F5 BIG-IP zero-day under active attack

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🔓 F5 BIG-IP zero-day under active attack

🎣 Microsoft details EvilTokens takedown after 12,000 accounts hijacked

🦠 New malware lets AI pick its next move

⚠️ SD-WAN server flaw under active attack

🐛 KVM flaw exposes host memory

Plus: 💡 6 strategies & tactics, 🎁 8 other news you might like, 🧰 6 tools, and 📚 3 papers.

🔓 F5 BIG-IP zero-day under active attack LINK

F5 and CISA warned today that hackers have been exploiting a critical BIG-IP Access Policy Manager (APM) zero-day, tracked as CVE-2026-94127 (critical, CVSS 9.8), which F5 says it discovered internally and has now patched with hotfixes.

The flaw lets attackers with no login run code on the appliance by sending malicious traffic, but only when BIG-IP APM is set up as an OAuth Authorization Server on a virtual server with an access policy configured; systems in Appliance mode are also affected.

Vulnerable versions are 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3, and F5 published three indicators of compromise whose combined, frequent appearance points to an attack, with CISA urging federal agencies to patch within three days.

🎣 Microsoft details EvilTokens takedown after 12,000 accounts hijacked LINK

Microsoft and law enforcement partners disrupted EvilTokens, a phishing-as-a-service operation that hijacked more than 12,000 inboxes across over 10,000 organizations, seizing 50 websites and disabling over 150 domains tied to its infrastructure.

Victims were tricked into entering an authentication code on Microsoft's legitimate sign-in page, handing over session tokens without revealing passwords, so access persisted even after a password reset unless the sessions and tokens were also revoked.

Sold on Telegram for a $1,500 fee plus $500 monthly, the service used AI to summarize mailboxes, find wire transfer discussions and vendor invoices, identify "money movers" and draft messages impersonating trusted contacts to accelerate fraud.

🦠 New malware lets AI pick its next move LINK

Cisco Talos documented CLOSEDQUORUM, a Windows implant that hands control of its next move to a panel of commercial large language models instead of relying on a human-operated command-and-control server to run the intrusion.

Written in Go and weighing 16.4MB, the malware queries DeepSeek, Qwen, Mistral, and Gemini to vote on a fixed menu, steal data, inject code, or set up persistence, aiming to harvest user credentials and crypto wallets, breaking ties by favoring DeepSeek first.

Talos never ran it fully against a live target because the copy they examined shipped with placeholder API keys and a dummy webhook, but static analysis confirmed the decision loop works, and they released the open-source CAIRN framework to classify such AI-integrated malware from file metadata.

⚠️ SD-WAN server flaw under active attack LINK

Arista has shipped urgent patches for a maximum severity (CVSS 10/10) flaw in on-premises VeloCloud Orchestrator that attackers are already exploiting as a zero-day to reach privileged internal functionality of the SD-WAN management tool.

The bug, CVE-2026-93952, is an improper input validation issue in VeloCloud Orchestrator On-Prem; a remote attacker only needs network access to the VCO web interface and the public part of the VeloCloud Edge authentication certificate, with no tenant or operator credentials required.

Fixed in VCO versions 5.2.3.16 and 6.4.2.8, the flaw threatens the confidentiality, integrity, and availability of the orchestrator; with no definitive indicators of compromise, Arista advises reviewing VCO web access, backend application, and system logs for suspicious activity.

🐛 KVM flaw exposes host memory LINK

A critical flaw in the Linux Kernel-based Virtual Machine (KVM) for ARM64 systems lets attackers break out of a guest virtual machine and read and write the host kernel's memory directly.

The bug, CVE-2026-89775, affects ARM64 hosts with nested virtualization enabled, where a size calculation returns zero so an invalidation step is skipped, leaving a freed host page still mapped writable into the attacker's guest.

Disclosed after its embargo expired with no exploitation reported, the flaw is fixed in the mainline Linux kernel; where /dev/kvm has world-writable 0666 permissions, an unprivileged local user could exploit it to gain root, so admins should patch or disable nested virtualization.

💡 Strategies & Tactics

> Prismor: Open-source runtime control plane for AI agents: Prismor checks each action an AI coding agent tries before it runs, blocking risky commands or package installs to stop compromised code from causing harm.

> Rogue external MFA providers can steal passwords during logins: Attackers with high-level access can register a fake external MFA provider that shows a convincing Microsoft password prompt, capturing credentials during logins.

> How Cloud Privilege Escalation Paths Form: Detect cloud privilege-escalation risks by mapping how individually harmless permissions combine into paths to admin access, not by reviewing permissions one at a time.

> GitHub App Private Keys: 474 Leaked Keys Exposed: Leaked GitHub App keys that never expire let one exposed credential grant attackers lasting access to private code and even full organization takeover.

> The Blueprint: What the hell are my agents doing?: Amazon, Google, and other software firms formed the Blueprint Alliance to build shared standards for tracking and controlling AI agents like human users, since only 34% of organizations currently do.

> Inside AI Prompt Security: Why Stopping Every LLM Exploit Is Impossible: Layered defenses make chatbot attacks harder but never fully stop them, because language models can't reliably tell developer instructions from user tricks.

Other news you might like

• Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RATLINK

• Autonomous AI Agents Hack Retailers for $25 and Steal 600,000 Credit CardsLINK

• Critical SolarWinds Flaws Let Attackers Remotely Execute Code on Observability ServersLINK

• MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain AttackLINK

• Critical ManageEngine Flaw Lets Attackers Gain SYSTEM Access Through Windows Login ScreenLINK

• Hacking group ShinyHunters claims it breached the FBI, stole agents’ and applicants’ dataLINK

• Check Point warns of Management Server zero-day exploited in attacksLINK

• CVE-2026-87902: how close is your WordPress to remote code execution?LINK

🧰 Trending tools

Halo: detects deepfakes and synthetic media across text, image, and audio via an API, helping fraud and trust teams block attacks.LINK

Execlave: enforces runtime policies, spend limits, kill switches, and audit logs on autonomous AI agents while mapping controls to SOC 2, EU AI Act, and ISO 27001.LINK

qsa.sh: scans your public IP for open ports and known vulnerabilities using naabu, nmap, and nuclei, streaming results to your terminal via one curl command.LINK

Cybermes: an autonomous security framework for bug bounty and red teaming, using AI agents with specialized reasoning and multiple language models.LINK

KUMO-Domain-Recon-Tool: performs domain OSINT and security reconnaissance across 27 parallel modules, gathering DNS, open ports, leaked credentials, subdomains, CVEs, and malware data.LINK

all-your-agents: monitors and displays all AI agents running on your machine, providing visibility into their activity and processes.LINK

📚 Trending papers & reports

Privacy stress-testing gets a sharper toolkit for measuring how much private data a supposedly secure model leaks, using specially crafted test examples that reveal several times more exposure than earlier methods.LINK

Deception-aware hacking bots can spot security decoy traps ~97% of the time versus 19% when unaware, then flip them against defenders, showing that honeypot defenses fail against attackers who know to look for them.LINK

Agent-to-agent guardrails stop AI assistants from acting on hidden, unauthorized instructions slipped into their messages, salvaging the useful parts and safely redoing the task instead of blindly trusting or discarding everything.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!