Canvas extortion attack; JDownloader, Hugging Face & Trellix hit

Executive Summary

• Canvas learning management system compromised in extortion attack affecting hundreds of universities and K-12 schools nationwide, disrupting final exams
• Critical supply-chain attacks: JDownloader installers replaced with Python RAT malware, fake OpenAI repository on Hugging Face distributes infostealer, and Trellix source code breached by RansomHouse
• New banking trojan TCLBANKER targets 59 financial platforms via WhatsApp and Outlook worms; Quasar Linux RAT specifically harvests developer credentials for supply-chain compromise
• cPanel/WHM patches three critical vulnerabilities enabling privilege escalation and code execution; Microsoft Patch Tuesday addresses 167 flaws including SharePoint zero-day
• ICS/OT critical: Polish water treatment plants breached with ability to modify operational parameters; Russian state actors harvesting Microsoft Office tokens via router exploits

Top Threats Today

1. Canvas Instructure Breach – Education Sector Extortion Attack

Severity: Critical   Affected: Education

The Canvas learning management platform serving thousands of schools and universities nationwide was compromised in an active data extortion campaign. Threat actors defaced login pages with ransom demands and threatened to leak sensitive personally identifiable information affecting students, faculty, and staff. The attack forced universities to reschedule final exams and disrupted coursework across multiple institutions. ShinyHunters claims responsibility for a second attack against parent company Instructure, with PII from hundreds of millions of users at risk.

2. Software Supply-Chain Triple Threat – JDownloader, Hugging Face, and Trellix Breaches

Severity: Critical   Affected: Technology

Three major supply-chain compromises expose millions of users and developers to malware and credential theft. JDownloader's official website was hacked to distribute Python RAT malware in Windows and Linux installers. A malicious Hugging Face repository impersonating OpenAI’s “Privacy Filter” project reached the platform’s trending list while distributing information-stealing malware. Separately, Trellix source code was breached by RansomHouse threat group, with leaked proof-of-concept images confirming intrusion. These attacks create cascading risks for all downstream users and organizations integrating these tools.

3. Banking Trojan TCLBANKER – Financial Sector Targeting via Social Engineering

Severity: Critical   Affected: Finance

A previously undocumented Brazilian banking trojan designated TCLBANKER (tracked as REF3076 by Elastic Security Labs) is actively targeting 59 banking, fintech, and cryptocurrency platforms. The malware propagates via WhatsApp and Outlook worms, leveraging social engineering to compromise financial users. The sophisticated capabilities and broad platform targeting indicate a major emerging threat to financial institutions and their customers globally. Concurrent with banking threats, Quasar Linux RAT specifically targets developers to harvest credentials for software supply-chain compromise, creating compound risk.

4. Critical Infrastructure Compromise – Water Treatment Plants and ICS/OT Breaches

Severity: Critical   Affected: Energy, Government

Polish security authorities reported intrusions at five water treatment plants with attackers gaining ability to modify operational parameters of critical infrastructure. Separately, Russian military intelligence-linked actors exploited known router vulnerabilities to mass harvest Microsoft Office authentication tokens, creating lateral movement pathways into enterprise networks. These incidents represent direct threats to public safety and national security. An AI-driven cyberattack against Mexico’s critical infrastructure was thwarted only by SCADA system isolation, highlighting the escalating sophistication of OT targeting.

5. cPanel/WHM and Microsoft Patch Tuesday – High-Volume Vulnerability Exploitation Risk

Severity: High   Affected: Technology, Government

cPanel released patches for three critical vulnerabilities (CVE-2026-29201 and others) enabling privilege escalation, code execution, and denial-of-service attacks against web hosting infrastructure. Microsoft’s April Patch Tuesday addressed 167 vulnerabilities including a critical SharePoint Server zero-day and the “BlueHammer” Windows Defender weakness. The volume and severity of patches create immediate exploitation windows before deployment. Attackers routinely target unpatched instances within hours of patch release.

Today’s Action Checklist

• ☐ URGENT: Canvas users: force password resets, implement MFA, monitor for unauthorized access and credential abuse
• ☐ URGENT: Developers: rotate all API keys, secrets, and credentials; scan systems for Python RAT and infostealer malware
• ☐ URGENT: Financial institutions: deploy TCLBANKER IoCs; implement credential harvesting detection and transaction anomaly rules
• ☐ URGENT: ICS/OT operators: verify network segmentation; audit router inventory for known vulnerabilities; implement egress filtering
• ☐ URGENT: All organizations: apply cPanel/WHM and Microsoft Patch Tuesday updates; prioritize zero-day remediations
• ☐ HIGH: Monitor for PCPJack and Quasar Linux RAT indicators; hunt for developer credential theft and cloud environment access
• ☐ HIGH: Review SOC alert processes; implement AI-assisted triage to address analyst alert fatigue and detection delays
• ☐ MEDIUM: Audit third-party software sources; implement software signing verification and trusted repository policies
• ☐ MEDIUM: Threat hunt for Russian state actor router exploitation and token harvesting; correlate with network access logs
• ☐ MEDIUM: Review education sector incident response plans; prepare breach notifications and regulatory filings for Canvas-affected students