Weekly Threat Awareness ReportSharePoint RCE Exploited · Tomcat Command Injection · npm-Hosted ClickFix Lures

Microsoft SharePoint - Remote Code Execution

Improper Input Validation (CWE-20)  ·  Unauthorized · Remote  ·  Actively exploited

A high-severity flaw in Microsoft SharePoint lets an unauthorized attacker execute malicious code remotely over a network. It stems from improper input validation: SharePoint fails to properly check the data it receives, so an attacker can disguise malicious commands as standard input that the system then executes. Exploitation could lead to full system compromise, unauthorized data access, or ransomware deployment, and gives attackers a foothold inside the organization's internal infrastructure. The flaw is being exploited in the wild, and proof-of-concept exploit code on GitHub lowers the barrier to entry. No state-sponsored APT groups have been linked to it yet, but more than 10 identified indicators of compromise and significant social-media discussion show a high level of active interest.

Apache Tomcat CGI Servlet - OS Command Injection on Windows

OS Command Injection (CWE-78)  ·  Remote  ·  Windows with enableCmdLineArguments enabled

A high-severity flaw in the Common Gateway Interface (CGI) Servlet of various Apache Tomcat versions lets attackers run unauthorized commands on Windows servers. The root cause is a mismatch between how the Java Runtime Environment passes command-line arguments and how Windows parses them, so special characters are not properly neutralized. Exploitation grants code execution with the same privileges as the Tomcat server - enough for data theft, malware installation, or total control of the server. Any organization running Tomcat on Windows with the enableCmdLineArguments option active is at high risk. Although the flaw dates to 2019, it is actively exploited in the wild, with numerous public proofs of concept and exploit scripts available for download. No APT groups have been explicitly linked, but the ready availability of tooling makes it a target for opportunistic attackers, and 8 indicators of compromise are known.

npm/unpkg Fake Cloudflare CAPTCHA ClickFix Campaign

A threat actor is using the npm registry and its mirrors as free, trusted hosting for fake Cloudflare CAPTCHA pages that funnel victims into ClickFix social engineering. Because some of these platforms let individual files inside npm packages be opened directly in a browser, they effectively become free web hosting for phishing pages on a reputable domain. OX Security found 24 packages carrying a single index.html lure that redirects visitors to attacker infrastructure. None run code at install time - developers are not the target; the people clicking the links are. After Chrome flagged the original Microsoft typosquat, the actor switched to api.keyval.org as a dead drop resolver, swapping destinations without republishing a single package. The technique was first spotted in July by researcher inf0stache in a "china_airlines" npm package that used a fake Cloudflare verification page, and was also reported by IntelFusions.

AnonyMousKIT - AI-Powered PhaaS Targeting Stolen Apple Devices

SOCRadar's Threat Research Unit (STRU) conducted an inside-out analysis of AnonyMousKIT, a credit-metered, AI-powered Phishing-as-a-Service platform engineered to disable Apple's Activation Lock on stolen devices. The platform automates credential harvesting through a five-channel pipeline: email, SMS, WhatsApp, recorded voice, and conversational AI voice agents impersonating "Alice from Apple Support". By exploiting a bare-relative-path coding flaw in the kit, STRU unraveled a shared-codebase reseller supply chain spanning 506 domains, 168 storefront brands, and 30 confirmed backend installations active since February 2024. Unlike a traditional centralized threat group, AnonyMousKIT operates as a decentralized enterprise structured across four specialized tiers of a cybercrime supply chain.