Malware
NKAbuse
- First Reported
- Apr 16, 2026
- Latest Reported
- Apr 16, 2026
Reported Context (2)
- Attackers are exploiting a critical remote code execution flaw in the Marimo reactive Python notebook (CVE-2026-39987) to deploy a new variant of NKAbuse hosted on Hugging Face Spaces. Attackers exploit Marimo RCE to deploy NKAbuse variant via Hugging Face
- harvest credentials, run reverse shells, pivot to PostgreSQL/Redis, and deploy a previously undocumented NKAbuse variant hosted on a typosquatted HuggingFace Space. Sysdig Reports marimo CVE-2026-39987 Exploitation and NKAbuse Deployment via Typosquatted Hugging Face Space
CVE (1)
MITRE ATT&CK (12)
Vendors (2)
Products (4)
Tools (1)
Countries (9)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.