ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories

Microsoft said it has observed multiple incidents in which threat actors deployed GSocket, an open-source remote access tool, on internet-facing Linux servers to maintain access after the original vulnerabilities were addressed, turning a single web application compromise into persistent access. “Because GSocket relays traffic through a shared public network, there is no threat actor-owned IP address or domain to block,” Microsoft said. “Defenders should look for GSocket deployment, persistence, privilege escalation, and outbound connections on affected hosts, not treat application patching alone as complete remediation.” According to telemetry data, devices with GSocket-related detections increased 356.2% from March through August 2026, with most of them associated with PHP web applications, cPanel hosts, and Apache. The majority of targets of GSocket activity are in the education and research sector, followed by technology and communications, manufacturing, and government entities.

Europol, along with global partners, has disrupted the criminal infrastructure behind GootLoader, CastleRAT, and StealC malware, seizing 235 servers and 257 domains. “The operation targeted ‘cybercrime-as-a-service’ models, where these tools enabled further crimes like ransomware attacks and data theft,” Europol said. As part of the operation, authorities have identified over 6 million victim credentials. “The suspects were using these credentials, stolen from the victims after they infected them, to sell them and later be used for other cyber-attacks such as ransomware,” Europol added.

A command and control (C2) framework called Falcon (aka XG or Xiàng Gē) has been found compromising victims’ browsers by running malicious JavaScript. Falcon shares near-identical URL structures, payload delivery mechanisms and communication protocols with PeckBirdy, another JavaScript C2 framework that came to light early this year. It’s assessed that Falcon and PeckBirdy represent variants of the same core framework. “An actor leveraged Falcon to compromise visitors of webmail portals and government web applications by placing malicious JavaScript directly within these sites,” Palo Alto Networks Unit 42 said. “Operating entirely inside the browser context, attackers have used the framework to sideload malicious Chrome extensions and steal the following information: passwords, emails, session cookies, [and] communications.” Falcon has also been used to deliver an implant dubbed Antino, which uses Microsoft OneDrive as a C2 channel. The activity has targeted government entities in one Middle Eastern country and four Southeast Asian countries between March and May 2026. “The campaigns we observed targeted ministries of foreign affairs, defense and interior, and law enforcement agencies, consistent with strategic intelligence collection objectives,” Unit 42 said.

Microsoft said its scan of a subset of Linux kernel subsystems from late May to mid-June 2026 unearthed 26,502 raw findings using MDASH, which subsequently formed the basis for 59 public upstream reports and 33 assigned CVEs. This includes working root privilege-escalation exploits for eight of those CVEs, such as CVE-2026-64563. “CVE-2026-64563 is a one-line state-reset bug in rhashtable, the Linux kernel’s shared resizable hash table,” Microsoft said. “Because callers trust the object pointers returned by a table walk, this small library flaw enabled a stable local privilege escalation on Linux — and affected Android with SELinux enforcing — without requiring special kernel configurations or user namespaces.”

An exposed Silent Lynx server has uncovered cyber espionage operations targeting Central Asian governments and critical infrastructure from April to October 2026. “The directory held the group’s tooling alongside data from active intrusions into government and critical infrastructure organisations across the region, and the AI agent the operator relied on to run them,” CloudSEK said. “We assess with medium confidence that the operator has a Kazakhstan nexus: the operation runs in Russian, and the operator’s own test traffic came from a residential Kazakh connection, which supports existing vendor assessments. The collection priorities, spanning transport, defence correspondence and resource ministries in neighbouring states, point to regional intelligence gathering rather than financial motive.”

A new Russian-speaking ransomware group called Citrus is targeting Windows systems in corporate environments. The attackers have been found to gain access through compromised contractor accounts and leverage AI-generated PowerShell scripts, batch files, and commands during later stages of the intrusion. In an attempt to reduce visibility, the threat actor removes tools and output files after execution, clears command history, and deletes event logs. The group also disguises tools and related artifacts with benign-looking names to make them appear legitimate by using a trusted brand name. The ransomware is a Sn00py-family ransomware variant written in Go. On Windows systems, the malware encrypts user files and appends the .citrus extension, while taking steps to hinder recovery and incident response. Kaspersky said the activity shares several similarities with Toy Ghouls. “Citrus stands out for the way AI-generated content appears to support hands-on intrusion activity on compromised systems,” said Stanislav Larinsky, Kaspersky Security Services expert. “In the cases we investigated, the attackers combined third-party account access, privilege-escalation attempts and domain-wide deployment techniques. These incidents show how limited contractor access can become a path to broader compromise if it is not tightly controlled and continuously monitored.”

Proofpoint has disclosed details of a new technique called BluePhishing that’s described as the “next evolution of OAuth consent abuse,” enabling bad actors to leverage agent identities like Microsoft Entra Agent ID for initial access. BluePhishing “socially engineer[s] victims into granting consent to a malicious agent blueprint for initial access,” it said. “Analogous to app consent phishing where attackers use client credentials to gain initial access to a tenant, BluePhishing extends this technique to the agent ecosystem. By exploiting gaps in visibility and governance around emerging AI agent adoption, attackers can abuse one-time consent links to create agent identities in target tenants, obtain access tokens, and operate with the privileges assigned to those agents.”

Meta has announced that it’s expanding its AI age-estimation technology globally to automatically place millions of teens in Teen Account protections on Instagram. “We use AI technology to find people we suspect to be teens, even if they use an adult birthday, and place them in Teen Account protections,” Meta said. “As a result, millions more teens across the world who use Instagram will receive these built-in protections, even if they’ve misrepresented their age.” In Australia, Meta has opted to use Apple’s age-range signal as another method to help understand age.

Microsoft 365 Mailbox Replication Service (MRS) has added support for OAuth as an authentication method when migrating mailboxes between Microsoft 365 and an on-premises Exchange environment. “Once OAuth for MRS is configured, tenant administrators can create an OAuth migration endpoint and use it in migration batches or in onboarding and offboarding move jobs,” Microsoft said. “You can use this method in both hybrid and non-hybrid organizations.”

In more Microsoft-related news, the tech giant has incorporated additional protections into Windows starting November 10, 2026, that address CVE-2026-118737 (CVSS score: 8.1), a critical remote code execution flaw in Remote Procedure Call Runtime that could allow an unauthorized attacker to execute code over a network. “These updates represent the first phase of improvements to NTLM message signing,” Microsoft said. “These changes help ensure that authenticated NTLM sessions always establish a cryptographic session key and negotiate real message signing, reducing exposure to relay attacks.” To that end, Windows servers will begin requiring NTLM signing by default starting May 2027.

Details have emerged about a now-patched security flaw affecting the Planning Inspectorate, an executive agency of the United Kingdom’s Ministry of Housing, Communities and Local Government (MHCLG). The issue involved a complete Microsoft Entra ID application credential that was committed in plaintext to a GitHub repository. “Although removed from the branch, the commit was orphaned via a force push and remained retrievable via GitHub’s raw object CDN for 18 months,” ControlPlane said. The client secret was deleted about 20 minutes after responsible disclosure on August 26, 2026.

An SEO poisoning campaign is using fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malware called Armorsteal. “The installer deployed a Python 3.11 runtime environment and three main components providing remote access, surveillance, and information stealing capabilities, with the Python code protected by Pyarmor,” Zscaler said. “The remote access component communicates with a command-and-control (C2) server, downloads additional modules, and executes remote tasks. The surveillance component logs keystrokes, monitors the clipboard, captures screenshots, and displays fake cryptocurrency wallet notifications. The information stealing component targets browser data, Discord tokens, cryptocurrency wallets, seed phrases, saved passwords, SSH keys, and Steam data.”

A new Grandoreiro banking malware campaign is targeting users across Argentina, Chile, Colombia, Mexico, and Peru through country-specific phishing lures that are tailored to each region. “The campaign uses localized phishing lures, primarily in Spanish, with some observed using Portuguese even when targeting Spanish-speaking countries,” Arctic Wolf said. “The phishing chain relies on recently registered domains and layered redirection to hinder detection. The final payload is retrieved through a Domain Generation Algorithm (DGA) seeded with the current date. The downloaded ZIP archive uses a deeply nested folder structure populated with two legitimate PE files and two benign PDF documents. A VBScript file located in the archive’s root directory acts as the primary payload, employing junk code and multiple layers of obfuscation before reconstructing and launching a Delphi-based loader.” The loader masquerades as a PDF reader and is used to fetch and run the banking trojan.

Palo Alto Networks Unit 42 said it detected an indirect prompt injection (IDPI) campaign across 26 domains. “These are attempting black-hat Generative Engine Optimization (GEO) to game AI-powered search results,” Unit 42 said. “Almost all of the 26 pages have very similar content, presenting as AI-powered digital asset trading platforms. These sites appear to be scam sites designed to collect user information. The injected prompt is set to be hidden from a regular web user but likely visible to an AI agent. These attacks intend to poison SEO and manipulate AI agents to eventually get users to visit these sites.”

The Python Package Index (PyPI) has added a security tab to its project pages, giving developers easy access to security signals. “The new security tab communicates release provenance states and displays per-file attestations, giving you a dedicated place to verify where the release files came from,” PyPI said. “PyPI calculates each release’s provenance state by checking whether each release file has an attestation.”

The information stealer known as RevStealer is being propagated as part of an “industrial-scale, financially motivated campaign” that uses game cheats and AI tools as lures. The payload is distributed through more than 100 interconnected domains, trojanized Electron applications masquerading as Anthropic’s Claude Opus 5, and hijacked YouTube distribution channels, per Akatsuki Legion. “Once executed, the malware performs a ten-point weighted sandbox-evasion scoring routine, decrypts an AES-256-CBC in-memory payload, and leverages fourteen indirect syscall wrappers and FNV-1a API hashing to bypass user-mode hooks before systematically harvesting credentials from browsers, password managers, cryptocurrency wallets, Steam, Roblox, Battle.net, EA Desktop, and Minecraft; then exfiltrating the loot as streamed, encrypted typed records over HTTPS, with a resilient Polygon blockchain dead-drop resolver standing by as a fallback command-and-control channel,” the independent adversary research group said.

Threat actors have increasingly targeted AI orchestration platforms over the past few months, according to Sekoia. This is because “they concentrate API keys, enterprise data, and access to external tools,” it added. This includes Flowise, which has been affected by multiple security flaws like CVE-2025-59528 and CVE-2026-41264. In one exploitation attempt recorded in August 2026, a suspected Chinese-speaking actor abused legitimate Flowise functionality to conduct automated reconnaissance and attempted to hijack the LLM agent to serve as an offensive analysis vector against external targets. “The attacker attempted to turn the AI agent into an interactive offensive assistant, submitting real-world reconnaissance data (Nightingale/Redis infrastructure) to generate custom exploitation playbooks and target analysis,” Sekoia said.

LevelBlue has disclosed details of a family of phishing kits named BlackApex, DarkApex, SPY, XXX101-TOKEN, OGPARKER1, W1-TOKEN, and ALIBOBO-TOKEN that are used to facilitate device code phishing attacks using shared document lures. The findings once again demonstrate how AI can speed up the development of a convincing multi-brand phishing kit. “Across all of its lures, the source shows traits we associate with AI-generated code, whether from direct prompts to a language model or from a person working alongside an AI coding assistant,” LevelBlue said. “The code, endpoints, and interface are the same across all of them. We cannot say whether these names reflect separate operators, resellers or customers of a single kit, but the pattern is consistent with a shared product being rebranded and redeployed.”

Google’s DeepMind has introduced AlphaProof Code, which brings together human experts and AI agents to verify software and mathematically demonstrate that it works as intended. The multi-agent AI framework has been used to prove key security properties of libsignal, the Signal protocol’s reference implementation, at the machine-code level. “AlphaProof Code consists of a human-guided agent for writing Lean specifications of code, a formal semantics of AArch64 machine code, and a team of autonomous prover agents whose proofs are accepted only if Lean’s kernel checks them against the approved specification,” DeepMind said. “Applied to libsignal, our agents generated about 6.5 million lines of machine-checked Lean proof code, resting on about 26,000 lines of trusted specifications and AArch64 semantics. The proofs cover Signal’s post-quantum PQXDH handshake and Triple Ratchet, establishing forward secrecy, authentication, post-compromise security, and handshake secrecy.”