Advisory ID: NCC-CSIRT-2026-039

Summary: 

JAMF Threat Labs reported AmnesiaStealer, a multi-stage Rust-based macOS information stealer distributed through counterfeit GitHub download pages using ClickFix-style social engineering. Victims are instructed to copy and execute a command in macOS Terminal. Reported capabilities include collection of credentials, Keychain and browser data, Apple Notes, Telegram-related data and documents. A separate module can clone supported Chromium browser profiles and provide remote browser control, creating a risk of misuse of authenticated sessions. NCC-CSIRT has not established that Nigerian organizations have been affected.

Damage: High

Probability: Medium

Product (s): 

• Apple macOS devices
• Chromium-based browsers
• Chromium Browsers’ profiles and stored credentials
• macOS Keychain and locally stored data

Version (s): All macOS and Chromium browser versions

Platform (s): 

• Apple macOS devices
• macOS endpoints
• Enterprise workstations
• Telecommunications operator offices and support environments
• Government and business systems using macOS

Description: 

The reported infection chain begins with a counterfeit GitHub download page that prompts a user to paste and execute a command in Terminal. The command initiates delivery and execution of the malicious payload. The malware then collects selected sensitive information from the compromised Mac. Research also describes a separate browser-control component that can operate a cloned Chromium browser profile remotely. This capability may enable misuse of existing authenticated sessions; it does not mean every account protected by multifactor authentication will necessarily be compromised. The attack relies on user-assisted execution rather than confirmed drive-by exploit in the chain described. No Nigeria-specific targeting or victimization is established by the cited public reporting.

Consequences: 

Potential consequences associated with foreign information manipulation and disinformation campaigns may include:

• Theft of credentials and sensitive local data
• Unauthorized access to email, cloud and other online accounts
• Misuse of authenticated browser sessions
• Exposure of confidential organizational information
• Financial fraud and impersonation
• Potential further compromise through stolen credentials or sessions

Threat Types: 

• Poten
• Information Stealer
• Social Engineering (ClickFix)
• Credential and Session Theft
• Browser-Session Hijacking
• Data Exfiltration

Solutions/Mitigations:  

NCC-CSIRT recommends the following actions:

• Do not paste or execute commands from unfamiliar websites, counterfeit download pages or unsolicited instructions.
• Download applications only from trusted sources and verify their authenticity.
• Ensure macOS, browsers and endpoint security tools are updated and supported.
• Monitor suspicious Terminal activity, untrusted downloads, quarantine-attribute removal, unexpected executable launches and suspicious LaunchAgents or LaunchDaemons.
• Use EDR or equivalent endpoint monitoring on macOS devices where available.
• Enforce least privilege and restrict unauthorized software execution where feasible.
• Review identity, email, cloud and privileged-account logs for suspicious activity.
• If compromise is suspected, isolate the device where feasible, preserve evidence, revoke active sessions and refresh tokens, rotate exposed credentials from a known-clean device, and investigate possible data exfiltration.
• Rebuild the endpoint from a trusted source if system integrity cannot be confidently restored.
• Validate any indicators of compromise against the original research before blocking or using them for detection.

References:

• Office of the Secretary to the Government of the Federation (OSGF): Researchers Uncovered New macOS Information Stealing Malware.
• https://www.jamf.com/blog/amnesia-stealer-macos-infostealer-clickfix/

Advisory ID:   ngCERT-2026-0900020

SUMMARY

ngCERT has identified instances of Open VNC (Virtual Network Computing) services that may expose systems to unauthorised remote access due to inadequate security controls. This exposure presents a significant security risk, as successful unauthorised access could compromise sensitive information, enable credential theft, deploy malware, take over systems, and enable further attacks against connected systems. CVE-2025-27459 highlights the security risks associated with inadequate VNC credential protection. Organisations are advised to disable unnecessary VNC services and restrict required access to trusted networks through firewalls or secure VPN connections.

DESCRIPTION

Open VNC refers to VNC services that are accessible from the internet or other untrusted networks without sufficient access restrictions. VNC provides remote graphical access to systems, allowing connected users to interact with desktops, access files, execute applications and modify system settings. When improperly exposed, attackers can discover VNC services through automated scanning and attempt unauthorised access using weak, default or compromised credentials. Common VNC services may be exposed through ports such as TCP/5900, 5901 and 5902. Inadequate firewall configurations, weak authentication, unnecessary internet exposure and outdated VNC implementations can increase the risk of compromise. As a related case, CVE-2025-27459 affects a VNC application that stores passwords in the Windows Registry using DES encryption; because DES is considered broken, the original passwords can be recovered by an attacker with the required local access. The case highlights the importance of protecting VNC credentials and restricting VNC services to authorised users and trusted networks.

Damage:      Critical 

Probability:  High

Platform(s):  Windows, Linux, macOS, Servers, IoT and OT/ICS System

CONSEQUENCES

Successful exploitation of Open VNC services can lead to:

• 1. Unauthorised Access.
  2. Data Theft.

  3. Credential Compromise.

  4. Malware Deployment.

  5. Lateral Movement.

  6. Session Interception.

  7. Service Disruption.

SOLUTION/MITIGATION

ngCERT recommends the following actions:

• 1. Disable VNC services that are not required and remove unnecessary Internet-facing exposure.

  2. Restrict VNC access to authorised users and trusted networks using firewalls and security groups, particularly for TCP ports 5900, 5901 and 5902.

  3. Use secure VPN connections or remote-access gateways where remote VNC access is required.

  4. Enforce strong, unique credentials and enable multi-factor authentication (MFA) where supported.

  5. Enable TLS or other strong encryption and replace legacy VNC implementations that lack adequate security protections.

  6. Regularly patch and update VNC software, operating systems and related components to address known vulnerabilities.

  7. Monitor VNC activity, review authentication logs and conduct periodic vulnerability assessments to identify and respond to suspicious or unauthorised access.

HYPERLINK

• https://www.kaspersky.com/blog/vnc-vulnerabilities/31462/
• https://www.bleepingcomputer.com/news/security/dozens-of-vnc-vulnerabilities-found-in-linux-windows-solutions/ 
• https://scansearch.net/en/exposures/open-vnc/ 
• https://www.youtube.com/watch?v=b2G4UvlH8A4

Advisory ID:   ngCERT-2026-090002

Damage:      Critical 

Probability:  High

Platform(s):  Kaspersky Endpoint Security version 14.0.0.504; Windows 11 Version 25H2

SUMMARY

ngCERT has observed the public release of HardBreacher, a proof-of-concept (PoC) that claims to exploit a Local Privilege Escalation (LPE) vulnerability in Kaspersky Endpoint Security for Windows. The PoC was tested on a fully patched Windows 11 Version 25H2 system running Kaspersky Endpoint Security Version 14.0.0.504 and may allow a low-privileged user to write a DLL to the protected C:\Windows\System32 directory. The vulnerability has not been assigned a CVE, and the publicly available PoC is unstable and has not been independently verified to provide reliable SYSTEM-level code execution. Kaspersky has addressed the underlying issue. Organisations using Kaspersky Endpoint Security are advised to verify the affected versions in their environments and ensure that the applicable vendor remediation has been applied.

DESCRIPTION

HardBreacher is a PoC that targets a LPE vulnerability in Kaspersky Endpoint Security for Windows. The PoC demonstrates the interaction between a standard Windows user and a privileged process, which may allow unauthorised file operations within the protected C:\Windows\System32 directory, including the creation of MY_SNAKE_IS_SOLID.dll with permissions accessible to the initiating user. The PoC was demonstrated on Windows 11 Version 25H2 with Kaspersky Endpoint Security Version 14.0.0.504 and requires local access or prior code execution on the endpoint. The exploit is unreliable and may require multiple attempts or a system reboot, while current analysis does not independently confirm dependable SYSTEM-level code execution, all affected product versions, or a CVE assignment. Public availability of the PoC could enable attackers to improve its reliability or combine the technique with other methods to achieve further privilege escalation, modify protected resources, disrupt endpoint security controls, or establish persistence. Organisations are advised to verify applicable vendor remediation and monitor for unauthorized DLL creation or modification, abnormal Kaspersky process activity, security-service disruptions, and suspicious privilege changes.

CONSEQUENCES

Successful exploitation could result in:

1. Escalation of privileges from a standard user to SYSTEM-level access.
2. Unauthorised modification of protected Windows system resources.
3. Execution of malicious code with elevated privileges.
4. Disruption or bypass of Kaspersky Endpoint Security controls.
5. Establishment of persistence on affected endpoints.
6. Exposure of sensitive data, credentials, and system resources.
7. Potential lateral movement and further compromise of other organisational systems. 

SOLUTION/MITIGATION

ngCERT recommends the following:

1. Verify all endpoints running Kaspersky Endpoint Security and apply the applicable Kaspersky vendor remediation or security update, particularly Version 14.0.0.504.
2. Keep Windows and Kaspersky Endpoint Security fully updated.
3. Enforce least-privilege access and restrict unnecessary administrative privileges.
4. Monitor C:\Windows\System32 for suspicious DLL creation or modification.
5. Review EDR, SIEM, and Windows logs for abnormal activity and privilege changes.
6. Do not execute the HardBreacher PoC on production systems.
7. Isolate and investigate affected endpoints where exploitation is suspected.  

HYPERLINK

• https://cyberpress.org/hardbreacher-poc-targets-kaspersky-endpoint-security-zero-day/
• https://gbhackers.com/hardbreacher-exploit-targets-kaspersky-endpoint-security/
• https://securityaffairs.com/198214/hacking/chaotic-eclipse-releases-kaspersky-zero-day-hardbreacher.html
• https://www.linkedin.com/pulse/hardbreacher-exploit-targets-kaspersky-endpoint-h5opc/

Advisory ID:   ngCERT-2026-090003

Damage:      Critical (CVSS Score: 9.8)

Probability:  High

Platform(s):  cPanel & WHM and WP Squared

SUMMARY

ngCERT is alerting organisations, businesses, government agencies, website administrators and hosting providers to a critical security vulnerability in cPanel & WHM and WP Squared. The vulnerability, tracked as (CVE-2026-65643), can allow an authenticated hosting customer who can add parked or add-on domains to create arbitrary files on the server. Successful exploitation could lead to code execution as the root user, giving an attacker full control of the server and every account, website and database hosted on it. The vulnerability is rated Critical with a CVSS Score of 9.8 and affects all supported versions of cPanel & WHM. Although patches have been released to fix the flaw, organisations and hosting providers are advised to treat this vulnerability as a high-priority patching requirement.

DESCRIPTION

CVE-2026-65643 is a critical vulnerability in the domain parking and add-on domain functionality of cPanel & WHM. An authenticated cPanel account holder who has permission to add parked or addon domains can exploit the flaw to create arbitrary files anywhere on the underlying server. This capability can be leveraged to achieve code execution as the root user. Domain parking is a routine feature enabled by default for most shared-hosting customers, meaning the attack surface is present on virtually every multi-tenant cPanel environment. Successful exploitation gives the attacker unrestricted control over the entire machine, including every other customer account, website, database and email service hosted on the same server. Affected products are all currently supported versions of cPanel & WHM below. However, the vendor has released security fixes in builds 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2 and later, and WP Squared 11.138.1.7 or later.

CONSEQUENCES

Successful exploitation could result to the following:

1. Access to, modification and removal data belonging to every hosted account, website, application, and database.
2. Deployment persistent backdoors and malware across all tenants.
3. Theft of credentials, TLS certificates, and configuration secrets.
4. Alteration of website content, server configurations, and service settings.
5. Use of compromised server as a pivot point for further attack. 

SOLUTION/MITIGATION

ngCERT recommends that organisations:

1. Immediately update all affected systems to a patched build of cPanel & WHM (11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2 or later) or WP Squared (11.138.1.7 or later) using /scripts/upcp --force or the WHM upgrade interface.
2. Prioritise multi-tenant shared and reseller servers for patching due to the elevated risk of cross-account compromise.
3. Temporarily disable the Parked Domains and Addon Domains features in customer feature lists through WHM where immediate patching is not feasible.
4. Verify the installed cPanel build on every server after updating and confirm it matches a patched version.
5. Audit servers for signs of prior exploitation, including unexpected files outside home directories, unauthorised root processes, new privileged accounts, and anomalous network activity.
6. Isolate any system showing indicators of compromise, preserve forensic evidence, and restore from known-good backups after removing malicious artefacts.
7. Reset credentials for root, WHM, and all administrative accounts on systems that may have been exposed.
8. Enforce least-privilege feature lists so that ordinary customer accounts cannot manage parked or addon domains unless operationally required.
9. Enable automatic daily updates for cPanel where compatible with change-management processes to reduce exposure to future similar flaws.
10. Maintain a current inventory of all cPanel and WP Squared instances, retain tested backups, and continuously monitor multi-tenant hosts for suspicious behaviour.  

HYPERLINK

• https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Vulnerability-in-cPanel-s-Domain-Parking-Functionality-August-27-2026
• https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html
• https://cybersecuritynews.com/critical-cpanel-vulnerability/