Researchers Defused a Popcorn Time Updater on Millions of PCs
Eye Security found Time4Popcorn's abandoned updater would run any file as SYSTEM or root, registered its domain and used it to switch the updater off. Android users remain exposed.
IOCs
Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
One Unrevoked Key Let Attackers Hijack LiteLLM’s Release Pipeline
LiteLLM says a master key leaked on GitHub in May and never revoked let an attacker steal maintainer tokens and ship a backdoored 1.107.0 to PyPI, Docker Hub and GHCR.
A Fake Amazon Ad Ends in finger.exe, Lumma and a Hijacked PC
Huntress says a sponsored Google result led to a fake Amazon login and a ClickFix CAPTCHA that used finger.exe to install the Lumma infostealer and NetSupport remote access.
KeyStealth Hid in a Microsoft 365 Inbox for Seven Weeks, MFA and All
ADAMnetworks details how a device code phishing kit let an operator register rogue Entra devices, sit in a company's Microsoft 365 account for seven weeks and attempt payment fraud.
Iran’s Prince of Persia Spies Move Their C2 Onto US Soil
Semperis says Iran-linked Prince of Persia (Infy) rebuilt its infrastructure after a February exposure and is now running a Tornado C2 server in the US for the first time in a decade.
Fake IT Support on Teams Delivers EtherRAT, C2 Via Ethereum
A Teams caller posing as IT talks victims into installing remote-access tools, then drops EtherRAT, a Node.js backdoor that looks up its command server in an Ethereum smart contract.
Old-School VBScript Lures Plant RATs Across Brazil and Portugal
WatchGuard details three Brazil-linked campaigns, Overlord RAT, Lampion and a newdev.dll RAT, that start with VBScript and lean on built-in Windows tools and signed programs to stay hidden.
CriticalCVE-2026-109618CVE-2026-109619 7 Hunt LeadsIOCsRemote AttackerMiraiAmazon Threat Intelligence (AWS Security Blog)
PHP2Shell Was Being Exploited Four Days Before Anyone Knew
Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.
Microsoft: China’s Storm-0940 Let AI Agents Run the ConnectWise Hack
Microsoft ties the ConnectWise Cloud Backup supply-chain attack to China-aligned Storm-0940, which used ARTEX AI agents to try sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 a minute.
SafePay Ransomware Hit 600 Victims Using Stolen VPN Logins and Old Bugs
A joint FBI, CISA and USSS advisory says SafePay ransomware has hit at least 600 victims since August 2024, getting in through stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam flaws, then wiping backups before it encrypts.
Lazarus Turns a Korean Banking Plug-In Into a Spy’s Front Door
Kaspersky says Lazarus abused South Korea's mandatory INISAFE CrossWeb EX security plug-in to break into at least three firms, using fake résumé sites, GitHub-based C2 and a post-quantum key exchange.
PaperCut Attacker Left an AI Hacking Workbench Wide Open
Hunt.io found the PaperCut mass-exploitation crew's AI agent prompts, exploit variants, credential stealers and victim access kits on an open server, plus a second RCE route through the XML-RPC API.
Fake Cloudflare Check Hides Its C2 List on the Polygon Blockchain
Stormshield says hacked WordPress sites read C2 addresses from a Polygon smart contract, then show Windows visitors a fake Cloudflare check that leads to a stealer loaded through the Deno runtime.
Belarus-Aligned Hackers Hid a Backdoor in VMware Tools for 2 Years
Solar 4RAYS says Partisan Zmiy spent about two years in a Russian healthcare network, hiding the Telegram-controlled Vasilek backdoor and a fake service in an unmonitored VMware Tools directory.
Sandworm Gets a Handoff, Wipes a Ukrainian Grain Firm
ESET says UAC-0099 phished into a Ukrainian grain logistics company and handed access to Sandworm, which wiped data, while a new Go backdoor hid its C&C inside the Yggdrasil mesh network.
CriticalCVE-2026-0257CVE-2023-27532 5 Hunt LeadsIOCsRemote AttackerQilinINC RansomQilinINC RansomThe Hacker News
Qilin and INC Ransomware Slip Past MFA Through Unpatched PAN-OS
Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.
Plex Servers Are Quietly Mining Crypto for Someone Else
Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.
NetScaler Crash Handler Turned Into a Root Shell, Rapid7 Finds
Rapid7 details intrusions where attackers chained CVE-2026-88771 and CVE-2026-88779 to get root on NetScaler ADC and Gateway, then planted HA-aware persistence and stole the appliance's credentials and keys.
GlassWorm Slips a Secret Stealer Into Five OVHcloud CLI Releases
An attacker used a hijacked developer account to swap the binaries on five OVHcloud CLI releases for a build that steals cloud keys, SSH keys and AI-tool data. OVHcloud ties it to GlassWorm and says about 250 downloads happened in the 94-minute window.
Rank Math PRO Shipped a Backdoor for 11 Hours
Rank Math PRO 3.0.123, served from the vendor's own site for about 11 hours on Oct. 15-16, carried a backdoor that creates hidden admins and rebuilds itself. Updating alone doesn't clean it.
A Stolen ConnectWise Credential Walked Into 173 Microsoft 365 Tenants
An attacker used ConnectWise Cloud Backup's own app credential to sign in to 173 partner and customer Microsoft 365 tenants, per Huntress. ConnectWise has taken the service offline and disabled seven app identities.
APT28 Spent the Summer Inside a NATO Naval Shipbuilder
Symantec says Russia's APT28 breached a naval shipbuilder, a law enforcement agency and an aircraft-engine maker in two NATO countries, using the HOOKEDGE backdoor and a previously unseen reflective loader.
CriticalCVE-2026-102764 8 Hunt LeadsYARAIOCsRemote AttackerARMORY CASTLESAWFLYBARECLAWGoogle Threat Intelligence Group / Mandiant
China-Linked Spies Turned BeyondTrust Help Desks Into Skeleton Keys
Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.
HighCVE-2021-4034CVE-2025-55182 12 Hunt LeadsIOCsRemote AttackerHands-On-KeyboardCL-UNK-1211Palo Alto Networks Unit 42
AI-Written Malware Spent Six Months Inside Government Linux Servers
Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts.