This week’s intelligence highlights an intense convergence of automated identity theft and structural zero-day exploitation. Threat actors are industrializing Multi-Factor Authentication (MFA) bypasses through highly sophisticated Phishing-as-a-Service (PhaaS) platforms, exploiting unpatched zero-days in enterprise VPN appliances, and leveraging misconfigured GitHub Actions to poison critical software supply chains.

SISA Weekly Threat Watch – our weekly feature brings to you a quick snapshot of all the major security vulnerabilities that posed a threat to organizations worldwide. These recurring actionable threat advisories will also provide information and recommendations that will help security teams take appropriate actions to defend against the latest and critical threats.

1. Identity Abuse & Phishing-as-a-Service (PhaaS)

Adversaries are actively abandoning traditional credential theft, pivoting instead to real-time session hijacking and device code abuse to bypass modern MFA protections.

• Forg365 PhaaS Platform — This comprehensive toolkit utilizes Adversary-in-the-Middle (AitM) tactics and Device Code authentication phishing to harvest Microsoft 365 tokens. Uniquely, it deploys a Chromium browser extension (ForgCookie) to perform silent OAuth refreshes, maintaining a continuous Single Sign-On (SSO) loop that grants persistent access even if original tokens expire.
• Jalisco and OmegaLord Toolkits — The Jalisco toolkit bypasses strict Time-To-Live (TTL) limits by generating OAuth device codes in real-time, allowing attackers to enroll their own rogue devices into a victim's Entra ID tenant. Concurrently, OmegaLord overlays convincing phishing interfaces demanding phone numbers to facilitate subsequent SMS hijacking and voice-based MFA bypass.
• "ClickFix" Coercion Campaigns — Threat actors are heavily utilizing fake browser error prompts (e.g., Google reCAPTCHA or Cloudflare verification) to trick users into manually running malicious terminal commands. This tactic is actively delivering:
  • ACR Stealer: Deployed filelessly via WebDAV shares or MSHTA steganography.
  • TELEPUZ MaaS: Unhooks AMSI and unlinks Event Tracing for Windows (ETW) before elevating to SYSTEM.
  • ClickLock Stealer (macOS): Traps Mac users in an 83-hour "kill loop" that constantly terminates Finder and Dock until the victim surrenders their local login password, granting the malware access to Chrome Safe Storage AES keys.

2. Zero-Days & Critical Edge Infrastructure

Enterprise gateways, secure file transfers, and core OS services are under immediate threat from unpatched zero-days and critical vulnerability chains.

• SonicWall SMA 1000 Zero-Days — Two flaws are being actively exploited in the wild: an unauthenticated SSRF (CVE-2026-15409, CVSS 10.0) and a post-authentication Code Injection flaw (CVE-2026-15410). Attackers are leveraging these to achieve arbitrary OS command execution, maintaining persistence via hotfix rollback manipulations.
• LegacyHive Windows Zero-Day — A local elevation of privilege (LoPE) flaw exists in the Windows User Profile Service (ProfSvc). The "LegacyHive" exploit permits a standard user to mount target user registry hives (like UsrClass.dat) into their own context. Modifying file associations within an administrator's hive allows the attacker to execute code as SYSTEM. It affects all Windows versions through the July 2026 patch cycle.
• July 2026 Patch Tuesday — Microsoft has initiated the final, irreversible enforcement phase of its Kerberos RC4 deprecation, permanently removing the registry rollback key for domain controllers. The update also rolls in the emergency out-of-band patch for "RoguePlanet" (CVE-2026-50656), an actively disclosed Microsoft Defender privilege-escalation flaw.

3. Supply Chain Attacks & Developer Targeting

Software delivery pipelines are being subverted via workflow misconfigurations, injecting runtime malware directly into trusted dependencies.

• AsyncAPI GitHub Actions Hijack — Attackers exploited a pull_request_target misconfiguration in the asyncapi/generator repository to steal an automation bot's Personal Access Token (PAT). They pushed malicious code to the next branch, publishing trojanized @asyncapi npm packages with valid OIDC provenance signatures. The payload—a Miasma RAT variant—executes instantly upon require(), posing a critical risk to FinTech CI/CD pipelines relying on event-driven architectures.

4. Application Flaws & Enterprise Software

Widely deployed enterprise software suites require immediate patching to prevent unauthorized remote code execution and data exposure.

• Zoom Client RCE (CVE-2026-53412) — A critical CVSS 9.8 input validation flaw allows unauthenticated, network-based adversaries to achieve silent account takeovers. If chained with active social engineering campaigns like UAT-11795's Starland RAT, attackers can pivot to drop trojanized installers directly into trusted internal Zoom chats.
• 7-Zip & Splunk Enterprise Flaws — 7-Zip suffers from a severe heap-based buffer overflow (CVE-2026-14266) when processing malformed XZ chunked data streams. Concurrently, Splunk Enterprise faces a high-severity CSRF vulnerability (CVE-2026-20296) that allows unauthenticated external actors to force arbitrary Search Processing Language (SPL) execution.
• Zimbra Classic Web Client XSS — A critical stored cross-site scripting (XSS) vulnerability allows attackers to inject malicious JavaScript into emails. The script executes within the browser session, enabling mailbox takeover and data exfiltration.

5. Ransomware & Advanced Cyber Espionage

State-sponsored actors and rapid-deployment ransomware operators are utilizing deeply obfuscated networking techniques to bypass traditional perimeter monitoring.

• Spirals Ransomware — A highly stealthy Rust-based payload deployed in a lightning-fast double-extortion attack (initial breach to encryption in under 24 hours). Attackers compromised an IIS web server, established redundant tunnels (Chisel, Cloudflared, revsocks), dumped LSASS, and forcibly terminated database services before encrypting the network.
• GoSerpent Backdoor Operations — Targeting Southeast Asia, this campaign utilizes the GoSerpent RAT to silently aggregate targeted documents into a hidden database (thumbcache_605a.db) for weeks. It later uses the open-source Stowaway proxy framework to inject the TmcPayload into svchost.exe, quietly exfiltrating the database over remote network shares.
• Return of Daxin & Stupig Backdoors — The China-linked kernel-mode rootkit Backdoor.Daxin has resurfaced, hijacking legitimate incoming TCP connections to bypass network anomaly detection. It is paired with Backdoor.Stupig, a pre-authentication backdoor masquerading as a keyboard layout (kbdus1.dll) that grants a SYSTEM command prompt directly on the Windows logon screen.

Proactive Steps for the Week

• Lock Down Device Code & Extension Flows: Explicitly disable the Device Code authentication flow within Microsoft Entra ID unless required for isolated headless devices. Enforce browser extension whitelists via MDM to block unauthorized session-stealing extensions like ForgCookie.
• Audit CI/CD Pipeline Triggers: Immediately review all GitHub Actions workflows for the use of the pull_request_target trigger. Ensure external forks cannot access sensitive repository secrets, and pin all AsyncAPI dependencies to the newly verified safe versions.
• Remediate Edge and OS Zero-Days: Apply the latest SonicWall SMA 1000 platform hotfixes (12.4.3-03453+ or 12.5.0-02835+) to mitigate the active SSRF/Code Injection flaws. Implement behavioral monitoring for unexpected registry mounts (UsrClass.dat) to mitigate the unpatched LegacyHive Windows LoPE.
• Patch Critical Applications: Force updates for Zoom Workplace to version 7.0.0+, update 7-Zip to the latest version to stop XZ stream exploitation, and patch Zimbra Classic Web Client to 10.1.19+ to halt stored XSS mail execution.
• Block "ClickFix" Execution Chains: Use WDAC or AppLocker to strictly restrict standard users from executing mshta.exe, rundll32.exe, and unaligned PowerShell.exe scripts directly from browser prompts or user-space directories.

Explore our DFIR Solutions to discover how our advanced incident response support, compromise assessments, and threat hunting frameworks can insulate your enterprise infrastructure against these campaigns.