GajShield Threat Intelligence

Severity: HIGH · Priority: P2 — Lunex/Psychedelic Stealer phishing overlays, investigate on hit alongside C2 traffic

These rules detect connections to credential-phishing domains associated with the Lunex malware-as-a-service platform, also known as Psychedelic Stealer. Lunex is a Russian-developed, CIS-aligned criminal platform sold to multiple criminal groups; Psychedelic Stealer is the name of the malware component deployed on victims' devices. The platform has been active since at least June 2026; Ontinue's analysis documented 28 panels across 13 countries.

The attack chain begins with a fake CAPTCHA or ClickFix lure on a compromised legitimate website, delivers a loader (LunexLoader) that bypasses Windows User Account Control, then uses a bring-your-own-vulnerable-driver (BYOVD) technique with an AMD driver to disable kernel-level security monitoring — an unusual step for an infostealer that ensures the theft runs without endpoint protection interfering. With security tools silenced, the stealer collects credentials from seven Chromium-based browsers, extracts cryptocurrency wallet contents, and installs a PowerShell-based native messaging bridge inside the victim's browser for persistent remote file access. The platform then injects phishing overlays into real brand websites the victim visits to harvest additional credentials. 

A hit on these rules indicates a device on your network is either contacting one of these phishing overlay domains directly (suggesting the user followed a lure) or, more significantly, has already been compromised by the Lunex stealer and is being served phishing overlays during active browsing. A hit should therefore be immediately correlated with the companion Lunex C2 and delivery rules in this ruleset. If a device is infected, treat it as a complete credential compromise: the stealer has had access to all browser-stored passwords, cookies, session tokens, and cryptocurrency wallets. Isolate the device, rotate all relevant credentials from a known-clean device, revoke sessions, and check for the psychedelicloveUtils scheduled task and the com.lunex.explorer native messaging bridge as persistence indicators. Rebuild the machine given the depth of browser-level compromise.

Severity: CRITICAL · Priority: P1 — mass exploitation by UNC6240 (ShinyHunters), CISA KEV, escalate immediately

These rules detect exploitation of CVE-2026-35273, a maximum-severity unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools 8.61 and 8.62, via the Environment Management Hub (PSEMHUB) component. An unauthenticated attacker with HTTP access to the PSEMHUB endpoint can send a crafted serialized Java object that the server deserializes without authentication, leading to complete takeover of the PeopleSoft instance. The vulnerability was exploited as a zero-day by ShinyHunters (tracked by Mandiant as UNC6240) for nearly two weeks before Oracle published an emergency patch on June 10, 2026, breaching over 100 organisations — 68 percent of them universities and colleges — and stealing 455,000 records from University of Nottingham alone including passport numbers and sensitive personal data. CISA added it to the Known Exploited Vulnerabilities catalogue on June 12 with a federal remediation deadline.

The September 2026 campaign represents a significant escalation: ShinyHunters modified the exploit to bypass the WAF rules that many organisations deployed after the June advisory instead of patching. The bypass works by URL-encoding a single character in the request path — for example /PS%45MHUB/hub rather than /PSEMHUB/hub — which passes through WAF string-matching rules that check the literal path while the PeopleSoft application server decodes the request normally and routes it to the vulnerable endpoint. These rules specifically target this technique, checking the raw undecoded URI rather than the normalised path, so they detect both the original encoded paths and the new bypass variants.

A hit on the rules indicates an active exploitation attempt. Because five to fifteen exploit requests typically precede webshell deployment in the confirmed attack sequence, treat even a first hit as urgent: check PeopleSoft WebLogic access logs immediately for external POST requests to /PSEMHUB/hub, confirm whether the server is patched, and inspect the filesystem under the PSEMHUB web application directory for unexpected JSP files or folders named logs, persistantstorage, or scratchpad. A hit on the webshell or SIDEEYE C2 rules indicates probable active compromise: isolate the server, assume all data accessible to the PeopleSoft service account is exposed, and escalate to incident response. Also check for outbound SMB traffic on port 445 from PeopleSoft hosts, recently modified XML files under envmetadata/data/environment (which can provide persistence through XMLDecoder deserialization on restart), and deployed MeshCentral agents disguised as legitimate cloud service binaries. Applying Oracle's June 10, 2026 emergency patch is the definitive fix; where immediate patching is not possible, Oracle's guidance is to disable the Environment Management Hub service on multi-server setups or remove the PSEMHUB application on single-server setups.

Severity: HIGH · Priority: P2 — active exploitation of an unauthenticated file-write flaw in a flat-file CMS, escalate on hit

This rule detects attempted exploitation of CVE-2026-42608, a path traversal vulnerability in the FormFlash component of Grav, a flat-file CMS used in an estimated 36,000 internet-facing installations. An unauthenticated attacker can supply a path traversal sequence in a form submission parameter, causing Grav to create arbitrary directories and write an attacker-controlled YAML configuration file to any location writable by the web server process. That write capability can be chained into remote code execution by placing a malicious plugin or configuration file where Grav's loader will include it on the next request. The flaw was fixed in Grav 2.0.0-beta.2 but was not backported to the older Grav 1.7 branch, meaning a large installed base of 1.7.x sites remained exposed. Active exploitation was confirmed in September 2026 when ShinyHunters used this vulnerability to compromise the leak site of the Clop ransomware group, which had been running an unpatched Grav 1.7.43 installation.

A hit indicates an active traversal attempt against a Grav server on your network. Confirm whether the targeted server runs Grav and which branch: any Grav 1.7.x installation is vulnerable since the fix exists only in Grav 2.0.0-beta.2 and later. If the server runs a vulnerable version, assume the traversal may have succeeded and escalate to incident response — check for newly created directories and unexpected YAML files in the Grav installation under user/config/, and look for signs of code execution from the web server process. If an immediate upgrade to Grav 2.x cannot be performed, disabling FormFlash or restricting POST submissions to known-good form identifiers at the web application layer reduces exposure.

Severity: HIGH · Priority: P2 — CSRF to admin account creation against widely-deployed WordPress plugin, escalate on hit

This rule detects exploitation of a cross-site request forgery vulnerability in the Elementor Website Builder plugin for WordPress and fixed in version 4.3.2 on September 24. Elementor is active on roughly ten million WordPress sites, with approximately two million running the affected versions 4.3.0 and 4.3.1. The vulnerability is in Elementor's Editor Events module, which bypasses WordPress's REST API nonce validation whenever the string elementor/v1/events/ appears anywhere in the incoming request URL. Because attackers control the query string, they can append this string to a URL that actually targets any other REST endpoint, and the bypass applies to the entire REST API surface — WordPress core routes and every other plugin's routes included. When the victim (a logged-in administrator) opens a link crafted this way, their authenticated session carries out whatever REST action the URL specifies. On a default WordPress installation this is used to create a new administrator account for the attacker. The fix in 4.3.2 validates the resolved REST route rather than the raw request URL, closing the bypass.

A hit indicates an attempt to exploit this flaw against one of your WordPress servers. Confirm whether the targeted site is running Elementor 4.3.0 or 4.3.1; if so, treat the attempt as potentially successful and escalate — the attack succeeds with a single link click by an administrator and requires no malicious page, no JavaScript, and no form. Check the site's WordPress user database immediately for unexpected administrator accounts created on or after September 24, 2026 and remove any found. Update Elementor to version 4.3.2 or later as the definitive fix; if immediate patching is not possible, blocking authenticated REST API access from unexpected sources at the network layer reduces exposure. Rotate all administrator account passwords on the affected site as a precaution.

Severity: HIGH · Priority: P2 — macOS credential-theft infostealer, investigate on hit

These signatures detect components of PamStealer, a macOS information-stealer. The malware targets Apple Silicon Mac users and operates in two stages. The first stage is a compiled AppleScript file distributed inside a disk image, disguised as a legitimate application — initially the Maccy clipboard manager, and later a fake cryptocurrency wallet. The script downloads and stages a second-stage Rust-based payload. The second stage is the infostealer itself, which collects browser credentials, iCloud Keychain data, clipboard contents, and cryptocurrency wallet data. PamStealer's distinctive technique is its use of macOS's own Pluggable Authentication Modules (PAM) API to verify the victim's login password before transmitting it. It presents a convincing native-looking system dialog asking for a password, then checks the entered password using the same mechanism macOS itself uses for sudo and system prompts. If the password is wrong, the dialog repeats until the correct password is entered. Because no subprocess is spawned and PAM calls are indistinguishable from legitimate system activity, this leaves no behavioral trace detectable through standard process monitoring. The malware also disguises itself as macOS Finder for persistence and shows the victim a fake "app is damaged" message to make the original installer disappear plausibly.

If GajAV flags one of these files, treat it as a probable macOS compromise: identify the Mac and user. Because PamStealer verifies and steals the macOS login password, treats that credential as confirmed-compromised — reset it from a known-clean device. Additionally rotate all credentials stored in iCloud Keychain, browser password managers, and cryptocurrency wallet recovery phrases or private keys accessible from the machine, since the infostealer specifically targets all of these. Check for a fake Finder application in the user's ~/Library/Application Support/ directory and remove it; also check login items for PamStealer's persistence entries. Rebuild the machine if the full scope of data accessed cannot be established. Warn users not to run disk image files from unofficial sources and not to press Command+R in Script Editor windows from downloaded files.

Severity: HIGH · Priority: P2 — active exploitation of an authenticated-but-low-privilege RCE in SharePoint, escalate on hit

These rules detect exploitation of CVE-2026-65660, a remote code execution vulnerability in on-premises Microsoft SharePoint Server that was initially and incorrectly categorised by Microsoft as a spoofing issue, leading many organisations to defer patching. Security updates fixing the flaw shipped on August 11, 2026. The root cause is a quoting failure in SharePoint's ToolPane component, which processes web-part markup on pages including ToolPane.aspx and AddGallery.aspx. When reconstructing ASP.NET Register directives from submitted markup, SharePoint places attribute values inside double quotes without escaping any double quotes already present in those values. An attacker can therefore break out of the attribute value and inject additional Register directives that name arbitrary .NET classes — classes that are registered and loaded after SharePoint's SafeControls type-check has already passed, bypassing the check entirely. With arbitrary class loading available, the attacker uses a XAML deserialization chain — passing the ObjectDataProvidergadget class through XamlServices.Parse() — to execute code. The researcher who discovered and demonstrated this technique uses it to create an in-memory webshell, avoiding the filesystem writes that most webshell detections look for. The first rule targets the high-confidence ObjectDataProvider gadget class; the second heuristic rule targets the Register directive injection at the vulnerable endpoint paths.

A hit on either rule indicates an active exploitation attempt against one of your SharePoint servers. Confirm whether the targeted server is patched to the August 11, 2026 or later cumulative update; if not, treat the attempt as potentially successful and escalate to incident response. Because the exploit creates an in-memory webshell rather than writing files to disk, standard filesystem-based webshell detection will not catch it — prioritise reviewing IIS request logs and SharePoint ULS logs for unusual requests to _layouts/15/ToolPane.aspx or _layouts/15/AddGallery.aspx, and for outbound connections from the SharePoint server process (w3wp.exe) to unexpected destinations. Treat all credentials stored or accessible through the SharePoint farm as potentially exposed and rotate them if compromise cannot be ruled out. Applying the August 2026 patch is the definitive fix.

Severity: HIGH · Priority: P2 — CI/CD credential theft from active build pipelines, investigate on hit

These rules detect a connection to the exfiltration domain used by Mini Shai-Hulud, a supply-chain attack campaign attributed to the TeamPCP threat actor, which compromises GitHub Actions workflows and npm packages to steal credentials from CI/CD pipelines. The campaign first struck in May 2026, compromising the actions-cool/issues-helper and actions-cool/maintain-one-comment GitHub Actions workflows by redirecting all version tags to malicious commits. Any CI/CD pipeline that referenced those actions by version tag silently ran malicious code on its next build. The malicious code reads the GitHub Actions runner's process memory to extract secrets, harvests credentials from cloud providers, npm, Kubernetes, and AI tools, and exfiltrates everything — encrypted and disguised as OpenTelemetry observability traces — to an attacker-controlled server. The campaign is a worm: stolen tokens are used to publish infected versions of other packages under the same maintainer's control, spreading the infection further.

The September 2026 relevance: the originally compromised repositories were suspended after discovery but were re-enabled on September 16, 2026, with the malicious code still in place and never removed. Any workflow that references the affected actions by version tag (rather than a pinned commit SHA) ran the malicious payload again on the first build after that date. Workflows pinned to a full commit SHA predating May 18, 2026 are not affected.

A hit indicates a machine on your network — most likely a CI/CD runner or a developer's workstation — is sending data to the attacker's collection server. Treat it as an active credential-theft event: identify the source machine and check for recent workflow runs that referenced actions-cool/issues-helper@v2.2.1 or actions-cool/maintain-one-comment, or any build that installed compromised npm packages from the @antv ecosystem between May and September 2026. Rotate all credentials accessible from that build environment: GitHub personal access tokens, npm publish tokens, AWS keys, SSH keys, and any secrets stored in CI environment variables. Check for unauthorized public repositories created under GitHub accounts whose tokens were accessible, for new .github/workflows/codeql.yml files with a workflow named "Run Copilot," and for files named cloud.json, contents.json, or environment.json in the home directory. Also review Sigstore transparency log entries for any signed artifacts created by compromised CI identities.

Severity: HIGH · Priority: P2 — Docker host actively being compromised, escalate on hit

These rules detect an active compromise attempt against your Docker hosts by Carbonato. Carbonato specifically targets Docker daemon APIs that are exposed to the network without authentication on TCP port 2375 — an administrative interface that should never be reachable from untrusted networks. The malware connects to that API and uses it to pull malicious container images, create a privileged container with the host's root filesystem mounted inside it, and then use that access to take over the underlying host entirely: installing an SSH server with the attacker's key, opening a reverse tunnel back to attacker infrastructure, and setting up multiple persistence mechanisms (cron jobs, systemd timers, rc.local, and OpenRC hooks).

What makes Carbonato notable is what comes next. It installs Hermes Agent, a legitimate open-source AI agent framework, but overwrites its configuration to create an agent named GH0ST that accepts tasks from a Telegram-based operator. The agent interprets natural-language instructions from the operator, writes terminal commands, executes them on the infected host, reads the output, and decides follow-up actions autonomously. The operator used this to steal AI service API keys, SSH credentials, and access tokens from compromised hosts. The botnet also self-propagates: every five minutes it scans the host's attached networks and Docker bridges looking for other exposed Docker daemons on port 2375, and repeats the attack on any it finds.

A hit on the image-pull or container-create rules means your Docker host is actively being attacked and may already be compromised at the host level. Act immediately: take the host off the network, rotate all credentials stored on it (SSH keys, cloud provider keys, AI service API keys, access tokens), and audit any other hosts on the same network segment for signs of lateral spread — Carbonato scans the local /24 aggressively. Check for unexpected SSH authorized_keys entries, unusual systemd units or cron jobs, a .docker-network-monitor persistence file, and processes disguising themselves as kworker/u2:0. The definitive fix is closing port 2375 to untrusted networks — Docker's API daemon should be bound to localhost or a Unix socket, never to an open network interface.

Severity: HIGH · Priority: P2 — macOS infostealer and backdoor infection, investigate on hit

These rules detect network activity from MacSync, a rapidly evolving macOS infostealer-as-a-service. MacSync descended from the AMOS/Atomic Stealer family and has shifted from simple AppleScript payloads to multi-stage Objective-C and Swift binaries. In this September 2026 iteration, MacSync delivers both an infostealer and a persistent Objective-C backdoor that disguises itself as macOS Finder. The campaign targets cryptocurrency enthusiasts and developers specifically: it impersonates a fictional crypto wallet called Toria (promoted on X and Telegram with a dedicated website), distributes through typosquatted versions of familiar names including Warpcast, and uses fake Apple infrastructure domains to host its staging files. The malware asks for the user's administrator password with a prompt styled to match the impersonated app, then uses macOS's PAM API to verify it — making it newer and harder to detect than the standard dscl approach used by most Mac malware.

A hit on the delivery-domain rules indicates a Mac on your network is contacting known MacSync staging infrastructure. A hit on the C2 or iCloud calendar rules indicates a probable active infection. MacSync steals browser history, cookies, and saved logins across all major browsers; macOS Keychain contents; Telegram session data; data from cryptocurrency wallet applications; and on developer machines, SSH keys, AWS and Kubernetes credentials, and Git configuration. The backdoor additionally allows ongoing remote access, screen capture, execution of arbitrary AppleScript, and can replace legitimate wallet applications with trojanised versions to steal seed phrases. Treat an active infection as a serious compromise: isolate the Mac, and because MacSync specifically targets cryptocurrency assets, move any holdings from wallets whose data was reachable from the machine immediately, from a known-clean device. Reset all credentials the machine held. For developer machines, rotate SSH keys, cloud provider credentials, and any service tokens. The backdoor persists via LaunchAgent, .zshrc modification, and Git hooks — all three need to be removed for a clean remediation.

Severity: MEDIUM · Priority: P3 — targeted sector spyware on a mobile device, investigate on hit

This signature detects Corp MDM, an Android spyware implant targeting the freight and logistics sector. The malware is distributed through counterfeit Google Play pages impersonating two logistics companies — CEVA Logistics and TKW Logistics — and installs itself on the victim's Android device disguised as a system service component. Once installed, it intercepts all newly received SMS messages and forwards them to the attacker's server, redirects calls using USSD forwarding commands, and maintains a hidden foreground service to stay active. Unlike broad commercial spyware, Corp MDM is deliberately narrow in scope: its focus is call and SMS interception, consistent with targeting logistics professionals who may receive sensitive communications such as delivery codes, authentication OTPs, or routing instructions by text.

If GajAV flags this file — for instance when scanning APKs crossing the gateway  — treat it as a probable device compromise: identify the device and user, and because the spyware intercepts inbound SMS, treat any OTP, authentication code, or sensitive message received on the device as potentially seen by the attacker. Revoke or reset any account protected by SMS-based two-factor authentication that the device may have received codes for. Remove the malicious application (com.corp.mdm) and check for any USSD call forwarding that may remain active — USSD call-forward settings can persist after an app is removed on some Android versions. Check call-forwarding settings and reset them if redirected. Rebuild the device if the scope of surveillance cannot be fully assessed.