Session CRT-20260624 — 24 June 2026 · Morning Edition

Look, C11 is a straight social-engineering-to-host-compromise chain, not magic. The flow is: a compromised WhatsApp account sends a fake business/financial document lure, the victim opens a .vbs file, WScript.exe launches it, the script pulls down more VBScript stages, and then the chain pivots into legitimate ManageEngine Endpoint Central / RMM for persistence and remote control. One branch also tampers with UAC, so I would treat that branch as an escalation attempt, not just noise. Malaysia is the only geography I’d call out confidently from the current evidence as the highest victim concentration; the campaign is broader/global, but the initial WhatsApp account compromise method is still unknown.

For hunting, focus on the boring stuff that actually bites: wscript.exe spawning powershell.exe, cmd.exe, mshta.exe, or cscript.exe; VBScript in Downloads/AppData/Temp; new Run keys, scheduled tasks, startup-folder writes; and immediate outbound traffic after script launch to odd domains or direct IPs. If you see UAC tampering plus script execution, stop calling it “phishing.” That’s host compromise with admin-seeking intent. Contain hard: isolate the box, review local admin creds, and inventory any new RMM/service installs.

C8 is uglier but cleaner. The packages called out are aes-decode-runner-pro, postcss-minify-selector, and postcss-minify-selector-parser; the broader cluster also includes procwire, routecraft, endpointmap, bytecraft, and staticlayer. The payload on Windows is a RAT/dropper chain that runs during npm install, writes a PowerShell script, pulls a ZIP, and drops VBScript plus a Python runtime and Python malware components. JFrog’s evidence shows persistence artifacts like %TEMP%\winPatch, %TEMP%\.store, %TEMP%\.host, chost.exe, loader.py, and a HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry (csshost), which gives defenders something concrete to hunt. The RAT can steal Chrome credentials and extension data, run shell commands, and move files to/from C2. Removal from npm is not confirmed from the current evidence; in fact, one source says the packages were still available at publish time, so assume they may still be live until you verify otherwise.

On GhostShell / MB-0009: the report is dated 2026-06-22, and the current evidence links MB-0009 to CVE-2025-8088 and CVE-2025-6218. The report also shows Besomar-impersonation lures and stage-2 behavior including screen capture and browser credential theft. Confidence on the operational picture is moderate.

On Handala / Kash Patel’s Gmail: SecurityWeek says the FBI confirmed threat actors gained access to an email account belonging to Kash Patel, and also says no government information was compromised and the account appears to be personal Gmail, not FBI systems. Attribution to Handala is supported in the reporting; attribution to MOIS-directed activity is presented as the government’s position in the coverage, so I’d treat that as moderate confidence rather than a settled fact.

Look, on C19 Xsolis, the current picture is a phishing-led breach affecting about 1.4M people. The visible evidence says exposed data included names, DOBs, addresses, SSNs, insurance details, and medical treatment info; Xsolis says it detected unauthorized activity on Jan. 22 after the intrusion started two days earlier, and it reported the incident to HHS. One source says seven health systems were involved, but I’d treat that as confirmed only if you have the buyer-facing notice or HHS entry in hand. The absence of a ransomware claim does not reduce PHI harm — this is still a confidentiality breach with identity-theft and medical-fraud risk, and in healthcare that means notification pressure is driven by exposure of PHI/PII, not by whether an extortion gang posted a logo.

For healthcare phishing controls: CRITICAL (do today) — force password resets for exposed accounts, kill active sessions, enable/verify MFA, block legacy auth, and hunt for mailbox rule tampering and forwarding abuse; those are the controls that actually stop follow-on abuse. HIGH (this week) — tighten user training around invoice/referral/phishing lures, add conditional access, and review vendor access paths because third-party healthcare platforms widen blast radius fast. MEDIUM (schedule) — longer-term PHI segmentation, DLP, and stronger vendor-risk reviews. On notification obligations, the practical rule is: once you know PHI/SSNs were exposed, legal/compliance needs to determine jurisdictional breach notice and patient notification timelines immediately; don’t wait for proof of misuse.

For C11 ManageEngine RMM campaign: containment first. If ManageEngine or adjacent RMM is unexpectedly installed, assume persistent remote access until proven otherwise: isolate the host, revoke admin creds, rotate service/account passwords, review new services and scheduled tasks, and check for outbound C2 from RMM processes. CRITICAL = remove unauthorized RMM, reset privileged credentials, and segment affected endpoints; HIGH = hunt across the fleet for the same installers, service names, and unusual remote sessions; MEDIUM = harden RMM allowlists and admin approval workflows. For C8 npm PostCSS RAT packages, treat them as a supply-chain compromise: yank the package versions from builds, rotate tokens used in the affected CI/CD path, purge compromised dependencies from lockfiles, and scan developer endpoints and build runners for postinstall execution and unexpected outbound connections. That’s the move: cut access, rotate secrets, and verify no persistence in build systems before you trust the pipeline again.

Quick deltas: SOCRadar FortiBleed checker — use it as a signal, not proof; if it flags exposure, immediately rotate any potentially exposed credentials and sessions, but validate against your own asset inventory before you panic. Boss Scam WhatsApp — lock down session verification and finance approval controls: out-of-band callback for payment changes, dual approval, and no transfer based on chat-only requests. ShapedPlugin Pro — WordPress operators should assume backdoored updates are a supply-chain event: verify plugin provenance, compare hashes, and roll back to a known-good package before updating in production.

CRITICAL (do today): reset creds / revoke sessions / isolate affected systems.
HIGH (this week): fleet-wide hunting for RMM, npm compromise, and suspicious WordPress plugin updates.
MEDIUM (schedule): tighten vendor-risk, PHI segmentation, and approval workflows.