IT threat evolution in Q2 2026. Non-mobile statistics

What Happened

A security company published its quarterly report on computer threats for April through June 2026. The report highlights several important developments. Microsoft shut down a service that was creating fake digital certificates to make malicious software look legitimate, which was used by multiple ransomware groups. A security flaw in Microsoft's own antivirus software is being actively used by ransomware attackers to gain elevated access to systems. A separate critical flaw in Check Point's VPN software was exploited by the Qilin ransomware group before a fix was available. A group called PayoutsKing is using virtual machine software to hide their activities from security tools on compromised computers. Organizations should ensure all security patches are applied promptly, especially for the vulnerabilities listed in government catalogs of known exploited flaws, and should review their VPN and endpoint security configurations.

Key Takeaways

• Microsoft dismantled the Fox Tempest malware-signing-as-a-service operation that abused Microsoft Artifact Signing to produce code-signing certificates for ransomware groups including Rhysida, Akira, INC, Qilin, and BlackByte.
• CISA confirmed CVE-2026-33825 (BlueHammer), a local privilege escalation flaw in Microsoft Defender, is actively exploited in ransomware attacks and added it to the KEV catalog.
• Check Point linked zero-day exploitation of CVE-2026-50751 in Check Point Remote Access VPN to the Qilin ransomware group, with activity spiking in early June 2026.
• PayoutsKing group uses the legitimate QEMU emulator to deploy hidden Alpine Linux-based virtual machines on compromised hosts, evading security tooling and establishing backdoor access via reverse SSH tunnels.
• FlutterShell, a new macOS backdoor built with the Flutter framework, passed Apple notarization and uses WebView bridge functions to execute arbitrary payloads delivered via malicious JavaScript.

Affected Systems

• Microsoft Defender (CVE-2026-33825)
• Check Point Remote Access VPN and Mobile Access (CVE-2026-50751)
• Check Point site-to-site VPN using IKEv1 (CVE-2026-50752)
• macOS systems targeted by FlutterShell backdoor
• IoT devices targeted by Mirai and Prometei botnets
• IDE environments targeted by GlassWorm stealer via Open VSX Registry extensions
• npm ecosystems affected by art-template supply chain compromise

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Ransomware groups leverage stolen or fraudulently obtained code-signing certificates from the Fox Tempest MSaaS platform to deliver signed malicious payloads
2. Exploitation: Attackers exploit CVE-2026-33825 in Microsoft Defender for local privilege escalation or CVE-2026-50751 in Check Point VPN for remote access
3. Evasion: PayoutsKing group deploys hidden Alpine Linux VMs via QEMU on compromised hosts to evade security tooling visibility
4. Persistence: Hidden VMs configured as backdoors managed via reverse SSH tunnels to attacker C2 infrastructure
5. Credential Theft: Tools deployed inside hidden VMs include credential theft software
6. Impact: Ransomware deployment and data exfiltration; Qilin accounted for 14.57% of all data leak site victims in Q2 2026

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article is a statistical threat landscape report and does not contain detection rules, queries, or signatures.

Detection Engineering Assessment

Required Log Sources

• Microsoft Defender update and scan logs (CVE-2026-33825)
• Check Point VPN authentication and session logs (CVE-2026-50751)
• EDR process creation and command line telemetry
• Network flow data for reverse SSH tunnel detection
• Code-signing certificate validation logs
• Apple notarization and Gatekeeper logs for macOS endpoints
• npm package audit and dependency logs

Hunting Hypotheses

Control Gaps

• EDR solutions may lack visibility into processes running inside QEMU-hosted virtual machines, allowing PayoutsKing to operate undetected.
• Code-signing validation controls would not flag malware signed with valid certificates from the Fox Tempest MSaaS operation before Microsoft revoked them.
• Apple notarization controls did not prevent FlutterShell from passing validation, indicating notarization alone is insufficient for macOS threat prevention.
• Traditional signature-based detection may not identify supply chain compromises in npm packages or IDE extensions until after the malicious payload is delivered.
• Network security monitoring may not detect reverse SSH tunnels if SSH egress is permitted by policy.

Key Behavioral Indicators

• QEMU process execution on endpoints where virtualization is not standard practice
• Reverse SSH tunnel connections from internal hosts to external IP addresses
• Executables signed with recently revoked certificates associated with Microsoft Artifact Signing abuse
• Anomalous Check Point VPN session patterns including unexpected source IPs or session durations
• macOS applications using Flutter WebView with registered bridge functions for native execution
• New IDE extensions installed from Open VSX Registry with network exfiltration behavior
• npm package art-template versions exhibiting unexpected network connections or payload injection behavior

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider disabling IKEv1 in favor of IKEv2 for site-to-site VPN connections where supported by your infrastructure, as CVE-2026-50752 affects the legacy IKEv1 protocol.
• Evaluate whether egress SSH traffic from internal hosts should be restricted or tunneled through a bastion host to reduce the risk of reverse SSH tunnel C2 channels.
• Consider implementing application allow-listing for virtualization software such as QEMU on endpoints where it is not required for business operations.
• If applicable, consider reviewing and tightening code-signing certificate validation policies to check certificate revocation status in real time.

User Protection

• Consider deploying endpoint detection capabilities that monitor for QEMU or emulator process execution on non-developer endpoints.
• Evaluate whether your macOS endpoint protection includes behavioral detection for WebView bridge function abuse, as notarization alone did not prevent FlutterShell.
• Consider implementing npm package integrity verification and dependency scanning in CI/CD pipelines to detect supply chain compromises such as the art-template incident.
• If your organization uses IDE environments, consider restricting extension installation to approved marketplaces and monitoring for extensions that exhibit network exfiltration behavior.

Security Awareness

• Consider incorporating awareness training on supply chain risks, particularly around npm package updates and IDE extension installation.
• Consider reminding development teams to verify package integrity and review changelogs for unexpected modifications in dependencies.
• Where applicable, consider training users on the limitations of code-signing and notarization as trust indicators, emphasizing that signed or notarized software is not guaranteed to be safe.

MITRE ATT&CK Mapping

Additional IOCs

• Other:
  • art-template - npm package compromised in a supply chain attack; the weaponized package injected the Coruna exploit kit into web applications, targeting iOS devices.