ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine. The rest of the week gets stranger: botnets borrowing AI, command traffic hiding in public infrastructure, malicious tools waiting before showing their real behavior, exposed systems getting scanned, and exploit windows shrinking again. Different tricks, same advantage: attackers keep finding places where trust is cheap and friction is low. That sets the tone. Heres the full list of what surfaced this week. The threats change every week. Subscribe, and well alert you when each new ThreatsDay Bulletin is out. Social engineering attempt fails ReliaQuest Targeted in Failed Extortion Attack Cybersecurity company ReliaQuest has confirmed that one of its employees was targeted in a social engineering attack after hackers impersonated a member of the security team. The incident took place on August 22, 2026. "The threat actor registered a lookalike domain and stood up a fake ReliaQuest single sign-on (SSO) page behind a content delivery network," the company said . "The threat actor then called multiple ReliaQuest teammates, each time posing as a security employee by name in an attempt to steer them towards the fake page. One teammate entered their password and approved the push notification on their phone. That handed the attacker a brief session on our identity dashboard." ReliaQuest said the extent of the access was view only, and that no applications or systems were accessed, and no customer data was ever touched. Although the company did not attribute the incident to a particular threat actor, it noted the playbook aligns with tactics adopted by ShinyHunters and other extortion crews, such as "an impersonation call, a throwaway lookalike domain registered and burned within the hour, a harvesting page behind a content delivery network, MFA push abuse, and a rapid attempt to enroll a new authenticator." The development comes as ShinyHunters listed the company on its dark web portal. Last week, ReliaQuest said it's tracking a ShinyHunters campaign using domains that follow the "company[.]claims" pattern, including "reliaquest[.]claims." Trojanized productivity apps Fake Websites Deliver Malware Fake websites advertising productivity software are being used to lure users into downloading a deceptively functioning program that contains malware. The Electron-based applications, such as Kitchen Canvas, Food or Meal Formula, DocConvertWizard, and other PDF conversion tools under different names, gain the ability to dynamically execute injected scripts and access desktop capture functionality through Electron APIs. Live operator-driven phishing JWR Phishing Framework Spotted An undocumented phishing framework, internally branded "JWR" by its developer, is designed to convincingly impersonate checkout and login pages across major payment and shopping platforms. "The client engine of the JWR phishing framework is a real-time, operator-driven system that, rather than merely logging form submissions like a static credential-stealing page, keeps an AES-CTR encrypted WebSocket open to the threat actor so they can steer each victim's session live," Cisco Talos said . "The victim data targeted by the actor using JWR extends well beyond payment data, encompassing identity documents, Social Security numbers, passport and driver's license images, website and PayPal credentials, 2FA codes, and full device fingerprints, all committed to the actor's server once a session ends." The JWR phishing framework is assessed to be a variant of The Outsider phishing-as-a-service (PhaaS) platform, based on several similarities in the client engine scripts and functionalities of the two PhaaS platforms. Android fraud bot for rent Octagon Android Banking Malware Sold on Underground Forums Cybersecurity researchers have disclosed Octagon, a previously undocumented Android on-device fraud bot sold as malware-as-a-service (MaaS) by the Russian-speaking actor AndroidKitKat. "The operator advertises Octagon for $1,400 a month, giving buyers accessibility overlays, hidden VNC, SMS and one-time password interception, unlock-pattern capture, and on-screen balance reading," iVerify said . "It targets crypto wallets and banking apps after installation, while the delivery app can use an unrelated theme." Rust backdoor tied to ransomware C2Looper Likely Used by Ransomware Group A new Rust-based malware family dubbed C2Looper is likely leveraged by a ransomware-related threat actor and delivered to victims through a multi-stage ClickFix infection chain. Zscaler ThreatLabz said it discovered the malware in July 2026. "C2Looper supports typical backdoor commands including remote shell execution, reconnaissance, and deploying additional malware tooling," Zscaler said . "C2Looper dynamically resolves Windows APIs and encrypts strings." There also exists a variant with additional features and capabilities, including the use of GitHub for command-and-control (C2) communications. 296,000 IoT devices compromised Dysphoria Botnet Targets IoT Devices Nearly 296,000 devices have been compromised by a botnet named Dysphoria. "Dysphoria targets IoT devices and its primary function appears to be for use in DDoS-attacks," the Shadowserver Foundation said . "Recently the botnet has gotten residential proxy functionality." C2 moves onto Polygon Aeternum Pivots to EtherHiding A recently discovered C++ botnet loader called Aeternum has shifted its C2 infrastructure entirely to the public Polygon blockchain. "Instead of relying on centralized servers or domains, threat actors operate Aeternum by writing encrypted and plaintext instructions directly using smart contracts," Palo Alto Networks Unit 42 said . "Infected devices continuously query public remote procedure call (RPC) endpoints to retrieve and execute these on-chain commands. The Aeternum botnet uses decentralized networks and evasion techniques, such as virtual machine detection and antivirus scanning, to operate effectively. This combination establishes a highly resilient, low-cost threat that complicates existing law enforcement takedown methods." AI enters botnet workflows ToxNetV2 Botnet Integrates AI into Decision Workflows An AArch64 Linux peer-to-peer botnet called ToxNetV2 has integrated a large language model (LLM) into the operational workflow of its controller. The controller communicates with NVIDIA NIM using the z-ai/glm-5.2 model, becoming a part of a feedback loop that determines how its capabilities can be put to use on a given machine based on information about the infected environment. "The controller collects host and botnet telemetry, sends that context to NVIDIA NIM, parses selected model responses into structured actions, and queues those actions for operator approval," Joe Security said . "The system is not fully autonomous or self-modifying. The operator remains the final approval point for its higher-impact AI-generated actions. Once approved, however, those actions can reach local command execution, file writes, remote SSH, persistent state, and a compilation workflow." According to the cybersecurity company, the AI subsystem resides within a broader Tox-based botnet featuring encrypted peer-to-peer C2, host-management capabilities, scanner workers, self-propagation logic, and 17 network-attack launchers. Two stealers target credentials Phantom Stealer and Salat Stealer Detailed An information stealer called Phantom Stealer is designed to collect browser credentials, saved passwords, session cookies, cryptocurrency wallet files, and detailed system fingerprints. "Since its appearance, Phantom Stealer has been observed in multiple campaigns targeting users across different countries, frequently distributed through phishing lures, cracked software, and malicious links spread via platforms like Discord and Telegram," Splunk said . "Its modular design and relatively low barrier to entry have made it an attractive option for both novice and experienced threat actors, contributing to its growing adoption and making it a persistent and evolving threat in the infostealer landscape." A second stealer malware family that has emerged in the wild is Salat Stealer , which is written in Go and can perform system reconnaissance, conduct credential theft, and monitor victim activity through desktop streaming and audio/video capture. ClickFix chain drops new RAT BabaDeda Loader Delivers CNCMachineRMS RAT A previously undocumented remote access trojan ( RAT ) called CNCMachineRMS is being delivered via BabaDeda Loader . "Infection starts with a ClickFix lure that launches a legitimately signed IBM SPSS IDE executable, WinWrapIDE.exe, whose scripting engine is abused to load a malicious DLL," LevelBlue said . "Four decoy DLLs load through ordinary Windows import resolution, then the final stage smuggles shellcode into execution via EnumTimeFormatsEx, a benign date-formatting API." The Trojan gives an operator remote administration of the host, including an interactive shell, a file manager, screen capture functionality, a local account backdoor, seven persistence mechanisms, and twenty typed commands for pulling down and running further payloads. New modular RAT emerges Modular Abyssos RAT Discovered Speaking of RATs, Abyssos is another new malware family that's written in C++ and supports credential theft, file exfiltration, and remote access via VNC. The modular malware was first detected in June 2026. "Abyssos uses a custom TCP protocol for network communication," Zscaler said . "Abyssos supports a number of different network commands and downloads additional modules from the command-and-control (C2) server to enhance its capabilities." Disk encryption bypass remains unpatched 0-Day Boot Chain Flaw in HP ThinPro 8 and 9 A zero-day boot-chain vulnerability in HP ThinPro 8 and 9 could allow physical attackers to bypass Trusted Platform Module (TPM) full-disk encryption and extract LUKS keys securing the device's root partition. The flaw stems from an incomplete measured-boot policy that omits the Linux kernel and initramfs (aka the initial RAM file system). "For defenders running ThinPro with disk encryption today: turn Secure Boot on and set a BIOS password," AmberWolf said . "Both slow an attacker down; neither closes the PCR gap. Beyond that, treat the encryption as no protection once the device is out of your control. Destroy the M.2 on disposal, and do not rely on ThinPro FDE for a lost or returned unit." The vulnerability remains unpatched. 1.99 million mobile attacks blocked Mobile Attacks in Q2 2026 Data from Kaspersky shows that more than 1.99 million attacks were recorded and blocked against mobile devices in Q2 2026 using malware, adware, or unwanted mobile software. "The Trojan-Banker category was the most prevalent mobile malware threat with a 30.77% share of total detected applications," Kaspersky said . More than 304,000 malicious installation packages were discovered, including 93,574 packages related to mobile banking Trojans and 570 packages related to ransomware. Python stealer targets credentials and wallets New Python-Based Vanta Stealer Steals Data Cybersecurity researchers have discovered a new Python-based stealer malware called Vanta Stealer that combines extensive credential harvesting capabilities with layered obfuscation techniques that make it possible to collect valuable user data while complicating analysis efforts. "Vanta Stealer targets a broad range of applications and digital assets, including Chromium-based browsers, Discord, Telegram Desktop, Steam, Riot Games, Roblox, Minecraft, Mullvad VPN, cryptocurrency wallets, and locally stored sensitive documents," Point Wild said . "In addition to harvesting browser passwords, cookies, and stored payment information, the malware collects authentication tokens, gaming platform data, VPN configurations, cryptocurrency wallet files, screenshots, webcam captures, and documents containing wallet recovery phrases or private keys." Exactly how it's delivered is currently not known, although it could be through phishing emails, fake installers, game cheats, fake software updates, SEO poisoning, malvertising, and malicious code repositories. Two more credential stealers surface DARTHVADER and DestinyStealer Join a Long List of Stealers Elsewhere, malicious LNK files disguised as PDF documents have been found to launch a multi-stage infection chain using cmd.exe, legitimate Windows utilities, AutoIt, and PowerShell to deploy DARTHVADER Stealer. Europe and the U.S. have been targeted by DestinyStealer, which exhibits clear code continuity from StormKitty Stealer . It collects browser data, cookies, passwords, cryptocurrency wallet extension storage, Outlook and VPN data, FileZilla credentials, Wi-Fi profiles, and desktop screenshots. Stealer scores hosts for sandbox signs ScarfaceStealer's Sandbox-Aware Anti-Analysis System Detailed An information stealer called ScarfaceStealer has been observed propagating via an Electron-based application masquerading as AI-related tools. The malware performs a set of environment checks intended to evade sandbox environments and evaluates the host through 11 indicators and combines their results into a weighted suspicion score. If the score reaches 7 or higher, it enters a decoy loop that continuously displays random message boxes. Execution continues only if the score is below 7. "Unpacking the Electron application exposed a second-stage JavaScript-based loader that performs initial evasion checks before decrypting and executing the next stage," Joe Security said . "That third stage applies four additional decryption layers, maps an embedded PE in memory, and transfers execution to it. The recovered final stage revealed the core anti-sandbox logic: a scoring-based mechanism used to decide whether the ScarfaceStealer payload should continue execution." Fake scans push antivirus removal Beware of Fake Microsoft Security Scans Malwarebytes is calling attention to a scam campaign that uses a set of 11 fake websites that claim to offer a way to check if antivirus tools are working as expected. The tools carry Microsoft branding and go by names like SysScan to lend them a veneer of legitimacy, only to instruct users to immediately uninstall antivirus programs installed on their machines to address compatibility issues. "Although the names vary, the sites work in essentially the same way: Run a convincing-looking but fake security scan, tell the victim their antivirus is causing problems, collect their information, and prepare them for a supposed refund call," the company said . ClickFix chain drops Amatera ClickFix Leads to PavinLoader Malware and Amatera Stealer Fake CAPTCHA checks that employ ClickFix lures and bogus software download campaigns are being used to deliver PavinLoader (aka RenPy Loader and RenEngine Loader), indicating the tool is being offered as a loader-as-a-service to other cybercriminals. "What happens next is much more consistent," Malwarebytes said . "PavinLoader uses legitimate Windows tools alongside malicious .NET files to run several stages of malware. It also uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to find the server from which it should retrieve additional malware." This ultimately leads to the deployment of Amatera Stealer and other malware. "In some cases, WiX Burn bundles downloaded another payload associated with PavinLoader. In others, we detected Hijack Loader," it added. "This gives the campaign operators the ability to deploy multiple payloads on a compromised machine." Per-app privacy controls tested Microsoft Tests New Privacy Controls Microsoft has begun piloting new privacy controls that will let Windows 11 users choose which desktop applications can access their camera, microphone, and precise location. "Windows Insiders can now manage camera, microphone, and location permissions for individual desktop apps," Microsoft said . "Previously, access for traditional desktop applications was managed through a single device-wide setting. With this update, you can review and control access on an app-by-app basis, giving you greater visibility into which apps are requesting access to sensitive resources and more control over your privacy choices." Telegram-sold RAT used by TA4922 PackClient C2 Framework Sold on Telegram Proofpoint has disclosed details of a new RAT and C2 framework called PackClient that's sold on Telegram and is being used by at least one threat actor, Chinese-speaking TA4922 , as part of its continued efforts to expand its malware arsenal. The first campaign, observed in late May 2026, used a tax-themed lure and impersonated the Shandong Provincial Tax Bureau to trigger a sense of urgency. Two other campaigns in mid- to late-July 2026 have been found to impersonate Indian tax authorities and used penalty-themed lures to deliver the malware. "PackClient consists of a first-stage loader executable, a second-stage loader ('PackClientLauncher') DLL module, a core module ('PackClientCore'), and several optional plugins that can be downloaded upon operator command," Proopoint said . "The malware connects to two hard-coded C2 endpoints over raw TCP sockets to download and reflectively execute the core RAT DLL, receive commands, and download additional plugins or payloads." The commands allow the malware to configure C2 servers, run shell commands, start screen capture, launch a SOCKS proxy tunnel, record using a webcam, perform file operations, enumerate running processes, log keystrokes, and update the core module. No less than 11 plugins have been identified. They allow remote desktop screen sharing, RDP-style virtual desktop, file management, system administration, interactive remote shell, and webcam streaming. Cloud database powers C2 New Miraak Post Exploitation Framework Identified A modular post-exploitation framework called Miraak has been found exposed in attacker-controlled open directories ("144.172.96[.]13"). "Miraak is designed to provide operators with persistent control of compromised systems while supporting command execution, file transfer, process management, screenshot collection, and extensible post-exploitation activity," Blackpoint Cyber said . "A defining aspect of the framework is its use of cloud-hosted PostgreSQL and Timescale infrastructure for command-and-control. Rather than communicating through traditional web-based C2 endpoints, Miraak uses database connections to register infected systems, retrieve operator tasking, track jobs, and return results." The malware has not been attributed to any known threat actor or group. Stored XSS enabled account takeover Account Takeover in Microsoft Purview A security vulnerability in Microsoft Purview could be exploited by a single external Teams message, email, or Copilot prompt to carry stored malicious code into a Purview reviewer's authenticated browser and turn a routine compliance check into a path to token theft and account takeover. "A standard user, including a user in a completely different tenant with no permissions in yours, could send a Teams message, an email, or a Copilot prompt containing a malicious payload, wait for it to be flagged and have their JavaScript execute inside the authenticated purview.microsoft.com session of every compliance analyst who opened the case," Cymulate said . "In our proof of concept, that meant the reviewer's access and refresh tokens leaving the browser and reaching an attacker-controlled server, which constitutes full impersonation of a privileged compliance identity." Microsoft has since issued a service-side fix. Malicious MCP server targets secrets Deadbugz, an MCP Supply Chain Attack Campaign A supply chain attack campaign codenamed Deadbugz has been observed attempting to distribute a malicious Model Context Protocol (MCP) server through public GitH