9 minhigh
10th August – Threat Intelligence Report
This weekly threat intelligence report covers multiple active campaigns and critical vulnerabilities. Notable items include a large-scale npm supply-chain compromise (Shai-Hulud CHAINDROP) affecting 400+ packages, critical vulnerabilities in AI coding tools (Gemini CLI and Claude Code), a vendor-installed backdoor in Zbtlink routers, and a macOS ClickFix campaign distributing infostealers via 250+ look-alike domains. Multiple critical patches were released for Cisco SD-WAN/IOS XE, WordPress, and TP-Link Omada products.
Sens:▲ 24hConf:medium
Showing defanged values
- cveCVE-2026-12537Flaw in Gemini CLI workflows rated CVSS 10.0 that could expose AI automation environments to code execution and API key theft.
- cveCVE-2026-54316Vulnerability in Claude Code that could expose automation environments to code execution and API key theft.
- cveCVE-2026-64638XSS2Shell flaw that can turn a failed login into pre-authentication cross-site scripting and, under specific conditions, remote code execution.
Detection / Hunteropenrouter
What Happened
Multiple cyberattacks and security flaws were reported this week. Hackers compromised a popular software library used by JavaScript developers, potentially affecting billions of downloads. Security flaws were found in AI coding assistants from Google and Anthropic that could let attackers steal API keys and run malicious code. A backdoor was discovered in over 20 models of internet routers that gives attackers full control. Fake websites are targeting Mac users with malware disguised as software updates. Organizations using WordPress, Cisco networking equipment, or TP-Link devices should apply the available security patches. Developers should audit their npm dependencies for compromised packages.
Key Takeaways
- Shai-Hulud CHAINDROP campaign backdoored 400+ npm packages by compromising the keyv library maintainer, stealing developer tokens via preinstall hooks across an ecosystem with 1.3 billion monthly downloads.
- CVE-2026-12537 (CVSS 10.0) in Google Gemini CLI and CVE-2026-54316 in Anthropic Claude Code could expose AI automation environments to code execution and API key theft; both vendors released patches.
- A vendor-installed backdoor was found across 20+ Zbtlink router models (Wiflyer, ZBT brands) that contacts hardcoded servers and accepts unauthenticated root-privilege commands.
- WordPress CVE-2026-64638 (XSS2Shell) can convert a failed login into pre-authentication cross-site scripting and potentially remote code execution; fixed in version 7.0.3 with backports to 4.7.
- macOS ClickFix campaign uses 250+ look-alike domains to distribute MacSync and Atomic Stealer, fingerprinting visitors before showing malicious instructions to target genuine macOS users.
Affected Systems
- Zbtlink routers (Wiflyer and ZBT brands, 20+ models)
- Google Gemini CLI
- Anthropic Claude Code
- WordPress versions 4.7 through 7.0.x
- Cisco Catalyst SD-WAN and IOS XE software
- TP-Link Omada controllers, network devices, mobile applications, VIGI cameras
- Cloudflare Code Mode / workerd runtime
- npm ecosystem (keyv library and dependent packages)
- Coinkite Coldcard hardware wallets
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-12537 | Google Gemini CLI | Critical | Flaw in Gemini CLI workflows rated CVSS 10.0 that could expose AI automation environments to code execution and API key theft. |
| CVE-2026-54316 | Anthropic Claude Code | Vulnerability in Claude Code that could expose automation environments to code execution and API key theft. | |
| CVE-2026-64638 | WordPress Core | High | XSS2Shell flaw that can turn a failed login into pre-authentication cross-site scripting and, under specific conditions, remote code execution. |
Attack Chain
- Initial Access: Shai-Hulud campaign compromises keyv npm maintainer to inject backdoored preinstall hooks into 400+ packages
- Execution: Preinstall hook executes when developers install affected npm packages, stealing developer tokens
- Persistence: Stolen tokens enable attackers to republish modified packages, expanding the supply-chain compromise
- C2/Payload: WEL1DROPPER downloader in separate npm campaign retrieves payloads via Cloudflare Workers or DNS TXT records and establishes persistence
- Exfiltration: MacSync and Atomic Stealer deployed via ClickFix campaign exfiltrate data from targeted macOS users
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article is a weekly summary report and does not include detection rules, queries, or signatures.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The article does not provide specific file hashes, process names, or behavioral indicators for endpoint detection. The npm supply-chain and macOS ClickFix campaigns would require package-level and browser-level telemetry not typically covered by EDR alone. |
| Network Visibility | Low | No specific C2 IPs, domains, or URLs are provided. The WEL1DROPPER campaign uses Cloudflare Workers and DNS TXT records for payload retrieval, which blends with legitimate infrastructure traffic. |
| Detection Difficulty | Hard | The campaigns described use legitimate infrastructure (Cloudflare Workers, npm registry, DNS TXT records) and social engineering techniques that blend with normal activity. The Zbtlink backdoor contacts hardcoded servers but no specific indicators are provided. The macOS ClickFix campaign fingerprints visitors to evade automated scanners. |
Required Log Sources
- npm package installation logs
- DNS query logs (for TXT record lookups)
- Web proxy logs (for look-alike domain detection)
- Endpoint process execution logs
- Developer token access audit logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for npm packages with preinstall or postinstall hooks that execute network calls or environment variable access, as the Shai-Hulud campaign uses preinstall hooks to steal developer tokens. | npm installation logs, package.json inspection, process execution logs during package install | Execution | Medium - many legitimate npm packages use install hooks for build steps or configuration. |
| Consider hunting for DNS TXT record queries to unusual or non-standard domains, as WEL1DROPPER retrieves payloads via DNS TXT records. | DNS query logs, passive DNS data | Command and Control | Medium - DNS TXT records are used legitimately for SPF, DKIM, and domain verification. |
| Consider hunting for outbound connections from router management interfaces to non-vendor IP addresses or domains, as Zbtlink backdoor contacts hardcoded servers. | Network firewall logs, router NetFlow data, DNS logs from router management networks | Command and Control | Low - router management interfaces contacting unknown servers is unusual. |
| Consider hunting for browser activity to domains resembling legitimate software update or support pages that serve macOS payloads, as the ClickFix campaign uses 250+ look-alike domains. | Web proxy logs, DNS logs, URL filtering logs | Initial Access | Medium - look-alike domains require typosquatting or homoglyph detection to differentiate from legitimate sites. |
Control Gaps
- Standard network security controls may not detect payload delivery via Cloudflare Workers or DNS TXT records as these use legitimate infrastructure.
- Automated security scanners may be evaded by the macOS ClickFix campaign which fingerprints visitors before displaying malicious content.
- npm package scanning may not detect backdoored preinstall hooks if the hook code is obfuscated or if the package appears functionally legitimate.
- Router backdoors contacting hardcoded vendor servers may bypass firewall rules if the servers appear to belong to a legitimate vendor.
Key Behavioral Indicators
- npm packages with preinstall hooks making network calls or accessing environment variables for tokens
- DNS TXT record lookups to non-standard domains as a payload retrieval mechanism
- Router management interfaces establishing outbound connections to hardcoded servers accepting unauthenticated commands
- Browser sessions to look-alike domains that conditionally display malicious instructions based on visitor fingerprinting
- Developer tokens being used from unexpected IP addresses or geographies following npm package installation
False Positive Assessment
Medium - The campaigns described use legitimate infrastructure and social engineering techniques. DNS TXT record usage, Cloudflare Workers traffic, and npm install hooks all have legitimate uses that could generate false positives without additional behavioral context.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider auditing npm dependencies for the keyv library and any packages from the Shai-Hulud CHAINDROP campaign, and evaluate whether developer tokens have been rotated.
- Consider patching Google Gemini CLI and Anthropic Claude Code to the latest versions if these tools are used in your development environment.
- If your organization uses Zbtlink, Wiflyer, or ZBT routers, consider isolating them from management networks until firmware status can be verified.
- Consider applying WordPress 7.0.3 or the appropriate backported patch for any supported WordPress installations.
Infrastructure Hardening
- Evaluate whether Cisco Catalyst SD-WAN and IOS XE patches released August 5 should be prioritized in your patching schedule given the CVSS 9.9 severity.
- Consider applying TP-Link Omada firmware updates across controllers, network devices, mobile applications, and VIGI cameras if these products are deployed.
- If your organization uses Cloudflare Workers, consider reviewing whether Code Mode is enabled and whether the workerd runtime patches have been applied.
- Consider implementing DNS monitoring for TXT record lookups to unusual domains as a detection for WEL1DROPPER-style payload delivery.
User Protection
- Consider deploying or updating URL filtering categories to block known look-alike domains associated with the macOS ClickFix campaign.
- Evaluate whether endpoint detection on macOS systems covers Atomic Stealer and MacSync malware families.
- If your organization uses Coinkite Coldcard hardware wallets, consider verifying that patched firmware has been applied and reviewing recent transaction history.
Security Awareness
- Consider reminding developers to review npm package install hooks and use package-lock files or dependency pinning to reduce supply-chain risk.
- Consider updating security awareness training to cover social engineering via phone calls impersonating IT staff, as observed in the UNC6671 campaign targeting financial firms.
- Consider briefing finance and IT staff on the UNC6671 tactics of caller impersonation and spoofed websites for credential and MFA code capture.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
