Cyber Threat Brief — August 19 2026
⚠️ This report is AI-generated. Always validate findings.
1. macOS Screen Sharing Pre-Auth RCE — CVE-2026-65400
TL;DR: CISA added CVE-2026-65400 (CVSS rescored to 9.8) to KEV on August 18. Pre-auth bypass in macOS Screen Sharing SRP implementation grants root RCE over TCP 5900 — attackers are deploying Monero miners on internet-exposed Macs.
What’s New:
- CISA KEV addition August 18; federal remediation deadline pending
- NCSC-NL confirmed active exploitation August 12 — every observed case resulted in root access + Monero miner installation
- Root cause: SRP frame-length validator returns stale success status, treating unauthenticated connections as authenticated; session continues without cryptographic protection (cleartext)
- Multiple PoCs public: fG! obfuscated read-only PoC (July 29), bl4sty read/write/RCE PoC (August 1-2), reverse-shell + LaunchDaemon persistence
- Patched August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9 — hosted bare-metal Mac providers may still provision vulnerable images
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| TCP 5900 exposed to internet | Misconfiguration | T1190 | Firewall logs, Censys/Shodan | Block external access immediately |
| authentication_type: SRP (vs legitimate RSA-SRP) | Exploit indicator | T1078 | ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH | Alert on SRP-only auth type |
| session_username: root | Suspicious session | T1078.003 | macOS Endpoint Security logs | Alert — root user disabled by default |
| session_username: null | Enumeration | T1087 | macOS Endpoint Security logs | Hunt for null-user enumeration attempts |
| SSFileCopySender process with UID 0 GID 80 | Post-exploitation | T1083 | ES_EVENT_TYPE_NOTIFY_EXEC | Monitor for root-context file operations |
| XMRig / Monero miner on macOS | Post-exploitation | T1496 | Process monitoring, CPU utilization | Alert on unexpected mining processes |
| LaunchDaemon persistence (reverse shell) | Persistence | T1543.004 | FSEvents, launchd logs | Monitor /Library/LaunchDaemons/ for new plists |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | Need macOS Screen Sharing pre-auth detection; LaunchDaemon creation rule (generic exists) |
| Elastic | None | Need macOS VNC/Screen Sharing auth anomaly rule |
| Sigma | None | Need rule for SRP-only auth_type in Screen Sharing attach events |
Sources: CISA KEV Alert August 18 · Huntress Analysis · Malwarebytes · The Hacker News
2. StopAndProtect — WordPress C2 + ClickFix Ransomware Campaign
TL;DR: Check Point Research disclosed a large-scale operation using ~2,000 compromised WordPress sites as C2 infrastructure for double-extortion ransomware, credential theft, and lateral movement via SMB/USB worm — 6,000+ victim IPs across US, Russia, and India.
What’s New:
- Check Point Research published full disclosure August 18 after tracking campaign since May 2026
- ClickFix social engineering delivers initial payload: fake CAPTCHA prompts victims to paste PowerShell commands
- Modular .NET toolkit: ransomware, SMB/USB worm, LockScreen, VBS spreader, live victim chat utility, credential stealer
- ~2,000 compromised WordPress domains rotate as C2/payload hosting/exfil storage — resilient infrastructure
- 6,000+ unique victim IPs identified from exposed internal logs (OPSEC failure by operators)
- Exfiltration includes corporate documents, screenshots, credentials, and communication logs
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| ClickFix PowerShell execution (user-initiated) | Initial access | T1204.002 | PowerShell ScriptBlock logs (EID 4104) | Alert on encoded/obfuscated user-pasted PS commands |
| .NET downloader/loader stages | Execution | T1059.001 | Sysmon EID 1, EDR | Hunt for staged .NET binary downloads |
| SMB worm lateral movement | Lateral movement | T1021.002 | SMB audit logs, Zeek | Hunt for anomalous SMB file writes to ADMIN$/C$ shares |
| USB worm propagation | Lateral movement | T1091 | Sysmon EID 11 (file create on removable) | Monitor for autorun/shortcut file creation on USB |
| VBS spreader component | Execution | T1059.005 | Script execution logs | Alert on WScript/CScript launching VBS from temp dirs |
| WordPress C2 callbacks | C2 | T1102 | Web proxy logs | Hunt for high-frequency POST to obscure WordPress paths |
| LockScreen component | Impact | T1491.001 | Process monitoring | Alert on screen-locking binaries outside Windows native |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Malicious PowerShell Process - Encoded Command (partial) | Need ClickFix-specific PowerShell pattern; WordPress C2 callback detection |
| Elastic | PowerShell Suspicious Script with Audio Capture (partial) | Need SMB worm lateral movement pattern; .NET staged loader detection |
| Sigma | proc_creation_win_powershell_encode.yml (partial) | Need VBS spreader from temp directory rule; USB worm autorun creation |
Sources: Check Point Research · Check Point Blog · CyberSecurityNews
Status Updates
- CVE-2026-33824 (Windows IKE Extension): CISA KEV addition August 18. Unit 42 confirmed Chinese-speaking actor sending reverse-shell callbacks to IKE VPN endpoints. Federal deadline August 21 (3 days). Patched April 14 Patch Tuesday. CISA KEV · GridInSoft.
- CVE-2026-55040 (SharePoint Auth Bypass): CISA KEV addition August 18. Active exploitation ongoing since August 12 after Rapid7 PoC. 8,500+ on-prem instances internet-exposed. CISA KEV.
- CVE-2026-59310 (VMware vCenter Path Traversal): CISA KEV addition August 18. China-nexus APT attribution with reverse_ssh persistence. CISA KEV.
- CVE-2026-68820 (Windows AFD.sys LPE): Lazarus FudModule v3.1 rootkit ongoing. CISA KEV deadline August 25 approaching. No new IOCs.
- CVE-2025-62593 (Ray AI Framework): CISA KEV federal deadline tomorrow August 20. ShadowRay 2.0 cryptomining exploitation ongoing.