GajShield Threat Intelligence

Severity: High | Priority: 1

This update adds signatures covering the infrastructure of a long-running web-skimming campaign. The campaign has compromised around 953 online stores since July 2025, most of them running Magento or Adobe Commerce. The attackers plant a small JavaScript loader inside the store’s CMS blocks, the static content sections Magento renders on every page. When a shopper visits an infected store, their browser silently contacts the attacker’s server. The server fingerprints the visitor to separate real shoppers from security scanners, and then decides whether to deliver a malicious payload. Earlier payloads in this campaign included a page posing as a well-known crypto hardware wallet brand.

The operator rotates to a new domain every few months. These signatures cover all nine known domains: the five loader domains used in turn since July 2025, two additional traffic-distribution domains, and two payload domains. 

Severity: High | Priority: 1

This update adds 40 policy signatures  that detect hosts in your network running the abandoned Time4Popcorn fork of Popcorn Time. This fork, once one of the most widely used BitTorrent streaming clients, installs a background updater that starts with the operating system. The updater checks for new versions over unencrypted HTTP from a fixed set of 20 domains. It installs whatever it receives without verifying a code signature. On Windows and macOS this happens silently and runs with full system privileges (SYSTEM on Windows, root on macOS). Many of these update domains lapsed and could be registered by anyone, so whoever controls one can run arbitrary code on every machine that calls it. The issue is tracked as CVE-2026-30612 and is rated critical.

The recommended action is to uninstall Popcorn Time from every flagged host. Disabling the updater alone does not make the application safe, because it also runs an outdated browser engine with its sandbox turned off, uses unencrypted connections, and loads scripts from other abandoned domains. Where immediate removal is not possible, stop and disable the “Update service” on Windows, or unload the PT.updd launch daemon on macOS, as an interim measure. On Android the updater cannot be disabled separately, so removing the app is the only fix. Administrators who want to stop these beacons at the perimeter while cleanup is under way can switch the signatures from alert to drop in the GajIPS policy.

Severity: High | Priority: 2

OpenCode is an open-source AI coding agent. Versions 1.0.137 through 1.18.32 on Windows and WSL let a malicious or hijacked remote MCP server run commands on the developer’s machine.

The attack happens when the developer signs in to that server, for example with opencode mcp auth. The server supplies an OAuth authorization address. OpenCode passes that address to a PowerShell command without escaping it, so commands hidden inside an otherwise normal HTTPS link run on the machine.

macOS and Linux are not affected. Version 1.18.33, released on September 28, 2026, fixes the flaw. No CVE or vendor advisory was issued, so vulnerability scanners and dependency alerts will not flag affected installations.

If an alert is raised, a developer machine on your network has received an OAuth discovery document whose authorization address contains hidden PowerShell syntax. If the developer completed sign-in on an affected OpenCode version, those commands may have run.

1. Identify the machine and its user, and find out which remote MCP server they were signing in to.
2. Remove that server from their OpenCode configuration.
3. Check the machine for:
   • PowerShell processes started by OpenCode around the time of the alert
   • new scheduled tasks or start-up entries
   • unfamiliar downloaded files
   • outbound connections you don’t recognise

Severity: High | Priority: 1

Operation FlashHole targets South Korean organisations in software, construction and communications equipment manufacturing. Victims receive spear-phishing emails linking to fake résumé or portfolio websites, apparently built with AI-generated content. These sites load malicious JavaScript that is believed to abuse INISAFE CrossWeb EX, a security program that South Korean financial and government websites require.

The infection installs a chain of tools:

• TechHub: a downloader that uses a private GitHub repository for commands.
• TouchHub and TouchShift: these install a service and side-load the next stage.
• Cubridge: a modular backdoor that steals browser passwords and cookies, queries Active Directory, injects into processes and runs commands.
• ClientHub and LPEClient: backdoors that communicate through compromised legitimate websites or Dropbox.

To reduce exposure:

• Make sure INISAFE CrossWeb EX and other browser-facing security plugins are updated or removed where they aren’t needed.
• Warn staff about unsolicited job applications and portfolio links.
• Restrict GitHub and Dropbox API access from machines that don’t need it.

Severity: High | Priority: 1

Plex2Shell is a chain of four vulnerabilities in Plex Media Server v1.43.2 and earlier. Together they let an attacker with no valid account run code on the server as the Plex service user. Many Plex servers are exposed directly to the internet on TCP port 32400. CISA has added the flaws to its Known Exploited Vulnerabilities catalog.

The chain works in four stages:

1. A request to Plex’s companion player endpoint passes a token check that only tests whether a header is present.
2. That request makes the server call its own plugin interface over loopback.
3. A plugin function then leaks the server owner’s admin token to the attacker.
4. With that token, the attacker changes transcoder settings to write and load a malicious library.

Attackers seen exploiting the chain have installed the XMRig cryptominer and a proxy tool (myawesomeproxy). The proxy tool lets them route other people’s traffic through the victim’s internet connection, which is often a home connection.

Severity: Critical | Priority: 1

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS and Prisma Access. It is rated CVSS 7.8. It lets attackers set up VPN sessions without valid credentials, bypassing multi-factor authentication. Palo Alto Networks patched it in May 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on May 13, 2026.

Unit 42 has since seen the Qilin and INC ransomware groups use it for initial access. After connecting, the attackers:

• run internal reconnaissance with remote management tools
• move laterally over RDP and SMB
• stage credential-theft, data-exfiltration and ransomware tools

In one case, the attackers moved from the VPN gateway to vCenter, disabled protections on ESXi hosts, and dumped domain credentials from a domain controller’s virtual disk, which avoided the endpoint security inside the server. They have also chained this access with a Veeam backup flaw, CVE-2023-27532.

If an alert is raised, one of the addresses Unit 42 linked to exploitation has reached your GlobalProtect portal or gateway. Check your GlobalProtect logs for successful “gateway-connected” events from that address. Also look for connections from any address using these values:

• the host IDs aa:bb:cc:dd:ee:ff or 00:11:22:33:44:55
• the device names WINDOWS-LAPTOP-001, DESKTOP-GP01 or GP-CLIENT
• the OS version string “Microsoft Windows 10 Pro 64-bit” combined with an empty user domain

If you find a successful session, treat it as a network intrusion and start incident response. Then:

1. End the session, and identify the internal address it was assigned and everything that address connected to.
2. Hunt for remote management tools, RDP and SMB activity from VPN address ranges, and new accounts.
3. Check vCenter and ESXi for logins and configuration changes, including the execInstalledOnly setting.
4. Check Veeam servers for unauthorised access.
5. Reset domain administrator, service account and krbtgt credentials. Attackers who reach a domain controller’s disk can take every password hash in the domain.

Whether or not you see alerts:

• Upgrade PAN-OS and Prisma Access to a fixed version listed in Palo Alto Networks’ advisory, or apply its workarounds.
• Review GlobalProtect logs back to May 2026 using the indicators above.
• Make sure vCenter, ESXi and backup servers can’t be reached directly from VPN address ranges.
• Keep backups offline or immutable so ransomware operators can’t delete them.

Severity: High | Priority: 1

Attackers behind the Romulus ClickFix campaign are abusing a DLL sideloading flaw in Siemens Software Center, tracked as CVE-2026-110936 (CVSS v4 8.4). Versions up to and including 3.5.8.7 load helper DLLs from their own folder without verifying them.

The attack does not need Siemens software already on the victim’s PC. Victims are lured, in some cases through malicious ChatGPT Custom GPTs, to a fake page that tells them to paste a command into the Windows Run box or PowerShell. That command installs AllMyBasic.msi. The MSI drops a genuine, signed copy of SiemensSoftwareCenter.exetogether with a malicious archive.dll. When the trusted Siemens program starts, it loads the attacker’s DLL, which then installs a remote access trojan.

If an alert is raised, treat the source machine as compromised and isolate it from your network. Then check it for:

• SiemensSoftwareCenter.exe running from AppData\Local\Programs or started by msiexec.exe
• a folder named AppData\Local\Programs\SM Software Provisioning Service
• the files activate.bak and statinfosta.DB next to the Siemens executable
• an AppData\Local\FTSuite folder containing ftc.uml
• a “Siemens Software Center” start-up entry or scheduled task, especially on a PC that never had the software installed

To clean the machine:

1. Stop the process.
2. Remove the start-up entry and scheduled task.
3. Delete the files, or rebuild the machine.
4. From a clean device, reset the passwords of users who logged on to it, because the remote access trojan gave the attackers control of that machine.

Find out how the user reached the lure, and block that page if you can.

Whether or not you see alerts:

• Update Siemens Software Center on every machine to 4.0.9.8 or later. Starting the program installs the update.
• Download Siemens software only from official Siemens sources.
• Remind users never to paste commands from a website into Win+R, the Run box or PowerShell, whatever the page claims.
• Search your past firewall and DNS logs for connections to wizardexpensive.com, 96.62.218.59 and 2.27.248.127. These addresses may have been contacted before these rules were deployed.

Severity: High | Priority: 1

On October 19, 2026, an attacker used a compromised OVHcloud developer’s GitHub account to replace the release binaries of the official OVHcloud CLI (ovh/ovhcloud-cli). The affected versions are v0.11.0 to v0.15.0 for macOS, Linux and Windows x86-64. The malicious files were available for about 94 minutes, between roughly 12:47 and 14:21 UTC. The attacker also replaced checksums.txt, so the backdoored files matched their published checksums.

Versions v0.10.0 and v0.16.0 are clean, as are builds made from source with go install and the Docker images. The install script and Homebrew cask fetched the backdoored files during the window.

The backdoor is linked to the GlassWorm campaign. It looks up the next-stage download address in a Solana blockchain transaction, then runs a payload that searches the disk for secrets.

If an alert is raised, the source machine has run the backdoored CLI or another GlassWorm-infected tool. Isolate it and identify its user. The backdoor’s purpose is to steal secrets from disk, so treat everything readable on that machine as exposed. From a different, clean machine, rotate:

• OVHcloud API and consumer keys, and the contents of ~/.ovh.conf
• other cloud provider credentials
• SSH keys
• package registry tokens in .npmrc, .pypirc and .netrc
• Kubernetes configs
• secrets in .env files

Then review the logs of each service whose credentials were exposed for activity you don’t recognise.

To clean the machine:

1. Remove the CLI binary.
2. On macOS, delete the ~/init.json marker file.
3. Install v0.16.0 or later, and confirm it with gh attestation verify.

To check whether an existing binary is the backdoored build, run go version -m ./ovhcloud. A vcs.modified=true line or a +dirtyversion means it is malicious. The malicious build also prints no version tag when you run ./ovhcloud version.

Even if you see no alerts, find every machine and CI pipeline that installed or updated the OVHcloud CLI on October 19. In CI, pin downloads to known SHA-256 hashes and verify release attestations. On build servers, block outbound connections to Solana and other blockchain RPC services unless they have a real need for them.

Severity: Critical | Priority: 1

Rank Math is a widely used WordPress SEO plugin. The paid “PRO” version 3.0.123 was distributed with a backdoor between October 15, 2026, 20:02 UTC and October 16, 2026, 07:12 UTC. Rank Math removed it and released a clean build, version 3.0.124. Sites that only downloaded 3.0.123 were not affected; the backdoor runs only once the plugin is activated. Once active, it:

• creates rogue administrator accounts (usernames starting with wpsupport_, emails ending in @wp-mail.net)
• plants a fake WordPress core file, wp-includes/class-wp-cache-util.php
• hides code in other plugins, themes, mu-plugins and uploads
• persists through the web server’s crontab, WordPress scheduled events and .htaccess rules that run .cache files as PHP
• rebuilds itself on every page visit, so deleting files alone does not remove it

If an alert is raised, the source is a WordPress server on your network that is running the backdoor and contacting rank1cdn.com. Treat that site as compromised, and keep the block on rank1cdn.com in place. The safest fix is to restore both the site files and the database from a backup taken before October 15, 2026, 20:02 UTC. Then install Rank Math PRO 3.0.124 and run a security scan.

If no clean backup exists, follow the cleanup steps in this order. Because the backdoor rebuilds itself, stop it before removing anything else.

1. Stop the rebuild. Delete the entire rank-math-pro folder; deactivating the plugin is not enough. Then remove the wp_options entries _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.
2. Remove what it planted:
   • Delete unknown administrator accounts and the fake core file.
   • Reinstall WordPress core from an official source.
   • Check mu-plugins, other plugin and theme folders, and uploads for unexpected PHP files.
   • Review .htaccess files, .cache files, crontab entries tagged #ms6v46, and WordPress cron events.
3. Change every credential the site could access:
   • WordPress passwords
   • database credentials
   • the wp-config.php salts and keys
   • API and SMTP keys
   • hosting, SSH and FTP access
4. Verify the cleanup. Run wp core verify-checksums and a security scan. Watch for removed files reappearing; if they do, repeat the cleanup.

Even if no alerts are raised, check every WordPress site you run. If Rank Math PRO was updated or installed during the window, check whether version 3.0.123 was ever activated. Download version 3.0.124 only by logging in to your Rank Math account directly. Rank Math does not send download links by email.

Severity: High | Priority: 1

REF8801 is a campaign that operators pose as “Apex,” a Web3 startup accelerator, and target cryptocurrency founders and developers. They build credibility with:

• fake portfolio and funding claims
• fake reviews and blog posts
• event listings and an in-person invitation site
• free Claude and Gemini AI credits

Victims are persuaded to install two npm packages, @apexacc/cli (“Apex Copilot”, a repackaged open-source coding agent) and @apexacc/audit, an MCP server whose 18 “security audit” tools return fabricated results. Both packages download a platform-specific executable that fetches commands from the attackers. On macOS, this installs the CloudSyncD backdoor, which phishes the administrator password through a fake dialog and can run further payloads as root. On Windows, it bypasses UAC, disables security tooling and installs an infostealer that sends data to Telegram. That data includes:

• browser passwords and cookies
• cryptocurrency wallets
• messaging and VPN data
• AI tool configs for Claude, Cursor and Windsurf
• files from user folders

The coding agent also routes the developer’s AI prompts and code through attacker servers. It runs with tool approvals defaulted to “yolo” and registers an attacker-controlled MCP server that can inject instructions.

If an alert is raised, treat the source machine as compromised and isolate it from your network. Then:

1. Identify the developer and check whether @apexacc/cli or @apexacc/audit is installed. Look for these artefacts:
   • On Windows: _apex_run.ps1, _apex_run.vbs, _audit_run.*, exegis.exe or updater_loader.exe in %TEMP%; a %APPDATA%\.cobra file; and a Defender exclusion for %USERPROFILE%\.apex-audit.
   • On macOS: ~/.config/cloudsync/, ~/.local/share/cloudsync/ and a running cloudsync process.
   • On any platform: ~/.apex/agent/mcp.json.
2. Remove the packages and rebuild the machine rather than cleaning it.

Because the infostealer takes browser data and AI tool configs, the user should reset everything stored or used on that machine from a separate, clean device:

• browser-saved passwords and session cookies, signing out of all sessions
• cryptocurrency wallet seed phrases, moving funds to new wallets
• AI service API keys and any Apex token
• source-code hosting tokens such as GitHub and npm
• SSH keys and cloud credentials

Any source code or secrets the developer used while the Apex Copilot agent was running should be treated as exposed to the attackers.

To reduce exposure:

• Check every developer machine on your network for the @apexacc packages.
• Install npm packages only from publishers you have verified, and review packages that download executables at install time.
• Disable “yolo” or auto-approve modes in AI coding agents.
• Verify accelerator, investor and audit offers independently before installing any tools they supply.