FortiGuard Labs tracked a supply chain attack against QuickFox that trojanized a Windows Electron installer, used a fake `cdns3[.]51quickfox[.]cn` domain, and delivered a JavaScript loader that deployed the FDMTP implant for persistent access. The campaign has been active since at least August 2025, shows ongoing infrastructure development, and uses guardrails plus DLL sideloading to target specific Windows endpoints while avoiding re-infection. #QuickFox #FDMTP #TwillTyphoon
Traditional CASB and DLP controls can discover and govern AI tools, but they fall short because AI risk appears in prompts, responses, and agent actions rather than simple app or file access. Security teams need an interaction layer that inspects the semantics of conversations and authorizes what AI agents can retrieve,…
The FBI and EPA warned that cyberattacks against internet-facing PLCs have hit water and wastewater utilities in at least seven states, causing operational disruptions like pressure loss, flooding, and manual fallback. The attacks relied on exposed, outdated controllers and weak access controls, highlighting the need for utilities to remove PLCs from the public internet, strengthen passwords, and monitor OT environments continuously. #FBI #EPA #PLC #Aliquippa
Metabase has disclosed that a maximum-severity zero-day in its business intelligence and data visualization software was exploited in the wild, allowing unauthenticated attackers to inject SQL and gain administrator access. The issue affected Metabase Cloud and self-hosted versions, with Framework confirming customer data exposure, while Metabase urged immediate patching and log…
![Threat Research | Weekly Recap [09 Aug 2026]](https://www.hendryadrian.com/tweet/image/WeeklyRecap.png "Threat Research | Weekly Recap [09 Aug 2026]")
Cybersecurity Threat Research ‘Weekly’ Recap. The recap highlights supply-chain abuse in npm ecosystems (ChainDrop/Shai-Hulud, keyv/cacheable compromises, and additional npm worm activity), alongside rising AI token jacking that steals API keys and drains AI credits while attackers increasingly weaponize AI and coding agents for pre-prompt execution. It also covers phishing and vishing extortion efforts (UNC6671, ScreenConnect lures, ARERA and pagoPA scams, FakeCaptcha infrastructure, and developer lures), targeted intrusions and malware such as APT37/NarwhalRAT and BINDCLOAK, and cloud/container abuse including fileless in-memory cryptojacking (Fileless XMRig) and direct-to-IP C2 that evades DNS monitoring. #ChainDrop #ShaiHulud #keyv #cacheable #UNC6671 #ScreenConnect #ARERA #pagoPA #FakeCaptcha #Xeno #BHAlert #RovoBlast #RAT37 #NarwhalRAT #BINDCLOAK #QuasarRAT #UltraVNC #Xctdoor #CRAT #XMRig #Nextjs #Sliver #FilelessXMRig
A researcher disclosed serious flaws in the Connective digital identity browser extension used widely in Belgium, allowing websites to read eID and payment card data, steal eID PINs, and forge electronic signatures. The report also detailed a separate remote code execution issue, and Nitro has since fully remediated the vulnerabilities and…
There were 9 defacement incidents targeting sites in Indonesia and Vietnam. The attackers involved were Simsimi and maw3six, with most of the incidents attributed to maw3six. #Indonesia #Vietnam…
Naval Interior Team in FI was targeted by the qilin ransomware group, resulting in system disruption and encrypted files. The incident affected the victim’s operations in #Finland
Price Shoes in Mexico reported a ransomware attack attributed to the qilin threat actor, resulting in unauthorized access and encrypted or disrupted systems. The incident impacted Mexico #Mexico
Chun Tai Sing Chemical Industry in HK reported a ransomware attack attributed to the qilin threat actor, resulting in disruption of business operations and encrypted files. The incident impacted Hong Kong. #HongKong
East Field Corporation in JP reported a ransomware incident attributed to the qilin threat actor, resulting in disruption to access to its systems and data. The incident affected operations in #Japan
Panda Logistics Taichung Branch in Taiwan reported a ransomware incident attributed to the qilin threat actor. The attack resulted in data and operational disruption for the organization in #Taiwan
Energetic Development Corp in Taiwan reported a ransomware incident attributed to the Qilin threat actor, involving unauthorized access and file encryption. The attack resulted in disruption and potential data exposure in Taiwan #Taiwan
Synergy Interactive in the US reported a ransomware incident attributed to the qilin threat actor, resulting in disruption of operations and potential data exposure. The impacted country is #UnitedStates
Marconi Industrial Services in Italy reported a ransomware incident attributed to the play threat actor, with attackers reportedly deploying malicious encryption to disrupt operations. The incident impacted Italy #Italy