Loki Intelligence — Security Briefs · Published
Daily Security Brief: EDR Killers, DPRK Developer Lures, and Exploited Zyxel Switches
Today's risk centers on social engineering aimed at developers and everyday users that delivers stealers, backdoors and security-tool killers, alongside an actively exploited Zyxel switch flaw. Teams should verify software download sources, harden developer endpoints, restrict risky script and driver execution, and patch Zyxel GS1900 firmware.
Signal 01 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. CISA urges all organizations to make catalog entries a priority in risk-based vulnerability management, not only the federal agencies bound by its directive.
Why it matters: Find GS1900 switches in your inventory, apply Zyxel's fixed firmware, and keep switch management interfaces reachable only from trusted administrative networks.
Source: CISA
Signal 02 · The Hacker News
Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
LastPass and Delphos Labs found a fake LastPass Authenticator page on GitHub delivering a loader that installs a Microsoft-attested but abusable kernel driver to terminate 145 security processes before a password stealer runs. The renamed driver had zero antivirus detections and was missing from Microsoft's vulnerable driver blocklist; LastPass systems were unaffected.
Why it matters: Download software only from vendor sites or official stores, enforce driver blocklist and application control policies, and hunt for driver loads followed by security tools being killed.
Source: The Hacker News
Signal 03 · The Hacker News
Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
A joint advisory from Japanese, U.S., Australian and German agencies says North Korea's Contagious Interview campaign has compromised at least 30,000 devices in more than 100 countries and stolen at least $10.71 million in cryptocurrency. Attackers pose as recruiters and use coding tests to install malware such as BeaverTail and InvisibleFerret.
Why it matters: Warn developers about recruiter-supplied coding tests, run untrusted projects in isolated environments, and strengthen identity checks for remote hires to catch IT worker fraud.
Source: The Hacker News
Signal 04 · The Hacker News
Google Fined €403 Million Over GDPR Violations Tied to Location Data
Ireland's Data Protection Commission fined Google €403 million for GDPR breaches in how Web & App Activity, Location History and Location Accuracy handled location data between May 2018 and February 2020, citing lawfulness, transparency and retention failures. Google must bring processing into compliance within six months and can appeal.
Why it matters: Teams processing location or behavioral data should document lawful bases, make settings transparent, and enforce retention limits they can demonstrate to regulators.
Source: The Hacker News
Signal 05 · The Hacker News
TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data
Securonix detailed TASK#STOMP, a campaign in which an encoded VBScript creates scheduled tasks and Startup folder persistence, then launches PowerShell modules that steal documents, Wi-Fi passwords and clipboard data, capture screenshots and run remote commands over redundant C2 servers. The initial access route is unclear, possibly phishing or social engineering.
Why it matters: Monitor wscript and hidden PowerShell activity, review new scheduled tasks with system-like names, and restrict Windows Script Host where business needs allow.
Source: The Hacker News
Signal 06 · The Hacker News
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Blackpoint documented ChainScript, a Node.js-based remote access trojan spread through ClickFix lures and fake Spotify, Zoom or Teams installers, which locates its WebSocket servers through a Polygon smart contract. Separately, a hijacked HBO Max Reddit account served malicious ads pushing ClickFix attacks that installed stealers on Windows and macOS.
Why it matters: Teach users never to paste commands from web pages into Run dialogs or Terminal, and alert on msiexec, PowerShell or Node.js launched from unusual user directories.
Source: The Hacker News
Signal 07 · The Hacker News
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
SentinelOne linked North Korea's Jade Sleet to a breach of an Indian IT services firm involving FLATROOF and ROOFDECK, Rust-based macOS backdoors previously seen in the KelpDAO attack. The group uses fake job interviews with Terraform project repositories whose lock files pull attacker-controlled modules when developers run terraform init.
Why it matters: Treat developer laptops as high-value endpoints: review Terraform lock files and provider sources before running init, and monitor macOS hosts for unknown Launch Agents.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.