Cyber Threat Brief — July 24 2026
⚠️ This report is AI-generated. Always validate findings.
1. FakeAgent: Claude Desktop Malvertising Delivers SectopRAT via DLL Sideloading
TL;DR: Bing malvertising redirects victims through a legitimate claude.ai public artifact to download a trojanized Claude Desktop installer that deploys SectopRAT via DLL sideloading, GPU-shader payload encryption, and EtherHiding C2 — 29 organizations hit July 21-22.
What’s New:
- Attacker created public Claude Artifact (
ca456f1f-44c0-42af-b329-4f1c7534a877) mimicking Claude Desktop download page — 7,100 views before Anthropic takedown - Redirect chain: Bing ad → claude.ai artifact →
claude.ai.download-app[.]us→downloading-api.it[.]com/html/claude/win→ClaudeDesktop.exe ClaudeDesktop.exeis JetBrainsjcef_helper.exesideloading VMProtect-packedlibcef.dll; persistence viaDockerDesktop.exescheduled task andsslconf.exe(IBM SPSS) sideloadingtempdir.dll- GPU anti-VM gate checks DXGI adapters for QEMU/VMware vendor IDs, VRAM <1GB, and compute shader timing; payload decrypted via DirectX SM5 shader with modified AES-256-CTR (non-standard MixColumns)
- Same operator linked to April 2026 Docker Hub campaign (StealC via
libcef.dllsideloading); domainpolse[.]usseized in Microsoft Operation Endgame
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| 2.24.131[.]246 | IPv4 (active C2) | T1071.001 | Proxy/Firewall | Block |
| download-app[.]us | Domain | T1566.002 | DNS/Proxy | Block |
| 5ca8758c-02d0-4a72-89c8-d468b66dda41[.]com | Domain (backup C2) | T1071.001 | DNS/Proxy | Block |
| downloading-api.it[.]com | Domain | T1105 | DNS/Proxy | Block |
| 0xe012d0f34cde9b870e9d9ed566ea5f8fd9b92228 | ETH BSC Contract | T1102.002 | — | Indicator |
| 0xc1907d7be91f95903ad66d775c397302e7dd9228 | ETH BSC Contract | T1102.002 | — | Indicator |
| 1cd58cfba596da296ab1878d74023e00c399345a1b6c2a0e5446c53563f4e3bb | SHA256 tempdir.dll | T1574.002 | EDR/Sysmon | Block/Hunt |
| 26bae4d7012bf59847ab4036a065419c3d4ca47e020479f55b3b2c6d0d21394a | SHA256 libcef.dll | T1574.002 | EDR/Sysmon | Block/Hunt |
| 1fe3646d27d286db8123297e06ae7badf3e26f352a04f91b6d82c28869a91664 | SHA256 SectopRAT payload | T1055 | EDR | Block |
ClaudeDesktop.exe → Defender exclusion + sched task | Behavior | T1562.001, T1053.005 | Sysmon/EDR | Hunt |
sslconf.exe in %APPDATA%\Microsoft\EdgeUpdate\Install\ | File path | T1036.005 | Sysmon EID 11 | Hunt |
| Historical C2 IPs (see Huntress blog) | IPv4 list (21 IPs, May 2025-present) | T1071 | Firewall | Block retroactively |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No rule for jcef_helper.exe/libcef.dll sideloading, no EtherHiding BSC contract detection, no GPU-shader payload decryption indicators |
| Elastic | Suspicious DLL Loaded via Side-Loading (generic) | Needs tuning for jcef_helper.exe + libcef.dll pair |
| Sigma | proc_creation_win_susp_sideload.yml (generic) | Needs IOC-specific tuning; no EtherHiding signature |
Sources: Huntress FakeAgent Analysis, BleepingComputer
2. RefluXFS: 9-Year-Old Linux Kernel XFS Race Condition Grants Silent Root — CVE-2026-64600
TL;DR: Race condition in Linux kernel XFS copy-on-write path lets unprivileged local users overwrite any readable file on an XFS volume and gain persistent root — silently, with no kernel log output, bypassing SELinux. 16.4M+ systems estimated affected.
What’s New:
- Qualys disclosed July 22; affects Linux kernel v4.11+ (since 2017) — 9-year-old bug
- Two concurrent O_DIRECT writes to a reflinked file; kernel drops inode lock during transaction log wait, allowing stale metadata write to original shared block
- PoC demonstrated modifying
/etc/passwdand SUID-root binaries for persistent root; changes survive reboots - XFS reflink enabled by default on RHEL 8+, Oracle Linux, AlmaLinux, Rocky Linux, Fedora
- No kernel log output on exploitation — traditional log-based detection fails
- Qualys has working PoC but has NOT released exploit code publicly
- Vendor-fixed kernels available for RHEL, Oracle Linux, AlmaLinux, Rocky Linux, Fedora
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| XFS reflink=1 + kernel < fixed version | Config | T1068 | Package manager | Patch immediately |
Unexpected /etc/passwd modifications | File integrity | T1548.001 | AIDE/OSSEC/auditd | Hunt |
| Unexpected SUID binary modifications | File integrity | T1548.001 | AIDE/OSSEC/auditd | Hunt |
cp --reflink or ioctl(FICLONE) in user context | Syscall | T1068 | auditd | Baseline |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No XFS reflink race detection; need FIM for /etc/passwd + SUID changes |
| Elastic | None | No coverage |
| Sigma | None | No community rule yet; log-based detection fundamentally limited per Qualys |
Sources: Qualys Blog, BleepingComputer, The Hacker News
Status Updates
- CVE-2026-50522 (SharePoint Deserialization RCE): CISA KEV federal deadline TOMORROW July 25. Active exploitation via BinaryFormatter payload at
/_trust/default.aspx. Machine key theft enables persistence surviving patching. Original brief. - CVE-2026-16232 (Check Point SmartConsole): CISA KEV federal deadline TOMORROW July 25. Zero-day auth bypass exploitation ongoing against small number of customers. Original brief.
- CVE-2026-6875 (ServiceNow AI Platform): Active exploitation ongoing since July 18. Second sandbox-escape gadget chain bypasses original PoC defenses. Fortune 500 and critical infrastructure victims confirmed. Not yet on CISA KEV. Original brief.
- CVE-2026-63030 / CVE-2026-60137 (WordPress wp2shell): Mass exploitation ongoing. 35 exploitation attempts across 13 IPs per KEVIntel. WP-SHELLSTORM crew attributed. Original brief.