Week in review: Gyazo breach exposes 23.6M user records, TASK#STOMP steals documents
Summary
This cybersecurity roundup covers Gyazo's confirmed breach affecting about 23.62 million user records, TASK#STOMP malware, exploited ZyXEL and Check Point flaws, Microsoft's disruption of EvilTokens, and other security developments.
Key points
- Helpfeel confirmed attackers exploited a vulnerability in Gyazo's image-upload server, stealing about 23.62 million user records and metadata tied to hundreds of millions of images.
- TASK#STOMP is a Windows backdoor that steals documents, Wi-Fi passwords and clipboard text, takes screenshots, and can execute operator commands.
- GreyNoise reported that a Chinese-speaking threat actor exploited CVE-2026-7273 in unpatched ZyXEL switches and exfiltrated data from 996 devices across 48 countries.
- Microsoft and partners disrupted EvilTokens, a phishing service reported to have compromised more than 12,000 inboxes at over 10,000 organizations.
- Check Point issued emergency fixes for a critical Management Server vulnerability exploited since July; a separate patched Security Gateway flaw was also reportedly probed.
- Other coverage included a DarkMe malware campaign distributed through phishing emails, an Android banking trojan targeting customers of more than 30 banks, and security fixes in WordPress, GNOME, and NetBSD.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering malware activity, exploitation of vulnerabilities, phishing-service disruption, data breaches, and other security developments.
- Impact
- Reported incidents include theft of approximately 23.62 million Gyazo user records and metadata associated with hundreds of millions of images; data exfiltration from 996 ZyXEL switches across 48 countries; and compromise of more than 12,000 inboxes at over 10,000 organizations through the EvilTokens phishing service. The roundup also reports exploitation of Check Point vulnerabilities and attacks involving other products and organizations.
CVE
CVE-2026-7273Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)CVE-2026-851022026. The company also confirmed that a pre-authentication remote code execution (RCE) vulnerability (CVE-2026-85102) in Check Point (Quantum) Security Gateway for which it released patches on September 9, 2026,CVE-2026-87902WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)CVE-2026-93616Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back as July 23, 2026. The company also confirmed that a
People
Andy BurnhamUK Prime Minister who announced plans for a National Centre for Information Defence.Ariel AssarafCEO of Coralogix, interviewed about AI-agent guardrails.Guilherme JoventinoCOO of MIGNOW, interviewed about SAP ECC migration.Kelly HerrellCEO of Nol8, interviewed about AI-agent data exposure.
Threat Actors
Malware
DarkMeDarkMe RAT trades zero-days for plain phishing emailsMacSyncMacSync info-stealing malware hides malicious commands in an iCloud calendarRemControlNew Android malware RemControl steals banking PINs and blocks removal attemptsTASK#STOMPTASK#STOMP steals files, Wi-Fi passwords, screenshots, and clipboard data from Windows systems.
Vendors
Check Point SoftwareCheck Point Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back as July 23, 2026. The company also confirmed that aGoogleabuse, and large-scale data breaches affecting organizations such as ZyXEL, Check Point, Elsevier, Google, and Microsoft.HelpfeelJapanese software company Helpfeel has confirmed a data breach on its screenshot-sharing platform Gyazo, in which attackers exploited a vulnerability in its image upload server, stealing approximately 23.62 million userMicrosoftand large-scale data breaches affecting organizations such as ZyXEL, Check Point, Elsevier, Google, and Microsoft.WordPressWordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)Zyxelphishing schemes, AI-agent abuse, and large-scale data breaches affecting organizations such as ZyXEL, Check Point, Elsevier, Google, and Microsoft.
Products
BIG-IP APMAttackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instancesCheck Point (Quantum) Security Gatewaythat a pre-authentication remote code execution (RCE) vulnerability (CVE-2026-85102) in Check Point (Quantum) Security Gateway for which it released patches on September 9, 2026, started getting probed a few daysCheck Point Management ServerCheck Point Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back as July 23, 2026. The company also confirmed that aEvilTokens#TASKSTOMPGyazo#TASKSTOMPWordPressWordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)ZyXEL GS1900 Smart Managed SwitchesA Chinese-speaking threat actor has exploited a vulnerability (CVE-2026-7273) in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data from 996 devices across 48 countries, GreyNoise reported
Tools
Cairnan open-source framework that they hope will be used to classify and analyze the threat. The tool, called CAIRN, works entirely from metadata pulled off files. No downloading the malware, no running it.ScreenConnecthave never released one, Allure Security have found. Anyone who runs the installer gets a copy of ScreenConnect, a legitimate remote access tool, configured to let the attacker control the computer without the user
Countries
AustraliaOpenAI agent hacking spree widens to Australia, targeting government websiteCanadathat the malware targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada and some Gulf states.China80,000 relay servers help users in China slip past U.S. AI region bansFrancehas found. Researchers confirmed that the malware targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada and some Gulf states.Italyacross 48 countries, GreyNoise reported on Monday. The affected switches are predominantly located in Italy, the US, Taiwan, South Korea, and a number of EU countries.PolandResearchers confirmed that the malware targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada and some Gulf states.Portugalconfirmed that the malware targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada and some Gulf states.South Koreareported on Monday. The affected switches are predominantly located in Italy, the US, Taiwan, South Korea, and a number of EU countries.Spainfound. Researchers confirmed that the malware targets customers of more than 30 banks in Italy, France, Spain, Poland, Portugal, Canada and some Gulf states.TaiwanGreyNoise reported on Monday. The affected switches are predominantly located in Italy, the US, Taiwan, South Korea, and a number of EU countries.
Industries
Academic publishingThree domains / web portals belonging to Dutch academic publishing company Elsevier have been redirecting users to a page branded “LAPSUS$ GROUP, Chapter II,” carrying a signed statement that taunted the FBI and countedCryptocurrencythat has previously been associated with a threat group that targeted financial market traders and cryptocurrency users, has been spotted again. This time around, its distribution has been simplified: instead of