GajShield Threat Intelligence

Severity: HIGH · Priority: P2 — active exploitation of a pre-auth webmail SQLi, escalate on hit

These rules detect attempts to exploit CVE-2026-48842, a pre-authentication SQL injection vulnerability in Roundcube Webmail, the open-source webmail platform used widely in hosted email environments and self-managed mail servers. The flaw sits in an optional plugin that maps login usernames to mailbox addresses using an administrator-configured SQL query. The plugin attempted to prevent injection by escaping quote characters, but its escaping logic was built on PHP's preg_replace() in a way that a backslash placed before a quote character causes the escaper to treat the backslash as the escaped character, leaving the quote raw and unescaped. A login attempt that never succeeds is sufficient to trigger the injection — no valid credentials, no session token, and no prior access are required. 

A hit indicates an attempted SQL injection against your Roundcube server through the login form. Confirm first whether the targeted Roundcube installation has the virtuser_query plugin enabled — installations that do not have this plugin active are not vulnerable to this specific flaw, and a hit in that case may indicate a scanner probing your server. If the plugin is enabled, treat an alert as an active exploitation attempt: escalate and check database and authentication logs for signs that the injection was successful — unexpected query errors, unusual authentication events, or database modifications. Roundcube should be upgraded to version 1.6.16 or 1.7.1 as the definitive fix; until then, disabling the virtuser_query plugin if it is not actively required removes the vulnerable code path entirely.

Severity: HIGH · Priority: P2 — active ClickFix infostealer campaign targeting Ukrainian organisations, investigate on hit

These rules detect network activity from the Psychedelic Stealer campaign, a previously undocumented infostealer documented by Arctic Wolf Labs and reported on September 23, 2026. The campaign compromises legitimate Ukrainian business websites by injecting hidden frames that display a fake Cloudflare bot-verification page in Ukrainian. A distinctive feature of this campaign is its delivery method: where most ClickFix attacks write an encoded PowerShell command to the clipboard, this one writes a Windows Installer command instead, bypassing detection tools that focus only on encoded PowerShell activity. The command silently installs one of several named MSI packages hosted on the attacker's domain. Those packages download and run the final payload — psychedeliclove.exe — from a secondary server. The stealer harvests passwords, account tokens, and session data from Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, Yandex) and extracts cryptocurrency wallet data from MetaMask, Trust Wallet, OKX Wallet, SafePal, Exodus, Electrum, and Bitcoin Core. It persists through a scheduled task named "psychedelicloveUtils" and polls a command-and-control server for additional tasks, which can include executing further executables, batch scripts, MSI packages, or PowerShell commands.

A hit on any of these rules should be investigated promptly. A hit on the C2 API rules or the IP rules indicates a probable active infection: isolate the machine, and because the stealer specifically targets cryptocurrency wallets and browser sessions, treat all such credentials as exposed — reset passwords, revoke sessions, and move cryptocurrency holdings from any wallet whose files or seed phrases were reachable from the machine, from a known-clean device. Delete the scheduled task "psychedelicloveUtils" and the associated executable. Rebuild the machine if compromise is confirmed; the stealer's ability to receive and execute additional payloads means its full scope may be wider than the initial credential theft.

Severity: HIGH · Priority: P2 — password-spraying tool in use (inbound: against your auth / outbound: from your network)

These rules detect the use of TeamFiltration, an open-source password-spraying and account-takeover framework, by matching its hardcoded default User-Agent string. TeamFiltration was built for enumeration, credential spraying, and automated exfiltration of Microsoft 365 and Azure Active Directory accounts. Its default configuration has included the same specific User-Agent string — from an outdated 2020 Microsoft Teams desktop client — since the tool was published, and attackers using it without customisation leave this distinctive fingerprint on every request they make. 

A hit on the inbound rule indicates an authentication spray in progress against your own systems: examine the authentication logs immediately for the accounts being targeted, lock accounts showing repeated failed attempts, and correlate source IP addresses against known attacker infrastructure. A hit on the outbound rule indicates a machine on your network is the attacking host: identify and isolate it, treat any Microsoft 365 or Active Directory credentials accessible from it as potentially exposed, and investigate whether it successfully authenticated to any external service with those credentials. Because TeamFiltration's auto-exfil mode runs automatically after a successful sign-in, also check for signs of email, Teams, and file access from unfamiliar devices or locations in the affected accounts' sign-in logs.

Severity: HIGH · Priority: P2 — DPRK supply-chain RAT targeting DevOps and infrastructure engineers, investigate on hit

These signatures detect components of the Graphalgo supply-chain campaign, a North Korea-linked operation first documented by ReversingLabs in February 2026 that was attributed to the Lazarus Group's ongoing effort to compromise developers through the software supply chain. In September 2026, the campaign had expanded into new territory: malicious Terraform providers and Go modules — the first confirmed case of malware distributed through HashiCorp's Terraform provider registry. The specific packages involved are gogets.dev/btreex (a Go module whose payload is concealed inside a ZIP archive disguised as a SQL database file, with commit timestamps forged to show a November 2025 date) and two Terraform providers that hide their malicious code inside a standard provider resource function.

The malware is a Go-language remote-access trojan with two notable design choices. First, it activates only under specific conditions — it checks whether runtime values like container names match a hardcoded cryptographic hash — meaning it is designed for targeted compromise rather than mass infection. Second, it uses two independent command-and-control channels: an encrypted Slack messaging channel and an Ethereum smart contract on the Arbitrum test network, giving the operator resilience against takedown of either channel alone. Commands can instruct it to run additional code or delete itself. The campaign shares public-key and blockchain infrastructure with earlier Graphalgo npm and PyPI packages, confirming a common operator.

DevOps engineers and infrastructure-as-code developers are the intended targets because their machines routinely hold cloud provider credentials, GitHub and CI tokens, SSH keys, and Terraform state files — a single compromised workstation can give an attacker access to the systems it deploys and manages. If GajAV flags one of these files, treat it as a probable developer-workstation or CI runner compromise: isolate the machine immediately and treat all credentials reachable from it as exposed. From a known-clean device, rotate cloud provider keys, Git and CI tokens, SSH keys, and any API credentials the machine held; audit Terraform state files for signs of unauthorised infrastructure changes; and check your Terraform lock files, internal module proxies, Go module caches, and CI/CD build logs for the identified package names. Given DPRK attribution, a forensic investigation rather than a quick wipe is warranted.

Severity: CRITICAL · Priority: P1 — active exploitation of a critical unauthenticated WordPress flaw, escalate on hit

These rules detect attempts to exploit CVE-2026-87902, a critical unauthenticated vulnerability in WordPress Core patched in WordPress 7.1.2 on September 22, 2026. The flaw affects nearly every WordPress installation from version 4.7.0 onward — code vulnerable for almost ten years before disclosure. It allows an unauthenticated attacker to manipulate the value WordPress uses when choosing a page template, causing it to include a readable PHP file outside the active theme's directories. No WordPress account, authentication cookie, administrator interaction, or vulnerable plugin is required for this file-inclusion step. Exploitation began within hours of the patch being published.

A hit on the traversal or pearcmd rules indicates an exploitation attempt against one of your WordPress servers. Confirm whether the targeted site is running WordPress 7.1.2 or later; if not, upgrade immediately. Note that exploitation into full code execution is conditional: the server must also run PHP with register_argc_argv enabled — which is the default in official PHP Docker images and in many cPanel environments running PHP below version 8.5. If the site is unpatched and those conditions are met, assume the attempt may have succeeded and escalate to incident response: check writable directories (/tmp, /var/tmp) for newly written PHP files with names like wp-pear-rce-*.php or luci_*.php, and look for signs of code execution from those locations. Rotating the site's database credentials and any secrets accessible from the web-server account is prudent where compromise cannot be ruled out.

Severity: HIGH · Priority: P2 — Android banking trojan, investigate on hit

These signatures detect components of RemControl, a previously undocumented Android banking trojan documented by Group-IB on September 23, 2026, operating as a Malware-as-a-Service platform. The malware targets retail banking customers across Western Europe (primarily Italy, France, Spain, Poland, and Portugal), Canada, and the Middle East, with more than 30 financial institutions in scope. It reaches victims through malvertising campaigns driving users to fake Google Play Store pages impersonating the TVTap IPTV application; once the fake app is installed and the user grants it Accessibility Service permission, the operator gains full remote control of the device.

The malware operates in two stages. The dropper application installs itself as a seemingly legitimate media player, then immediately starts a VPN service to block Google Play Protect from performing real-time malware checks — preventing the security layer from flagging it during the critical installation window. Once established, the dropper installs the payload, which abuses Android's Accessibility Service to inject phishing overlays over legitimate banking applications, stream the device screen to the operator in real time, log keystrokes including PINs and passwords, and relay commands from the operator. The C2 server address is resolved dynamically through encrypted Telegram channels rather than a hardcoded server, making the infrastructure resilient against domain takedowns. The operator behind the campaign is tracked as UNKK, and there are indicators suggesting a possible connection to the Medusa banking trojan campaign that previously used identical dropper naming conventions before switching to RemControl in mid-2026.

If GajAV flags one of these files on a device or while scanning sideloaded APKs, treat it as a probable infection. Because RemControl can give an operator full remote control — including the ability to see the screen, capture keystrokes, and interact with any open app — treat the device as fully compromised: isolate it, reset all financial and account credentials from a known-clean device, revoke banking sessions, and notify the user's financial institutions. The device should be factory-reset, as Accessibility Service malware of this kind is designed to resist uninstallation.

Severity: HIGH · Priority: P2 — ClickFix payload delivery and C2, investigate on hit

These rules detect network activity from a ClickFix campaign documented by Bleeping Computer in September 2026 that exploits a domain with an unusual history. The domain third-party.com has long been used in developer documentation, tutorials, and code examples as a convenient placeholder name for a fictional external service — appearing in countless README files, API guides, and sample code snippets. Whoever now controls it has turned it into a ClickFix lure: visitors see a fake Cloudflare bot-verification page that instructs them to paste and run a PowerShell command. When a developer follows the prompt, the command downloads and executes a payload from elxxvvx.xyz, which acts as both the delivery server (serving the installer via /f and /update2.zip) and the C2 channel for the installed malware.

A hit on the rules indicates a probable active infection: identify the device, check whether the user recently ran a command pasted from a browser window showing a CAPTCHA or verification prompt, and isolate the machine. Because ClickFix payloads in this campaign family typically deliver infostealers or remote-access tools, treat any credentials or data accessible from the device as potentially exposed and reset them from a known-clean device. 

Severity: MEDIUM · Priority: P3 — novel AI-driven Windows implant, not yet confirmed in active attacks

These signatures detect CLOSEDQUORUM, a Windows malware implant documented by Cisco Talos on September 22, 2026, and described as the first publicly documented Windows malware to replace a human attacker's command-and-control role with a panel of commercial AI language models. Rather than waiting for instructions from an operator's server, CLOSEDQUORUM collects information about the infected machine, sends it to up to four AI services — DeepSeek, Qwen, Mistral, and Google Gemini — and executes whichever attack action wins a plurality vote from the models. The actions available to the AI panel are credential theft (including Windows login data, saved browser passwords across Chrome, Edge, and Firefox, and cryptocurrency wallet contents), shellcode injection through Windows process manipulation, persistence, and lateral movement. Results and stolen data are sent back to the attacker through a Discord messaging channel rather than a conventional command-and-control server, which helps the malware avoid network-level blocking of dedicated attacker infrastructure.

If GajAV flags one of these files and other evidence suggests active execution, treat it seriously: CLOSEDQUORUM can steal Windows credentials, saved passwords, and cryptocurrency wallets, and can inject shellcode into other processes. Isolate the device, reset credentials reachable from it, and look for signs of data sent to a Discord webhook from the machine's network history.

Severity: HIGH · Priority: P2 — software supply chain credential-theft worm, investigate on hit

These rules detect network activity from the sckit worm (also tracked as "supplychain.local"), a Go-based credential-stealing supply chain worm that was published inside two packages belonging to MemTensor, an AI memory-integration framework, on September 23, 2026. The attacker obtained MemTensor's publishing tokens by compromising its own GitHub Actions release pipelines and used them to ship malicious versions of the npm OpenClaw plugin and the PyPI MemOS Python library. The payload runs in the background each time the affected package is invoked — during agent-gateway startup and memory-recall events — rather than at install time, which helped it avoid detection during installation checks. Once active, it inventories the home directory and process environment, harvests credentials for cloud providers, source-control services, package registries, AI platforms, and business applications, and exfiltrates them over HTTPS to three subdomains of an attacker-controlled domain registered just eight days before the attack. The worm also contains templates to inject itself into other npm packages, Python packages, and GitHub Actions workflows that the stolen credentials can reach, meaning the infection can spread to additional projects the victim can push to.

A hit on the C2 rules indicates a machine is actively communicating with the worm's infrastructure. A hit on the package-fetch rules indicates the malicious package is being downloaded. In either case, identify the machine and act immediately: kill any running sckit process, delete $HOME/.openclaw/.cache/runtime (npm) or $HOME/.memos/.cache/runtime (PyPI), and pin the project to the safe version — 0.1.20 for the npm package, 2.0.33 for the PyPI package. Because the worm harvests credentials from the home directory and process environment, rotate every credential that was reachable from the affected machine — cloud provider keys, GitHub and CI tokens, npm and PyPI publish tokens, and any API keys in the environment or home directory configuration files. Critically, check every repository and package the victim can push to for an unexpected runtime-update.yml workflow file or a .sckit/ directory, as the worm may already have spread beyond the initial infection. If your team publishes packages from CI, review whether your release workflow trusts files from the commit it builds and consider switching to trusted publishing to remove long-lived tokens from CI jobs.

Severity: CRITICAL · Priority: P1 — nation-state zero-day exploitation, escalate on hit

These rules detect network activity from a campaign by UTA0565, a Chinese state-linked espionage group. The group exploited three zero-day vulnerabilities — two in Chrome's JavaScript engine and one in Windows — chained together to break out of the browser's security sandbox and gain elevated access on the victim's system without any patches available at the time. The attack was delivered through typosquatted websites that closely impersonated legitimate organisations, including China Digital Times and the Center for American Progress, and targeted Asian government entities with politically themed phishing emails around the imprisonment of Hong Kong activist Chow Hang-tung. The fake pages displayed content pulled directly from the real sites, making them visually convincing. Victims who visited an attacker-controlled page received a silent exploit that installed CLEANGULP, a previously undocumented backdoor written in C and designed to resist analysis. CLEANGULP can run commands, list processes, transfer files, and execute attacker-supplied code, and maintains persistence by masquerading as a Microsoft input-method component.

A hit on the C2 rules indicates a machine on your network is actively communicating with the CLEANGULP backdoor, meaning it is already compromised and under attacker control. Isolate the device immediately, assume all credentials, files, and data accessible from it are exposed, and escalate to incident response — given this is targeted state espionage, a full forensic investigation is warranted rather than a quick wipe. Hunt for persistence under %LOCALAPPDATA%\Microsoft\IME\ and a scheduled task named "MicrosoftIME." A hit on the exploit-kit or delivery domain rules indicates a user may have visited an attacker-controlled page — confirm whether the machine received the exploit and treat it as potentially compromised pending investigation.

For all affected hosts, update Chrome and Windows to versions patching CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 immediately, since all three were actively exploited as zero-days by this and related China-linked groups. All rules are alert-only; they do not block traffic.