Weekly Threat Digest: 03 to 09 August 2026

CVE-2026-63077, a critical unauthenticated RCE in JetBrains TeamCity On-Premises, is under active exploitation to hijack build servers and expose CI/CD credentials.

A macOS ClickFix campaign used fake CAPTCHA prompts to install a Go-based stealer that drains cryptocurrency wallets a fraction at a time to evade notice.

XCSSET returned in a stealthier v40 build that blocks macOS security updates while spreading through poisoned Xcode projects.

ChainDrop, a self-propagating Shai-Hulud npm worm, poisoned the keyv package family within hours, weaponizing over two billion monthly installs to steal developer and cloud credentials.

Mirage Kitten (UNC1549), an Iranian state-backed group, deployed the NightLedger backdoor and custom tunnelers against defense and government targets across the Middle East, Africa, and South Asia.

CVE-2026-18577 is being exploited to bypass authentication in N-able N-central, giving attackers full admin control and a pivot into managed domain controllers.

NightLedger is a previously undocumented Windows backdoor. It masquerades as SspiCli.dll and is designed for DLL search-order hijacking against the legitimate AppVShNotify.exe, abusing the fact that RPCRT4.dll can delay-load SspiCli.dll during authenticated RPC calls, while forwarding expected exports to the real DLL. A UUID-style mutex enforces a single running instance. Functionally, it adds screenshot capture and collection of NetSetup.log on top of TWOSTROKE's core command set.

BridgeHead is a custom WebSocket-based tunneling tool, observed as a side-loaded DLL unbcl.dll under %LocalAppData%\Microsoft\VisualStudio on an Egyptian host, and libwinpthread-1.dll inside a univpn directory in a Pakistan-based environment. Before activating, it dynamically resolves GetUserNameA from advapi32.dll, lowercases the current Windows username, and checks it for a hardcoded substring; if the match fails, it exits — evidence of prior internal reconnaissance, per-target tailoring of each binary, and an anti-sandbox guard.

ArcBridge is a custom WebSocket tunneling tool, first identified in April 2026 in activity against victims in the Middle East. On execution it creates a mutex to enforce single-instance execution using the same UUID-style naming convention matching the NightLedger backdoor and reinforcing common authorship.

ChainDrop is a self-propagating Shai-Hulud npm worm that harvests developer and cloud credentials via a malicious preinstall hook, then reuses stolen tokens to republish itself across additional packages and repositories. Exfiltrated data is RSA-encrypted and routed through an Ethereum smart contract (EtherHiding) for C2 rotation.

FDMTP is a backdoor malware that lets attackers secretly control an infected Windows computer. It first checks the victim's device to make sure it's a real target, then quietly reports back details like the computer's username, installed antivirus, and network info to the attacker's server. From there, it can download more malicious tools, stay hidden using scheduled tasks and registry tricks, and give the attacker ongoing access to spy on or further compromise the system.

XCSSET is a modular macOS malware family that infects Xcode projects and executes when the project is compiled, active since August 2020. The latest version, v40, has been tracked since mid-April 2026 across two waves, adding polymorphic payloads, fileless persistence, a Chrome backdoor, and a Telegram trojanizer.

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability. Affects N-able N-central before 2026.3.1.7. CWE-288. Associated TTPs: T1190 Exploit Public-Facing Application, T1057 Process Discovery.

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability. Affects N-able N-central before 2026.2. CWE-288. Associated TTP: T1190 Exploit Public-Facing Application.

Ruby on Rails Active Storage Arbitrary File Read Vulnerability (KindaRails2Shell). Affects Ruby on Rails Active Storage, all versions before 7.2.3.2; version 8.0 and later before 8.0.5.1; and version 8.1 and later before 8.1.3.1. CWE-1188. Associated TTPs: T1203 Exploitation for Client Execution, T1059 Command and Scripting Interpreter, T1083 File and Directory Discovery, T1005 Data from Local System.

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability. Affects JetBrains TeamCity On-Premises, all versions before 2025.11.7 and before 2026.1.3. CWE-502. Associated TTPs: T1190 Exploit Public-Facing Application, T1195 Supply Chain Compromise, T1059 Command and Scripting Interpreter.

Also known as: UNC1549, TA455, Smoke Sandstorm, Bohrium, DEV-0056, Yellow Dev 13, Subtle Snail, Nimbus Manticore, Screening Serpens, GalaxyGato.

Targeted Industries: Aerospace, Aviation, Defense, Telecommunications, Government, Financial Services, Small and Medium-Sized Business.

Associated Malware: NightLedger, BridgeHead, ArcBridge, affecting Windows platforms.

Targeted Regions: Cameroon, Sudan, Iran, Iraq, Seychelles, Ghana, India, Turkey, Comoros, Central African Republic, Yemen, Guinea, Madagascar, Equatorial Guinea, Saudi Arabia, Malawi, Kuwait, Bhutan, Sri Lanka, United Arab Emirates, Palestine, Liberia, Bangladesh, Mauritania, Oman, Morocco, Lesotho, Tanzania, Bahrain, Angola, Syria, Mali, Nepal, Mauritius, Guinea-Bissau, Senegal, South Africa, Cyprus, Gabon, Algeria, Burundi, Egypt, Libya, Pakistan, Qatar, Nigeria, Togo, Lebanon, Botswana, Israel, Uganda, Zambia, Maldives, Namibia, Ethiopia, Afghanistan, Chad, Ivory Coast, La Reunion, Cape Verde, Jordan, Tunisia, Niger, Rwanda, Kenya, Djibouti, Akrotiri and Dhekelia, Burkina Faso, Democratic Republic of Congo, Zimbabwe.

TTPs: TA0042 Resource Development, TA0001 Initial Access, TA0002 Execution, TA0005 Defense Evasion, TA0007 Discovery, TA0009 Collection, TA0010 Exfiltration, TA0011 Command and Control, T1583 Acquire Infrastructure, T1566 Phishing, T1204 User Execution, T1129 Shared Modules, T1059 Command and Scripting Interpreter, T1574 Hijack Execution Flow, T1497 Virtualization/Sandbox Evasion, T1027 Obfuscated/Encoded Files or Information, T1036 Masquerading, T1082 System Information Discovery, T1083 File and Directory Discovery, T1057 Process Discovery, T1113 Screen Capture, T1005 Data from Local System, T1583.001 Domains, T1583.006 Web Services, T1566.002 Spearphishing Link, T1204.002 Malicious File, T1574.002 DLL, T1497.001 System Checks, T1036.005 Match Legitimate Resource Name or Location, T1071 Application Layer Protocol, T1572 Protocol Tunneling, T1090 Proxy, T1105 Ingress Tool Transfer, T1041 Exfiltration Over C2 Channel, T1071.001 Web Protocols.