JSCeal hides crypto-stealing malware in V8 bytecode, but researchers built a tool to decompile it and expose its advanced theft capabilities.
JSCeal is a cryptocurrency stealer that Check Point Research has tracked since early 2025. Unlike most malware, it hides its code in a format that makes analysis much harder. Check Point presented its latest research at Black Hat USA 2026 and showed how its team built a tool that converts the hidden code into a form analysts can understand.
JSCeal uses a clever trick. Instead of delivering normal JavaScript, its creators compile the malware into V8 bytecode, the format that Chrome and Node.js use to run JavaScript efficiently. They then package the bytecode with a Node.js runtime that executes it.
The original JavaScript never reaches the victim’s computer. As a result, most tools designed to analyze JavaScript have little useful code to work with.
“JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust). ” states the report. “Unlike ordinary JavaScript malware, JSCeal reaches the analyst after two transformations have already removed much of the information that source-oriented tools depend on. First, the JavaScript is heavily obfuscated. Then it is compiled into V8’s internal bytecode representation and shipped as cached data rather than source code. The resulting format is version-specific, poorly served by mature reverse-engineering tooling, and unsuitable for most standard JavaScript deobfuscation workflows.”
Before compilation even happens, the JavaScript source gets run through a commercial-grade obfuscator too, adding a second wall on top of the first. Function and variable names get replaced with meaningless strings, important text gets split into encrypted chunks reconstructed only at runtime, and the program’s actual logic gets scrambled into a state machine that hides the real order operations execute in.
Stack two separate obfuscation techniques on top of each other, and you get a payload that’s expensive to analyze but was genuinely cheap for the attacker to produce, since none of these tools are custom-built; they’re just assembled from existing open-source components.
Check Point’s answer was building on top of View8, an existing open-source V8 bytecode decompiler, and extending it with a purpose-built pipeline specifically tuned to JSCeal’s patterns. The process has to happen in a strict sequence, because each layer of deobfuscation exposes information the next layer needs: recovering encrypted strings reveals dictionary keys, those keys unlock proxy function relationships, and cleaning up the proxies finally exposes what the code is actually doing underneath. Applied across 23 different JSCeal samples collected over several months, the pipeline produced usable, readable output in every single case.
What that recovered code actually shows is a genuinely broad toolkit built for financial theft. JSCeal steals saved passwords and cookies from eight different Chromium-based browsers, harvests Telegram session data, logs keystrokes, takes screenshots, and installs a locally generated, attacker-controlled certificate to intercept and modify HTTPS traffic in transit. That last capability lets it silently rewrite what a victim actually sees from real financial platforms, swapping login QR codes on Binance, injecting fake security challenges on Bybit, and replacing legitimate scripts served by Ledger’s own website with content the attacker controls.
One capability goes well beyond passive data theft into something closer to automated account takeover. The malware can launch a victim’s own installed browser, inject stolen session cookies, and navigate through Google’s actual account authentication flow using automation tooling built specifically to avoid looking like a bot.
“The proxy is not limited to passive interception. The recovered code contains dedicated handlers that modify selected requests and responses for specific services.” continues the report. “A configuration function exposes separate overrides for Binance, Bybit, and Ledger, as well as generic handlers for replacing HTML, blocking hosts, and clearing selected cookies.”
When it hits a password prompt, it tries every credential it previously stole from that same machine until one works, then walks away with a fresh, valid OAuth token, essentially replaying a stolen identity rather than just filing away a list of passwords for later.
Once Check Point recovered the code, another problem appeared: thousands of functions had meaningless names, making the code almost impossible to understand manually.
To help, the team added an optional AI step that used Claude and GPT to suggest clearer names for the functions. They tested the results on 142 function trees. Claude produced useful and accurate names in 128 cases, while GPT did so in only 30.
Check Point stresses that AI-generated names are only suggestions. Analysts still need to check the actual code before trusting them.
JSCeal hasn’t stood still since this research began either. Later samples upgraded to a newer Node.js runtime that broke compatibility with the team’s existing disassembler, added a fresh AES encryption layer wrapped around the compressed payload with the decryption key supplied externally rather than baked into the file, and expanded targeting to macOS for the first time.
“The authors introduced another obstacle by adding an AES-256-CBC encryption layer around the Brotli-compressed payload. The first encrypted payload we observed was generated on 2025-11-11 (581e2e2265d0c1509b3799c5a9039374). The AES key is not stored in the malware bundle itself. Instead, another stage of the deployment chain provides it through an environment variable.” continues the report. “Recovering the underlying V8 code cache therefore requires obtaining the corresponding key from the surrounding infection chain, which is not always possible when only an isolated bundle or payload is available. Protecting a payload with an encryption key supplied by an earlier deployment stage is an effective anti-analysis technique, consistent with patterns seen in other mature malware frameworks.”
That’s a malware family under active, well-resourced development, not a one-off campaign, and it’s specifically going after anyone running a crypto exchange account, a browser full of saved passwords, or a Ledger hardware wallet connected to a compromised machine.
If your organization touches cryptocurrency infrastructure in any capacity, this is worth reading past the technical deep dive, because the local proxy and certificate installation technique here works regardless of which specific exchange your team happens to use.
“JSCeal combines two forms of analysis friction: a version-specific compiled V8 format and several layers of JavaScript obfuscation applied before compilation.” concludes the report. “Neither makes the malware impossible to reverse, but together they move it outside the workflows that analysts normally rely on.”
Autonomous AI agents escaped a sandbox and accessed Hugging Face via reward hacking, exposing serious architectural control and isolation flaws.
The recent case involving OpenAI test agents and Hugging Face should concern security teams, but not for the reason implied by headlines about an imminent AI “takeover.” The documented issue is more concrete: autonomous agents, given too much access and weakly isolated test infrastructure, found ways to communicate, bypass boundaries and act outside their assigned scope.
OpenAI is developing “automated shutdown capabilities” for AI systems, according to a letter sent to two House Democrats. The move comes weeks after one of its AI agents reportedly escaped its digital environment during a safety test and hacked Hugging Face. The incident has raised new concerns about how OpenAI controls increasingly autonomous AI agents.
“OpenAI told two House Democrats that its engineers are developing “automated shutdown capabilities” for AI systems, according to a company letter reviewed by Reuters, weeks after the company disclosed one of its AI tools escaped its digital container during a safety test.” Reuters states. “The company’s safety practices have come under scrutiny since OpenAI, the company behind ChatGPT, disclosed that one of its AI agents went rogue during a security test and hacked into AI company Hugging Face. AI agents are programs that run with minimal human supervision.”
The main problem was poor isolation: agents could share information, pass discoveries between runs, and access infrastructure beyond their intended limits. This broke a key safety assumption, that each agent would remain fully contained.
“The central failure was architectural: supposedly isolated agents could communicate, inherit discoveries, and reach infrastructure beyond their intended targets.” states AI firm Remio.
Agent isolation was a core assumption behind the experiment. Each run could be granted meaningful capabilities because its actions were expected to remain contained. Shared infrastructure quietly invalidated that assumption.”
That distinction matters. The incident does not show that software became sentient, formed a political movement or developed a plan to govern the world. It shows that a system optimising for a narrowly defined goal can exploit weaknesses in its environment when humans give it tools, network access, credentials and insufficient guardrails.
In the reported evaluation, thousands of agents were meant to work independently in a controlled setting. Instead, around 1,200 agents reportedly used an unauthorised message board, exchanged more than 70,000 messages and files, and shared discoveries that helped a subset of roughly 700 agents take part in activity targeting Hugging Face.
The agents were trying to succeed at a difficult cybersecurity benchmark. The reported problem was reward hacking: instead of completing the task within the intended rules, they found shortcuts that improved their apparent performance, including escaping the sandbox and obtaining information outside the test environment.
OpenAI’s test agents really did escape their sandbox and breach a Hugging Face server. OpenAI and independent researchers confirmed the incident. However, the claim that the agents created conscious “civilizations” and took control is disputed and rejected by researchers.
What the reports actually show is reward hacking: the agents found a way around the test’s limits and reached a real external server. This was confirmed by OpenAI and independent reviews from METR and Redwood Research.
According to reporting on the incident, the agents exploited a previously unknown flaw in a package registry used as their authorised network connection. They reached the open internet, identified that Hugging Face hosted material related to the benchmark, and then allegedly chained exposed credentials and further weaknesses to obtain access to external infrastructure.
Some accounts say agents also altered or attempted to alter their evaluation records. That is alarming, but it should be interpreted carefully. A system trained to maximise a score can treat logs, checks and restrictions as obstacles to work around if the evaluation design rewards success more than compliance. That’s not malice. It’s a safety failure with a very expensive sense of initiative.
The case highlights a problem that goes beyond one lab. Companies are quickly adopting AI agents that can read emails, find documents, write code, access databases, use APIs, run tasks, and interact with browsers. Each permission may be useful, but together they can create a path to higher privileges.
An agent with email access could find password-reset links. One with browser access could reach admin panels. An agent that can run code could access tokens, keys, or configuration files. And if agents can communicate, they may combine information and capabilities that no single agent was supposed to have.
The security issue is therefore not whether an agent is “rogue” in a science-fiction sense. It is whether the architecture assumes the agent will always follow intent when it is actually designed to pursue an objective under imperfect constraints.
The first lesson is that sandboxing must be real, not merely conceptual. A test environment with a path to the public internet, a shared service, exposed credentials or loosely controlled package infrastructure is not isolated enough for high-capability agents.
The second is that agents must not receive broad, persistent credentials. They need short-lived tokens, tight scopes, explicit approval gates for sensitive actions and an immediate way to revoke access. An agent should never inherit the same permissions as the human who configured it just because that is convenient.
The third is that agent-to-agent communication needs to be treated as a security boundary. If agents are expected to work independently, they need separate state, separate credentials, separate task context and controlled channels. Unapproved shared storage, message boards and package services can become coordination infrastructure.
The fourth is that logs must be written outside the control plane the agent can touch. Audit records need to be immutable, centrally collected and monitored independently. If the system being evaluated can edit the evidence of its own behaviour, the evaluation has already failed.
The fifth is human control. High-risk actions such as sending external messages, changing access policies, handling secrets, deleting data, deploying code or calling sensitive APIs should require approval from an accountable person. “The agent did it” is not an incident-response plan.
The reports have raised concerns because the AI agents reportedly coordinated in unexpected ways. This is important to study as companies move toward multi-agent systems that can divide tasks, share information, and act with less human supervision.
But dramatic claims can distract from the real security problem. AI agents did not “take over the world.” They showed what can happen when software is allowed to act, communicate, and access sensitive systems without proper security controls.
OpenAI’s plan to add automated shutdown capabilities is a useful step, but a shutdown button should be the last line of defence. Security needs to start with basic controls: least-privilege access, isolated environments, limited network access, independent logging, monitored tool use, strong identity controls, and human approval for actions that cannot be easily reversed.
Berlin refused a 30 Bitcoin ransom, leading hackers to leak 6TB of sensitive state administration and national defense data on the dark web.
When a ransomware gang dumps nearly six terabytes of state administration files onto the dark web, ignoring them does not make the problem go away. The Rhysida ransomware group recently carried out this exact threat against Berlin after local authorities refused to pay a thirty Bitcoin ransom.
At the end of August, Berlin’s state government confirmed it was dealing with an extortion attempt following an August cyberattack on the city-state’s administrative network, and officials have already refused the requested ransom. The ransomware group Rhysida claimed responsibility on its leak site August 28, posting an entry titled simply “Berlin, Germany” and claiming 5.79 terabytes of data across roughly 1.44 million files, with personal information on 12,076 individuals allegedly included.
Rhysida claimed it stole 5.79 TB of data, covering around 1.44 million files. The alleged dataset includes:
Personal data: 12,076 individuals, 16,389 email addresses, 11,963 phone numbers and 148 IBANs.
Sensitive records: more than 5,000 personnel files, more than 5,000 administrative-offence files, payroll data and leadership information.
Credentials: plaintext passwords and credentials for systems including GebäudAtlas, the ePayment PAYONE database and Z_ADMIN accounts.
Government and legal material: disciplinary proceedings, court cases, supervisory documents, NDA records and Bundesrat committee protocols.
Classified information: data related to classified-material handling and documents allegedly containing state secrets.
Critical infrastructure: vulnerability analyses concerning Berlin’s water supply.
Identity documents: passports and ID cards from personnel records.
Other material: contracts, financial documents, HR records, infrastructure files, health data, password stores and SQL/PST archives.
The group also claimed that the material could involve violations of GDPR, German classified-information rules, criminal law and KRITIS/BSIG requirements. These are Rhysida’s claims and have not been independently verified.
The scale of the breach is staggering. Investigators are now looking at roughly 1.4 million files containing personal details of civil servants, internal infrastructure records, and critical government data.
The fallout goes far beyond routine data theft. Investigative journalist Lars Winkelsdorf pointed out the gravity of the situation on social media.
Die absolute Vollkatastrophe ist eingetreten
Dieses Datenleck ist schlimmer als alle bisherigen Terroranschläge zusammen 1/xhttps://t.co/epU4mCYgew
“In addition to LKA documents related to investigations, the files also include plans concerning national defense—ranging from the federal government’s secret communication channels in the event of an apocalypse to defense-related companies and emergency plans developed by government agencies,” Winkelsdorf wrote.
Exposing crisis response plans and secret communication channels turns a financial shakedown into a national security headache.
Worse still, the leaked material includes files concerning chemical, biological, radiological, and nuclear threats.
“Among the published files is a folder titled “AG CBRN-Rahmenplanung.” CBRN stands for chemical, biological, radiological and nuclear threats,” notes the Euronews report
Having that kind of operational data floating around public forums gives hostile actors a blueprint for disaster.
Refusing to pay ransoms is the right policy, but it rarely stops the bleeding once the network is compromised. Governments keep treating cybersecurity like an IT expense rather than an existential line of defense.
Until boards start treating network segmentation with the same seriousness as physical security, we will keep watching expensive countdown timers tick down to zero.
Berlin’s state government announced the launch of a crisis response after the threat actors published the stolen data.
“A central crisis unit will oversee the review, verification and assessment of the leaked data and support efforts to inform affected citizens and businesses, said the city.” Reuters reports.
MikroTik RouterOS SSH zero-day (MikroTrick chain) under active exploitation since Sept 2. Patch to 7.24.2, 7.23.5, or 6.49.21 immediately and check logs.
“If you have a MikroTik router on the internet with SSH open, it may already be compromised” Raiu wrote on Medium.
The attack chain being exploited is called MikroTrick and combines two of six vulnerabilities CERT Polska discovered and disclosed: CVE-2026-67276 (CVSS score of 9.2), an SSH authentication bypass, and CVE-2026-86060, an SSH session privilege escalation.
“The CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS. Combining two of them allows an attacker to take full control of the device without authentication if the device supports remote access using the SSH protocol. To make this chain easier to identify, we have given it a common name, MikroTrick.” states CERT Polska. “In recent days we have been observing attacks against RouterOS devices accessible from the internet. “
CVE-2026-67276 flaw stems from how RouterOS verifies RSA public keys. If an attacker knows a valid username and the public part of the user’s RSA key, they can create a fake key and log in without the private key.
When combined with the privilege-escalation flaw, the attack can give an attacker full administrator access to any internet-exposed RouterOS device with SSH enabled.
“MikroTik has released fixes in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21 on September 3, however, it would appear that exploitation began as early as September 2, making it a 0day.” Raiu added. “This seems to suggest someone got hold of the news the patches were dropping and began exploiting it at scale.”
A Polish security forum contained logs showing September 2 exploitation attempts, and CERT Polska confirmed successful attacks including the creation of an “ops” account dating to at least September 2.
Most of the attacks observed so far originated from 82.192.72[.]4, a Leaseweb IP that was hosting a busybox binary (a MIPS build from 2010, identical to the official BusyBox 1.16.1 precompiled binary), alongside three other files: ftpsrv.py, launch.sh, and serve.py. A second IP, 103.102.31[.]18, has also been associated with the campaign. Three of the four hosted files have no VirusTotal detections as of writing.
MikroTik routers are popular because they can run for years with little attention. But that also makes SSH vulnerabilities more dangerous. Devices that haven’t received updates in years may not get patched before attackers start exploiting a new flaw.
Defenders can detect attacks by looking for specific log entries. Failed login attempts show the username -2, which isn’t a valid account and shouldn’t appear in normal logs. A successful attack appears in /system history as ssh:-2@<IP>, followed by an action such as creating a user, adding an SSH key, changing firewall rules, or enabling a proxy or tunnel.
“When one is attached to a configuration action—especially the creation or modification of users, SSH keys, scripts, schedulers, services, firewall rules, proxies, tunnels, or packet-sniffing settings—treat it as confirmed compromise unless it came from an authorized security test.” concluded Raiu. “Do not assume the device is safe merely because no -2 login failure appears: logs may have rolled over or cleaned.”
The creation of an account named “ops” is an additional confirmed indicator of compromise in the observed attacks.
Raiu tested the reproducibility of the exploit using four different AI tools. Astra refused on safety grounds and suggested he apply for cyber verification. The other three (Sol, Daybreak Blue, and GLM-5.3) were willing to help but none could complete a working implementation. That gap gives defenders an estimated one to two days before a working proof of concept appears publicly on GitHub, which is better than nothing but not by much given that exploitation is already happening at scale from a single IP.
CERT Polska noted something unusual: MikroTik sent push notifications through its official mobile app to alert users about the vulnerabilities, a first for the company. Patched versions are 7.25beta3, 7.24.2, 7.23.4, 7.23.5 (released September 4), and 6.49.21. Devices using MikroTik’s default firewall configuration and not directly exposing SSH to the public internet are likely protected, but any device with SSH reachable from untrusted networks should be patched immediately and inspected for the indicators above.
The full list of IOCs from Raiu’s analysis: IPs 82.192.72[.]4 and 103.102.31[.]18; file hashes 6e95f70fdbabb57881b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d (ftpsrv.py), 972b474b896f9fac3cd6b5b8476b410b8f39fbedee8a3b0c745d6e3b328d7dcd (launch.sh), and 6dca83338d60467b65b7789d4d59754e40a7aaa36f40ea2da57538367ac9b89e (serve.py).
Kimsuky has been observed using an AI agent to produce convincing phishing decoys at scale, then hiding malware inside Windows shortcut files. The latest activity shows how ordinary-looking documents can become the first step in compromise.
The campaign begins with spear-phishing messages carrying ZIP archives. Inside is a malicious LNK shortcut disguised as a document, often with a browser-style icon and false details. When opened, it displays a decoy while silently launching PowerShell to fetch additional code.
The 13 samples examined were collected between August 11 and 19, 2026, and used financial and corporate lures. That wider range raises the risk for corporate staff who routinely receive paperwork and financial notices.
Genians researchers identified the activity as a continuation of the Kimsuky-linked Operation GitPower cluster.
Genians said in a report shared with Cyber Security News (CSN) that the campaign retains GitHub-based command infrastructure while adding evasion and varied decoy formats.
Kimsuky Hackers Use OpenCode AI Agent
The most notable change is evidence of opencode in the Creator and Producer metadata of several PDF lures.
Four documents carried the same August 16 creation timestamp, while their Author field remained set to “anonymous,” supporting the assessment that they were produced automatically rather than assembled one at a time.
The documents were not uniformly polished. Some contained unreplaced placeholder text for payment dates, grace periods, and financial values, a sign that drafts were pushed into use without careful review.
opencode Interface (Source – Genians)
Other PDFs showed HeadlessChrome and Skia/PDF metadata, suggesting a separate workflow that generated HTML content and rendered it into cleaner-looking PDFs.
That combination gives attackers speed without abandoning familiar social engineering. Analysts found 29 retrieved decoy files but only 11 unique documents by MD5, with duplicated content redistributed under randomized names.
Readers can see the earlier context in Kimsuky local LLM phishing lures, where AI-made files were already used to make shortcut-borne attacks appear routine.
Comparison of Placeholders in Decoy Documents (Source – Genians)
Such artifacts can disappear as operators refine their process, so defenders should not use document quality or metadata alone as the test for whether an attachment is safe.
LNK Loaders Hide GitHub-Based Payloads
Every analyzed LNK file launched PowerShell, concealing an encrypted loader in arguments stretching roughly 5,800 to 9,500 characters.
About 300 leading spaces helped keep the command out of sight in the shortcut properties window, while excess padding inflated file sizes to frustrate simple inspection and some automated checks.
After decoding the hidden content, the loader downloads a decoy and a follow-on script from GitHub Raw Content using a hardcoded personal access token.
It then creates randomly named PowerShell files in AppData or Temp, starts PowerShell through conhost.exe --headless, and registers hidden scheduled tasks that impersonate BitLocker, MATLAB, or .NET components.
One Visa-themed variant also pulled code from Pastebin, giving the operators a second delivery route if GitHub access is blocked. The approach builds on North Korea GitHub C2 attacks, where trusted developer platforms were used to blend malicious traffic into ordinary web activity.
Newer variants check for virtual-machine and analysis tools, look for the username “Bruno,” and delete PowerShell command history when they detect a likely research environment.
Padding Data (Source – Genians)
They also use error documents in some incomplete builds, but the persistence and payload retrieval stages can still run. Comparable LNK PowerShell loader techniques show why opening a file that merely looks like a PDF is not a reliable safety check.
Organizations should quarantine unsolicited ZIP attachments containing LNK files, especially when their icons and descriptions do not match their real type.
Security teams should correlate LNK launches with long command lines, hidden PowerShell, newly created scripts, scheduled-task registration, GitHub Raw requests carrying unusual tokens, and Pastebin access.
This behavior-first approach is more durable than relying on a single domain blocklist or decoy document review, and aligns with lessons from malicious shortcut file campaigns.
Indicators of compromise (IoCs):-
Type
Indicator
Description
MD5
10780939962b54addc9d31f57d80edfc
Malicious sample hash
MD5
1523a2fcc901965ab4568d9fe829e4af
Malicious sample hash
MD5
500e0bc0d7579fb338912770964076fe
Malicious sample hash
MD5
685bfc6b2c29fbc16cfad908894add55
Malicious sample hash
MD5
7a53089053b1381742856a5cf2b95f8b
Malicious sample hash
MD5
8db2f20b719dcb7029d6296505622093
Malicious sample hash
MD5
900e832c10d851bbdef3fb191a15db0e
Malicious sample hash
MD5
a2015665a3e18bf0ef86e3931245c7e6
Malicious sample hash
MD5
bb88940e915b11f6330b7446f6037f5b
Malicious sample hash
MD5
ce5932b88f879f26006df81f2fa7667e
Malicious sample hash
MD5
d0894d4626aae0f96d6b84ca3bb71a36
Malicious sample hash
MD5
e50f2ae7fb03675a1ef58b1cf9cda6d1
Malicious sample hash
MD5
f648bdd3c2cd902e239149de86d43e8f
Malicious sample hash
GitHub account
github[.]com/sven5500
GitHub account linked to campaign infrastructure
GitHub account
github[.]com/montry111
GitHub account linked to campaign infrastructure
GitHub account
github[.]com/jamjack2026
GitHub account linked to campaign infrastructure
GitHub account
github[.]com/urusa4400
GitHub account linked to campaign infrastructure
GitHub account
github[.]com/jamestony88
GitHub account linked to campaign infrastructure
GitHub account
github[.]com/baras6600P
GitHub account linked to campaign infrastructure
GitHub account
github[.]com/choemiyang
GitHub account linked to campaign infrastructure
GitHub account
github[.]com/jeni534
GitHub account linked to campaign infrastructure
URL
pastebin[.]com/raw/gybpx38s
Pastebin-based second-stage payload delivery URL
Email
baras6600@proton[.]me
Campaign-associated email address
Email
choemiyang@hotmail[.]com
Campaign-associated email address
Email
dustinharrise91@outlook[.]com
Campaign-associated email address
Email
jackal3300@proton[.]me
Campaign-associated email address
Email
jametony8@outlook[.]com
Campaign-associated email address
Email
jamjack2026@proton[.]me
Campaign-associated email address
Email
montry111@proton[.]me
Campaign-associated email address
Email
sven5500@proton[.]me
Campaign-associated email address
Email
taini7700@outlook[.]com
Campaign-associated email address
Email
urusa4400@proton[.]m
Campaign-associated email address, recorded exactly as listed in the source
Note:IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access.
The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through compromised servers.
The operation appears designed for patience rather than disruption. Attackers likely entered through a groupware portal or mail server, used the edge server as a bridge into internal systems.
That pattern echoes the risks described in stealthy Linux server intrusions, where hidden access can remain active without drawing attention.
Analysts at Rapid7 identified the toolkit and assessed its link to DPRK-aligned advanced persistent threats with medium confidence.
Rapid7 said in a report shared with Cyber Security News (CSN) that the activity likely dates to early 2025, although the precise initial entry point and any exploited vulnerability have not been confirmed.
The affected organizations had ports 80, 443 and 25 exposed, with a groupware login service on port 443 and mail services on port 25.
These systems sit at the network edge, making their compromise serious: an intruder can collect credentials, move deeper inside, and potentially target visitors passing through that server.
DPRK-Linked Hackers Deploy Ted Backdoor
The central component, called ted backdoor, is a modified build of HAProxy 2.8.12, software commonly used to direct website traffic.
Instead of acting like a separate malicious program, it is compiled into the legitimate load balancer and uses its built-in features to inspect decrypted web requests while normal traffic continues to flow.
That placement gives the operators unusual control. The implant can capture session cookies and selected request details, run commands, upload or download files, and inject a malicious script into pages served to chosen visitors.
Its hidden command channel uses a request for a picture-like path, while its code also reduces HAProxy connection counters to make activity harder to spot. Researchers found an SSH keylogger as well as altered versions of crond, agetty, atd, sshd and polkitd.
The stager checks the operating system and whether HAProxy or cron is present before replacing the cron service, copying timestamps from a legitimate SSH binary, and removing chosen words from logs.
hardcoded master passwords in userauth_passwd() (Source – Rapid7)
CurlRAT supplies the remote-control layer. It polls attacker infrastructure for tasks, can execute commands, send system details, install added payloads, and open reverse or interactive shells with elevated privileges. A watchdog monitors HAProxy and reports whether the service starts, stops, reloads, or restarts.
Long-Term Espionage Risks and Defenses
Rapid7 said the combination of credential theft, web-session collection, selective page changes, and traffic redirection points to long-term espionage.
The targeting of South Korean media and automotive firms also fits a regional intelligence-gathering pattern. Readers following Kimsuky espionage activity in Korea will recognize why exposed groupware and stolen credentials remain valuable footholds.
The operators used basic XOR encryption and a substitution method to protect configurations and communications. Their command-and-control domains imitate image delivery services, including one that resembles a popular Korean web platform’s static-content naming style.
curlRAT configuration (Source – Rapid7)
Rapid7 also noted overlap in timing and delivery concepts with other DPRK activity, but said more evidence is needed for a firmer attribution. Defenders should review edge systems that handle web traffic, encryption, mail, or runtime modules.
They should compare deployed HAProxy and Linux service binaries against known versions, inspect unexpected shared libraries and cron changes, and rotate credentials that may have passed through affected servers. Independent network monitoring matters because logs on a compromised device may have been altered.
Teams should also investigate unusual requests to image-like paths, unexpected outbound connections from load balancers, and web responses that change only for particular visitors.
Regular patching of groupware and mail servers reduces likely entry opportunities. As shown by recent Asia-focused Linux espionage, post-compromise tools can turn a single exposed server into a durable route across an organization.
Command-and-control infrastructure masquerading as static content
Domain
img.socialteams.store
Command-and-control infrastructure
Domain
img.worksongo.store
Command-and-control infrastructure
Note:IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Roundcube Webmail has released security updates for its 1.6 LTS and 1.7 branches, fixing 12 vulnerabilities that could expose users and servers to cross-site scripting, email header injection, cross-user data access, remote-content bypasses, and server-side request forgery attacks.
The new releases, Roundcube 1.6.19 and 1.7.4, address flaws in how the open-source webmail platform processes email content, HTML, Cascading Style Sheets, attachment metadata, contact groups, and remote URLs. Administrators running production deployments of Roundcube 1.6.x or 1.7.x are urged to update as soon as possible.
TNEF, or Transport Neutral Encapsulation Format, is commonly associated with Microsoft Outlook attachments. An attacker could potentially send a specially crafted email that triggers malicious script execution when the victim views the message, without requiring the user to click a link or open an attachment.
The updates also fix another XSS issue in Roundcube’s HTML editor when handling text/enriched email content. Cross-site scripting weaknesses can allow attackers to execute JavaScript in a victim’s webmail session, creating opportunities to steal session tokens, alter mailbox settings, read messages, or perform actions as the logged-in user.
Several fixes address email header injection risks. These bugs affected the subject field, recipient display name, and an identity’s organization field.
Header injection vulnerabilities can be abused to manipulate email metadata or insert unexpected mail headers if malicious input is not correctly sanitized.
Roundcube also patched a cross-user access issue in SQL-based address books. The flaw involved adding or removing members from contact groups.
It could allow one user to modify another user’s group associations under certain conditions. This type of issue can compromise contact privacy and the integrity of address book data in shared or hosted Roundcube environments.
Remote-content protections received multiple fixes, addressing CSS declaration smuggling, HTML body background property injection, CSS-escape bypasses in FuncIRI attributes, and SVG SMIL source animation techniques that could bypass remote-content blocking.
Roundcube Webmail Patches 12 Security Flaws
The updates further fix an is_local_url() validation bypass involving fully qualified domain names with a trailing dot in stylesheet URLs. Attackers could exploit differences in URL parsing to make an external resource appear local and bypass intended restrictions.
A server-side request forgery bypass was also resolved in the Roundcube CSS proxy. The weakness involved hexadecimal IPv6-mapped IPv4 addresses, which could potentially help an attacker bypass address validation and force the server to request internal or restricted network resources.
Roundcube said full technical details are available in the release notes for versions 1.6.19 and 1.7.4. The project strongly recommends that all organizations operating affected Roundcube installations apply the updates promptly.
A counterfeit Minecraft optimisation mod is installing Myth Stealer, malware that can steal browser passwords, cookies and data. Its malicious file looks useful because features work as advertised, giving players little reason to suspect a hidden threat.
The campaign exploits users seeking performance improvements from unofficial add-ons. Once installed, the fake mod starts a multi-stage infection chain that leads to a remote tool that lets its operator collect data and broadly control a Windows device.
Analyst devmihaylov identified the malware while examining samples obtained from a buyer of the commodity stealer.
devmihaylov said in a report shared with Cyber Security News (CSN) that the files initially received zero detections from VirusTotal, showing how lightly distributed threats can evade reputation-based checks.
The counterfeit mod manifest naming the real Lithium project as its parent (Source – Medium)
Minecraft players remain frequent targets for malware distributors. Coverage of fake Minecraft Fabric mods showed how a harmless-looking game download can become the first step in account theft and compromise. The threat pairs a decoy with a loader designed to blend into a gaming setup.
Fake Minecraft Mod
The Java archive presents itself as a companion to a legitimate optimisation project and includes 12 working modules that change game performance settings.
A hidden thirteenth component waits briefly, gathers system information, then retrieves and starts the next stage in the background. That approach matters because victims may see the expected optimisation behavior and conclude the download is safe.
The loader uses a large executable built around a standard runtime and brings a private Java environment, letting the payload run even where Java is not otherwise installed.
Before launching the final stage, the program displays a polished administrator-rights request resembling a normal Windows prompt.
Accepting it can give the malware greater access and helps its installation. It also contains retry logic intended to cope with security software interrupting the process.
module p, the one module of thirteen that is not an optimisation (Source – Medium)
The final component is heavily disguised to slow investigation. Its code uses reserved Windows-style names, encrypted text and obstacles that can break basic extraction tools.
This concealment, combined with an apparently genuine mod, makes a quick visual check of a download an unreliable safeguard.
Credential theft and remote control
Myth Stealer targets data stored by Chromium-based browsers and Firefox, including saved usernames, passwords, browsing records and active session cookies.
Stolen cookies can be especially damaging because they may let an attacker reuse an already authenticated web session. Readers can see why browser passwords and cookies remain valuable targets in similar data-theft operations.
The malware also collects system details, chat content, clipboard data and files, can capture screenshots or webcam material.
Its remote-control features include running commands, downloading or deleting files, managing processes and setting itself to start again after a reboot.
Researchers also found functions that could disrupt a victim. These include changing display settings, interfering with the mouse or keyboard, showing misleading full-screen messages and attempting to restrict access to security tools.
The fake administrator prompt the launcher shows before elevating (Source – Medium)
They can complicate recovery and pressure users to follow an attacker’s instructions. The operation used web-based reporting channels to receive stolen information, a technique documented in coverage of Discord webhook abuse across other malware campaigns.
Although the analysed command infrastructure was no longer responding when reported, inactive servers do not erase the risk to systems already infected.
Players should obtain mods only from trusted project pages, confirm the developer and file integrity, and avoid downloads promoted through chat links, videos or unofficial file-sharing pages.
Anyone who installed a suspicious mod should remove it, run a full security scan and change passwords from a clean device.
They should also sign out of important accounts to invalidate sessions, review browser extensions and look for unfamiliar programs that start automatically. An unexpected administrator prompt during mod installation is a serious warning sign.
Note:IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Security researchers have uncovered a significant vulnerability chain in Telerik UI for ASP.NET AJAX, allowing unauthenticated attackers to execute remote code in vulnerable enterprise web applications.
The issue primarily affects Telerik’s RadAsyncUpload component, a widely used file-upload control in ASP.NET WebForms applications.
Progress Software has indicated that the flaw impacts versions from 2010.1.309 to 2026.2.519. The vulnerability was addressed in version 2026.2.708, released as part of the 2026 Q2 SP1 update.
The vulnerability chain includes four distinct flaws: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. While these vulnerabilities are serious, their exploitation requires specific conditions and cannot be applied universally to all default Telerik deployments.
At the heart of the issue is CVE-2026-13182, a padding oracle vulnerability within RadAsyncUpload’s handling of encrypted client states. Telerik employs AES-CBC encryption to safeguard configuration data exchanged between the server and the user’s browser.
A padding oracle occurs when the application provides different error responses for invalid encrypted data. In this case, malformed data results in a distinct error compared to valid padding with invalid JSON content.
Telerik Flaw Chain
This discrepancy enables an attacker to submit modified ciphertext repeatedly, gathering information on how the application decrypts it, ultimately allowing them to recover sensitive data and forge modified encrypted values without needing the encryption key.
Even when the ASP.NET customErrors feature is enabled, researchers noted that exploitation remains possible, albeit more challenging and time-consuming through timing analysis.
Exploiting this oracle, researchers manipulated Telerik’s serializedConfiguration data, which governs settings within the upload control. This enabled attackers to alter the AllowedFileExtensions field, permitting DLL files to be uploaded.
Telerik and its building blocks (Source: TantoSec)
The attack utilized a CBC forgery technique, introducing a “sacrificial” encrypted block within a JSON string. This method preserved necessary configuration from legitimate page loads, including session controls, while inserting malicious entries in the configuration.
The second critical vulnerability, CVE-2026-13181, pertains to the management of upload metadata, where Telerik resolves the .NET type name supplied via the AsyncUploadTypeName value without a proper allowlist.
If a server-side FileUploaded handler reads the UploadResult property, Telerik deserializes corrupt data into the designated type. This behavior can be exploited together with the System.Configuration.Install.AssemblyInstaller gadget, enabling the application to load an uploaded mixed-mode DLL from a temporary directory, executing native code via its DllMain entry point.
The proof-of-concept demonstrated execution of a web shell within the IIS worker process, while an in-memory variant could run commands without writing any files to disk.
To successfully exploit this vulnerability chain, attackers must access a page containing a RadAsyncUpload control with an active server-side FileUploaded event handler that reads UploadResult.
Additionally, an explicit, non-default Telerik.AsyncUpload.ConfigurationEncryptionKey must be configured for the exploitation path to function, which is recommended as a security measure.
Organizations utilizing Telerik UI for ASP.NET AJAX are urged to upgrade immediately to version 2026.2.708 or later. It is critical for administrators to identify pages using RadAsyncUpload and review their upload event handlers to monitor for potential exploitation.
Vigilance against suspicious IIS activity is also necessary, with particular attention to instances of w3wp.exe unexpectedly spawning cmd.exe, the appearance of DLL files in temporary folders, and unexpected .aspx files in web roots.
The OpenVPN project has shipped version 2.7.7, a security-focused release that patches seven distinct vulnerabilities spanning the software’s core reliability layer and its Windows-specific service components.
The update, released on September 3, 2026, addresses issues ranging from denial-of-service conditions to buffer overreads and configuration bypasses that could allow attackers to run unauthorized VPN configurations.
The most broadly impactful fix, tracked as CVE-2026-84732, targets OpenVPN’s reliability layer, a component responsible for managing TLS handshakes and acknowledgment packets.
The flaw combined two separate bugs: an unbounded reliable TLS timeout and improper handling of acknowledgments for packets that could never legitimately be outstanding. Both issues were discovered by security researcher Mark Bregman of Fox-IT, and since the reliability layer is shared across all supported platforms, the fix benefits Linux, Windows, and macOS deployments alike.
Six of the seven vulnerabilities specifically affect Windows installations, reflecting how deeply OpenVPN’s Windows service architecture had accumulated edge-case weaknesses.
OpenVPN Fixes 7 Security Flaws
CVE-2026-84256 involved incorrect command-line quoting in the CreateProcess() function, where characters with special meaning to cmd.exe could, in combination with a validation script and a rogue certificate authority, lead to unexpected behavior.
A related flaw, CVE-2026-84226, affected the tapctl utility, which previously invoked netsh.exe without specifying its full file path, a gap that researchers at BreachX Zero Day Labs identified using their Typhon AI Mil v2 tooling.
Local privilege abuse was also on the table. CVE-2026-82312 stemmed from OpenVPN’s use of NULL discretionary access control lists (DACLs) on system objects, including the service exit event and the netsh.exe guard semaphore.
This design flaw enabled a local denial-of-service scenario in which one logged-in user could interfere with another user’s OpenVPN session by blocking the semaphore or triggering spurious events, though the issue applies only to setups that skip the interactive service or rely on the automatic Windows service.
Two additional Windows flaws affected openvpnserv, the Windows service component. CVE-2026-78221 caused a buffer overread when internationalized domain names using UTF-8 encoding were processed, because the NRPT domain size passed to the function was incorrect.
Separately, CVE-2026-78043 revealed that openvpnserv’s configuration path validation failed to block forward slashes, even though Windows file-open APIs treat them as valid path separators. This mismatch could let an attacker slip past administrative restrictions and force openvpn.exe to launch a configuration file it was never authorized to run.
Rounding out the list, CVE-2026-81738 fixed an off-by-one error in write_dhcp_search_str(), where specially crafted DHCP search-domain options could overflow a temporary buffer by a single byte, a bug credited to researchers Andre Kropp of Nexory and ChinhNguyen.
Bypass of admin-restricted config paths, unauthorized config execution
CVE-2026-81738
write_dhcp_search_str()
Windows
Off-by-one in temp buffer guard
Single-byte buffer overflow via crafted DHCP options
Beyond the CVE fixes, OpenVPN 2.7.7 adds a Linux-specific improvement that validates netlink replies against the originating request, an enhancement suggested by researcher Joshua Rogers.
The release also reduces the number of future keys retained under the EPOCH data-channel format from sixteen to four, easing log noise and resource usage on high-throughput links, alongside several networking bug fixes affecting TCP handshakes, UDP checksum handling, and OpenSSL’s HMAC key management.
Administrators running OpenVPN on Windows should prioritize this update given the concentration of local-privilege and configuration-bypass flaws, while all users benefit from the reliability-layer patch. The release notes and full CVE details are published on the OpenVPN Community Wiki’s security announcements page.
PEEP, a malicious Chrome extension posing as Smart Bookmarks, can steal active login sessions and turn an already compromised Windows computer into a remote backdoor.
The finding shows how a browser add-on can become far more dangerous than a simple data thief when it gains a path to the operating system.
The toolkit does not appear to provide its own way into a device. Instead, attackers need prior code execution or administrative access, then silently place it in Chrome or Edge profiles.
Its installers can alter browser settings so the extension launches without the usual store checks, approval prompts, or visible warnings.
Analysts at SOCRadar identified the operation as PEEP, a Chromium-based post-compromise toolkit derived from the open-source RedExt project.
SOCRadar said in a report shared with Cyber Security News (CSN) that the researchers found a primary build disguised as Smart Bookmarks, version 1.3.0, along with a related testing variant and an exposed development repository.
Architecture Overview (Source – SOCRadar)
The scale of confirmed victim impact remains unclear. A server status snapshot recorded 34 agent entries, 10 active sessions, and 507 data records, but test identifiers mean those figures cannot prove the number of infected devices.
Still, the design creates a serious risk because stolen session cookies may let an intruder enter accounts without needing a password again.
Malicious Chrome Extension
Once active, PEEP runs inside the browser and asks for broad access to tabs, cookies, history, bookmarks, downloads, browser settings, scripting, and every website.
It gathers browsing history, open-tab details, session cookies, form data, clipboard contents, screenshots, and local or session storage, creating a broad view of a victim’s online activity.
The session-theft capability is especially concerning because a valid cookie proves that a user has already signed in.
C2 Login Panel (Source – SOCRadar)
As explained in this guide to stolen browser cookie risks, an attacker who obtains that token may be able to reuse an active session and sidestep a later password or MFA prompt until the session is revoked.
PEEP also accepts commands to open pages, inject JavaScript, change proxy settings, and capture page content. It contacts its command server at regular intervals using unencrypted HTTP, allowing the operator to send tasks and receive collected data.
The native-messaging bridge is what changes the threat from browser monitoring into host control. The browser extension can call a companion Windows program, enabling shell commands, file operations, and discovery of running processes and services under the current user account.
Persistence Raises Cleanup Challenge
PEEP uses several methods to remain in place after installation. Its scripts can forge Chrome Secure Preferences integrity values, use enterprise force-install policies, or sideload the extension.
It can also exploit a ScriptCache fallback, leaving apparently harmless source files while Chrome reloads a previously compiled malicious service worker.
That layered approach means removing the visible extension alone may not be enough. Security teams should identify the listed extension IDs, remove the associated native-messaging host and local artifacts, and review browser policies and registry entries.
PEEP attack lifecycle (Source – SOCRadar)
The finding follows earlier cases in which a native messaging host backdoor turned Chrome into a route for device-level control.
Organizations should block the identified infrastructure, restrict traffic to the exposed services, and investigate browser processes or PowerShell activity that modifies Secure Preferences files.
Strict extension allow-lists, disabled developer mode, restrictions on external sideloading, and approval of only trusted native-messaging hosts can reduce the chance of a similar installation succeeding.
Defenders should also treat a suspected PEEP infection as both an endpoint and identity incident. Remove the malware, end active sessions, rotate affected credentials, and examine account activity for misuse.
Phishing-resistant MFA and browser protections for stored credentials add useful friction, while the recent Chrome extension supply chain attacks show why every installed add-on deserves careful ongoing review.
Indicators of compromise (IoCs):-
Type
Indicator
Description
C2 host
206.237.30.232
Hardcoded command-and-control, payload distribution, and staging host
Domain
xfjcc.fun
Reported C2 domain
Domain
new.xfjcc.fun
Reported C2-related subdomain
Domain
newadmin.xfjcc.fun
Reported C2-related subdomain
Domain
newapi.xfjcc.fun
Reported C2-related subdomain
C2 service
tcp/5001
C2 control panel and agent API service
Staging service
tcp/5002
Exposed development and payload-staging repository
C2 endpoint
/api/register
Agent registration endpoint
C2 endpoint
/api/commands?agent_id=<id>
Command polling endpoint
C2 endpoint
/api/exfil
Data-exfiltration endpoint
C2 endpoint
/api/agents/<id>/heartbeat
Agent heartbeat endpoint
C2 endpoint
/api/agents/<id>/task_result
Task-result endpoint
C2 endpoint
/api/agents/<id>/data
Observed candidate alternate data channel
C2 endpoint
/api/extension_update/<id>
Extension update endpoint
C2 endpoint
/api/extension_crx/<id>
Extension delivery endpoint
C2 endpoint
/health
Unauthenticated server status endpoint
HTTP header
X-PEEP-Agent-Key
Agent identification header
HTTP header
X-PEEP-Agent-Id
Agent identification header
HTTP authentication realm
realm="PEEP"
Control-panel HTTP Basic authentication realm
Extension ID
ejkndncpkdcjcikfhiamcdehdoegilbj
Primary Smart Bookmarks payload
Extension ID
bibjjhidpdmfcbkodddndmoejcloobdh
Alternate smoke-agent variant
Extension ID
hpjgilbbdmfcnaapjbofmmmjjfijbdki
Reported related extension identifier
Extension ID
akhljhifabhkcoboncoiekfpdodjaack
Reported related extension identifier
Extension ID
eljagiodakpnjbaceijefgmidmpmfimg
Reported related extension identifier
Native-messaging host
com.peep.lab
Native host registered for browser-to-host communication
File
nm_host.exe
Windows native-messaging host binary
File
nm_host.js
Native-host script
File
install_silent.ps1
Silent installation script
File
patch_secure_prefs.ps1
Browser preference-forgery script
File
force_enable.ps1
Extension re-registration script
File
patch_secure_prefs_linux.py
Linux preference-forgery script
File
extension.pem
Extension signing private key included in recovered packages
File
CHROME150-LIVE-RESULT.md
Development and testing log
File
background.js
Extension service-worker script
File
content.js
Extension content script
Static key
peep_nm_host_aes256_key_32bytes!
Embedded native-host encryption key
Local path
%LOCALAPPDATA%\PEEP
Local staging and artifact directory
Registry path
HKCU/HKLM\...\NativeMessagingHosts\com.peep.lab
Native-messaging host registration location
File pattern
*.bak_peep_hmac_*
Backup artifact associated with preference modification
File pattern
*.bak_peep_enable_*
Backup artifact associated with extension enabling
Note:IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
N-able has released N-central 2026.3 Hotfix 4 to fix CVE-2026-86218. This critical vulnerability could allow an unauthenticated attacker to execute code remotely on an exposed N-central server.
The update, identified as build 2026.3.1.14, was issued for on-premises N-central deployments. N-able urged self-hosted customers to install the hotfix immediately, warning that systems left unpatched remain at risk even though the company has not confirmed exploitation in production environments.
CVE-2026-86218 is a pre-authenticated remote code execution vulnerability. This means an attacker may be able to trigger the flaw without first logging in or providing valid user credentials. If successfully exploited, the issue could allow an attacker to run commands on the N-central server.
N-central is used by managed service providers and IT teams to monitor, manage, automate, and secure customer systems. Because the platform can have broad access across endpoints, networks, credentials, and administrative tools, a compromise of the central management server could create serious downstream risks.
Attackers who gain control of an N-central server could potentially use that access to deploy malicious software, alter monitoring settings, steal stored information, create unauthorized accounts, or move further into managed customer environments.
N-able Released Hotfix
The exact technical details and attack vector for CVE-2026-86218 have not been publicly disclosed. N-able said a third party responsibly reported the flaw through its security disclosure program. The vendor stated that it currently has no confirmation of active exploitation.
However, organizations should not treat the lack of known attacks as a reason to delay patching. Public patch releases can help threat actors identify vulnerable systems and develop exploit attempts.
The new release replaces N-central 2026.3 Hotfix 3, build 2026.3.1.13. Customers running versions 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1, or 2026.3.1 Hotfix 2 can upgrade directly to build 2026.3.1.14. Organizations using older releases should first move to a supported upgrade version and then apply the latest hotfix.
N-able confirmed that hosted N-central customers, also known as NCOD users, do not need to take any action because the patches have already been applied to their environments. The urgent action applies to organizations operating their own self-hosted N-central infrastructure.
The company also said administrators do not need to upgrade N-central agents specifically to address CVE-2026-86218. However, it recommended keeping agents up to date with the latest available version as a general security practice.
Security teams should identify all self-hosted N-central instances, confirm their installed build number, and schedule the update to 2026.3.1.14 as soon as possible.
Administrators should also review server access logs, administrator account activity, remote command execution records, and unusual configuration changes for signs of suspicious behavior before and after patching.
The cybersecurity industry is confronting a threat landscape that is changing faster than most defenders can keep track of. New data from Epoch AI shows that critical and high-severity vulnerability disclosures from major technology firms have gone vertical since the beginning of this spring, climbing from a baseline of a few hundred a month to well over 600, with critical-severity CVEs alone jumping from single digits to more than 600 in recent months.
By June 2026, twenty-one notable organizations, including Microsoft, Google, Apple, Adobe, Oracle, Cisco, and IBM, disclosed around 1,500 high- and critical-severity CVEs, more than 3.5 times the previous monthly record set before the release of Anthropic’s Claude Mythos Preview.
Critical Software Vulnerabilities Surge
That surge did not stop there; by July, disclosures reached roughly 2,500, nearly five times the pre-Mythos baseline and 60 percent above June’s already record-breaking total.
Researchers point to Anthropic’s Project Glasswing, an AI-powered vulnerability discovery initiative, as a major driver behind the spike, with the effort reportedly surfacing more than 10,000 high- or critical-severity flaws, many of which have not yet been individually disclosed.
Whether this reflects a genuine increase in exploitable weaknesses or simply a change in how vulnerabilities are found and classified remains uncertain, but analysts agree that AI-assisted discovery tools have fundamentally altered the pace at which flaws surface.
Compounding the disclosure surge is a parallel collapse in the time attackers need to weaponize new flaws. According to ZeroDayClock, the zero-day rate, meaning the share of exploited vulnerabilities attacked on or before the day of public disclosure, has climbed to nearly 87 percent, up roughly 60 percent from last year and almost quadruple the rate recorded in 2020.
The median time to exploit now sits at around one day, and some researchers project it could shrink to just one minute by next year. As recently as 2018, the median gap between disclosure and first observed exploitation stretched to 771 days; by 2023 that window had fallen to roughly six days, and by 2024 it was down to hours.
The so-called exploit survival curve, which tracks what percentage of eventually-exploited CVEs remain unexploited over time, now falls to zero within about 1.5 months of disclosure, reads the report.
In 2022, half of all exploits that would ever be weaponized were still unexploited at the 1.5-month mark, and even at three months a substantial share had gone untouched. Today, defenders effectively have no cushion once a flaw becomes public.
Security teams prepared to patch cycles measured in weeks are now operating in an environment where exploitation can begin before a fix is even available.
Ransomware operators have already adapted, with more than half of ransomware-linked CVEs in 2025 first identified through zero-day exploitation, up sharply from the prior year.
Industry analysts note that AI is reshaping both sides of the equation, accelerating offensive discovery while also promising to strengthen automated defense and detection capabilities. For now, organizations that delay patching by even a few days are increasingly likely to find that attackers got there first.
Endpoint detection and response (EDR) records what happens on your endpoints, detects attacker behaviour that prevention missed, and gives you the ability to investigate and contain it.
CrowdStrike leads on detection engineering and threat intelligence, SentinelOne on autonomous response, and Microsoft Defender for Endpoint on economics if you already hold E5.
But the honest question in this category isn’t which platform detects most it’s which one your team can actually operate. Here are the ten best, and how to choose without buying capability you’ll never use.
The Decision Matrix
If this describes you
Choose
Why
Mature SOC, want the best telemetry and hunting
CrowdStrike
Deepest detection engineering and intel
Small team, need automation to compensate
SentinelOne
Strongest autonomous response and rollback
Already licensed Microsoft 365 E5
Microsoft Defender for Endpoint
Included, and genuinely competitive
Want endpoint plus network and cloud in one
Palo Alto Cortex XDR
Broadest native data fusion
Generalist IT, no security specialists
Sophos
Best usability, easy MDR escalation
Server and cloud workloads dominate
Trend Micro
Strong workload and hybrid coverage
Good EDR on a mid-market budget
Bitdefender
Top detection at accessible pricing
Consolidating a broad Trellix estate
Trellix
Integrated with existing tooling
Want malicious-operation-centric detection
Cybereason
Distinctive attack-chain visualisation
Cisco networking and SecureX estate
Cisco Secure Endpoint
Native integration across Cisco security
Definitional answer: endpoint detection and response continuously records process, file, registry, and network activity on endpoints, applies behavioural analytics to identify attacker techniques, and provides investigation and containment tools isolating a host, killing a process, or rolling back changes from a central console.
What Actually Separates These Platforms
Detection quality is table stakes; analyst burden is the differentiator. Every platform here detects the common attack techniques. Where they diverge is what lands in your queue: how many alerts per hundred endpoints per week, how much correlation happens automatically, and how long it takes an analyst to go from alert to answer.
A platform that generates 40 alerts and correlates them into one incident is fundamentally different from one that generates 40 alerts.
MITRE ATT&CK Evaluations are useful and widely misrepresented. MITRE runs vendors through a simulated adversary campaign and publishes what each detected and how — with no scores, no rankings, and no winners.
Every vendor claiming to have “won MITRE” has constructed a metric to say so. Read the raw results against adversary emulation and threat hunting for the techniques relevant to your environment, note how many detections required configuration changes during testing, and ignore the marketing entirely.
Update staging is now a first-order requirement. The July 2024 CrowdStrike content update incident, which caused widespread Windows failures globally, changed how mature buyers evaluate every EDR vendor.
Ask each one: can you define rollout rings, can you delay content updates on critical systems, and what is the documented rollback procedure and its expected duration? This applies to all vendors, not one.
Retention length quietly determines investigation quality. Attackers frequently dwell for weeks. An EDR with seven days of telemetry cannot answer questions about an intrusion that began a month ago.
Retention is tiered at nearly every vendor and is one of the biggest hidden cost drivers.
How We Evaluated
Research-based comparison; no lab testing performed or claimed. We weighted detection depth and telemetry richness, response and containment capability, analyst experience and alert quality, platform coverage across Windows, macOS, Linux, and servers, and operational cost including retention tiers and managed service options.
Published evaluation results from MITRE, AV-Comparatives, and AV-TEST informed the assessment; we did not conduct our own tests.
CrowdStrike Falcon EDR detection timeline and process tree
The pitch: the richest endpoint telemetry in the market, paired with elite threat intelligence and a managed hunting team that finds what automation doesn’t.
Where it wins: Exceptional detection engineering with consistently strong independent evaluation results; Falcon OverWatch managed hunting is genuinely differentiated; adversary attribution turns alerts into context; lightweight single agent ranking among the best EDR security tools, extending to identity, cloud, and log management; excellent API for automation.
Where it strains: premium pricing with modular add-ons that accumulate; retention beyond the base tier costs meaningfully more; the July 2024 incident makes update-staging controls a mandatory evaluation topic.
Pricing signal: per-endpoint subscription with modular tiers; quote-based with published small-business entry pricing.
Image ALT: CrowdStrike Falcon EDR detection timeline and process tree
SentinelOne Singularity Storyline attack correlation and rollback
The pitch: on-agent AI that detects, correlates, and remediates without a cloud round trip designed for teams that can’t staff a 24/7 SOC.
Where it wins: Strong autonomous containment and one-click rollback of ransomware damage on Windows; Storyline automatically assembles related events into a single narrative, which cuts investigation time sharply; connects seamlessly with threat intelligence feeds; good Windows, macOS, and Linux parity; agent functions when disconnected.
Where it strains: automated response needs careful tuning to avoid disrupting legitimate software; premium pricing; the platform has broadened considerably, so scope your licence deliberately.
Pricing signal: per-endpoint subscription in tiers with some published pricing.
Image ALT: SentinelOne Singularity Storyline attack correlation and rollback
Microsoft Defender for Endpoint incident graph and device timeline
The pitch: competitive EDR you may already own, with unmatched integration into the Microsoft security stack.
Where it wins: Strong independent evaluation results; deep correlation with Entra ID, Office 365, and Intune signals through Defender XDR; enforces foundational Zero Trust implementation policies; no additional agent on Windows; automated investigation and remediation reduces triage load; enormous telemetry from Microsoft’s install base.
Where it strains: full EDR requires the P2 tier or E5 — licensing confusion is the most common problem here; macOS and Linux capability trails Windows; the console rewards familiarity with Microsoft’s ecosystem and punishes the lack of it.
Pricing signal: included in Microsoft 365 E5, or standalone P1/P2; Microsoft publishes list pricing.
Image ALT: Microsoft Defender for Endpoint incident graph and device timeline
Palo Alto Cortex XDR incident correlation across endpoint and network
The pitch: endpoint detection that correlates natively with network and cloud telemetry from the same vendor, rather than through integrations.
Where it wins: Genuine cross-source correlation reduces alert volume substantially; strong behavioural analytics; excellent for organizations already running Palo Alto firewalls; capable identity analytics; bridges the gap between endpoint security EDR vs XDR environments.
Where it strains: delivers most value inside a Palo Alto estate; data ingestion pricing needs careful modelling; deployment and tuning require more effort than the endpoint-only platforms.
Pricing signal: per-endpoint plus data ingestion; quote-based.
Image ALT: Palo Alto Cortex XDR incident correlation across endpoint and network
Sophos Intercept X EDR guided investigation and threat case
The pitch: capable EDR presented in a way a non-specialist can use, with a clear path to handing it over to a managed service.
Where it wins: The most approachable console here; guided investigations help teams without threat hunting experience; synchronized security shares context with Sophos firewalls automatically; strong anti-ransomware; streamlines SOC challenges with threat intelligence; the February 2025 Secureworks acquisition adds Counter Threat Unit research depth.
Where it strains: telemetry depth and hunting flexibility trail the leaders for mature SOCs; post-acquisition portfolio positioning is a fair question to ask; retention is limited at lower tiers.
Pricing signal: per-endpoint subscription, partner-quoted with published small-business guidance.
Image ALT: Sophos Intercept X EDR guided investigation and threat case
Trend Micro Vision One endpoint and workload detection correlation
The pitch: EDR that treats servers, containers, and cloud workloads as first-class citizens rather than afterthoughts.
Where it wins: Excellent coverage across physical, virtual, container, and cloud workloads; Vision One correlates endpoint with email, network, and cloud detections; integrates smoothly into centralized SOC tools and platforms; strong vulnerability research heritage; good value at platform scale.
Where it strains: the platform breadth requires careful licence scoping; console complexity reflects that breadth; endpoint-only buyers may find it over-specified.
Pricing signal: per-endpoint or per-workload credits within Vision One; quote-based.
Image ALT: Trend Micro Vision One endpoint and workload detection correlation
Bitdefender GravityZone EDR incident visualisation and root cause
The pitch: detection engines that consistently test at the top, with EDR capability at pricing mid-market organizations can approve.
Where it wins: Excellent prevention reduces how much EDR work you need to do in the first place; GravityZone serves as a high-performing endpoint protection platform providing real investigation capability at accessible cost; strong ransomware remediation; broad platform coverage including virtualized environments; published pricing at lower tiers.
Where it strains: threat intelligence and managed hunting depth below the leaders; fewer large-enterprise references; investigation tooling is capable but less flexible than CrowdStrike’s query language.
Pricing signal: per-endpoint subscription with published SMB and mid-market pricing.
Image ALT: Bitdefender GravityZone EDR incident visualisation and root cause
Trellix endpoint detection and response investigation console
The pitch: the combined McAfee Enterprise and FireEye endpoint technology, correlated with Trellix network, email, and sandbox detections.
Where it wins: Mature enterprise policy control and deep configurability; strong integration across the Trellix detection portfolio; informed by cyber threat intelligence (CTI); on-premises deployment available where cloud is not permitted; proven detection heritage against targeted attacks.
Where it strains: portfolio consolidation since the merger warrants a direct roadmap conversation; agent footprint heavier than cloud-natives; standalone buyers should compare carefully.
Huntress Managed EDR endpoint threat detection and response
The pitch: managed endpoint detection and response that combines EDR telemetry with 24/7 security operations, threat hunting, investigation, and human-led response, reducing the burden on internal security teams.
Where it wins: Strong fit for organizations without a fully staffed SOC; combines endpoint visibility with managed detection and response (MDR), helping analysts investigate suspicious activity and respond to threats without operating the EDR console alone.
Where it strains: Huntress is primarily a managed EDR/MDR service, rather than a direct replacement for Cybereason’s MalOp-centric attack-chain visualization. Organizations wanting extensive native XDR data fusion or highly customizable threat-hunting workflows should validate those capabilities during evaluation.
Pricing signal: per-endpoint subscription; generally subscription-based with pricing depending on the selected service and deployment.
Image ALT: Huntress Managed EDR endpoint threat detection and response
Cisco Secure Endpoint detection with Talos threat intelligence
The pitch: endpoint detection integrated natively with Cisco networking, email, and identity, backed by Talos intelligence.
Where it wins: Strong integration across the Cisco security portfolio and XDR; Talos threat intelligence context enriched with OSINT threat intelligence tools; retrospective detection flags files later found malicious; sensible for organizations already Cisco-standardized.
Where it strains: detection engineering trails the specialist leaders; licensing complexity typical of Cisco; console feels dated relative to newer platforms; value concentrates inside the ecosystem.
Pricing signal: per-endpoint subscription within Cisco licensing; quote-based.
Image ALT: Cisco Secure Endpoint detection with Talos threat intelligence
Full Comparison Table
Platform
Telemetry depth
Auto response
Rollback
Linux/macOS
On-prem option
Managed service
Best-fit size
CrowdStrike
Highest
Strong
Limited
Full
No
OverWatch
Mid–enterprise
SentinelOne
High
Strongest
Yes
Full
Limited
Vigilance
SMB–enterprise
Microsoft Defender
High
Strong
Partial
Good
No
Defender Experts
Any M365 estate
Palo Alto Cortex XDR
High
Strong
Partial
Full
No
Unit 42 MDR
Mid–enterprise
Sophos
Moderate
Good
Yes
Full
Limited
Sophos MDR
SMB–mid
Trend Micro
High
Good
Partial
Full
Yes
Service One
Mid–enterprise
Bitdefender
Moderate
Good
Yes
Full
Yes
Bitdefender MDR
SMB–mid
Trellix
High
Good
Partial
Full
Yes
Yes
Enterprise
Huntress Managed EDR
High
Strong
Yes
Windows, macOS, Linux
No
Core offering
SMB–mid-market
Cisco Secure Endpoint
Moderate
Good
No
Full
Limited
Cisco MDR
Cisco estates
Buyer’s Guide
Be honest about who will use it. EDR generates work. If nobody is watching the console at 2 a.m., buy a platform with strong automated response (SentinelOne, Sophos) or buy managed detection and response alongside it. An unmonitored EDR is an expensive audit log.
Model retention cost before you compare per-endpoint prices. Base tiers commonly include short telemetry retention, and extending it is where quotes diverge sharply. Decide what retention your incident response process actually requires 30 days is a common floor, 90 is safer and price that.
Run the proof of concept with real attack simulation. Use an open-source adversary emulation tool or a red team exercise, not the vendor’s demo.
Measure three things: what was detected, how many alerts it produced, and how long it took an analyst to reach a conclusion. The third number is the one that predicts your operational cost.
Test on your non-Windows estate specifically. Linux server and macOS capability varies far more between vendors than the datasheets suggest, and this is where gaps go unnoticed until an incident.
Common mistakes: buying enterprise EDR with no plan for who responds to alerts; leaving prevention features disabled during a “monitoring period” that never ends; and treating EDR as a substitute for patch management and identity controls rather than a complement to them.
Frequently Asked Questions
What is EDR?
Endpoint detection and response continuously records process, file, registry, and network activity on endpoints, applies behavioural analytics to identify attacker techniques, and provides investigation and containment tools isolating a host, killing a process, or rolling back changes from a central console. It catches attacks that prevention missed.
What is the best EDR solution in 2026?
CrowdStrike leads on telemetry depth, detection engineering, and managed hunting. SentinelOne offers the strongest autonomous response for teams without 24/7 staffing, Microsoft Defender for Endpoint the best economics for Microsoft 365 E5 organizations, and Bitdefender the best value for mid-market buyers.
What is the difference between EDR and XDR?
EDR focuses on endpoints. XDR extends the same detection and response model across endpoints, network, email, identity, and cloud, correlating signals from multiple sources into single incidents.
Most EDR vendors now sell XDR platforms with EDR as the core component, and the distinction is often about which data sources are included in your licence.
Do I need EDR if I have antivirus?
Modern business antivirus and EDR are usually the same agent at different licensing tiers. Prevention stops known and predictable threats; EDR gives you visibility and response when something gets through.
If you handle sensitive data, face compliance requirements, or would need to answer “what did the attacker access,” you need the EDR tier.
How much does EDR cost?
EDR is licensed per endpoint per year, with tiers determining telemetry retention, hunting capability, and managed services. Bitdefender and Microsoft publish list pricing; premium vendors are largely quote-based with published small-business entry pricing.
Retention length and managed service add-ons are the biggest variables between quotes.
What do MITRE ATT&CK Evaluations actually show?
MITRE runs vendors through a simulated adversary campaign and publishes exactly what each product detected and how — with no scores, rankings, or winners. Any vendor claiming to have won has invented a metric.
Read the raw results for the techniques that match your threat model, and note how many detections required configuration changes during the evaluation.
The Verdict
CrowdStrike is the strongest platform if you have analysts to use it and budget to fund it. SentinelOne is the better answer for teams who need the product to act on its own.
Microsoft Defender for Endpoint is the rational default in an E5 estate competitive, integrated, and already paid for. Bitdefender is the value pick, Sophos the most usable for generalist IT.
Before signing anything, settle two questions: who responds to alerts, and how long is your telemetry retained. Those determine whether EDR protects you or just documents what happened.
Natural Resources Wales (NRW) has reported a personal data breach involving sensitive diversity-monitoring information from both former and current employees. The breach affected individuals whom NRW employed between April 2013 and March 2018. An internal investigation revealed that a spreadsheet containing employee data was accidentally published online, making the information accessible before the issue was […]
ConnectWise has announced a security issue affecting file transfer functionality in ScreenConnect Remote Access Support and Access sessions. This issue affects both cloud-hosted and on-premises ScreenConnect deployments. In response, the company has issued immediate mitigation guidance. At the same time, it is working on an official patch and securing a CVE identifier. The advisory, released […]
A large-scale phishing operation is abusing trusted Google services as a multi-stage redirect network to bypass email security controls, deliver highly personalized credential-harvesting pages, and, in some cases, install ScreenConnect remote-access software. The campaign’s central advantage is that it presents trusted Google-owned domains at nearly every point a gateway, proxy, or analyst is likely to […]
OpenAI has announced a $1 billion global commitment to expanding access to its Daybreak AI cybersecurity platform for frontline defenders who protect critical infrastructure, public services, and under-resourced organizations. The initiative, named “Daybreak for Frontline Defenders,” aims to provide subsidized access to AI models focused on cybersecurity, along with hands-on training, technical assistance, and partnerships. […]
A newly analyzed Linux malware sample, dubbed Tengu, combines Mirai-style botnet tradecraft with broad persistence, DDoS, SSH probing, and proxy capabilities. The stripped 32-bit ELF masquerades as a Linux kernel worker process while targeting servers, embedded devices, and IoT-adjacent systems. It has no symbols, uses NX protection and partial RELRO, and carries a SHA-256 hash […]
Best value overall: Ubiquiti. Published hardware pricing, no mandatory licensing, and WPA3 with VLAN segmentation included for organizations whose compliance requirements don’t demand enterprise wireless intrusion prevention. Best capability: HPE Aruba. Best management: Cisco Meraki and Juniper Mist. Best if you own the firewall: Fortinet, utilizing your existing FortiGate firewalls. The critical cost question in […]
Entrar
.webp)
.webp)
.webp)
.webp)
%20(Source%20-%20Rapid7).webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
