ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and
This week's ThreatsDay bulletin highlights a variety of security concerns affecting multiple industries. A tool designed to steal data has been discovered, adding an unnecessary element of scare tactics for victims. Additionally, vulnerabilities have been exploited, including CVE-2026-0257 in PAN-OS GlobalProtect and Prisma Access, which can allow malicious activity to go unnoticed.
Qilin and Settra ransomware groups are actively targeting organizations using CVE-2026-0257. Organizations are advised to upgrade affected systems, disable authentication override cookies, terminate active GlobalProtect sessions, and investigate unexpected connections. Russia has been using hybrid, asymmetric warfare tactics against European nations, testing defensive capabilities, degrading critical infrastructure, and instilling fear to undermine the enemy's response.
Infoblox revealed a DNS wallet-drainer kit called Noir that uses DNS TXT records to locate its pool, hosted on Cloudflare Pages. The kit does not require a seed phrase, password, or private key to perform theft. A Rust-based remote access trojan, CikaBika Bot, has been observed being delivered via document-themed lures containing malicious LNK files and PDFs with embedded payloads.
The malware utilizes a Nim loader, PowerShell UAC bypass, DLL search-order hijacking, and Discord for Command and Control, reconnaissance, remote execution, and data exfiltration.
A Windows remote access trojan, KGB RAT, has been marketed on underground forums since late 2025, boasting features such as a built-in crypter, HVNC, credential theft, ransomware, and psychological harassment capabilities. The threat actor behind KGB RAT has been developing and testing the malware for years before releasing it. Additionally, a multi-stage infection chain on Windows has discovered a previously undocumented .NET RAT with live screen surveillance capability.
Google has implemented multi-layered protections across Google Messages and third-party messaging apps to protect Android users from scams, including enhanced Scam Detection with Private AI Compute and redesigned warnings for unfamiliar links.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
