Cybersecurity Threat Research 'Weekly' Recap. Attackers abused fake installers, developer-platform lures, and AI-driven tooling to deliver loaders and steal credentials, including campaigns tied to Silver Fox, GlassWorm, JSCEAL, TA419, Remcos, and Vidar. Alongside these tradecraft shifts, the roundup highlighted active zero-day exploitation in Citrix NetScaler and PaperCut MF, plus supply-chain and exposed-credential risks involving MALFEX and leaked GitHub datasets. #SilverFox #GlassWorm #JSCEAL #TA419 #Remcos #Vidar #CitrixNetScaler #CVE-2026-88771 #CVE-2026-88772 #PaperCutMF #AdaptixC2 #MALFEX #TIKTOUK #Jewelbug #Warlock

eSentire TRU detected exploitation of PaperCut MF zero-days (CVE-2026-82078 and CVE-2026-81578) against an education customer, leading to a web shell, a trojanized Microsoft Copilot binary, and deployment of an AdaptixC2 implant. The intrusion progressed to domain controller compromise, credential dumping, NTDS.dit extraction, and pass-the-hash movement across the Active Directory environment. #PaperCutMF #CVE-2026-82078 #CVE-2026-81578 #AdaptixC2 #MicrosoftCopilot

Threat actors are exploiting newly patched flaws in PaperCut NG and PaperCut MF to bypass authentication and execute arbitrary code on vulnerable servers. Huntress and watchTowr observed limited real-world activity using chained exploits, post-exploitation reconnaissance, and Java .class payloads to fingerprint systems and collect data. #PaperCutNG #PaperCutMF #CVE-2026-82078 #CVE-2026-81578...

PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of PaperCut NG and PaperCut MF in zero-day attacks, with confirmed incidents affecting customers. The company has released emergency patches and is urging organizations to restrict Internet-exposed PaperCut Application Servers to trusted IP addresses. #PaperCutNG #PaperCutMF