TL;DR
Trojanized npm packages deliver RedC2 4.0 Linux backdoor with AI-assisted command and control; Microsoft Defender's boot driver can be weaponized to disable security software; AWS leaked keys remain active, granting full account access.
Executive Summary
- Fourteen trojanized npm packages masquerade as utilities while delivering RedC2 4.0, an AI-powered Linux backdoor with remote command execution capabilities.
- Check Point Research disclosed a technique enabling Microsoft Defender’s legitimately signed boot-time driver to perform arbitrary kernel operations across Windows 7 through Windows 11 25H2, with no CVE required.
- Over 9,300 publicly exposed AWS access keys remain active and valid, granting adversaries full control over affected corporate accounts.
- BleepingComputer reports a new malware family called SynkLoader spreads via Microsoft Teams phishing campaigns, targeting credential theft through fake lock screens.
- CISA added three new vulnerabilities to its Known Exploited Vulnerabilities catalog: two TrueConf Server flaws and one MLflow SSRF vulnerability.
Top Threats Today
1. Trojanized npm Packages Distribute RedC2 4.0 Linux Backdoor
Severity: HIGH Affected: Technology
Cybersecurity researchers have discovered 14 trojanized npm packages masquerading as calendar and streak utilities that are engineered to deliver RedC2 4.0, an artificial intelligence-powered Linux implant [1]. When the module loads, it locates a bundled binary designed for remote code execution and command and control [1]. This represents an active supply-chain attack leveraging the npm ecosystem to compromise Linux systems at scale.
Sources:[1] The Hacker News
Recommended Action
- Audit npm dependencies for any of the 14 identified trojanized packages; remove and rebuild affected projects immediately.
- Monitor Linux systems for unusual outbound connections and process execution from node modules directories.
- Implement npm package signing verification and consider shifting to private package registries for critical dependencies.
2. Microsoft Defender Driver Weaponized for Security Software Deletion
Severity: HIGH Affected: Technology
Check Point Research has disclosed a technique that leverages Microsoft Defender’s own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2 [1]. The attack exploits no software flaw; instead, it abuses the driver’s intended functionality for malicious purposes [1]. An attacker with local administrative access can weaponize this driver to delete or disable competing security software at boot time. ⚠
Sources:[1] The Hacker News
Recommended Action
- Review boot driver permissions and apply principle of least privilege to administrative accounts.
- Monitor for unexpected driver modifications or abuse of the Microsoft Defender boot remediation service.
- Implement Secure Boot and driver signature enforcement to restrict unsigned driver loading.
3. Active AWS Access Keys Expose Full Account Control
Severity: HIGH Affected: Technology
BleepingComputer reports more than 9,300 Amazon Web Services access keys publicly exposed between August 2022 and August 2026 remain active and valid [1]. These credentials grant attackers full control over affected corporate AWS accounts, enabling data exfiltration, resource manipulation, and lateral movement ⚠[1].
Sources:[1] BleepingComputer
Recommended Action
- Immediately rotate all AWS access keys that may have been exposed; audit CloudTrail logs for unauthorized API activity.
- Enforce MFA on all AWS console and programmatic access.
- Deploy AWS access key scanning tools and implement automated credential detection in CI/CD pipelines.
4. SynkLoader Malware Targets Microsoft Teams Users via Phishing
Severity: HIGH Affected: Technology
BleepingComputer reports a previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via fake lock screen overlays [1]. The malware targets Teams users, a widely adopted enterprise communication platform, enabling credential harvesting at scale.
Sources:[1] BleepingComputer
Recommended Action
- Educate end users on phishing indicators and discourage clicking file links in Teams from untrusted sources.
- Deploy advanced threat detection in Teams to flag suspicious file transfers and credential prompts.
- Enforce conditional access policies requiring additional verification after credential entry.
5. CISA Adds TrueConf and MLflow Vulnerabilities to Known Exploited Catalog
Severity: HIGH Affected: Technology
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on August 19–20, 2026 [1][2][3]. CVE-2026-72529 (TrueConf Server) is a missing authentication vulnerability allowing remote code execution via port 4307/TCP with a federal remediation deadline of August 23, 2026 [2]. CVE-2026-72530 (TrueConf Server) is a code injection flaw enabling arbitrary code execution through port 4307/TCP with a federal deadline of September 3, 2026 [1]. CVE-2026-64849 (MLflow) is a server-side request forgery vulnerability enabling access to internal metadata services with a remediation deadline of September 2, 2026 [3]. All three are confirmed in active exploitation.
Sources:[1] CISA KEV[2] CISA KEV[3] CISA KEV
Recommended Action
- For TrueConf deployments: immediately patch to the latest version and restrict port 4307/TCP access to trusted networks only.
- For MLflow: patch immediately or restrict SSRF attack surface by implementing network segmentation and egress filtering.
- Prioritize remediation according to CISA’s federal deadlines if your organization is in scope.
Today’s Action Checklist
- ☐ URGENT: Audit and remove the 14 trojanized npm packages from all projects; rebuild and redeploy affected applications.
- ☐ URGENT: Rotate all AWS access keys exposed publicly between August 2022 and August 2026; audit CloudTrail for unauthorized activity.
- ☐ HIGH: Patch TrueConf Server (CVE-2026-72529, CVE-2026-72530) and MLflow (CVE-2026-64849) per CISA remediation deadlines.
- ☐ HIGH: Review boot driver permissions and monitor for abuse of Microsoft Defender remediation driver on Windows systems.
- ☐ HIGH: Deploy phishing detection for Microsoft Teams and educate users on credential-harvesting tactics.