# Threat Intel Brief — September 22, 2026

TL;DR

  • Critical Linux kernel vulnerabilities (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) are under active exploitation; CISA mandates immediate federal patching and forensic triage.
  • Cisco ISE authentication bypass (CVE-2026-76460, CVSS 10.0) exploited in the wild; unauthenticated attackers can gain full device access via API endpoint.
  • North Korean Contagious Interview campaign compromised 30,000+ devices across 100+ countries, stealing $10.71M in cryptocurrency through job-interview social engineering.
  • Fake LastPass installer uses Microsoft-signed kernel driver to disable EDR/antivirus before deploying credential stealer; distributed via malicious GitHub repository.
  • WordPress Core CSRF flaw ("Click2Shell") enables remote code execution; proof-of-concept published, patch available in version 7.1.1.

---

Critical Threats

Linux Kernel Vulnerabilities Under Active Exploitation

What happened:
CISA issued an emergency directive warning that three Linux kernel vulnerabilities are being actively exploited. CVE-2025-39964 is a 14-year-old race condition in the AF_ALG cryptographic socket interface enabling privilege escalation and container escape. CVE-2026-53266 is an out-of-bounds write in ebtables SNAT allowing memory corruption and privilege escalation. CVE-2025-39682 affects kTLS receive-path logic. Public exploits are available for at least two of the three flaws.

Impact:
All three vulnerabilities affect Linux systems across distributions (RHEL, Ubuntu, Debian, SUSE). CVE-2025-39964 enables system crashes or cryptographic result manipulation; CVE-2026-53266 provides a privilege escalation path similar to Dirty Pipe. Container environments, cloud infrastructure, and systems using kernel cryptographic APIs face immediate risk. CISA requires federal agencies to patch by end of day and conduct forensic triage on all affected assets.

Recommendations:

  • Apply vendor-provided kernel security updates immediately for CVE-2025-39964, CVE-2026-53266, and CVE-2025-39682 across all Linux distributions.
  • Prioritize internet-facing systems, container hosts, and infrastructure using kernel cryptographic APIs or kTLS.
  • Conduct forensic triage on critical Linux assets: review system logs for unexpected privilege escalations, container escapes, or cryptographic anomalies.
  • If immediate patching is infeasible, consider disabling AF_ALG socket interface (CONFIG_CRYPTO_USER_API_SKCIPHER) and restricting ebtables/iptables usage where operationally acceptable.

---

Cisco ISE Zero-Day Authentication Bypass

What happened:
Cisco Identity Services Engine (ISE) is affected by CVE-2026-76460, a maximum-severity (CVSS 10.0) authentication bypass vulnerability exploited in the wild. Unauthenticated remote attackers can bypass authentication entirely via a vulnerable API endpoint and gain unauthorized access to devices through the web management interface.

Impact:
Cisco ISE is widely deployed for network access control and authentication in enterprise environments. Successful exploitation grants attackers full administrative access without credentials, enabling lateral movement, policy manipulation, and credential harvesting across managed networks.

Recommendations:

  • Apply Cisco ISE patches for CVE-2026-76460 immediately.
  • Review ISE API access logs for suspicious unauthenticated requests to management endpoints.
  • Implement network segmentation to isolate ISE management interfaces from untrusted networks.
  • Monitor authentication logs for anomalous access patterns or policy changes.

---

Fake LastPass Installer with Microsoft-Signed EDR Killer

What happened:
A malicious LastPass Authenticator installer distributed via a fake GitHub repository (github.com/LastPass-Authenticator) deploys a Microsoft-signed kernel driver (Alinubx.sys, originally CcProtect.sys from CnCrypt) that terminates 145 antivirus and EDR products. The driver, signed in March 2023, had zero VirusTotal detections in August 2024 and was not on Microsoft's driver blocklist as of September 17, 2024. After disabling endpoint security, the installer deploys credential-stealing malware targeting browser passwords, cryptocurrency wallets, and messaging app sessions.

Impact:
This is a BYOVD (Bring Your Own Vulnerable Driver) supply chain attack achieving kernel-level persistence. Compromised systems lose all endpoint protection, allowing exfiltration of Chrome/Edge passwords (via app-bound encryption bypass), cryptocurrency wallets, Discord/Steam/Telegram sessions, and Windows Credential Manager contents. The driver persists across reboots and continuously re-kills security tools, preventing normal remediation. Microsoft declined to classify the driver behavior as a security vulnerability.

Recommendations:

  • Hunt for IoCs: service named NvFsFilter, driver file C:\Windows\System32\drivers\nvfsflt64.sys, device path \\.\Alinubx, and drivers signed by Henan Dafeng Software or containing "CnCrypt" in certificate details.
  • Block the malicious GitHub domain github.com/LastPass-Authenticator at web proxy and DNS layers.
  • Educate users that legitimate LastPass Authenticator is only distributed via lastpass.com and official app stores.
  • For confirmed compromised systems: treat as kernel-level breach requiring full forensic analysis or rebuild; force password resets for all browser-saved credentials, cryptocurrency wallets, and messaging app sessions from a clean device.
  • Verify Windows 11 2022 update or later is deployed to enable driver blocklist by default.

---

WordPress Core CSRF Flaw Enables Remote Code Execution

What happened:
A cross-site request forgery (CSRF) vulnerability dubbed "Click2Shell" in WordPress Core versions 7.1.0 and earlier allows attackers to achieve remote code execution by chaining the CSRF flaw with vulnerable themes from the official catalog. The attack requires an authenticated administrator to click a malicious link. Proof-of-concept exploit code has been published by pwn.ai. WordPress version 7.1.1 patches the vulnerability. CVE: see source.

Impact:
Successful exploitation allows file modification, database credential theft from wp-config.php, rogue admin account creation, and malicious script injection. The attack vector requires administrator interaction (clicking a crafted URL while logged in), limiting immediate mass exploitation but enabling targeted attacks via phishing or XSS. Sites with DISALLOW_FILE_MODS enabled are protected from the theme installation component of the attack chain.

Recommendations:

  • Update all WordPress installations to version 7.1.1 immediately.
  • Enable DISALLOW_FILE_MODS in wp-config.php as temporary mitigation if immediate patching is not possible.
  • Review WordPress administrator access logs for unusual theme preview or Customizer activity since August 22, 2026.
  • Implement security awareness training for WordPress administrators about phishing links.
  • Deploy web application firewall rules to detect and block suspicious theme preview requests with malformed parameters.

---

Threat Actor Activity

North Korea: Contagious Interview Campaign

North Korean threat actors operating under the 313 General Bureau of the Munitions Industry Department conducted the Contagious Interview campaign, compromising at least 30,000 devices across more than 100 countries and stealing $10.71M in cryptocurrency from over 7,000 wallets. The operation, tracked by multiple vendors as CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, PurpleBravo, Tenacious Pungsan, UNC5342, Void Dokkaebi, and WaterPlum, primarily targeted web designers, software developers, engineers, and cryptocurrency specialists.

Actors posed as recruiters on LinkedIn and other platforms, offering lucrative job opportunities. Victims were instructed to complete coding assessments or job tests that triggered multi-stage infection chains deploying malware families including BeaverTail, InvisibleFerret, FlexibleFerret, GolangGhost, PylangGhost, OtterCookie, RATatouille, OtterCandy, and StoatWaffle. Recent tactics include Discord-based proxy recruitment schemes offering $3,000-$5,000 to Western and Latin American citizens to serve as identity mules for bypassing sanctions and KYC controls.

Defensive measures:

  • Implement strict vetting procedures for unsolicited job offers requiring file downloads or coding assessments.
  • Monitor for outbound connections to VPN services (Astrill VPN, Mullvad) from developer workstations.
  • Deploy endpoint detection for malware families associated with this campaign.
  • Enhance cryptocurrency wallet security with hardware tokens and transaction monitoring.
  • Strengthen hiring processes with enhanced identity verification and in-person interviews where feasible.

---

North Korea: Jade Sleet Targets IT Service Providers

North Korean threat actor Jade Sleet (also tracked as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899) compromised an India-based IT services provider through a DevOps engineer's Apple Silicon MacBook. The actor deployed FLATROOF (aka Gaslight) and ROOFDECK backdoors, both Rust-based ARM macOS implants. FLATROOF uses Telegram for C2 with capabilities for command execution, file operations, and credential theft from browsers and keychains. ROOFDECK uses the Nostr protocol for decentralized C2 with signed commands, system reconnaissance, file manipulation, remote shell access, lateral movement, and persistence via Launch Agents.

The attack chain employed social engineering via job interview lures and weaponized GitHub repositories with malicious Terraform dependency lock files (.terraform.lock.hcl) that point to attacker-controlled domains. The compromise occurred in parallel with the March-April 2026 attack on KelpDAO's LayerZero bridge, with an updated ROOFDECK variant deployed one day after LayerZero publicly acknowledged the KelpDAO hack.

Defensive measures:

  • Monitor for suspicious Terraform operations, particularly "terraform init" commands connecting to non-standard registry domains.
  • Implement application allowlisting and behavioral monitoring on developer endpoints.
  • Detect outbound connections to Telegram API endpoints and Nostr protocol relays from developer workstations.
  • Scrutinize GitHub repositories used in technical interview processes for weaponized dependency files.
  • Monitor for Launch Agent persistence mechanisms on macOS systems and file operations targeting browser credential stores.

---

ChainScript RAT Campaign

Threat actors are using ClickFix-style social engineering lures to distribute ChainScript, a previously undocumented remote access trojan masquerading as legitimate software including Spotify, Zoom Workplace, and Microsoft Teams. The malware uses Polygon blockchain infrastructure to rotate command and control servers, employing EtherHiding-style C2 discovery using smart contracts for infrastructure rotation. ChainScript establishes persistence via scheduled tasks with Registry Run key fallback and includes capabilities for command execution, file operations, screen capture, payload deployment, cryptocurrency wallet enumeration, remote JavaScript execution, self-update, and persistence removal.

Defensive measures:

  • Monitor msiexec.exe execution with unusual command-line parameters or downloads from non-standard sources.
  • Detect hidden PowerShell and VBScript execution chains dropping Node.js runtime components to %LOCALAPPDATA% paths.
  • Alert on scheduled task creation with names resembling legitimate software executing scripts from user-writable directories.
  • Implement network monitoring for WebSocket connections to unusual or newly-registered domains; consider blocking blockchain RPC endpoints (Polygon, Ethereum) from non-administrative workstations.
  • Deploy behavioral detection for cryptocurrency wallet enumeration activity and suspicious screen capture API calls.

---

Geopolitical Context

EU Regulatory Enforcement Against U.S. Technology Firms

Ireland's Data Protection Commission fined Google €403 million ($463 million) for GDPR violations related to the processing of users' location data between May 2018 and February 2020. The enforcement action represents continued EU regulatory assertion of digital sovereignty and data protection standards against major U.S. technology platforms. The case underscores transatlantic tension between Silicon Valley's data-driven business models and European regulatory expectations around transparency, consent, and user control. Google was ordered to bring its data processing into compliance with EU law within six months.

The decision reinforces the EU's position as the global standard-setter for data protection regulation, with ripple effects beyond Europe as other jurisdictions model privacy frameworks on GDPR principles. The penalty contributes to a cumulative regulatory burden on U.S. technology firms operating in Europe, potentially influencing investment decisions and service architectures.

---

North Korean Cyber Operations as Sanctions Evasion

The Contagious Interview campaign and Jade Sleet's targeting of IT service providers reflect North Korea's systematic approach to circumventing international sanctions through dual-track cyber activities: direct theft of cryptocurrency assets and fraudulent IT worker placement schemes. The campaign's global reach—spanning over 100 countries—and its targeting of blockchain and Web3 specialists reflects the regime's strategic prioritization of cryptocurrency as both a sanctions evasion mechanism and revenue source. The overlap between offensive cyber operators and North Korean IT workers suggests organizational integration of cyber espionage, intellectual property theft, and illicit revenue generation under a unified command structure.

The targeting of an IT services provider in India—a major global hub for software development and outsourcing—suggests an operational shift toward third-party compromise as a pathway to downstream targets in cryptocurrency, blockchain, and financial technology sectors. For allied nations, the campaign underscores the challenge of countering North Korean cyber operations that blend criminal activity with state intelligence objectives.

---

Recommended Actions

Immediate (0-24 hours)

  • Apply Linux kernel patches for CVE-2025-39964, CVE-2026-53266, and CVE-2025-39682 across all distributions; prioritize internet-facing systems and container hosts.
  • Patch Cisco ISE for CVE-2026-76460; review API access logs for suspicious unauthenticated requests.
  • Hunt for fake LastPass installer IoCs: service NvFsFilter, driver nvfsflt64.sys, device path \\.\Alinubx, and drivers signed by Henan Dafeng Software.
  • Block malicious GitHub domain github.com/LastPass-Authenticator at web proxy and DNS layers.
  • Update WordPress to version 7.1.1 to patch Click2Shell CSRF vulnerability.

Within 24-72 hours

  • Conduct forensic triage on critical Linux assets for signs of prior exploitation: review system logs for unexpected privilege escalations, container escapes, or cryptographic anomalies.
  • Update OpenAI Codex Desktop to build 26.818.21641 or later and Codex CLI to version 0.149.0 or later to address sandbox escape vulnerabilities.
  • Audit package.json and lock files for malicious npm packages: indexed-btree, ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, sliding-score-window.
  • Rotate all secrets, API keys, tokens, and credentials in environments where malicious npm packages were installed.
  • Review WordPress administrator access logs for unusual theme preview or Customizer activity since August 22, 2026.

This week

  • Implement strict vetting procedures for unsolicited job offers on LinkedIn and social media platforms, particularly those requiring completion of coding assessments or file downloads.
  • Monitor for outbound connections to VPN services (Astrill VPN, Mullvad) from developer workstations and investigate anomalous remote access patterns.
  • Deploy endpoint detection capabilities to identify malware families associated with North Korean campaigns (BeaverTail, InvisibleFerret, FlexibleFerret, GolangGhost, PylangGhost, OtterCookie, RATatouille, OtterCandy, StoatWaffle, FLATROOF, ROOFDECK).
  • Enhance cryptocurrency wallet security with hardware tokens and transaction monitoring for employees in Web3, blockchain, and cryptocurrency roles.
  • Scrutinize GitHub repositories used in technical interview processes for weaponized dependency files, particularly .terraform.lock.hcl files with unusual domain references.

---

Watch List

  • AI coding agent vulnerabilities: Plugin4Shell affecting Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI; monitor for updates addressing SHA-pinning bypass.
  • ClickFix campaign evolution: Continued distribution of MacSync, Atomic macOS Stealer (AMOS), Amatera Stealer, and cryptocurrency clippers (AnimateClipper, ZigClipper).
  • BigCommerce breach: Compromised credentials for third-party Ribon applications used to inject malicious scripts into online stores; monitor for additional supply chain impacts.
  • TASK#STOMP campaign: PowerShell backdoor harvesting business documents, Wi-Fi passwords, clipboard contents, and screenshots; watch for attribution updates.
  • npm runtime malware: Continued evolution of install-script evasion techniques; monitor for additional packages using runtime triggers.

---

Sources

  • BleepingComputer: CISA alerts of active exploitation of three Linux kernel flaws
  • BleepingComputer: WordPress Click2Shell flaw lets hackers execute PHP on the server
  • BleepingComputer: Google fined €403 million over location data privacy violations
  • BleepingComputer: Malicious npm packages evade install-script defenses at runtime
  • BleepingComputer: Researchers escape OpenAI Codex sandbox to run commands on host
  • BleepingComputer: BigCommerce alerts merchants of data breach linked to Ribon apps
  • The Hacker News: Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
  • The Hacker News: Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
  • The Hacker News: Google Fined €403 Million Over GDPR Violations Tied to Location Data
  • The Hacker News: Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
  • The Hacker News: TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data
  • The Hacker News: ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
  • The Hacker News: Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors