-specific applicability.

---

Threat Actor Activity

UNC6671 Vishing Campaign Targets Financial Sector

UNC6671, a financially motivated data extortion group operating under multiple brands (Redact, Pink, Helix, Falcon, formerly BlackFile), is conducting sophisticated voice phishing (vishing) attacks targeting enterprise employees in financial services, private equity, and professional services. The group impersonates IT help desk staff via spoofed phone numbers, contacting victims on personal mobile devices to create urgency around mandatory security migrations. Victims are directed to adversary-in-the-middle (AitM) phishing infrastructure that intercepts credentials and multi-factor authentication tokens in real time.

The group uses tailored Okta and Microsoft Entra ID phishing kits hosted on generic root domains with victim-specific subdomains (e.g., passkeyhelpdesk[.]com, setupsso[.]com, idokta[.]com). Post-compromise, UNC6671 removes existing MFA devices, registers adversary-controlled MFA devices, and leverages compromised identity provider access to move laterally across the victim's entire SaaS ecosystem. Data exfiltration is conducted using automated Python and PowerShell scripts. Between January and May 2026, the group received over $10.6 million in Bitcoin payments.

Recent targeting has focused on high-value financial organizations including hedge funds (Point72 Asset Management, Millennium Management, Two Sigma Investments, Citadel), major law firms, and financial-rating agencies. The shift from broad enterprise targeting to concentrated financial sector victims indicates a deliberate Big Game Hunting strategy.

Defensive measures: Deploy phishing-resistant MFA (FIDO2/WebAuthn hardware tokens) that cannot be intercepted by AitM infrastructure. Implement user awareness training focused on vishing attacks, emphasizing verification procedures when contacted on personal devices. Monitor for anomalous MFA device registration activity, particularly removal of existing devices followed by registration of new devices. Establish behavioral analytics for unusual IdP authentication patterns and lateral movement across multiple SaaS applications.

---

ClickFix Campaigns Deliver macOS Cryptocurrency Stealer

Multiple ClickFix-style attacks are delivering a Go-based macOS malware capable of stealing cryptocurrency assets, browser passwords, Apple iCloud Keychain data, and cached credentials. The infection chain uses phishing emails that trick users into executing Terminal commands. A shell script profiles the host and fetches a CPU architecture-compatible malware payload. The malware targets cryptocurrency wallets (Bitcoin, Ethereum, Litecoin, Dogecoin, Monero, XRP), establishes persistence, escalates privileges via fake authentication prompts, and can selectively drain crypto wallets (partial or full). Infrastructure is hosted on Aeza Group (AS 210644), a sanctioned Russian bulletproof hosting provider.

Defensive measures: Block outbound connections to AS 210644 at network perimeter. Deploy EDR rules to detect removal of com.apple.quarantine extended attributes and execution of binaries from directories mimicking system process names. Monitor for osascript execution creating authentication dialogs outside normal system update workflows. Educate macOS users on ClickFix social engineering tactics.

---

Connor Riley Moucka Pleads Guilty to Snowflake Breach

Connor Riley Moucka, a 26-year-old Canadian cybercriminal (aliases "Judische," "Waifu"), pleaded guilty to computer fraud and conspiracy to extort over 165 organizations using Snowflake cloud storage, and to stealing call and text records of more than 100 million AT&T customers. Moucka worked with co-conspirators including U.S. Army soldier Cameron Wagenius ("Kiberphant0m") and John Erin Binns ("IRDev," "IntelSecrets"). The operation targeted Snowflake customer accounts lacking multi-factor authentication, conducting large-scale data exfiltration and extortion. High-profile victims included TicketMaster, Lending Tree, Advance Auto Parts, Neiman Marcus, AT&T, and Verizon. The conspiracy generated over $2.5 million in ransom payments between February and October 2024. Moucka was arrested in Canada in October 2024 on a U.S. provisional warrant.

---

Geopolitical Context

Swiss Government SharePoint Breach

Switzerland's Federal Office for Information Technology and Telecommunication (BIT) disclosed a breach of its Microsoft SharePoint servers where attackers exploited vulnerabilities to compromise approximately 200 government accounts. The exploitation of recently disclosed Microsoft SharePoint vulnerabilities—potentially CVE-2026-56164 or CVE-2026-50522—within weeks of their July 2026 disclosure suggests adversaries are actively monitoring and weaponizing enterprise collaboration platform flaws. No attribution has been made public. The Federal Office for Cyber Security and Microsoft are assisting in the investigation. BIT states that classified and highly sensitive personal data were not stored on the platform.

US Water Utility Attacks and Exposed PLCs

Forescout discovered 4,407 internet-facing Rockwell Automation PLCs exposed online globally, with 2,844 in the United States. Critically, 22 controllers were found in US cities recently targeted by water utility cyberattacks affecting at least seven states since July 27, 2026. Attackers changed IP addresses and set passwords on exposed controllers without exploiting vulnerabilities, denying operators visibility and control. Over 70% of US-exposed controllers run on mobile carrier networks (Verizon, AT&T, T-Mobile). The FBI and EPA issued public service announcements but have not attributed the campaign. The concentration of legacy devices (50% MicroLogix 1400, 8% discontinued MicroLogix 1100) and firmware vulnerable to CVE-2017-16740 illustrates deferred maintenance challenges endemic to water and wastewater sectors.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch WordPress: Update all WordPress installations to version 7.0.3 to address CVE-2026-64638.
  • Patch Linux SCTP: Update to patched kernel versions 7.1.6, 6.18.42, 6.12.101, or 6.6.148 on systems with SCTP enabled.
  • Patch Cisco infrastructure: Upgrade Catalyst SD-WAN and IOS XE Software to fixed versions; prioritize CVE-2026-20200 (IMC) due to available PoC exploit.
  • Audit npm dependencies: Scan for malicious packages and block network access to identified C2 infrastructure.
  • Remove PLCs from internet: Isolate all Rockwell PLCs from direct internet exposure; implement VPN or private APN access.

Within 24-72 hours

  • Rotate credentials: Revoke and rotate npm publishing tokens, GitHub personal access tokens, cloud provider credentials, and CI/CD secrets potentially exposed by npm supply chain attack.
  • Hunt for compromise: Search developer workstations and CI/CD runners for indicators of npm worm infection; review WordPress access logs for XSS exploitation attempts.
  • Implement MFA controls: Deploy phishing-resistant MFA (FIDO2/WebAuthn) for Microsoft 365 and Okta accounts to mitigate UNC6671 vishing attacks.
  • Patch KVM hosts: Update KVM hosts exposing nested virtualization to address CVE-2026-64561 (Zapscape).

This week

  • Review NAT configurations: Apply Windows updates for CVE-2026-56181 and Linux kernel patches for CVE-2026-63913 (NatJack attacks).
  • Audit AI agent infrastructure: Upgrade Google Agent Development Kit to 2.5.0+, Vercel AI SDK packages to fixed versions, and review AWS Strands message-history handling.
  • Implement CPU mitigations: Update Linux kernels on AMD Zen systems to address interrupt injection attacks bypassing Spectre v2 defenses.
  • Security awareness training: Conduct targeted training on vishing and ClickFix social engineering tactics.

---

Watch List

  • CryptoJS vulnerability: Monitor for additional wallet applications affected by weak RNG vulnerability (GHSA-rg76-677x-56q9, CVSS 9.0). Five confirmed affected apps: RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, Milo.
  • ChainDrop npm worm: Self-propagating worm affecting 400+ npm packages, stealing GitHub Actions secrets via Ethereum smart contract C2.
  • HTTP desynchronization techniques: AI-assisted research discovered novel HTTP desync and response queue poisoning techniques; Apache Traffic Server zero-day (CVE-2026-63078) patched but details not yet public.
  • Windows Hello for Business abuse: Malware can silently invoke Windows Hello keys to authenticate to Entra ID and establish persistent cloud access; proof-of-concept published.
  • Apple iCloud Private Relay leaks: WebKit proxy bypasses can expose real IP addresses through DNS prefetching, WebAuthn, and WebTransport.
  • Token jacking: Cybercriminals stealing AI API keys for resale through gray market transfer stations.

---

Sources

  • The Hacker News (multiple reports)
  • BleepingComputer (multiple reports)
  • CERT.BE (Belgium)
  • Krebs on Security
  • Unit 42 (Palo Alto Networks)
  • Cisco Security Advisories
  • WordPress Security Team
  • Tencent Zhuque Lab
  • Forescout Research
  • Google Threat Intelligence Group
  • Mandiant