• Defiant warned of active exploitation of WooCommerce Wholesale Lead Capture Plugin flaw (CVE‑2026‑27540)
• Critical unauthenticated file‑upload bug lets attackers deploy PHP webshells for site takeover
• Patch released in Feb 2026 (v2.0.3.2); Wordfence blocked 100,000+ attacks, users urged to update and check uploads

A critical vulnerability in a popular WooCommerce plugin is being actively exploited to upload malware and possibly take over entire websites, security experts have warned.

The plugin in question is called Wholesale Lead Capture Plugin for WooCommerce. It adds a dedicated registration and onboarding system for wholesale and B2B customers, letting businesses collect company and other custom information, review applications, assign wholesale user roles, and automate registration and onboarding emails.

It is a premium plugin that costs between $99 and $600 and which, according to the Wordpress store page, has more than 20,000 active installations.

A thousand victims

The plugin was vulnerable to an unauthenticated arbitrary file-upload flaw which, as the name suggests, allows unauthenticated parties to upload arbitrary files, including PHP webshells and executable code that can result in full site takeover. It is tracked as CVE-2026-27540 and carries a severity score of 9.0/10 (critical).

Versions 2.0.3.1 and older were said to be affected. Version 2.0.3.2, released on February 20, was said to have addressed the bug, meaning the patch has been available for almost half a year. However, WordPress security outfit Defiant said its Wordfence web application firewall blocked more than 100,000 attacks, and Wordfence added that it observed two attack spikes - one between June 4 and 17, and another one between July 1 and August 30.

In these incidents, the attackers were mostly uploading reconnaissance webshells, possibly mapping out the landscape before deploying more serious malware.

“The uploaded shell.php is a PHP webshell that reports host details and provides a browser-based upload form for writing additional malicious files to the site,” the researchers said.

If you are running the plugin, it is advised you update it to the newest version as soon as possible, and check upload directories for unexpected, or recently created, PHP files.

Via BleepingComputer

• Elastic Security Labs uncovered REF9334, a Brazilian banking malware campaign active since May 2025
• Malware “Kremlin” deploys fake docs and malicious Chrome/Edge extensions to steal banking data
• 1,515 infections found, 98% in Brazil

Security researchers from Elastic Security Labs have discovered a new Brazilian banking malware campaign that uses browser extensions to compromise users and steal sensitive information.

In an in-depth report published earlier this week, the researchers said the campaign has been active since at least May 2025. Dubbed REF9334, the campaign uses fake banking, invoice, and business documents, to trick victims into installing malware which, in turn, deploys a malicious extension in Chrome and Edge browsers.

The researchers named the malware “Kremlin”, and say it can steal browser credentials, cookies, session information, monitor browser activity, grab screenshots, and steal information from websites that the victims visit. But the goal of the campaign is primarily to target Brazilian bank users.

A thousand victims

The malware really makes an effort to hide and persist in the target environment. For example, it first checks to see if it’s in a sandbox and if so - it simply won’t run. If instead it determines that it’s running on a real user’s computer, it will deploy an extension with the name “AVSync System Inc.” in an attempt to trick the victim into thinking they have an antivirus addon running in the browser.

It also doesn’t use a fixed C2 server, but rather stores the information on the Ethereum blockchain, since it’s a lot harder to disrupt the communication between the operators and the infected machines that way.

During their investigation, Elastic researchers were able to take control of a domain that the malware used and discovered that it had infected 1,515 systems. Almost all of them (98%) were located in Brazil. They were also able to register the network canary domain and point it to their webhost, which resulted in the loader assuming it was in a sandbox. This also meant “the infections have not moved past the initial access”, Elastic explained.

The full list of indicators of compromise can be found on this link.

Via The Hacker News

• Huntress warns fake GTA 6 ISOs spreading malware ahead of official Nov 19, 2026 release
• Packages deliver RATs, infostealers, and Chaos ransomware disguised as game installers
• Users urged to avoid pirated downloads; infected systems should be reimaged and credentials reset

Grand Theft Auto 6 (GTA 6), one of the most anticipated computer games of all time, is due to launch on November 19, 2026 - so everything found online before that is almost certainly malware.

This is the warning sent out by security researchers Huntress, which said it recently saw one variant deploying all sorts of filth, from remote access trojans (RAT), across infostealers, to full-blown ransomware encryptors.

The story behind GTA 6

GTA 6 is a third-person action-adventure and open-world gam developed by Rockstar Games, which egan preliminary work more than a decade ago, and has allegedly spent more than a billion dollars during that decade and a half, which would make it, by far, the most expensive game ever developed.

It is also a sequel to GTA 5, a game that was sold in more than 230 million copies around the world, which made it one of the most popular games of all time.

In late August 2026, someone going by the alias LEEK claimed to have obtained a working, playable build of the game, roughly six months before the official release. They posted numerous screenshots and videos of them playing the game, even writing their nickname onto a wall, using a rifle to prove the authenticity. Truth be told, even without this, people would have still probably searched for, and downloaded, fake installers. This only made the problem worse.

And a major problem, it definitely is. Huntress is now saying it is seeing websites ranking relatively high (through SEO poisoning), offering for download an ISO of the game. Similar ISOs are circulating around different gaming forums, torrenting sites, and social media channels.

An ISO file is a digital copy of an entire disc, such as a CD, DVD, or Blu-ray, stored as one file. Users can download an ISO (which can weigh tens or hundreds of gigabytes), mount it into a virtual drive, and the computer will treat it like a physical disc.

Huntress found some ISOs weighing more than 100GB which was done just to make it seem authentic - the actual malware was “a factor smaller”. The ISOs they analyzed contained multiple variants, including NJRAT and CDRAT (two remote access trojans), Mercurial Grabber (an infostealer grabbing Roblox Studio cookies, Minecraft session data, Discord tokens, Chrome passwords and cookies, system information, IP addresses, and geolocation, Windows product keys, and screenshots), and Chaos Ransomware. The package also contained a legitimate, regular browser - “Just for kicks,” apparently.

A plausible failure

During the “game” installation, the installer displays a message in Russian, saying the product is unlicensed and that there is a good chance it won’t run. If that happens, the user is told to reach out to a specific Gmail address to receive an “updated crack”. After the installation completes, the victim will get that exact popup, saying “License not found”. All of this is just a smoke screen, to make the victim not suspicious as to why the “game” won’t run.

There is no way of telling how many people fell for the ruse and installed malware on their devices. Huntress says that generally speaking, trying to download cracked and pirated software is a bad idea, which is even worse if the game in question has not yet been released.

“This is fertile ground for scams and threat actors attempting to take advantage of the impatient and overeager,” the researchers said.

The good news is that all of the malware being distributed there is not new. Some of the variants contained in the ISOs are several years old, meaning most antivirus programs, such as Windows Defender for example, can easily detect it and stop it from compromising the system.

Those that do end up infected should disconnect the machine from the internet, reset all passwords, enable 2FA wherever possible, and do a complete reimage of the compromised system.

• Proofpoint detailed BlueMoon, an exploit kit chaining two Chromium flaws and one Windows bug
• Four groups, including China‑aligned TA412, used it loudly against NGOs, aerospace, and manufacturing targets
• Exploits were “patch‑gap” zero‑days; all flaws now patched

Four hacking groups, including some tied to the Chinese government, were seen using the exact same exploit kit in a span of a week, suggesting a certain “fear of missing out” among the criminals, experts have warned.

Security researchers Proofpoint have detailed BlueMoon, an exploit kit that leverages three vulnerabilities: two in Chromium, and one in older versions of Windows: Windows 10 (October 2018 Update), Windows Server 2019, Windows 10 2004, WIndows Server 2022, and the initial release of Windows 11.

The kit was first seen being used on August 28 2026, by a threat actor tracked as TA412, a China-aligned state-sponsored threat actor that was observed in the past targeting businesses using Microsoft SharePoint. TA412, also known as Violet Typhoon, used BlueMoon to “repeatedly target a small number of non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the United States.”

Soon after that, three others were spotted: UNK_LateNight, another China-aligned espionage group which targeted multiple US aerospace companies, UNK_DoubleCheck, a group going after a Vietnamese manufacturing entity, and UNK_QuietRacket, a threat actor taking aim at organizations across Singapore and Indonesia.

What all of these groups have in common is the fact that they did not try particularly hard to hide their activity. This is rather unusual, since a stealthy approach usually guarantees that a vulnerability can be exploited for longer.

Front running the Chromium supply chain train

BlueMoon takes advantage of three flaws, two in Chromium and one in older Windows variants. The Chromium vulnerabilities were found in V8, the JavaScript engine that the browsers use to allow applications to run efficiently. The first one is a “type confusion bug”, tracked as CVE-2026-85046, and assigned a severity score of 8.8/10 (high). The latter is a “sandbox escape” flaw, for which Google did not assign a CVE or a severity score.

The Windows bug, on the other hand, is tracked as CVE-2026-85880, and was given a severity score of 7.8/10 (high). It is described as a “heap-based buffer overflow” vulnerability in Windows Advanced Local Procedure Call, allowing malicious actors who can already execute code inside a low-privilege AppContainer to escape the sandbox and elevate privileges to SYSTEM. No additional user interaction is required.

Proofpoint has a theory as to why the crooks decided to be loud, instead of flying under the radar. Apparently, there is a very short window of opportunity between Google patching a Chromium vulnerability, and it being deployed to a browser such as Edge, or Brave, This window of opportunity also allows crooks to see how Google fixed a flaw, reverse-engineer it, and deploy an exploit before the browser is patched. This would mean that there is no time to be stealthy.

No time to hide

“Both V8 vulnerabilities were ‘patch-gap’ zero-days at the time of the observed activity,” Proofpoint said. “In other words, while they were known vulnerabilities already fixed in public upstream Chromium source code, they remained unpatched in the latest stable releases of Chrome and Chromium-based browsers available to the public. It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain.”

Another important factor is Artificial Intelligence. It would seem that AI has made flaw detection significantly faster, reducing the barrier to entry and making threat actors move more loudly.

“A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development,” Proofpoint stressed.

All three flaws have since been patched, so make sure you’re running the latest version of both the OS and the Chromium browser.

Via Ars Technica

• Calif researchers found a zero‑click WeChat VoIP flaw enabling account takeover via calls
• “WeWorm” spreads through ringing calls; victims need not answer to be compromised
• Tencent patched in Android 8.0.77 and iOS 8.0.76; no exploitation seen in the wild

Security researchers have found a flaw in WeChat which allows malicious actors to take over people’s accounts on both Android and iOS devices - but what makes this flaw stand out is the fact that it’s a zero-click bug - victims need not do a thing to be compromised.

WeChat is a “super-app”, allegedly used by roughly 1.4 billion people, and is especially popular in China. It started as a communications app, letting users send messages, and make voice and video calls, and has evolved to function as a social network, allowing users to share photos and videos, as well as a payment app through which users can transfer money, pay for things, order food, book taxis, and even access government and business services.

Security researchers from Calif have now disclosed finding a ‘memory corruption’ issue in WeChat's VoIP stack. For now, they decided not to share the technical details, and to instead demonstrate the flaw “at an upcoming conference.” To that end, they built a worm called WeWorm, capable of taking over target WeChat accounts and spread through phone calls made via the app.

A phone call would suffice

In practice, it works remarkably simple: an attacker uses WeChat to call a person they have in their contacts list (this is a prerequisite). They can use both an Android and an iOS device, and can call anyone, regardless of the model or the OS they’re using. As soon as the phone starts ringing, WeWorm gets to work, “worming” its way into the victim’s device.

The victim does not even need to answer the phone - having it ring is enough. If they answer, they’ll hear nothing but silence, yet the worm will continue operating. If they decline the call, the attack stops, but this is hardly a mitigation - the attacker can simply call again while the victim is asleep (or otherwise away from their device).

Within a few seconds, the attacker will have access to the victim’s WeChat account, including their messages, contacts list, and virtually anything else found in the app. What makes this bug particularly worrisome on the surface is the fact that WeChat can be used to transfer money and pay for things, but WeChat Pay has additional authentication and risk controls designed to prevent that from happening.

The good news is that there is no evidence of this flaw being exploited in the wild. The bad news is that this is not the first zero-click flaw found in modern-day smartphones, and most likely will not be the last one.

Tencent's response

Calif said it responsibly disclosed its findings to WeChat’s parent company Tencent, who came back with a patch. Versions 8.0.77 for Android and 8.0.76 for iOS have apparently solved the problem, although

Tencent did not list any details in its patch notes, simply saying the version brought “bug fixes”, but in a statement shared with The Hacker News, it said the exploit has been “mitigated for all users”, and that it was applied server-side - users need not install anything, aside from the patch.

It’s also worth mentioning that WeChat has apps for HarmonyOS, Windows, Mac, and Linux. However, it would appear that Calif did not test those, and Tencent did not include them in its patch. The researchers did say that they would be looking into this same flaw in other products, too:

“This specific WeChat bug is one instance of the many unconventional attack surfaces that are present across many messaging apps,” they said. “We're conducting more of this research across other apps and attack surfaces, while working with app developers on attack surface reduction. This may take an industry-wide effort, since some of it depends on the platform owners. Once that work is further along, we'll share our progress, including the technical details of this WeChat bug.”

• CISA, NSA, FBI warn Chinese AI firms of industrial‑scale knowledge distillation
• Companies like DeepSeek, Moonshot, Alibaba allegedly extracted billions of tokens from US frontier models
• Advisory urges detection of malicious prompts, deceptive responses to distillation, and cross‑provider intelligence sharing

Chinese AI companies’ core development strategy is to steal proprietary functionalities and capabilities from their US counterparts, law enforcement agencies have warned.

The US Cybersecurity and Infrastructure Security Agency (CISA) has published a new security advisory, drafted jointly with the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI), warning American AI companies about an ongoing “aggressive, malicious, and targeted distillation activities at an industrial scale,” and sharing recommended mitigation steps.

Knowledge distillation

IBM defines knowledge distillation as a “machine learning technique that aims to transfer the learnings of a large pre-trained model, the ‘teacher model,’ to a smaller ‘student model’.” It is used in deep learning as a form of model compression and knowledge transfer, it added, particularly for massive deep neural networks.

So, knowledge distillation is not illegal or malicious, per se. Its goal is to train a more compact model to mimic a larger, more complex one. In the security advisory, the agencies stress it is “recognized as a legitimate and useful technique in AI research,” but add that China-based AI companies are using it in ill will.

In other words, the agencies claim that instead of spending months and millions developing new capabilities for their models, the Chinese are simply sending huge numbers of carefully designed questions to US models and extracting the answers.

Which companies are engaged in knowledge distillation?

Apparently, all companies worth anything. DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI all allegedly “extracted billions of tokens across millions of exchanges/requests from US frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024.” CISA also stressed that this was likely done with the awareness of the Chinese government. It hasn’t outright said, “with its blessing”, although it could be read between the lines.

The advisory shares a thorough list of all the models that were being trained, as well as all the models being taken advantage of.

On the Chinese side, they include DeepSeek R1 and V3 models, Moonshot’s Kimi-K2 and Kimi-K3 models, and MiniMax’s M2 model. On the US side, they start with earlier models such as GPT-4, Claude 3.7, and Gemini 2.5 Flash Preview, all the way to Claude Fable 5, GPT-5, and similar.

When done in good faith, knowledge distillation is not illegal. However, the report says the companies routed the requests through multiple accounts, different API access points, multiple cloud providers, third-party AI aggregators, proxy services and “transfer stations”, as well as premium subscriptions shared between developers, all in an attempt to work around defenders trying to disrupt the process.

“This represents systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership. Addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing, spanning the U.S. Government, private industry, and allied nations,” the agencies concluded.

What US companies should be doing

To defend their intellectual property (and thus remain ahead of Chinese competing models) US AI companies should implement comprehensive detection and mitigation, the agencies said. That means hunting for anomalous and malicious prompts, accounts, networks, and behaviors. Furthermore, they should monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns.

The second step is to “deploy targeted response changes”: “Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.” In other words, AI companies should make sure their products lie when they spot they were being distilled for knowledge.

Finally, US AI firms should set up cross-organization intelligence sharing, correlating activity across model providers, cloud platforms, and API aggregators.

• Check Point Research exposed coerced insider flaw in ChatGPT’s agent architecture
• Containers shared metadata via internal service, enabling cross‑account prompt injection and data theft
• OpenAI closed the path, but CPR warns similar risks may exist in other AI platforms

ChatGPT’s AI agents were allowed to pull sensitive data from one account shared with an entirely different account because, colloquially speaking, all agents used to walk down the same hallways, experts have warned.

A new report from security experts Check Point Research (CPR) dubbed the flaw “coerced insider”, since it revolves around persuading the agent instead of abusing a vulnerability.

Coerced insider

When an AI agent is given a task that needs code execution, it handles that task in an isolated container which also sometimes needs to install software. To enable that, without giving containers direct internet access (which would be too risky), OpenAI routes those packages through an internal JFrog Artifactory instance. As a separate security contingency, containers from different accounts cannot talk between themselves.

However - they can reach the same internal service (our proverbial hallways), which exposes an item management feature that lets the containers attach text or binary properties to a repository item. As a result, any container can read back the properties written by any other container.

“Check Point Research confirmed the isolation gap directly: a property written from one account’s container was fully readable from a different account’s container moments later, with data too large for one property simply split into chunks and reassembled on the other end,” the researchers explained.

“The package delivery metadata effectively became a shared clipboard between containers that were supposed to be walled off from one another.”

From there, the exploit turns into your usual, off-the-shelf prompt injection. The only difference is that the malicious prompt is not delivered directly to the victim, but rather left in the hallways, and the results are not shared with the attackers directly, but rather left in those same proverbial hallways, too.

The attacker then delivers a prompt or a shared conversation that instructs the agent to check the same storage during its next ordinary reply. The agent checks, sees the malicious instructions, executes them, all the while replying to the victim’s question in the usual manner. The victim is oblivious to the fact that data theft is taking place in the background.

What kind of information can be stolen?

But this is just half of the equation. How destructive this attack ends up being still depends on the amount of data being shared with the victim agent.

The bare minimum is the information shared while chatting to the agent. It then grows with every connected app: Gmail, Google Drive, Microsoft Teams, GitHub, and similar. “In Check Point Research’s demonstration, ChatGPT retrieved the victim’s email data through their connected Gmail account and delivered it to the attacker’s session, all within a single ordinary turn,” CPR stressed.

The good news is that you’ll likely never be exposed this way, at least not via ChatGPT. CPR says it disclosed the findings to OpenAI, who then confirmed that the specific internal Artifactory instance identified in the research has been commissioned. In other words, the hallways attack path has been closed.

The bad news is that this doesn’t automatically mean everyone’s safe. This particular path might be closed, but the architectural pattern behind the flaw could be present in other platforms, CPR warns.

“Any AI assistant that operates inside an organization’s trust boundary, holding credentials, running code, and reaching connected services, can become what Check Point Research calls a coerced insider,” the report states. “The model itself does not need to be malicious. It only needs to be persuaded, through text it was never meant to trust, to use access that was granted for entirely legitimate reasons.”

Going forward, businesses are advised to learn which AI tools their employees are using, and what those tools are connected to. Then, they should govern what AI tools and agents are allowed to do, treating all of their actions (not just output) as something that needs to be monitored.