Cybercrimeinfo.nl biedt actuele informatie en analyses over cybercriminaliteit, cyberaanvallen en online veiligheid. Geschikt voor zowel beginners als experts.

Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces.

Three days after disclosure of a pre-auth remote code execution in the marimo Python notebook platform (GHSA-2679-6mx9-h9xc / CVE-2026-39987), multiple actors exploited the flaw to harvest credentials, run reverse shells, pivot to PostgreSQL/Redis, and deploy a previously undocumented NKAbuse variant hosted on a typosquatted HuggingFace Space. Defenders should look for the VS Code typosquat vsccode-modetx.hf.space, the kagent implant and installer, rotated credentials, and runtime behaviors such as reverse shells and systemd/crontab persistence #NKAbuse #marimo

A critical vulnerability in the marimo Python notebook platform is now being actively used by attackers to deploy a blockchain-powered backdoor on developer systems. The flaw, tracked as CVE-2026-39987, allows remote code execution without authentication, making it a dangerous entry point for threat actors leveraging it to install a new variant of the NKAbuse malware through a fake Hugging Face Space. The advisory, identified as GHSA-2679-6mx9-h9xc, was published on GitHub on April 8, 2026. Within just 9 hours and 41 minutes, the first active exploitation was recorded. From April 11 to April 14, 2026, attackers from 11 unique IP addresses across 10 countries launched 662 exploit events against exposed marimo instances. What began as early scanning quickly escalated into a full-scale, multi-actor campaign targeting AI developer workstations. Researchers at the Sysdig TRT identified and documented these attacks as they unfolded, noting four distinct post-exploitation patterns: credential harvesting, reverse shell attempts, DNS-based data exfiltration, and deployment of a previously undocumented NKAbuse variant. The speed of weaponization confirmed that multiple threat actors were independently targeting the same vulnerability within days of its public disclosure. The most alarming finding was the deployment of a Go-based backdoor named kagent through a typosquatted Hugging Face Space called vsccode-modetx, built to mimic a legitimate VS Code tool . Using a simple curl command against a marimo endpoint, the attacker pulled and executed a shell dropper that downloaded the kagent binary to the victim system. The Hugging Face domain carried zero malicious flags across 16 reputation sources at the time, allowing the payload to bypass standard security filters without raising any alarms. The attack impact extended beyond a single compromised notebook. Attackers quickly pivoted from exploiting marimo to accessing connected PostgreSQL databases and Redis instances using credentials pulled from environment variables. One operator extracted AWS access keys, database connection strings, and OpenAI API tokens, demonstrating that one exposed marimo instance could open a foothold into broader cloud infrastructure. NKAbuse Variant and Persistence Tactics The kagent binary is a stripped, UPX-packed Go ELF file that unpacks from 4.3 MB to 15.5 MB and communicates with a command-and-control server over the NKN blockchain network. the NKN protocol uses decentralized relay nodes, there is no single IP address or domain to block, and C2 traffic blends with normal blockchain activity, making detection difficult with conventional tools . The dropper script establishes persistence using three sequential methods: first creating a systemd user service at ~/.config/systemd/user/kagent.service, then adding a crontab @reboot entry, and finally installing a macOS LaunchAgent at ~/Library/LaunchAgents/com.kagent.plist. All output is silently redirected to ~/.kagent/install.log, hiding activity from standard process monitoring. Defenders must check all three locations to fully remove the implant. Compared to the original NKAbuse from December 2023, this 2026 variant targets AI developer tooling using a brand-new vulnerability, uses Hugging Face for delivery, and disguises the binary as a legitimate Kubernetes agent named kagent, where the original exploited a six-year-old Apache Struts flaw against Linux desktops and IoT devices . The Sysdig TRT shared the following steps for defenders: Update marimo to version 0.23.0 or later immediately, as the vulnerability requires no authentication and is actively targeted. Hunt for the ~/.kagent/ directory, the kagent.service systemd entry, and any running kagent process on systems that ran marimo. Block vsccode-modetx.hf.space at the proxy or DNS level to stop the known payload delivery URL. Rotate all credentials on exposed marimo instances, focusing on DATABASE_URL, AWS keys, and API tokens stored in environment variables. Monitor network traffic for NKN blockchain relay patterns that indicate active C2 communication from an infected host. Audit Hugging Face Spaces and AI/ML dependencies, and restrict access to verified publishers only. Deploy runtime behavioral detection, as signature-based tools cannot catch zero-detection malware hosted on trusted platforms. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post Attackers Weaponize CVE-2026-39987 to Spread Blockchain-Based Backdoor Via Hugging Face appeared first on Cyber Security News .

Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces.

Experts uncovered a new Go-based multi-platform malware, tracked as NKAbuse, which is the first malware abusing NKN technology.

The multifaceted malware leverages the NKN blockchain-based peer-to-peer networking protocol, operating as both a sophisticated backdoor and a flooder launching DDoS attacks.

Novel malware adapts delivers DDoS attacks and provides RAT functionality

A novel malware named NKAbuse has surfaced, utilizing blockchain technology for DDoS attacks.

A new Go-based multi-platform malware identified as 'NKAbuse' is the first malware abusing NKN (New Kind of Network) technology for data exchange, making it a stealthy threat.

Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces. [...]

Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face

A Critical Flaw Ignites a Rapid Cyber Offensive In early April 2026, a severe security vulnerability shook the developer and AI community. Just three days after its public disclosure on April 8, attackers had already moved from awareness to active exploitation. The flaw, identified as CVE-2026-39987, targeted the Marimo Python notebook platform and allowed attackers to execute commands remotely without authentication.

Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces. Attacks leveraging the remote code executio...

Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces.

Hackers are using a critical flaw in Marimo—a reactive Python notebook framework—to land a new NKAbuse malware variant, with delivery paths that lean Stay updated with the latest global news from MISRYOUM.

Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces.

Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces.

攻撃者は、marimo Pythonノートブックプラットフォームの脆弱性CVE-2026-39987を急速に悪用し、Hugging Face Spacesでホストされた新しいNKAbuseバックドアバリアントを展開し、AI/ML開発者環境を高価値の感染ポイントに変えています。 このキャンペーンは認証前RCE、認証情

ハッカーはMarimo リアクティブPythonノートブックの重大な脆弱性を悪用して、Hugging Face Spacesでホストされている新しいNKAbuseマルウェア亜種を展開しています。 リモートコード実行の脆弱性(CVE-2026-39987)を悪用した攻撃は、技術的詳細が公開されてから10時間以内に先週

Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces.