Executive Summary
- Ivanti EPMM CVE-2026-6973 (CVSS 7.2) and Palo Alto Networks CVE-2026-0300 (CVSS 9.3) are under active exploitation with limited and widespread attacks respectively, granting admin-level and root access.
- PCPJack credential stealer actively exploits five CVEs across cloud infrastructure, replacing TeamPCP malware while harvesting credentials from cloud, container, and developer environments.
- Russian state-sponsored actors are harvesting Microsoft Office authentication tokens via router compromises; Iranian APT (MuddyWater) using Chaos ransomware as cover for espionage.
- TCLBanker trojan and ClickFix/Vidar Stealer campaigns demonstrate worm-like self-propagation through WhatsApp, Outlook, and social engineering vectors targeting 59+ financial platforms.
- ShinyHunters extortion gang has breached Instructure Canvas again, defacing login portals for hundreds of educational institutions with mass disruption impact.
Top Threats Today
1. Ivanti EPMM Remote Code Execution (CVE-2026-6973)
Severity: High Affected: Technology Healthcare Finance
Ivanti Endpoint Manager Mobile versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0 contain improper input validation flaws exploited in limited zero-day attacks. Vulnerability allows remote code execution with admin-level access, affecting mobile device management infrastructure critical to enterprise operations.
Recommended Action
- Immediately upgrade all EPMM instances to patched versions (12.6.1.1, 12.7.0.1, or 12.8.0)
- Conduct forensic analysis on EPMM logs for exploitation indicators dating to vulnerability disclosure
- Isolate and re-baseline all managed devices for unauthorized configuration changes or lateral movement
2. Palo Alto Networks PAN-OS Critical RCE (CVE-2026-0300)
Severity: Critical Affected: Technology Finance Government Energy
Critical buffer overflow vulnerability in User-ID Authentication (CVSS 9.3/8.7) has been targeted since April 9, 2026, enabling root access and espionage. Threat actors have attempted exploitation in likely reconnaissance phases. Successful exploitation grants complete device compromise and lateral network access.
Recommended Action
- Apply Palo Alto emergency security patch immediately; verify patch installation across all firewalls
- Enable enhanced logging and monitoring for authentication anomalies and root-level command execution
- Review firewall logs from April 9, 2026 forward for exploitation attempts and failed authentication patterns
- Segment critical infrastructure behind patched firewalls and implement additional egress filtering
3. PCPJack Credential Theft Worm – Cloud Infrastructure Targeting
Severity: Critical Affected: Technology Finance Healthcare
PCPJack malware framework actively exploits five CVEs to propagate worm-like across cloud environments while harvesting credentials from cloud platforms, containers, developer tooling, productivity applications, and fintech systems. Malware uses parquet files for stealthy target discovery and actively removes competing TeamPCP infections. Represents sophisticated supply-chain and infrastructure compromise threat.
Recommended Action
- Audit and patch cloud infrastructure for known CVEs (prioritize PCPJack-associated vulnerabilities); implement EDR across all instances
- Rotate all cloud service credentials immediately; enforce MFA on all cloud tenant administrative accounts
- Search cloud logs for parquet file artifacts, unauthorized credential access, and suspicious container/developer tool activity
- Implement cloud-native threat detection and isolation playbooks for credential theft indicators
4. Russian State-Sponsored Microsoft Office Token Harvesting – Router Compromise Campaign
Severity: Critical Affected: Government Technology Finance Defense
Russian military intelligence-linked hackers are exploiting known flaws in older Internet routers to mass-harvest Microsoft Office authentication tokens. Campaign allows state-backed actors to silently siphon credentials, enabling persistent access to cloud infrastructure, email systems, and sensitive documents without additional authentication prompts.
Recommended Action
- Inventory all network routers; identify and replace or isolate end-of-life models; apply all available firmware patches immediately
- Implement network segmentation to restrict router access; monitor for suspicious outbound connections to non-standard ports
- Force re-authentication of all Microsoft Office cloud sessions; review and revoke suspicious OAuth tokens and session records
- Deploy passwordless authentication (Windows Hello, FIDO2) to reduce token-based lateral movement risk
5. TCLBanker Trojan – Worm Self-Propagation via WhatsApp & Outlook
Severity: High Affected: Finance Retail
TCLBanker banking trojan distributes via trojanized Logitech AI Prompt Builder MSI installer, targets 59 banking, fintech, and cryptocurrency platforms, and self-propagates through WhatsApp and Outlook contacts. Credential stealer demonstrates sophisticated supply-chain hijacking and social engineering combining.
Recommended Action
- Block installation of suspicious MSI packages; verify software legitimacy via official vendor channels only
- Deploy endpoint detection and response (EDR) focused on banking malware and credential theft behaviors
- Alert users to phishing attempts via trusted communication channels (WhatsApp, email); disable message preview and auto-load features
- Monitor credential vaults for unauthorized access; implement secure credential management solutions
Today’s Action Checklist
- ☐ URGENT: Patch Palo Alto Networks firewalls (CVE-2026-0300) and Ivanti EPMM (CVE-2026-6973) before end of business
- ☐ URGENT: Rotate all cloud infrastructure credentials and enforce MFA; audit cloud logs for PCPJack indicators
- ☐ URGENT: Audit network routers for end-of-life status; isolate vulnerable devices from critical infrastructure
- ☐ Conduct forensic analysis of EPMM and PAN-OS systems for exploitation and lateral movement indicators
- ☐ Revoke suspicious Microsoft Office OAuth tokens; force re-authentication of all cloud sessions
- ☐ Notify security teams of TCLBanker distribution via software supply chain; scan endpoints for trojanized installers
- ☐ Review Canvas/Instructure login portal access logs; reset credentials for affected educational organizations
- ☐ Deploy enhanced EDR and cloud threat detection for credential theft and worm propagation behaviors