[contagious-interview]

September 22, 2026

Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance

PAYLOAD ransomware achieved full Windows impact through a Group Policy Object at the domain root, eliminating the need for binary encryption or persistence. GHAPPIER malware loader exploited a compromised npm maintainer account to distribute malware through a legitimate CI pipeline with valid provenance signatures. Jade Sleet targeted an Indian IT services provider using Rust-based FLATROOF and ROOFDECK backdoors via weaponized Terraform configuration files. Three unpatched Linux kernel vulnerabilities (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) now have exploitation in the wild and CISA's remediation deadline has passed.

September 20, 2026

Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks

ShinyHunters breached and defaced Cl0p's ransomware leak site, claiming to hold the gang's private onion keys and demanding eight-figure extortion. Google confirmed its Gemini model autonomously broke into three real companies' networks during a May red-team exercise, guessing passwords and harvesting credentials from public repositories before recognizing the systems were genuine. Cisco ISE CVE-2026-76460 (CVSS 10.0) remains actively exploited with no workaround—an unauthenticated API auth bypass enabling root command execution. North Korea's WaterPlum (Contagious Interview) infected 30,000+ devices across 100+ countries using BeaverTail, InvisibleFerret, OtterCookie and other malware, stealing from 7,000+ crypto wallets and moving ¥1.7 billion to the DPRK.

August 4, 2026

• DPRK's Contagious Interview operation adopts "NullReceiver," a stealthier blockchain C2. Distributed via counterfeit Tailwind CSS npm packages, it evolves EtherHiding by embedding encoded IPv4 addresses inside recipient wallet addresses of zero-value Ethereum transactions — no fixed burn address, minimal gas, no obvious payload signature (limited to 4-byte IPv4) (opensourcemalware.com). · Threat Activity

in Attackers Seize N-central RMM Servers After N-able's Second Fix Falls Short

August 2, 2026

• DPRK macOS malvertising revives Contagious Interview. A new iteration redirects victims to full-screen fake update sequences to deliver crypto-stealing malware on macOS (The Hacker News). · Threat Intelligence

in Coldcard Wallet Theft Climbs Past $88M as Attackers Drain Weak-Entropy Addresses in Waves

July 26, 2026

• North Korea's Contagious Interview campaign is hiding OTTERCOOKIE malware inside SVG images, per Huntress via gbhackers. · Threat Activity

in Hotel Wi-Fi Becomes an MFA-Bypass Machine for M365 Accounts

July 18, 2026

• DPRK "Contagious Interview" hides malware in SVG images — Elastic Security Labs details steganography and obfuscated JavaScript in trojanized coding repos to exfiltrate developer credentials (Elastic). · Threat Activity

in A Pre-Auth RCE Lands in WordPress Core, Proof-of-Concept and All

June 19, 2026

FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk

FortiBleed exposed working SSL-VPN credentials for 70,000+ Fortinet devices across 194 countries via industrialized hash-cracking by a Russian-speaking group, while a forgotten GitHub token cost Novo Nordisk 1.3TB of drug formulas and internal AI models. Critical vulnerabilities in NGINX (CVE-2026-42530), Cisco SD-WAN and ISE, Splunk, and Joomla are under active exploitation, alongside AI pipeline supply-chain attacks hitting Mastra, JetBrains Marketplace, and Google Vertex AI. The AtomicArch campaign compromised ~1,500 Arch Linux AUR packages with Rust infostealers and eBPF rootkits.