Check Point has issued urgent warnings to customers following the discovery of active attacks targeting two zero-day flaws in its products. The two vulnerabilities, tracked as CVE-2026-85102 and CVE-2026-93616, both with a CVSS score of 9.8, have had patches released by the company after confirmation of exploitation. CVE-2026-85102 is a pre-authentication remote code execution vulnerability in the processing of certificates during a VPN negotiation.  Check Point published details of the issue and a fix on September 9, 2026. The company said there was no evidence of exploitation at the time of the patch release, but it has since detected attacks targeting Check Point Spark customers. The attacks, which first appeared on September 12, originate from anonymization infrastructure including VPN offerings and proxies. The researchers noted several certificates with subjects including “CN=vpn,OU=users,O=global,” “CN=vpn-user,OU=users,O=global” and “CN=vpnuser,OU=users,O=global.”  Check Point warned that the list of certificate subjects is not comprehensive. Customers were advised to review logs for anomalous certificate-based Mobile Access logins and not limit search terms to the certificate subjects included in the advisory. They should also look out for any suspicious activity from users that have authenticated to the gateway via Mobile Access including scanning of internal ports and services. The second issue, CVE-2026-93616, is a pre-authentication path traversal vulnerability in the management web service of Check Point Security Management.  An attacker could cause the system to execute a script from an arbitrary path and read an arbitrary Java class file, enabling them to gain unauthorized access to the underlying system. Check Point reported several limited attacks using this flaw on July 23, 2026. A patch for CVE-2026-93616 has been released, and customers are being urged to apply it immediately.  Affected versions of Check Point Security Management include R82.20, R82.10 Jumbo Hotfix Take 44 or lower, R82 Jumbo Hotfix Take 126 or lower, R81.20 Jumbo Hotfix Take 166 or lower and R81.10 Jumbo Hotfix Take 190 or lower. LivePatch Take 28/29 does not mitigate the vulnerability. End-of-life versions of the product are also affected. Check Point recommended that all customers with affected versions of the product should apply the relevant hotfix as both flaws are currently being actively exploited.

A widespread malicious campaign has been uncovered deploying dozens of spoofed websites designed to impersonate popular Windows utilities, developer toolkits,

Check Point Research published a technical analysis, revealing a stealthy prompt injection method. The newly documented Puzzlemask AI attack bypasses automated language model security checks without using suspicious encoding. Instead, the technique wraps malicious instructions inside ordinary English prose. The researchers demonstrated that lightweight gatekeepers fail to detect the hidden commands entirely. Consequently, vulnerable multi-tier systems pass dangerous prompts directly to powerful backend reasoning models for execution.

At a Glance Category Details Organization OpenAI (ChatGPT) Data Exposed Private user emails, chat histories, and connected app data Records Affected Unspecified (proof of concept demonstrated targeted extraction) Cause Shared internal JFrog Artifactory service lacking tenant isolation Disclosure Status Confirmed and patched by OpenAI Source Check Point Research Executive Summary Check Point Research discovered a severe ChatGPT cross-account data leak that bypassed container isolation boundaries.

Check Point Research revealed that Microsoft Defender’s legitimately signed BTR.sys boot-time remediation driver can be abused for arbitrary kernel-level file and registry operations on Windows from Windows 7 through Windows 11 25H2. The technique, demonstrated with the BTR_CLI proof-of-concept, can remove security binaries in a “golden window” after reboot, while Check...

Check Point Research uncovered a large-scale operation that impersonated open-source and freeware projects to capture search traffic through deceptive sites and click-driven redirects. The traffic was funneled through a CloudFront-hosted JavaScript staging layer and TDS chains that ultimately pointed selected users to RemusStealer, AnimateClipper, and the SessionGate framework. #CheckPointResearch #CloudFront #RemusStealer #AnimateClipper #SessionGate

Cybersecurity researchers have uncovered a major flaw in the VECT 2.0 ransomware that causes the malware to permanently destroy large files instead of properly encrypting them, making recovery impossible even if victims decide to pay a ransom. The ransomware operation has reportedly been promoted on newer versions of BreachForums, where the group invited users to join its affiliate program. Interested participants were allegedly given access keys through private messages. VECT operators also announced a collaboration with TeamPCP, the threat actor linked to recent supply-chain attacks targeting Trivy, LiteLLM, Telnyx, and even the European Commission. According to the announcement, the partnership aimed to exploit victims affected by those supply-chain breaches by deploying ransomware payloads and expanding attacks against additional organizations. Critical Encryption Flaw Discovered Researchers found that VECT 2.0 contains a serious issue in how it manages encryption nonces during the file-encryption process. Although the ransomware was designed to speed up encryption for large files, the implementation accidentally overwrites nonce data during each encryption cycle. Because the malware uses the same memory buffer repeatedly for nonce generation, every newly created nonce replaces the previous one. Once the encryption process is completed, only the final nonce remains stored and is written to disk. This mistake means that only the last 25% of an affected file can potentially be recovered, while the remaining portions become permanently inaccessible due to the missing nonces. The problem becomes even more severe because the lost nonces are not sent back to the attackers either. As a result, even the ransomware operators themselves would be unable to decrypt victim files after payment. Security researchers warned that the flaw effectively transforms the ransomware into a destructive data wiper, particularly in enterprise environments where most valuable assets exceed the malware’s file-size threshold. “At a threshold of only 128 KB, smaller than a typical email attachment or office document, what the code classifies as a large file encompasses not just VM disks, databases, and backups, but routine documents, spreadsheets, and mailboxes. In practice, almost nothing a victim would care to recover falls below this boundary,” Check Point says. Researchers also confirmed that the same nonce-management vulnerability exists across all VECT 2.0 variants, including Windows, Linux, and ESXi versions, meaning the irreversible file destruction behavior impacts every platform supported by the ransomware.

  Hackers have launched targeted attacks against TrueConf conference servers by exploiting a previously unknown vulnerability that enables the execution of malicious files across all connected systems. The vulnerability, identified as CVE-2026-3502, has been assigned a medium severity rating. It originates from the absence of an integrity verification step in the platform’s update process, allowing threat actors to substitute legitimate updates with compromised versions. TrueConf is a video conferencing solution often deployed as a self-hosted server. While cloud functionality exists, it is primarily built for secure, isolated environments. The company states that over 100,000 organizations adopted the platform during the COVID-19 pandemic to support remote operations, including military units, government bodies, energy firms, and air traffic control organizations. Security researchers at Check Point have been monitoring an ongoing campaign, dubbed “TrueChaos,” which has been actively exploiting CVE-2026-3502 as a zero-day since early this year. The attacks have mainly focused on government institutions in Southeast Asia. “An attacker who gains control of the on-premises TrueConf server can replace the expected update package with an arbitrary executable, presented as the current application version, and distribute it to all connected clients,” Check Point says. “Because the client trusts the server-provided update without proper validation, the malicious file can be delivered and executed under the guise of a legitimate TrueConf update.” The vulnerability impacts TrueConf versions 8.1.0 through 8.5.2. After responsible disclosure by researchers, the company released a patched version, 8.5.3, in March 2026 to address the issue. Details of the “TrueChaos” Campaign:Check Point researchers believe with moderate confidence that the activity is linked to a China-associated threat actor. This assessment is based on observed tactics, techniques, and procedures, the use of Alibaba Cloud and Tencent infrastructure for command-and-control operations, and the nature of the targets. The attack campaign leverages centralized TrueConf servers used by government entities, allowing attackers to distribute malicious updates to multiple agencies simultaneously. Once deployed, the infection chain includes DLL sideloading, reconnaissance commands such as tasklist and tracert, privilege escalation via UAC bypass using iscicpl.exe, and persistence mechanisms. Although the final payload was not recovered, network indicators suggest the use of Havoc command-and-control infrastructure. Havoc is an open-source framework that enables attackers to run commands, control processes, manipulate system tokens, execute shellcode, and deploy further malicious components. It has previously been associated with the Chinese-linked group “Amaranth Dragon” in similar campaigns. The report also provides indicators of compromise and warning signs of infection. Notable red flags include the presence of files such as poweriso.exe or 7z-x64.dll, along with suspicious paths like %AppData%\Roaming\Adobe\update.7z or iscsiexe.dll.

 The market for initial access brokers has expanded rapidly over the past two years, creating a system that allows advanced threat actors to outsource the early stages of an intrusion, according to new research from Check Point. The report says this growth has made it easier for both nation-state groups and criminal actors to breach a larger number of targets.  Check Point notes that the rise of the IAB economy coincides with the growing use of cyberspace by governments as a tool for projecting power. The firm is urging policymakers and businesses to strengthen identity security, secure software supply chains and improve the resilience of operational technology systems.  “Once considered peripheral players, IABs have become a critical node in the cyber-criminal supply chain, lowering barriers to entry for sophisticated operations and enabling rapid campaign scaling,” Check Point said.  By paying IABs to handle initial access at scale, threat actors can move faster and avoid the risks associated with the early stages of an attack. According to the report, “state-backed groups and sophisticated criminal actors can reduce operational risk, accelerate execution timelines, and scale their campaigns across dozens of targets simultaneously.”  This growing reliance on brokers also complicates attribution. When an IAB is involved, IT teams and investigators often struggle to determine whether an attack was carried out by a government-backed group or by a criminal operation.  For this reason, Check Point says that “IAB activity is no longer a peripheral criminal phenomenon but a force multiplier in the broader offensive ecosystem, one that directly supports espionage, coercive operations, and potential disruption of U.S. government and critical infrastructure networks.”  The report also highlights a sharp rise in IAB activity targeting essential sectors. Healthcare saw nearly 600 percent more IAB-related attacks in 2024 compared with 2023. Government, education and transportation networks were also significantly affected.  Check Point says these increases reflect both higher demand from adversaries for access to sensitive environments and the growing professionalisation of the IAB marketplace, where access to critical systems is treated as a commodity.  The research links this broader trend to rising geopolitical tensions and the changing role of nation-state hacking. “Cyber operations have evolved from opportunistic disruptions and intelligence-gathering into deliberate, coordinated campaigns designed to achieve political, economic, and strategic outcomes,” the report says.  According to Check Point, the line between geopolitics and cyber activity has largely disappeared. State-aligned groups are using digital operations to shape crises, signal intent and impose costs on rivals, often below the threshold of open conflict.  The firm notes that spikes in geopolitical risk are closely followed by spikes in targeted cyberattacks against U.S. government systems. “Cybersecurity is no longer just a technical issue; it is a strategic imperative,” Check Point said. The report argues that resilience, deterrence and rapid recovery must now be treated as national security priorities on the same level as traditional defence planning.

Gen Threat Labs tracked GoFlateLoader, a widespread Golang loader that uses inflated PE overlays and manual in-memory execution to deliver infostealers such as Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer. Its operators distribute it through cracked software and a malicious TDS, while its oversized binaries appear designed to evade size-limited scanning and analysis systems. #GoFlateLoader #Amatera #Remus #Lumma #Vidar #StealC #SvitStealer #CheckPointResearch

The leaked internal chats of The Gentlemen RaaS group reveal that the gang heavily depends on infostealer credential logs and tools like Snusbase to gain initial access to corporate networks. Checkpoint Research and Hudson Rock show that this credential-driven approach is now a major trend, with groups like the Coinbase Cartel and malware families such as RedLine, Lumma, and Vidar enabling silent intrusions. #TheGentlemen #Snusbase #CheckpointResearch #CoinbaseCartel #RedLine #Lumma #Vidar

Check Point Research discovered a hidden DNS-based outbound channel from ChatGPT’s isolated code-execution runtime that could silently exfiltrate user messages, uploaded files, and model-generated outputs. A single malicious prompt or a backdoored custom GPT could exploit this channel to leak sensitive data and even establish a remote shell inside the Linux runtime. #ChatGPT #CheckPointResearch

Sicherheitsforscher haben eine neue Variante der auf macOS ausgerichteten Schadsoftware namens Banshee Stealer entdeckt. Der Artikel <a href="https://tarnkappe.info/artikel/cyberangriffe/banshee-stealer-variante-zielt-auf-macos-user-ab-307523.html">Banshee Stealer Variante zielt auf macOS-User ab</a> erschien zuerst auf <a href="https://tarnkappe.info">TARNKAPPE.INFO</a>