TL;DR
Fortinet FortiSandbox actively exploited; three CVEs confirmed in the wild. Android malware Rokarolla targets 217 banking/crypto apps with 137 commands. Google Vertex AI SDK bucket-squatting flaw allows unauthorized model hijacking and code execution.
Executive Summary
- Fortinet FortiSandbox faces active exploitation of three CVEs (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) reported over the past 24 hours.
- Android banking trojan Rokarolla targets 217 banking and cryptocurrency applications with extensive command-and-control capabilities.
- Google Vertex AI SDK vulnerability enables bucket squatting attacks allowing unauthorized model upload hijacking and infrastructure code execution.
- ClickFix campaigns expand delivery mechanisms via three new malware loaders: BabaDeda, Lorem Ipsum, and Potemkin.
- Malicious JetBrains Marketplace plugins discovered stealing AI API keys from developer environments.
Top Threats Today
1. Fortinet FortiSandbox Active Exploitation
Severity: HIGH Affected: Technology
Threat actors are actively exploiting three security vulnerabilities in Fortinet FortiSandbox, according to threat intelligence firm Defused Cyber [1]. The exploited CVEs are CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089, with exploitation activity observed over the past 24 hours [1]. CVE-2026-39813 and CVE-2026-39808 were patched in April 2026, and CVE-2026-25089 was patched within the past week — all three require patching [1].
Sources:[1] The Hacker News
Recommended Action
- Immediately verify FortiSandbox version and apply all available security patches
- Review FortiSandbox logs for indicators of exploitation (unusual network connections, failed authentication attempts, unexpected process execution)
- Isolate affected FortiSandbox instances from network if patching cannot be applied immediately
- Monitor threat intelligence feeds for detailed exploitation signatures and IOCs
2. Rokarolla Android Banking Trojan Deployment
Severity: HIGH Affected: Finance
Security researchers at Zimperium's zLabs have documented a new Android banking trojan named Rokarolla that targets 217 banking and cryptocurrency applications [1]. The malware packs 137 remote commands, providing operators near-total control of infected devices [1]. The trojan is capable of lifting lock-screen PINs and reading SMS codes used in two-factor authentication [1]. Rokarolla has been spread via fake TikTok and Chrome downloads . ⚠
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Deploy mobile device management (MDM) policies blocking sideloading and restricting app installation to official app stores
- Educate users to download banking and financial applications exclusively from official app stores (Google an unattributed threat actor, Apple App Store)
- Enable SMS-based OTP notifications on accounts and monitor for suspicious SMS activity
- Implement application allow-listing on managed Android devices for known legitimate banking apps
3. Google Vertex AI SDK Bucket Squatting Vulnerability
Severity: HIGH Affected: Technology
A flaw in the Google Cloud Vertex AI SDK for Python allows an attacker with no access to a victim's project to hijack the victim's machine learning model upload and execute code inside Google's serving infrastructure [1]. The vulnerability leverages bucket squatting techniques to intercept model uploads [1]. Palo Alto Networks Unit 42 discovered and reported the bug through Google's bug bounty program [1].
Sources:[1] The Hacker News
Recommended Action
- Update Google Cloud Vertex AI SDK to the patched version immediately
- Audit Google Cloud Storage bucket naming conventions and apply restrictive IAM policies
- Enable bucket versioning and object hold policies to prevent unauthorized overwrites
- Monitor Cloud Storage audit logs for suspicious upload and access patterns
4. ClickFix Campaign Expansion with New Loaders
Severity: HIGH Affected: Technology
Cybersecurity researchers have identified multiple ClickFix campaigns delivering three new malware loaders: BabaDeda Loader, Lorem Ipsum Loader, and Potemkin [1]. Attacks using BabaDeda Loader were observed in April 2026 [1]. The Lorem Ipsum malware variant pivots to ClickFix delivery via compromised WordPress sites and may be linked to the ransomware and data extortion group Vice Society [2].
Sources:[1] The Hacker News[2] Dark Reading
Recommended Action
- Deploy URL filtering to block known ClickFix distribution domains and fake update sites
- Implement application whitelisting to restrict execution of unsigned or untrusted binaries
- Train users to verify software updates through official vendor channels and never download updates via unsolicited prompts
- Monitor for browser extensions and plugins requesting unusual permissions
5. Malicious JetBrains Marketplace Plugins Stealing API Keys
Severity: HIGH Affected: Technology
At least 15 malicious plugins found on the JetBrains Marketplace were designed to steal AI API keys from developers [1]. The plugins target development environments where sensitive credentials are stored and used for API authentication. ⚠
Sources:[1] BleepingComputer
Recommended Action
- Audit all installed JetBrains IDE plugins and remove any plugins from untrusted or unknown publishers
- Rotate all AI API keys and credentials that may have been exposed through installed plugins
- Implement IDE plugin governance policies restricting plugin installation to approved vendors only
- Enable API key rotation alerts and monitor for unauthorized API usage patterns
Today’s Action Checklist
- ☐ URGENT: Verify Fortinet FortiSandbox versions in production and apply security patches for CVE-2026-39813, CVE-2026-39808, CVE-2026-25089
- ☐ HIGH: Audit and remove malicious JetBrains Marketplace plugins; rotate all exposed AI API keys
- ☐ HIGH: Distribute Rokarolla threat intelligence to mobile security teams and deploy MDM controls blocking sideloading
- ☐ HIGH: Update Google Vertex AI SDK and audit Cloud Storage bucket policies for unauthorized access
- ☐ ONGOING: Monitor for ClickFix campaigns and fake update delivery; reinforce user training on software update verification