⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
A suspected China-nexus APT exploited CVE-2026-59310 (CVSS 9.8), a critical VMware vCenter directory-traversal flaw, deploying a backdoor, reverse SSH binary, and Babuk-derived ransomware as a forensic distraction Lazarus Group leveraged CVE-2026-68820 (CVSS 7.0), a Windows AFD.sys privilege escalation zero-day, to deliver a novel backdoor called "Troy" and ForestTiger targeting defense/aerospace firms across four countries under Operation Dream Job Apple macOS Screen Sharing authentication bypa
Analysis
TL;DR
- A suspected China-nexus APT exploited CVE-2026-59310 (CVSS 9.8), a critical VMware vCenter directory-traversal flaw, deploying a backdoor, reverse SSH binary, and Babuk-derived ransomware as a forensic distraction
- Lazarus Group leveraged CVE-2026-68820 (CVSS 7.0), a Windows AFD.sys privilege escalation zero-day, to deliver a novel backdoor called "Troy" and ForestTiger targeting defense/aerospace firms across four countries under Operation Dream Job
- Apple macOS Screen Sharing authentication bypass (CVE-2026-65400, CVSS 9.8) is actively exploited in the wild to gain root access and deploy Monero crypto miners, with port 5900 exposure cited as a key enabler
- Amnesia Stealer represents a significant escalation in macOS malware, combining Chromium profile cloning with Chrome DevTools Protocol (CDP)-based real-time interactive browser control at ~3fps, marking the first documented case of its kind
- GeoServer patched an un-CVE'd critical SQL injection leading to RCE after active exploitation was observed within hours of responsible disclosure, highlighting the risks of premature vulnerability exposure
Why It Matters
This week's threat landscape demonstrates that the most damaging attacks continue to stem from foundational infrastructure flaws—unpatched services, exposed ports, and weak authentication—rather than sophisticated novel techniques. For AI practitioners, the GhostSplice technique targeting AI coding assistants and MCP tools signals that the supply chain of AI-assisted development is becoming a new attack surface, while the Amnesia Stealer's use of CDP-based browser automation illustrates how legitimate developer protocols can be weaponized for interactive session hijacking.
Technical Details
- CVE-2026-59310: Critical directory-traversal vulnerability in VMware vCenter (CVSS 9.8) allowing unauthenticated remote code execution; exploited by China-nexus APT to deploy backdoors and ransomware as an anti-forensic smoke screen
- CVE-2026-68820: Privilege escalation flaw in Windows Ancillary Function Driver for WinSock (AFD.sys, CVSS 7.0); patched in August 2026 Patch Tuesday; weaponized by Lazarus Group to deliver Troy backdoor and ForestTiger malware
- CVE-2026-65400: Critical authentication bypass in macOS Screen Sharing (CVSS 9.8) allowing credential-less access to VNC service on port 5900; emergency patches released for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9
- Amnesia Stealer: First macOS malware to clone Chromium profiles with authenticated sessions and use Chrome DevTools Protocol (CDP) over dual WebSocket channels—one to attacker relay, one to local headless Chromium—to provide live interactive browser control with screencast at ~3fps and full input emulation
- GhostSplice: Emerging attack technique that bypasses AI coding assistant guardrails by splitting malicious payloads across separate channels (e.g., MCP tool descriptions, tool results), evading single-channel content filters
Industry Insight
- Organizations should prioritize network segmentation and port exposure audits—multiple exploited vulnerabilities this week (macOS Screen Sharing on port 5900, exposed VMware vCenter) succeeded because services were internet-accessible; zero-trust network access should be enforced for all management interfaces
- The Amnesia Stealer's CDP-based approach sets a concerning precedent: legitimate developer protocols (Chrome DevTools, MCP) are now recognized attack vectors, prompting the need for behavioral monitoring that detects anomalous headless browser spawning and WebSocket connections from malware rather than relying solely on signature detection
- The GhostSplice technique against AI coding assistants and MCP tools represents an emerging class of prompt-injection-adjacent attacks that exploit multi-channel communication; AI tool developers and enterprise adopters should implement cross-channel context validation and treat tool descriptions, results, and system prompts as a unified attack surface requiring holistic security review
Disclaimer: The above content is generated by AI and is for reference only.