Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
This week's cybersecurity news includes suspected China APT behind VMware exploitation, Apple macOS flaw exploited to drop crypto miner, Lazarus Group exploiting Windows 0-day, GeoServer patches critical flaw under attack, and Amnesia Stealer targeting macOS users.
Intelligence analysis by Llama
This week's cybersecurity news highlights several high-profile attacks, including suspected China APT behind VMware exploitation, Apple macOS flaw exploited to drop crypto miner, and Lazarus Group exploiting Windows 0-day. Additionally, GeoServer has patched a critical flaw under attack, and Amnesia Stealer has been found targeting macOS users.
Imagine you're playing a game where the other player can see everything you do and can even control your actions. That's what's happening with these cyber attacks. The attackers are finding ways to see what you're doing and even take control of your computer. It's like they have a magic remote control that lets them do whatever they want.
Analysis
Threat of the Week: Suspected China APT Behind Exploitation of New VMware Flaw
A suspected China-nexus APT is assessed to be behind the exploitation of a newly patched security flaw in VMware vCenter. The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code. In at least one compromised instance, the attacks led to the deployment of a backdoor and a reverse SSH binary, with the attack ultimately leading to the deployment of Babuk-derived ransomware.
According to QUIRSO, the primary objective of the attack was not ransomware, but rather to distract from the underlying intrusion and hinder subsequent forensic analysis by encrypting evidence. This highlights the importance of robust security measures and ongoing education and awareness in the face of emerging threats.
AI Adoption Is Outpacing Governance
A new SANS survey finds that 78% of practitioners now say AI is part of their cybersecurity strategy, up from 50% last year. However, governance hasn't kept pace, with only 36% having a formal AI risk program. This highlights the need for ongoing education and awareness in the face of emerging technologies.
Top News: Apple macOS Flaw Exploited to Drop Crypto Miner
A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner. The vulnerability in question is CVE-2026-65400 (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an attacker already on the network to authenticate to the built-in remote desktop feature service without valid credentials.
Lazarus Exploits New Windows 0-Day
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The activity is part of Operation Dream Job, a long-running cyber espionage and social engineering campaign orchestrated by Pyongyang-backed hackers to target professionals worldwide with fake-but-compelling job offers to steal sensitive data and install malware.
GeoServer Patches Critical Flaw Under Attack
GeoServer has released patches for a critical SQL injection vulnerability that can lead to remote code execution (RCE). The issue, which has yet to be assigned a CVE identifier, has been patched in versions 3.0.1, 2.28.5, and 2.27.6. Per watchTowr, the vulnerability witnessed active exploitation within hours of public disclosure and that it has seen hundreds of attempts originating from a small pool of IP addresses.
Amnesia Stealer Goes Beyond Data Theft
A newly discovered macOS stealer family called Amnesia Stealer has been found to target macOS users via ClickFix attacks. The malware, besides stealing data from 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes, documents, and iCloud Keychain data, includes a streaming module that allows the attacker to interactively control the victim's web browser.
Key points
- Suspected China APT behind exploitation of new VMware flaw
- Apple macOS flaw exploited to drop crypto miner
- Lazarus Group exploiting Windows 0-day
- GeoServer patches critical flaw under attack
- Amnesia Stealer targeting macOS users
While these attacks are concerning, it's worth noting that many of them have been patched or mitigated. Additionally, the fact that these attacks are being reported and addressed suggests that the cybersecurity community is working together to stay ahead of emerging threats. This is a positive sign that we are making progress in the fight against cyber attacks.
However, the fact that these attacks are still happening highlights the ongoing threat of cyber attacks. The use of social engineering tactics and the exploitation of vulnerabilities in widely used software demonstrate the need for robust security measures and ongoing education and awareness. If we don't stay vigilant, we risk falling victim to these attacks.
