Good morning. This is your security briefing for Thursday, March 19, 2026, covering eleven articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
We have a critical security alert. CVE-2026-20131, a remote code execution in Cisco Secure Firewall Management Center web interface allows unauthenticated remote code execution as root, has been added to the CISA Known Exploited Vulnerabilities catalog.
Trend Micro reports on a significant data breach where attackers exfiltrated data from SharePoint Online by exploiting a misconfigured Spring Boot Actuator endpoint that exposed service account credentials and Azure AD application secrets. The attackers used OAuth2 ROPC flow to bypass multi-factor authentication and accessed SharePoint via Microsoft Graph, demonstrating how credential exposure enables cloud service compromise without malware or exploits.
The Cybersecurity and Infrastructure Security Agency reports that on March 11, 2026, Stryker Corporation, a U.S. medical technology firm, experienced a cyberattack where threat actors misused legitimate endpoint management software to gain unauthorized access. CISA issued guidance urging organizations to harden endpoint management configurations, implement least privilege, enforce phishing-resistant MFA, and enable Multi Admin Approval in Microsoft Intune.
Virus Bulletin Limited reports that China-nexus threat group Amoeba, also known as APT41 or Earth Baku, deployed Calendarwalk malware against Taiwanese IT and ERP software vendors using a novel five-stage execution chain. The malware exploits Windows Workflow Foundation XOML files for initial access and leverages Google Calendar events as command and control infrastructure, employing living off trusted sites tactics to evade detection.
Security researchers Sathwik Ram Prakki and Kartik Jivani report on Operation GhostMail, a Russian APT phishing campaign targeting the Ukrainian State Hydrology Agency. The attackers exploited a cross-site scripting vulnerability, CVE-2025-66376, in Zimbra Collaboration webmail through a socially-engineered email containing obfuscated JavaScript that executed without user interaction, enabling deep account access and persistent access establishment.
The U.S. Attorney's Office, District of Alaska, announces that international law enforcement disrupted the command and control infrastructure of four major IoT botnets: Aisuru, KimWolf, JackSkid, and Mossad. These botnets infected millions of devices worldwide, operated as cybercrime-as-a-service platforms, and conducted record-breaking DDoS attacks reaching 30 Terabits per second while extorting victims for significant financial losses.
Gen Threat Researcher VojtΔch Krejsa reports on VoidStealer, a new infostealer marketed since December 2025 that uses a novel debugger-based technique to bypass Chrome's Application-Bound Encryption. The malware attaches to Chrome or Edge browser processes as a debugger, sets hardware breakpoints during startup, and extracts the master key directly from memory, enabling theft of passwords and cookies without detection or elevated privileges.
Zscaler reports on SnappyClient, a sophisticated C2 framework implant delivered via HijackLoader through deceptive telecom-themed phishing websites. The malware features extensive capabilities including cryptocurrency theft, browser data exfiltration, keylogging, and remote access, while employing advanced evasion techniques such as AMSI bypass and Heaven's Gate, with communications encrypted using ChaCha20-Poly1305.
TrustedSec researcher Nyxgeek disclosed GraphGoblin, a vulnerability in Azure Entra ID that allows attackers to obtain authentication tokens while bypassing sign-in log detection. The exploit abuses login POST requests by repeating scope values to overflow database columns and using oversized User-Agent strings, resulting in unlogged token issuance and Graph API access that requires Microsoft 365 E5 licensing to detect.
NVIDIA released NemoClaw, an alpha-stage OpenClaw plugin for OpenShell that enables secure deployment of always-on AI assistants in sandboxed environments. The framework employs multiple security mechanisms including Landlock, Seccomp, network namespaces, and policy enforcement across gateway, sandbox, and provider components to isolate and protect AI model inference operations.
Infoblox Threat Intel and Confiant report that threat actors are exploiting thousands of malicious Keitaro Tracker instances to deliver AI-driven investment scams targeting general internet users worldwide, particularly U.S. audiences and seniors. The campaigns leverage generative AI to create deepfake videos, automated trading promises, and convincing lure pages, combined with domain cloaking and registered domain generation algorithms.
WeChat Public Platform reports on Wuhan Anjun Technology, a company presenting itself as a professional cybersecurity firm in business registration and public promotion, which has been exposed when team members fell out and admitted to stealing. The article discusses the dual nature of this organization's operations, suggesting fraudulent activity within what was publicly portrayed as a legitimate security company.
That concludes today's briefing.