Profero

We take the 2am call on the worst day of your year, and we’re there every day before it. Here we share what we’ve learned along the way.
Rapid Incident Response

[Profero @ProferoSec]

🚨 Bookmark alert 🚨

1/ Are you using Grok? You need to read this.

Grok Bot’s sandbox accepts commands from anywhere on the internet after two checks. One is a password. The password is "local," the same for every customer.

From there, it’s root on the VM and your imported cookies in plaintext.

We told xAI and Cursor on Aug 24.
75+ days in...no reply.

Read the post by @GelosSnake >>>

[Profero @ProferoSec]

💡 What to do: Reset exposed passwords, revoke active sessions, and enforce MFA if you use services affected by Gootloader, CastleRAT, or StealC.

Some good news.

Europol and police from nine countries seized 235 servers and 257 domains behind Gootloader, CastleRAT, and StealC.

About 6.4M victim datasets were found on the seized systems, and the stolen credentials are being sent to notification services so victims can check their exposure.

[Profero @ProferoSec]

🚨Not great news for MUJI customers.

Parent company Ryohin Keikaku confirmed that attackers accessed 27M records, including 1.1M credit card numbers.

The CEO apologized and said the cards were stored without encryption and without a business need.

The online store is offline while customers are notified.

[Profero @ProferoSec]

💡 What to do: Patch Check Point Security Gateways against PHP2Shell and CVE-2026-123039 immediately and monitor for TSGA and destroy_v6 indicators.

Heads up if you run Check Point gateways.

Check Point Research says attackers have been exploiting PHP2Shell in unpatched Security Gateways since Oct 30.

The first wave targeted Israeli organizations, and a second wave on Nov 2 spread to multiple countries without destructive activity.

In the first wave, the attackers pivoted to VMware ESXi hosts and ran a wiper called destroy_v6.

Researchers say the destruction may be a smoke screen or false flag, and who is behind it is unconfirmed.

[Profero @ProferoSec]

🚨 Meet SCKit.

It’s malware that exploits ScreenConnect to target MSPs through support sessions and steals technician session cookies.

Huntress found it compromising 288 hosts in 90 minutes on Nov 12.

[Profero @ProferoSec]

💡What to do: Update all on-premises N-central deployments to version 2026.4 HF2 immediately to block unauthenticated exploitation.

Update on N-central.

Hackers are actively targeting the Able2Shell zero-days. N-able says all the flaws that can be exploited without authentication are now fixed in 2026.4 HF2.

It reports scanning activity tied to the public PoC but no compromise of hosted servers.

Defused notes that attackers opened anonymous agent sessions and accessed remote-control endpoints without authentication.

The remaining flaws need an authenticated account with elevated privileges and will be fixed in later hotfixes.

[Profero @ProferoSec]

💡 What to do: Scan your GitHub repositories for wfx-docs probe branches and rotate any exposed CI secrets or cloud credentials immediately.

This one’s for the DevOps folks.

Aikido says attackers hijacked 4,837 GitHub accounts to run a secret stealer called wfx-loot in 1,806 repositories, going after CI secrets and cloud credentials.

They created wfx-docs probe branches to check whether the payload ran.

Aikido warns that persistence may survive standard token rotation if you were compromised.

[Profero @ProferoSec]

💡 What to do: Verify all meeting requests through a separate channel and do not trust video feeds alone when receiving urgent requests from known contacts.

Update on Binance.

The US Justice Department announced coordinated actions against North Korean hacking groups, seizing cloud infrastructure and more than $1.2B in crypto stolen from Binance.

The FBI attributes that theft to TraderTraitor, and separately links a scheme called FaceStealer to over $400M in losses across crypto and Web3 over 18 months.

The attackers hijack Telegram, LinkedIn, Slack, and Discord accounts to invite targets to video meetings on fake Zoom and Teams sites.

The seized infrastructure held more than 900 secretly recorded webcam videos, used to impersonate victims in follow-on attacks.

[Profero @ProferoSec]

💡What to do: Check if your systems run Openwave Webtop Media Transcoder version 1.1.22.0 or Cisco BroadWorks before version RI.2026.07, and apply the relevant patches immediately.

This one’s for the telecom folks.

CISA added two actively exploited flaws to KEV: Openwave Webtop Media Transcoder (CVE-2026-111793) and Cisco BroadWorks (CVE-2026-20320).

The BroadWorks flaw lets remote attackers read sensitive configuration information without authentication.

Malbear Labs says a Chinese-speaking threat actor has been exploiting it in a broad campaign, and at least 13 organizations may have been targeted.

[Profero @ProferoSec]

💡What to do: Verify that all Office installations have applied the latest updates to patch CVE-2026-124194 and ensure Windows PCs are running Security Update KB5132061.

More on yesterday’s Outlook zero-day (CVE-2026-124194).

Microsoft’s November Patch Tuesday fixes more than 1,000 vulnerabilities.

One of them is CVE-2026-116928, a CVSS 9.8 flaw in the Windows Search Component that allows code execution if Exchange Server processes a malicious email attachment for indexing.

No active exploitation has been reported, but it requires no user interaction.

[Profero @ProferoSec]

💡 What to do: Monitor communications from Maersk partners for phishing attempts that reference the leaked driver records or IMEI numbers.

Update on Maersk from the weekend.

Maersk confirmed a data breach involving systems from its acquired LF Logistics unit, after WhiteArmor demanded $5M.

WhiteArmor claims it has about 100GB of data, including over 16,000 driver passwords stored without encryption and 33 SUPER_ADMIN accounts.

Maersk says the incident is isolated to a local system, no sensitive data has been disclosed to date, and operations continue as usual.

WhiteArmor gave them 30 days to pay.

[Profero @ProferoSec]

Quick one.

Over 35,000 Grok-built apps are exposed online, and some of them are leaking confidential data and passwords.

🚨 In case you haven't read our findings, you can find them here: https://t.co/P29MSkUZm7

[Profero @ProferoSec]

🚨 Bookmark alert 🚨

1/ Are you using Grok? You need to read this.

Grok Bot’s sandbox accepts commands from anywhere on the internet after two checks. One is a password. The password is "local," the same for every customer.

From there, it’s root on the VM and your imported cookies in plaintext.

We told xAI and Cursor on Aug 24.
75+ days in...no reply.

Read the post by @GelosSnake >>>

[Profero @ProferoSec]

Yesterday we posted about LLMJacking. Today, Railway says stolen AI keys led to an estimated $740,000 in unauthorized usage charges.

[Profero @ProferoSec]

💡 What to do: Review CloudTrail logs from October 1 for Qubole role assumptions and revoke any stale trust relationships.

Heads up if you ever used Qubole.

Wiz and Sentra found that attackers used stolen Qubole credentials to get into dozens of AWS environments.

Between Oct 14 and Oct 26 they used the legitimate permissions customers had granted Qubole to assume customer roles.

One victim lost millions of files, and another had dozens of passwords and keys stolen within minutes.

Researchers noted that many organizations still had those permissions in place after they stopped using Qubole.

AWS says there was no direct breach of its services, and Qubole hasn’t issued a statement yet.

[Profero @ProferoSec]

We're sure you have all been in this situation:

Someone builds an app over the weekend with an AI assistant. Leadership loves the demo. Then security shows up and gets blamed for slowing it down.

@barnhartguy on why the cheapest fix is a 30-minute review before the exec demo.

https://t.co/RiQJz4sUw4

[Profero @ProferoSec]

Amplifon Americas disclosed a breach in which attackers copied files between Jan 18 and Feb 8, 2026.

A Texas Attorney General filing lists about 1,332,826 people affected. The data includes names, contact details, government IDs, hearing and medical information, health insurance details, and, for some people, SSNs or financial data.

What to do: If you exchange data with Amplifon Americas, monitor for phishing attempts quoting leaked health or financial details.

[Profero @ProferoSec]

👀 Keeping an eye on LLMJacking.

Mandiant reported that LLMJacking incidents in 2026 have caused cumulative charges of up to $1M at some organizations before access was revoked.

What to do: Review your API usage logs for sudden spikes in billing charges and rotate any secrets or tokens associated with third-party AI inference providers.

[Profero @ProferoSec]

This one’s for the virtualization folks.

Vates confirmed active exploitation of an auth bypass in Xen Orchestra, VSA-2026-062.

With network access to the management interface, an attacker can log in without credentials using a crafted cookie containing an empty JSON object and then gain full root access on XCP-ng hosts.

Exploitation leaves no identifiers in logs, so you need HTTP monitoring to detect it.

What to do: Update Xen Orchestra to version 6.9.1 or 6.10.0 immediately and monitor HTTP logs for authenticationToken=j:%7B%7D.

[Profero @ProferoSec]

Quick one.

Google patched Chrome’s eighth actively exploited zero-day of 2026, CVE-2026-125350, a use-after-free in the XML component.

If an extension blocks the update, you may need to update manually.

What to do: Update all Chrome browsers to version 157.0.8103.50 immediately by checking the About Google Chrome menu or the Google Play Store.

[Profero @ProferoSec]

Microsoft patched an actively exploited Outlook zero-day, CVE-2026-124194.

If a user opens a crafted message file, Outlook connects to an attacker-controlled location without showing the usual external-content warning, leaking the user’s NTLMv2 hash.

The fix comes in specific Office updates, not in the standard Windows patches alone.

What to do: Verify Office build numbers across your fleet and apply the specific November Office updates to patch CVE-2026-124194.

[Profero @ProferoSec]

Heads up if you run N-central.

N-able took its hosted environment offline on Nov 10 after a researcher published more than 30 alleged zero-days on GitHub under the name Able2Shell.

He released PoC code for every flaw and described four exploit chains. N-able says it has no evidence the vulnerabilities were exploited in its environments before disclosure, and a hotfix is expected.

What to do: Monitor official N-able channels for the N-central hotfix release, and delay restoring on-premises environments until patches are applied.