Cyber Threat Intelligence Digest: Week 29

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

SonicWall SMA1000 Actively Exploited Code Injection Vulnerability (CVE-2026-15410) - On 14 July 2026, CISA added CVE-2026-15410 to its Known Exploited Vulnerabilities catalogue. The next day, GitHub user HKimhab published an alleged PoC exploit for the flaw, a high-severity Code Injection vulnerability in the AMC of SonicWall SMA1000 models 6210, 7210, and 8200v, affecting several 12.4.3 and 12.5.0 firmware builds. The flaw stems from improper code-generation controls in authenticated AMC functionality, allowing a remote administrator-level attacker to execute arbitrary OS commands, potentially leading to appliance tampering, credential exposure, and access to internal identity infrastructure. SonicWall released fixed hotfix versions on 14 July 2026.

The PoC requires a target IP/hostname and administrator credentials, then authenticates and runs a default id command (or an operator-supplied one) against likely AMC endpoints using various payload separators and parameter names. A HTTP 200 response is logged as a possible success, though the PoC never verifies actual command output, so it cannot confirm genuine execution.

CVE-2026-35336 allows Buffer Overflow affecting Mbed TLS - CVE-2026-35336 is a possible buffer overflow vulnerability in mbedtls_ecdh_calc_secret(), affecting all Mbed TLS versions up to 3.6.6. When called with an output buffer too small for the computed ECDH shared secret, the function may write past the buffer's end instead of returning an error, as the size check omits leading zero bytes of the secret while still writing all bytes to the output.

This makes the overflow probabilistic and dependent on the computed secret value. Applications using correctly sized buffers are unaffected, as is ECDH usage in TLS. Upgrading to Mbed TLS 3.6.7 or later is recommended.

Critical Interpretation Conflict and SQL Injection Vulnerability Affecting WordPress (CVE-2026-63030 and CVE-2026-60137) - On 6 June 2026, security researcher Sergio (sergiointel) published an alleged PoC exploit for CVE-2026-63030 and CVE-2026-60137, affecting various WordPress versions between 6.8.0 and 7.0.1. CVE-2026-60137 is a critical SQL Injection vulnerability in the author__not_in parameter of the WP_Query class, stemming from insufficient input sanitisation, allowing SQL injection via a vulnerable plugin or theme. CVE-2026-63030 is a high-severity route confusion issue in the REST API batch endpoint, which can be chained with CVE-2026-60137 to achieve remote code execution (RCE). WordPress released fixes on 17 July 2026 (versions 6.8.6, 6.9.5, 7.0.2, or 7.1 beta2, depending on the CVE).

The PoC targets a WordPress URL, using time-based blind SQL injection via the Categories REST API to confirm the flaw, then chains requests through the Batch, Widgets, Posts, and Users REST API endpoints to recover database details, forge post objects, and create a rogue administrator account. It then logs in, uploads and activates a malicious plugin exposing a custom REST endpoint, and sends a Base64-encoded command via this endpoint, which the plugin decodes and executes via passthru() before self-deleting. The PoC confirms success before printing the harvested administrator credentials and command output.

Potential Threats

Threat Actor Uses WebAssembly and SVG Steganography to Deliver ClickFix Pastejacking Payloads - On 16 July 2026, Palo Alto Networks' Unit42 reported a ClickFix campaign using on-the-fly WebAssembly (Wasm) module instantiation and steganography embedded within SVG image files to deliver PasteJacking payloads (a technique where a website secretly alters clipboard contents). Wasm allows browsers to execute code compiled from languages like C, C++, and Rust at near-native speed alongside JavaScript. Unit42 found the campaign uses compromised legitimate websites and layered obfuscation to conceal payload infrastructure, with threat actors bulk-registering domains hosting the malicious SVGs between 14 and 16 September 2025, and reusing expired domains to exploit residual passive DNS trust and evade reputation-based detection.

The campaign begins when a victim visits a compromised site containing injected, Base64-encoded JavaScript, which constructs a Wasm module that decodes the payload and extracts URLs to malicious SVG files (commonly named facebook.svg or instagram.svg). The Wasm module downloads these SVGs, extracts hidden data via steganography, and injects the reconstructed ClickFix URL into the page's DOM, triggering a fake verification page. Once the victim clicks a checkbox and is prompted to paste into the Windows Run dialog, the page silently places a malicious PowerShell command onto their clipboard; executing it downloads and runs further code, completing the infection chain.

ClickFix Campaign Impersonating Telegram Delivers Multi-Stage Payloads - On 18 July 2026, security researcher Anurag reported a ClickFix campaign impersonating Telegram. Per Anurag, the campaign directs victims to a fake verification page that instructs them to execute a PowerShell command, leading to a batch file download and execution, payload extraction, persistence, privilege escalation, and outbound HTTPS communication.

Based on Anurag's analysis, the campaign begins when a victim visits the fake Telegram verification page at hxxp://ajvcu[.]cn, which remained active at the time of writing. The page instructs the victim to press Win+R, paste a copied command with Ctrl+V, and press Enter, causing PowerShell to download and execute a batch file named run.bat from hxxps://bitbrarwser[.]com/run[.]bat, a URL that returned an error message at the time of writing. Once executed, run.bat downloads a ZIP archive named XinPu.zip from hxxps://bitbrarwser[.]com/XinPu[.]zip, saves it into the %TEMP% directory, extracts the archive, and executes XinPu.exe. This then drops gurfv.exe (originally named lhbkqrj.exe), along with ntktjobjn.mj. gurfv.exe attempts User Account Control (UAC) elevation and creates an ONLOGON scheduled task set to run with the highest privileges. Once persistence is established, gurfv.exe resolves www[.]ndiewh[.]com and initiates outbound HTTPS communication.

Threat Actors Abuse Shared Claude Chats to Deliver MacSync Stealer via ClickFix - On 15 July 2026, Zscaler's ThreatLabz reported a ClickFix campaign abusing Anthropic's Claude shared chat feature to distribute MacSync Stealer, a macOS information stealer that harvests browser credentials, Apple Keychain data, cryptocurrency wallets, and other sensitive files. The campaign used malvertising via Google Ads (targeting terms like claude download and claude mac) to redirect macOS users to malicious shared Claude chats labelled as being from Apple Support, instructing victims to run a malicious terminal command. It ran from 12 to 19 June 2026.

The command downloads a first-stage Z shell script from a Base64-encoded staging URL (now returning an error), which decodes an embedded payload and runs a second-stage script via eval. This suppresses terminal output, then downloads a third-stage AppleScript, piped directly to osascript without touching disk, containing the core MacSync Stealer functionality. The second-stage script locates /tmp/osalogging.zip and exfiltrates it in 10MB chunks via HTTP PUT requests, retrying failed uploads up to eight times before deleting the archive.

General News

UK investigates TikTok for alleged age-verification lapses, exposing kids to online harms - TikTok is under investigation for allegedly failing to effectively verify users' ages, the UK's communications regulator, Ofcom, announced on Wednesday, alleging a possible breach of Britain's Online Safety Act. Ofcom said age inference models, including those TikTok uses, may have failed to correctly identify many children, despite such tools not featuring on its list of "highly effective" verification methods. Rather than checking ID or biometrics directly, age inference works by analysing browsing habits and other online activity. Ofcom said it has particular concerns about TikTok's practices and urged firms using such models to switch to methods it deems highly effective. Breaches of the Act can bring fines of £18 million ($21 million) or 10% of global revenue, and in serious cases, a UK operating ban; the Act covers harms including pornography and content on suicide and eating disorders. Ofcom's Chief Executive, Melanie Dawes, said age checks are a cornerstone of UK online safety law and that too many services still have inadequate checks in place.

The Labour government also wants to bar under-16s from social media, with proposed legislation covering platforms such as Facebook, Instagram, TikTok, X, YouTube, and Snapchat, due before Parliament before Christmas. Ofcom separately plans to submit its own analysis of what effective age checks look like in practice, with Dawes noting that industry approaches are already shifting towards a more robust, whole-of-system model. A TikTok spokesperson said the firm enforces age-appropriate experiences through expert-informed rules and age inference technology in line with industry peers, adding that it has invested billions in platform safety over the past eight years and is confident it meets its obligations under the Act.

Scattered Spider hackers sentenced to 5.5 years over £29 million Transport for London hack - Two leading members of the Scattered Spider cybercrime collective, Thalha Jubair, 20, of East London, and Owen Flowers, 18, from Walsall, have each been sentenced to five years and six months' imprisonment at Woolwich Crown Court for the 2024 cyberattack against Transport for London (TfL). The pair pleaded guilty last month to offences under Section 3ZA of the Computer Misuse Act, only the second prosecution ever brought under this most serious offence, which carries a maximum sentence of life imprisonment. The attack disrupted public services, exposed customer data, and cost TfL £29 million ($39 million) in recovery expenses; although the transport network itself was not shut down, 148 internal systems became unavailable, all 27,000 TfL staff had to attend offices for in-person password resets, and the Oyster refund system was compromised. The National Crime Agency (NCA) said the economic impact could have reached £56 billion ($75.6 billion) had the attackers succeeded in disabling the network entirely.

Investigators identified Jubair and Flowers as leading members of Scattered Spider, an English-speaking cybercriminal network linked to numerous high-profile intrusions across the UK and US, typically using social engineering, SIM-swapping, and credential theft. Arrests in September 2024, including Flowers being caught simultaneously compromising US healthcare providers SSM Health Care Corporation and Sutter Health, significantly disrupted the group's operations, a conclusion Microsoft's own analysis reportedly supported. Evidence recovered from Flowers' home included a screenshot showing connectivity to TfL's infrastructure and videos allegedly showing Jubair accessing TfL systems during the intrusion; the pair had coordinated via Telegram and an online workspace. Following the sentencing, officials including NCA deputy director Paul Foster, Security Minister Angela Eagle, and City of London Police's Commander Ollie Shaw, who proposed new Cyber Crime Risk Orders to restrict offenders' technology use after release, stressed the case's significance for UK cybercrime enforcement. Jubair and Flowers were also both arrested last July over separate ransomware attacks on Marks & Spencer, the Co-op, and Harrods, though no charges have yet followed in those cases.

US seizes over 1,000 websites in FIFA World Cup piracy crackdown - The U.S. Justice Department has seized more than 1,000 websites and blocked 1,970 domains used to stream FIFA World Cup 2026 matches without authorisation. Law enforcement identified the domains using leads from U.S. authorities, FIFA, the Motion Picture Association's Alliance for Creativity and Entertainment (ACE), and entertainment networks including beIN Media Group, NBCUniversal, UFC, and Warner Bros. The seizures form part of Operation Offsides, a joint action led by the National Intellectual Property Rights Coordination Center (IPR Center) in coordination with Homeland Security Investigations (HSI) Washington, involving 14 partners across 54 countries and including nearly 400 web domains seized by the end of last month. Assistant Attorney General A. Tysen Duva said the operation formed part of the Department's ongoing effort to protect copyright while reducing consumer risk from malicious software embedded in illicit streaming services, while HSI Special Agent in Charge Eric Weindorf noted that such streamers expose viewers to malware and unsecured connections that can compromise personal and financial data.

Alongside this, law enforcement carried out "Operation Red Card" in coordination with the Justice Department's International Computer Hacking and Intellectual Property programme, blocking hundreds of illegal streaming sites across Argentina, Ecuador, Peru, Brazil, the Dominican Republic, and Colombia. A second phase, launched on 10 July in Colombia, led to the arrest of four members of the Los Ciberinfiltrados cybercriminal group, charged with illegally accessing telecommunications systems and selling pirated streaming content since at least 2024. IPR Center director Ivan J. Arvelo said unauthorised broadcasting of World Cup matches violates intellectual property rights and fuels criminal organisations. The announcement follows an FBI warning in May about fake websites impersonating FIFA ahead of the tournament, which sold fraudulent tickets and hospitality packages while stealing personal and financial information. Separately, in June, Mexican authorities shut down 44 domains linked to the illegal PirloTV streaming platform and a wider sports piracy ring, which collectively generated over 950 million visits annually, including around 230 million from Mexico alone.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.