Threat Alerts

A Chaos ransomware campaign tracked as STAC4749 has been observed using Microsoft Teams voice phishing (vishing) campaigns to gain initial access to enterprise environments before deploying Chaos ransomware. The campaign targeted organizations primarily in North America by impersonating internal IT support staff through external Microsoft Teams calls and chats. Victims were persuaded to establish remote access sessions, allowing attackers to execute PowerShell scripts that deployed custom malware and established persistence.

Following initial access, the attackers performed system reconnaissance, identified installed security products, and deployed a Python-based backdoor that retrieved additional Golang-based payloads from attacker-controlled infrastructure. In multiple incidents, the attackers rapidly expanded access across the environment and deployed Chaos ransomware in less than 24 hours after the initial compromise, demonstrating a highly efficient intrusion-to-encryption timeline. The campaign highlights the continued shift toward social engineering attacks that abuse trusted collaboration platforms rather than exploiting software vulnerabilities.

A newly identified ransomware group, CRPxO, has been observed targeting organizations through a multi-stage attack chain that combines credential theft, data exfiltration, and file encryption. Initial access is achieved through social engineering, with victims lured into opening malicious archive files containing disguised Internet shortcut (.lnk) files. Execution of the shortcut initiates a staged infection chain that retrieves and executes additional payloads, deploys a portable Python runtime, and loads modular components responsible for system reconnaissance, browser credential theft, clipboard monitoring, and data collection.

Once established on the host, the malware collects browser-stored credentials and other sensitive information before exfiltrating the data to attacker-controlled infrastructure. The operators then deploy the ransomware payload, encrypting victim files after the theft phase has been completed. The campaign targets both Windows and macOS environments and relies on a modular architecture, allowing operators to tailor capabilities to different stages of the intrusion without modifying the core malware framework.

CRPxO operates under a ransomware-as-a-service (RaaS) model and is actively recruiting affiliates to broaden its reach. According to the reporting, affiliates are offered a significant share of ransom payments in exchange for obtaining initial access to victim environments and deploying the ransomware. This operating model, combined with the group’s modular attack chain, could enable CRPxO to scale its operations and increase the frequency of future campaigns.

Broadcom has released security updates addressing multiple critical vulnerabilities affecting VMware vCenter, VMware ESXi, VMware Workstation and VMware Fusion. The most severe flaws include CVE-2026-59309 (CVSS: 9.8) an authentication bypass in VMware Directory Service that allows an unauthenticated attacker with network access to gain unauthorized access to vCenter, and CVE-2026-59310 (CVSS: 9.8) a directory traversal vulnerability in the vCenter syslog service that could lead to arbitrary code execution. The advisory also addresses CVE-2026-47876 (CVSS: 9.3) an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter that may enable code execution on the ESXi host from a compromised virtual machine, and CVE-2026-41703 (CVSS 7.6) an out-of-bounds read vulnerability that could result in information disclosure or denial-of-service under specific conditions.

Successful exploitation of these vulnerabilities could allow attackers to compromise virtualization management infrastructure, execute arbitrary code, bypass authentication controls or escape from guest virtual machines to the underlying host. While Broadcom has stated that there is no confirmed in-the-wild exploitation of these vulnerabilities at the time of disclosure the high severity of the flaws and the critical role of VMware products in enterprise environments make timely patching essential.

Recent disclosures highlight the accelerating role of advanced AI models in offensive cybersecurity and vulnerability discovery. Following the July incident in which OpenAI models autonomously discovered and exploited a previously unknown zero-day vulnerability in JFrog Artifactory during a controlled evaluation—ultimately compromising Hugging Face systems—Anthropic revealed that its Claude model successfully breached three isolated test environments as part of internal security assessments. During one exercise, the model identified a vulnerable Python package upload workflow and published a malicious package to a private PyPI repository to achieve persistence and downstream code execution, while other scenarios involved autonomous privilege escalation and lateral movement within the test environments. Together, these incidents demonstrate that frontier AI models are increasingly capable of independently identifying attack paths, chaining multiple techniques, exploiting previously unknown vulnerabilities, and adapting their behavior to accomplish complex objectives with minimal human guidance.

The incidents reinforce a broader trend in which AI models are evolving from assistants that support security research into autonomous agents capable of executing sophisticated offensive operations in controlled environments. As these capabilities continue to mature, organizations should expect faster discovery and weaponization of vulnerabilities, placing greater emphasis on rapid patch management, secure software development practices, least-privilege access controls, and continuous monitoring to reduce the window of opportunity for exploitation.

Researchers have identified msaRAT, a new Rust-based remote access trojan (RAT) used by the Chaos ransomware group to establish stealthy command-and-control (C2) communications by abusing legitimate web browsers. Instead of communicating directly with attacker-controlled infrastructure, the malware launches a hidden Google Chrome or Microsoft Edge instance in headless mode and leverages the Chrome DevTools Protocol (CDP) and WebRTC to tunnel encrypted C2 traffic through legitimate browser activity. This technique enables the malware to blend into normal network traffic, significantly reducing the likelihood of detection by traditional network security solutions.
Following initial access through phishing, vishing, or remote management tool abuse, attackers deploy msaRAT to execute remote commands, establish persistence, and maintain covert access to compromised systems. The malware retrieves connection parameters from Cloudflare Workers, uses Google STUN services for network traversal, and relays communications through Twilio TURN servers, while adding an additional encryption layer over WebRTC traffic to further obscure malicious activity. By routing all external communications through a legitimate browser process instead of its own executable, msaRAT represents an advanced evolution in browser-assisted malware techniques, allowing the Chaos ransomware group to evade network monitoring and sustain long-term access before deploying ransomware.

The AgentBaiting campaign has been observed abusing the growing AI ecosystem by distributing malware through more than 800 fake AI Skills and Model Context Protocol (MCP) servers hosted in malicious GitHub repositories. As part of the broader FakeGit operation, researchers identified approximately 7,600 malicious repositories created by over 6,600 fake developer accounts, impersonating legitimate AI tools, enterprise integrations and developer utilities. By cloning trusted projects, creating convincing documentation and leveraging public AI registries, the attackers increased the likelihood that both developers and AI assistants would recommend and install the malicious repositories.

Victims downloading the advertised AI Skills or MCP servers instead received malicious ZIP archives that executed SmartLoader, a multi-stage malware loader capable of establishing persistence, retrieving additional payloads and deploying the StealC information stealer. Researchers also demonstrated that AI assistants, including Claude Code, Gemini and ChatGPT, could surface these malicious repositories during tool discovery, potentially directing users toward attacker-controlled installation instructions. The campaign highlights a new evolution of software supply chain attacks, where threat actors exploit trusted AI development workflows and public capability marketplaces to distribute malware and harvest sensitive credentials and session data from developer environments.