CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
Kaspersky says attackers are actively hijacking compromised WhatsApp accounts to push malicious VBScript attachments through WhatsApp Desktop and Web, kicking off multi-stage infections that end with remote access software on victim machines. The day’s most urgent developments center on identity compromise and trusted workflows: Russian intelligence-linked operators are phishing Signal backup recovery keys, while developers face code-execution risk from malicious repositories targeting Amazon Q and AI coding agents.
The WhatsApp campaign stands out because it turns a familiar business channel into a malware delivery path at scale. Kaspersky says the lures arrive as fake business documents from real compromised accounts, and opening the attachment downloads additional malware before installing remote access software. At the same time, FBI and CISA warned that UNC5792 and UNC4221 are manipulating Signal users into surrendering backup recovery keys, giving attackers access to message history without breaking the app’s encryption.
Attackers are also leaning hard on trust borrowed from platforms and tools. Netcraft saw Bluekit use real-time proxying to relay Microsoft MFA prompts and steal credentials, session cookies, and tokens for account takeover. Researchers also disclosed CVE-2026-12957 and CVE-2026-12958 in Amazon Q Developer for VS Code and Language Servers for AWS, where hidden MCP configuration in a malicious repository could trigger code execution and expose inherited AWS credentials, while Mozilla 0DIN showed a clean-looking GitHub repo can coax AI coding agents into running a hidden payload fetched through DNS TXT records.
Editorial: Recommended Actions
01
PRIORITY
Block or heavily restrict VBScript attachments delivered through WhatsApp Desktop and Web, and warn users not to open unsolicited “business document” files sent in chats. Kaspersky says attackers are actively using compromised WhatsApp accounts to push VBScript attachments that start a multi-stage infection chain and end with remote access software on victim systems, with cases observed across multiple countries. Organizations that use WhatsApp for customer, partner, or field communications should treat chat-delivered attachments as an active malware path, not a lower-risk messaging channel.
02
PRIORITY
Update Amazon Q Developer for VS Code and Language Servers for AWS immediately, and review developer workstations for exposure to untrusted repositories with hidden .amazonq/mcp.json files. Researchers say CVE-2026-12957 and CVE-2026-12958 let malicious repositories auto-load MCP configuration without proper trust checks, enabling arbitrary code execution and possible exposure of inherited AWS credentials, session tokens, API secrets, and SSH agent access. Teams using Amazon Q in development pipelines should treat repository trust and extension versioning as credential-protection controls.
03
PRIORITY
Audit who can delete cloud storage buckets and inventory every logging, replication, and transfer workflow that depends on bucket names in AWS, Azure, and Google Cloud. Unit 42 says attackers with bucket-delete capability can recreate the same globally unique name under their own account and silently receive data from existing pipelines that keep sending to the reused name. Any organization using S3, Azure Storage, or Google Cloud Storage for telemetry, backups, or cross-account transfers should treat bucket deletion rights as potential exfiltration privileges.
04
PRIORITY
Harden Microsoft account defenses for session hijacking, not just password theft, and train users to distrust perfect-looking login flows that still request MFA. Netcraft says Bluekit is a phishing-as-a-service platform using real-time proxying to relay MFA challenges and steal Microsoft credentials, session cookies, and tokens for account takeover, with about 70 live hostnames seen in one week. Organizations that rely on Microsoft accounts should assume some phishing campaigns are designed to capture authenticated sessions after MFA succeeds.
05
TELL SIGNAL USERS NOW
never share backup recovery keys with anyone claiming to offer support, and prioritize that warning for officials, military personnel, journalists, activists, and Ukraine-related staff. FBI and CISA warn that Russian intelligence-linked actors including UNC5792 and UNC4221 are socially engineering users into revealing those keys, which lets attackers restore Signal backups and read message history without breaking encryption. Any organization that depends on Signal for sensitive communications should treat backup recovery keys as equivalent to message access.
ROUNDTABLE
Expert Panel Discussion
11 AI experts analyzed this briefing across 3 turns of structured debate
11Agents12Messages18mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_