Cyber Threat Intelligence Digest: Week 23

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Google Chrome Patches 74 Vulnerabilities, Including Actively Exploited CVE-2026-11645 in V8 - On 8th June 2026, Google released Chrome versions 149.0.7827.102 and .103 for Windows, macOS, and Linux, addressing 74 security vulnerabilities in total. Amongst these was an actively exploited out-of-bounds memory access vulnerability tracked as CVE-2026-11645, affecting the V8 JavaScript engine.

Successful exploitation of this vulnerability allows threat actors to execute arbitrary code within a sandbox environment via a crafted HTML page.

TP-Link Patches CVE-2026-34126 Vulnerability Affecting Tapo Devices - On 28th May 2026, TP-Link patched a vulnerability tracked as CVE-2026-34126 affecting several Tapo smart home devices. The affected products include Tapo L535E versions prior to 1.4.1 Build 251016 Rel.204554, Tapo P300 versions prior to 1.4.2 Build 251219 Rel.142654, and Tapo D100C versions prior to 1.3.1 Build 260421 Rel.031658.

Successful exploitation of this vulnerability could allow threat actors to eavesdrop on Bluetooth communications, manipulate transmitted setup data, and potentially gain unauthorised control of affected devices. At the time of writing, there are no reports of this vulnerability being exploited in the wild. To mitigate the risk, it is recommended that users update each affected device to its respective patched firmware version as detailed above.

HP Patches Critical CVE-2026-0826 Vulnerability in Poly VVX and Trio Conference Phones - On 1st June 2026, Rapid7 disclosed CVE-2026-0826, a critical 9.2-severity vulnerability affecting a range of HP Poly desk and conference phones, specifically the VVX 150, 250, 350, and 450 models, as well as the Trio 8300, 8500, and 8800 conference phones. The vulnerability is an unauthenticated stack-based buffer overflow arising from the affected devices' parsing of Session Description Protocol attributes for Interactive Connectivity Establishment (ICE) when ICE is enabled. A remote, unauthenticated threat actor could exploit this by sending a crafted SIP INVITE request containing a malicious "candidate" attribute over UDP port 5060, potentially achieving remote code execution with root privileges.

HP Poly has released patched firmware in response, and recommends disabling unnecessary ICE connectivity as an additional mitigation measure. Affected VVX devices should be updated to UCS 6.4.8, Trio 8300 to UCS 8.1.7, and Trio 8500 and Trio 8800 to UCS 7.2.8.

Potential Threats

Threat Actors Abuse Fake Amazon Security Alerts to Deliver HarborWatch Agent Through ClickFix - On 8th June 2026, Cofense published a report detailing an Amazon-themed phishing campaign using the ClickFix self-infection technique to deliver a custom RAT dubbed HarborWatch Agent. Victims receive spoofed emails claiming their account has been locked, containing a button that redirects them to a typosquat domain. There, a fake CAPTCHA instructs them to open the Windows Run dialogue and paste clipboard content, covertly executing a hidden PowerShell command that decodes a Base64 payload and ultimately downloads mysql.exe into the local temp directory. The malware requires a hardcoded password argument to execute, likely as an anti-analysis control.

Once running, HarborWatch Agent connects to a C2 server and collects extensive host information — including OS version, architecture, memory, disk usage, hostname, and network status — before transmitting it back and awaiting tasks via dedicated API endpoints. Heartbeat traffic maintains persistent agent visibility. Cofense also identified a Chinese-language administrator panel on the C2 IP, branded as "Harbor Sentinel", advertising asset monitoring and real-time client status updates, consistent with the agent's observed behaviour.

Threat Actors Distribute WeedHack Malware Through YouTube Videos and SEO Poisoning to Steal Credentials and Cryptocurrency Wallet Data - On 2nd June 2026, McAfee Labs reported that the WeedHack Malware-as-a-Service (MaaS) operation had infected over 116,000 systems since January 2026, distributing malicious Minecraft mods, clients, cheats, and utilities via YouTube videos and SEO poisoning across more than 240 distribution URLs. The platform is publicly accessible, allowing customers to generate payloads, manage infections, and access stolen data, and is supported by ten identified domains, eleven related MaaS domains linked to the same threat actor, and a Telegram community of over 850 members. Victims are lured into downloading malicious JAR files through spoofed Minecraft content, which upon execution launches via javaw.exe and uses the EtherHiding technique to retrieve C2 infrastructure details from the Ethereum blockchain.

Once active, WeedHack downloads additional payloads, bypasses User Account Control by abusing cmstp.exe, and creates Microsoft Defender exclusions to evade detection. It harvests a broad range of data including browser credentials, Discord tokens, cryptocurrency wallet data, screenshots, and Minecraft session IDs, before establishing persistence via registry run keys and scheduled tasks. Further payloads extend its capabilities to include remote desktop access, webcam monitoring, keylogging, reverse shell access, and file management, with firewall rules created to facilitate ongoing communications with threat actor-controlled infrastructure.

Threat Actors Published Malicious npm Packages That Profile Developer Environments Through Dependency Confusion and Install-Time Reconnaissance - Between 28th and 29th May 2026, SafeDep and Microsoft published reports detailing an active dependency-confusion campaign involving malicious npm packages using scoped names designed to mirror likely internal corporate namespaces. Microsoft identified 33 malicious packages published across two waves by maintainer aliases attributed to a single threat actor, based on shared infrastructure, identical authentication values, and near-identical package templates. SafeDep reported a broader corpus of 183 malicious packages, some using artificially high version numbers such as 100.100.100 and 99.99.99 to increase the likelihood of installation via dependency resolution. Packages were made to appear legitimate through realistic metadata and spoofed repository URLs resembling internal development resources.

The infection chain is triggered when a malicious package is installed on a developer workstation or CI/CD build host, executing a postinstall lifecycle hook that runs a heavily obfuscated script. This script performs environment checks, establishes a cache directory, identifies the project root, and downloads a second-stage payload from a remote C2 host. The second stage harvests extensive developer and build-environment reconnaissance, including the full process environment — which may expose npm tokens, cloud credentials, CI/CD secrets, and API keys — before exfiltrating the data over HTTPS using a hard-coded authentication header. Even if the second-stage download fails, the script is designed to transmit collected system data to the C2, ensuring reconnaissance is gathered regardless. The threat actor can subsequently use this data to identify high-value targets for follow-on exploitation.

General News

CISA directive for AI executive order to be released this week - CISA Acting Director Nick Andersen announced on Wednesday that the agency plans to release a binding operational directive to federal agencies by the end of the week, outlining steps required to implement the president's artificial intelligence executive order. The directive will focus in part on vulnerability management, and CISA will additionally be rolling out specific AI access to partners in the coming days. The AI executive order, released the previous day, represents a scaled-back version of an earlier draft, with the pre-release testing window for AI models reduced from 90 days to 30 days on a voluntary basis, following internal administration disagreements.

Speaking at the TechNet Cyber conference in Baltimore, Andersen emphasised the dual nature of AI in the security landscape, highlighting both its risks and its potential as a defensive tool to reduce attack surface exposure. CISA is set to play a central role in establishing the "cyber clearinghouse" envisioned by the executive order, including vetting AI models directly. Andersen also drew attention to the broader challenge facing federal IT infrastructure, noting that legacy and end-of-life devices operating within government environments continue to present significant exposure to adversaries.

EU unveils tech sovereignty package to cut reliance on US - This week, the European Commission proposed a broad legislative package aimed at reducing EU dependence on foreign technology, bundling a Chips Act 2.0, a Cloud and AI Development Act (CADA), an Open Source Strategy, and an energy digitalisation roadmap. With over 80% of the EU's key digital infrastructure currently sourced from foreign suppliers, the drive for autonomy is partly motivated by deteriorating US relations and fears that existing dependencies could be exploited. CADA introduces a four-tier cloud assurance framework for public bodies, ranging from basic data residency through to full supply-chain control, whilst the Chips Act 2.0 streamlines approvals for new fabrication facilities and extends state aid — building on the original 2023 act which mobilised over €52 billion but missed its 20% global production target.

Reaction has been divided. US technology industry representatives condemned CADA's upper tiers as discriminatory and effectively closed-market, whilst European cloud providers welcomed the direction but warned of loopholes. The open-source elements drew broader support, with funding committed for critical open-source infrastructure maintenance and procurement steered towards open-source tools. Critics cautioned that sovereignty pursued through ownership and location requirements risks producing protected rather than competitive industries, and that the package's security value will depend heavily on how member states apply the frameworks in practice.

New cyber force would cost up to $11 billion to start - A report published Wednesday by the Commission on Cyber Force Generation recommends establishing a dedicated US military cyber branch comprising approximately 30,000 personnel, including around 5,000 National Guard members and up to 6,000 civilians, at an estimated cost of up to $11 billion. The proposed Cyber Force would take 12 to 18 months to stand up and could either align with the Department of the Army or operate as its own Pentagon department. The commission — a partnership between CSIS and FDD — launched with the assumption that such a force would be created, focusing on how it should be structured rather than relitigating whether it was necessary.

The report arrives as Congressional lawmakers prepare their annual defence authorisation bill, with bipartisan frustration mounting over the existing military branches' persistent failure to supply US Cyber Command with combat-ready personnel. Proponents argue that whilst Cyber Command is currently functional, it lacks a viable path to growth against an increasingly aggressive adversary environment, particularly as Russia and China continue maturing their own digital capabilities. Senator Kirsten Gillibrand is expected to offer an amendment mirroring the commission's conclusions, and similar legislation may emerge from the House Armed Services Committee. A separate feasibility study by the National Academies of Sciences is also expected to conclude in the coming months.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.