Weekly Cybersecurity Recap Covers Vercel Breach, Malware Campaigns and QEMU Abuse
Summary
The weekly roundup covers Vercel’s disclosed breach linked to Context.ai, malware and browser-extension campaigns, a DDoS-for-hire takedown, QEMU abuse, new Android RATs and security product news.
Key points
- Vercel disclosed unauthorized access to some internal systems after the compromise of third-party tool provider Context.ai. The attacker’s identity is unknown; someone using the ShinyHunters persona claimed responsibility.
- Authorities across multiple countries took down 53 domains, arrested four people and sent warnings to thousands of users in an operation targeting DDoS-for-hire services.
- The roundup describes campaigns involving the PowMix botnet, PHANTOMPULSE RAT delivered through Obsidian, and STX RAT distributed through trojanized CPUID downloads.
- A cluster of 108 Chrome extensions reportedly shares command-and-control infrastructure and collects user data while enabling ad injection and arbitrary JavaScript execution.
- Threat actors are abusing QEMU virtual machines for defense evasion and credential theft; one activity cluster may be preparing to deploy ransomware, according to Sophos.
- Four Android malware families—RecruitRat, SaferRat, Astrinox and Massiv—are reported to target users across more than 800 banking, cryptocurrency and social media applications.
- OpenAI announced GPT-5.4-Cyber for defensive workflows, including binary reverse engineering; the recap also lists vulnerabilities highlighted for the week.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering breaches, law-enforcement disruption, malware and fraud campaigns, and abuse of trusted software and infrastructure.
- Impact
- Vercel reported unauthorized access to certain internal systems and environment variables after an employee’s Context.ai account was compromised and their Google Workspace account taken over. The incident’s perpetrator is unknown; a threat actor using the ShinyHunters persona claimed responsibility. Other reports describe credential and data theft, financial fraud, malware deployment, and remote access activity. Authorities also took down 53 domains, arrested four people, and sent warnings to thousands of DDoS-for-hire service users.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | chromsterabrowser[.]com | Primary update domain embedded in the adware operation to retrieve an MSI installer; the source says it was unregistered and later sinkholed, and warns it could have enabled malicious updates if registered. |
MITRE ATT&CK
T1003 · OS Credential DumpingMimikatz was used to harvest credentials, and the attacker also attempted remote credential dumping.T1053.005 · Scheduled TaskPowMix established persistence using a scheduled task.T1059.001 · PowerShellA PowerShell script was used in the adware update operation to terminate processes and disable antivirus protections.T1078 · Valid AccountsThe Vercel attacker took over an employee’s Google Workspace account and later abused privileged accounts in a separate reported intrusion.T1110.003 · Password SprayingAn attacker launched a broad password-spraying campaign from a compromised IIS server.T1204.002 · Malicious FileVictims were tricked into opening a cloud-hosted Obsidian vault, leading to malware delivery.T1219 · Remote Access ToolsScreenConnect was installed for persistent remote access in reported intrusions.T1566.002 · Spearphishing LinkSMS phishing attacks used bogus links to steal company employees’ credentials.T1574.002 · DLL Side-LoadingDLL side-loading was used to deliver STX RAT and Direct-Sys Loader.T1620 · Reflective Code LoadingThe STX RAT attack used reflective PE loading as part of an in-memory payload chain.
CVE
People
Threat Actors
APT28The article says the campaign targeting email accounts of Ukrainian and other European officials is believed to be the work of APT28.Fancy BearThe article explicitly identifies Fancy Bear as an alternate name for APT28.MuddyWaterReportedly used targeted social engineering through Microsoft Teams, posing as IT support to get targets to run malware.ShinyHuntersA threat actor using the ShinyHunters persona claimed responsibility for the Vercel breach; the article says the incident’s perpetrator is not known.STAC3725Sophos reported that this activity cluster exploited Citrix Bleed 2 to gain a foothold, installed ScreenConnect, and used a QEMU VM for follow-on activity.STAC4713Sophos reported that this activity cluster used QEMU as a covert reverse SSH backdoor and harvested domain credentials; deployment of Payouts King ransomware was described as a likely goal.TeamPCPThe article reports that the hacking group partnered with Vect and that its supply-chain attack victims could be used to attack organizations.Tyler Robert BuchananPleaded guilty to conspiracy to commit wire fraud and aggravated identity theft; the Justice Department said he and others conspired to conduct cyber intrusions and virtual-currency thefts.VectDataminr reported that the ransomware group formalized partnerships intended to facilitate ransomware deployment and exploit victims of supply-chain attacks.
Malware
AstrinoxThe development comes as Zimperium flagged four new Android malware families, RecruitRat, SaferRat, Astrinox (aka Mirax), and Massiv, that are capable of harvesting sensitive information and facilitating unauthorizedCGrabberMulti-Stage Intrusion Drops Direct-Sys Loader and CGrabber Stealer —An attack chain involving ZIP archives distributed through GitHub user attachment URLs is abusing DLL side-loading to deliver a malware loader calledDinDoorby masquerading as IT support staff to trick them into running a botnet malware called Tsundere (aka Dindoor).DINODANCE“The attacker leveraged deno.exe to execute a highly obfuscated, Base64âencoded payload — tracked as DINODANCE — directly in memory, minimizing on-disk artifacts and complicating detection.” Once decoded, the malwareDirect-Sys LoaderMulti-Stage Intrusion Drops Direct-Sys Loader and CGrabber Stealer —An attack chain involving ZIP archives distributed through GitHub user attachment URLs is abusing DLL side-loading to deliver a malware loader calledLumma StealerHigh-profile incidents include the Vercel breach tied to Context.ai and campaigns delivering PHANTOMPULSE, STX RAT, Lumma Stealer, and widespread malicious Chrome extensions.Massivas Zimperium flagged four new Android malware families, RecruitRat, SaferRat, Astrinox (aka Mirax), and Massiv, that are capable of harvesting sensitive information and facilitating unauthorized financialMiraxcomes as Zimperium flagged four new Android malware families, RecruitRat, SaferRat, Astrinox (aka Mirax), and Massiv, that are capable of harvesting sensitive information and facilitating unauthorized financialPayouts KingSSH backdoor to deliver tooling and harvest domain credentials with the end goal of likely deploying Payouts King ransomware (likely tied to former BlackBasta affiliates) after obtaining initial access viaPHANTOMPULSEHigh-profile incidents include the Vercel breach tied to Context.ai and campaigns delivering PHANTOMPULSE, STX RAT, Lumma Stealer, and widespread malicious Chrome extensions.PowMixNewly Discovered PowMix Botnet Hits Czech Workers—An active malicious campaign is targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025.RecruitRatThe development comes as Zimperium flagged four new Android malware families, RecruitRat, SaferRat, Astrinox (aka Mirax), and Massiv, that are capable of harvesting sensitive information and facilitating unauthorizedSaferRatThe development comes as Zimperium flagged four new Android malware families, RecruitRat, SaferRat, Astrinox (aka Mirax), and Massiv, that are capable of harvesting sensitive information and facilitating unauthorizedSTX RATHigh-profile incidents include the Vercel breach tied to Context.ai and campaigns delivering PHANTOMPULSE, STX RAT, Lumma Stealer, and widespread malicious Chrome extensions.Tsundere BotnetMicrosoft Teams by masquerading as IT support staff to trick them into running a botnet malware called Tsundere (aka Dindoor).
Vendors
ConnectWiseFake Adobe Reader Site Drops ScreenConnect —Threat actors are using fake Adobe Acrobat Reader website lures to lure victims into installing ConnectWise’s ScreenConnect.Context.aiHigh-profile incidents include the Vercel breach tied to Context.ai and campaigns delivering PHANTOMPULSE, STX RAT, Lumma Stealer, and widespread malicious Chrome extensions.CPUIDCPUID Downloads Hijacked to Serve STX RAT—Unknown threat actors hijacked the official CPUID download page to serve trojanized installers that ultimately led to the deployment of STX RAT, a remote access trojan withGoogle“The attacker used that access to take over the employee’s Vercel Google Workspace account, which enabled them to gain access to some Vercel environments and environment variables that were not marked as ‘sensitive,’”MicrosoftCVE-2026-20186 (Cisco Identity Services Engine), CVE-2026-33032 (nginx-ui), CVE-2026-32201 (Microsoft SharePoint Server), CVE-2026-27304 (Adobe ColdFusion), CVE-2026-39813, CVE-2026-39808 (FortinetOpenAIOpenAI Launches GPT-5.4-Cyber—OpenAI announced a new model, GPT-5.4-Cyber, specifically designed for use by digital defenders.VercelHigh-profile incidents include the Vercel breach tied to Context.ai and campaigns delivering PHANTOMPULSE, STX RAT, Lumma Stealer, and widespread malicious Chrome extensions.
Products
Adobe Acrobat ReaderCVE-2026-6358, CVE-2026-5873 (Google Chrome), CVE-2026-34078 (Tails), CVE-2026-34622 (Adobe Acrobat Reader), CVE-2026-33413 (etcd), CVE-2026-1492 (User Registration & Membership plugin), CVE-2026-23818AndroidThe Pushpaganda campaign has been found to target the personalized content feeds of Android and Chrome users.AWSContext.ai also disclosed a March 2026 incident involving unauthorized access to its AWS environment.Context.aiHigh-profile incidents include the Vercel breach tied to Context.ai and campaigns delivering PHANTOMPULSE, STX RAT, Lumma Stealer, and widespread malicious Chrome extensions.Deno“A notable aspect of this intrusion was the abuse of Deno, a legitimate JavaScript and TypeScript runtime typically used for backend application development,” CyberProof said.Google ChromeHigh-profile incidents include the Vercel breach tied to Context.ai and campaigns delivering PHANTOMPULSE, STX RAT, Lumma Stealer, and widespread malicious Chrome extensions.Google DiscoverAI-Driven Pushpaganda Exploits Google Discover to for Ad Fraud—A novel ad fraud scheme has been found to leverage search engine poisoning (SEO) techniques and artificial intelligence (AI)-generated content to pushGoogle Workspace“The attacker used that access to take over the employee’s Vercel Google Workspace account, which enabled them to gain access to some Vercel environments and environment variables that were not marked as ‘sensitive,’”Microsoft Defender Antimalware PlatformThe threat actor subsequently used Impacket to enumerate the role assignments and other activities that were flagged and blocked by Microsoft Defender.Microsoft Entra Connectpredictive shielding was enabled in late July 2025, the attacker’s attempts to sign in to Microsoft Entra Connect servers were blocked.Microsoft TeamsMuddyWater Targets Global Organizations via Microsoft Teams —The Iranian hacking group known as MuddyWater has been observed using targeted social engineering to approach targets via Microsoft Teams by masquerading asObsidianObsidian Plugin Abuse Delivers PHANTOMPULSE RAT—A social engineering campaign has abused Obsidian, a cross-platform note-taking application, as an initial access vector to distribute a previously undocumented WindowsPrestaShopOver 200 PrestaShop Stores Expose Installer —More than 200 PrestaShop online stores have left their installation folder exposed online, allowing attackers to abuse the behavior to overwrite database configuration, gainQEMUBrowser extensions and common tools (e.g., ScreenConnect, QEMU) are abused for data exfiltration and defense evasion.Roundcube Webmailhacking campaign that it has been tracking since 2023, with the attacks weaponizing flaws in Roundcube webmail software to run malicious code as soon as a specially crafted message is opened.ScreenConnectBrowser extensions and common tools (e.g., ScreenConnect, QEMU) are abused for data exfiltration and defense evasion.SolarWinds Web Help Deskaffiliates) after obtaining initial access via exploitation of known security flaws in SolarWinds Web Help Desk, and STAC3725, which exploits Citrix Bleed 2 (aka CVE-2025-5777) for obtaining a foothold andVercelHigh-profile incidents include the Vercel breach tied to Context.ai and campaigns delivering PHANTOMPULSE, STX RAT, Lumma Stealer, and widespread malicious Chrome extensions.
Tools
AdaptixC2AdaptixC2 Detailed —Kaspersky has detailed the inner workings of an open-source command-and-control (C2) framework known as AdaptixC2, which has seen increased adoption by bad actors over the past year.ImpacketThe threat actor subsequently used Impacket to enumerate the role assignments and other activities that were flagged and blocked by Microsoft Defender.MalfixerCleafy has released an open-source tool called Malfixer to detect and fix malformed APKs.MimikatzThe attacker then performed reconnaissance, escalated their privileges, leveraged the compromised IIS service account to reset the passwords of high-impact identities, and deployed Mimikatz to harvest credentials.
Countries
BulgariaThe espionage activity also targeted officials in Romania, Greece, Bulgaria, and Serbia.CanadaThe infections are concentrated around the U.S., France, Canada, the U.K., and Germany.Czech RepublicNewly Discovered PowMix Botnet Hits Czech Workers—An active malicious campaign is targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025.FranceThe infections are concentrated around the U.S., France, Canada, the U.K., and Germany.GermanyThe infections are concentrated around the U.S., France, Canada, the U.K., and Germany.GreeceThe espionage activity also targeted officials in Romania, Greece, Bulgaria, and Serbia.IndiaIndia Will Not Require Smartphone Makers to Preload Aadhaar App —The Indian government will no longer require smartphone makers like Apple and Samsung to preload devices with a state-owned biometric identification app,ItalyAccording to Sansec, the affected stores span 27 countries, including France, Italy, Poland, and the Czech Republic.PolandAccording to Sansec, the affected stores span 27 countries, including France, Italy, Poland, and the Czech Republic.RomaniaThe espionage activity also targeted officials in Romania, Greece, Bulgaria, and Serbia.RussiaRussian Hackers Target Ukrainian Agencies —Threat actors linked to Russia broke into more than 170 email accounts belonging to prosecutors and investigators across Ukraine in recent months,” Reuters reported, citingSerbiaThe espionage activity also targeted officials in Romania, Greece, Bulgaria, and Serbia.SpainBritish National Pleads Guilty to Scattered Spider Campaign —Tyler Robert Buchanan, who was extradited from Spain to the U.S.Ukraineto Russia broke into more than 170 email accounts belonging to prosecutors and investigators across Ukraine in recent months,” Reuters reported, citing data from Ctrl-Alt-Intel.United StatesLaw Enforcement Operation Brings Down DDoS-for-Hire Operation—Law enforcement agencies across Europe, the U.S., and other partner nations cracked down on the commercial DDoS-for-hire ecosystem, targeting both operators
Industries
business process outsourcinginteractive entertainment companies, telecommunications companies, technology companies, business process outsourcing (BPO) and information technology (IT) suppliers, cloud communications providers, virtualCryptocurrencyremote access trojan called PHANTOMPULSE in attacks targeting individuals in the financial and cryptocurrency sectors.GovernmentState Service of Special Communications and Information Protection (SSSCIP) confirmed that local government agencies were targeted in a long-running hacking campaign that it has been tracking since 2023, withHealthcareThese included universities, OT networks, government entities, primary and secondary educational institutions, healthcare organizations, and multiple Fortune 500 companies.Payment servicesSQL Injection Campaign Targets Payment Services —An active SQL injection campaign is operating through attacker infrastructure located in Canada.real estateThe campaign has targeted 35 websites, with confirmed successful SQL injection exploitation and data exfiltration affecting three organizations operating in the payment, real estate, and developer service sectors.Technologyand intended victims included interactive entertainment companies, telecommunications companies, technology companies, business process outsourcing (BPO) and information technology (IT) suppliers, cloudTelecommunications“The victims and intended victims included interactive entertainment companies, telecommunications companies, technology companies, business process outsourcing (BPO) and information technology (IT) suppliers, cloud