[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPjoB0EqC0sbWuC8Q8J9Kb0L2eCnOtRpNh0Pr500Ui7k":3},{"article":4,"iocs":59,"watch_terms":73,"solutions":74,"lesson":35},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"fc11db82-5c50-4ba9-af65-9ff1a1ae00b8","⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and More","weekly-recap-linux-rootkit-macos-crypto-stealer-websocket-skimmers-and-more-4dc027","Rough Monday. Somebody poisoned a trusted download again, somebody else turned cloud servers into public housing, and a few crews are still getting into boxes with bugs that should’ve died years ago — the same old holes, same lazy access paths, same “how the hell is this still open” feeling. One report this week basically reads like a guy tripped over root access by accident and decided to stay","This weekly recap highlights multiple active threats including Quasar Linux RAT (QLNX), a modular Linux malware with P2P mesh networking and rootkit capabilities designed for supply chain and cloud breaches; PCPJack replacing TeamPCP for credential theft; active exploitation of CVE-2026-6973 in Ivanti EPMM and zero-day CVE-2026-0300 in Palo Alto Networks PAN-OS affecting thousands of exposed hosts. The recap emphasizes recurring patterns of supply chain poisoning, cloud misconfigurations, and exploitation of years-old vulnerabilities.","Weekly security recap covers Linux RAT, macOS stealer, WebSocket skimmers, and active exploitation of Ivanti and Palo","https:\u002F\u002Fthehackernews.com\u002F2026\u002F05\u002Fweekly-recap-linux-rootkit-macos-crypto.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiD4a3gzeAEAv4Bs5FqWbHG1cRyNqIOjygeSxxpNoChwyyMUWlbZHzkG0n8ysGpoAYuKqklfMtTKRct0OeYktaKLhdXpRH5pKH94tVaMX7iPeNDf7vZjFky3myBkFPJPl1xIdsWDlIYP30IeR7IZGhQZ5p82yHRdRO1OGkpAtTWgZcQSG3zXqh9tLbSSrgP\u002Fs1600\u002Fcyber-recap.jpg","2026-05-11T12:36:00+00:00","2026-05-11T14:00:05.691977+00:00",9,[17,20,22,25,27,30],{"name":18,"type":19},"Ivanti","vendor",{"name":21,"type":19},"Palo Alto Networks",{"name":23,"type":24},"Ivanti Endpoint Manager Mobile (EPMM)","product",{"name":26,"type":24},"PAN-OS",{"name":28,"type":29},"TeamPCP","threat_actor",{"name":31,"type":32},"Linux","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":55},{"id":56,"icon":35,"name":57,"slug":58},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[60,64,67,70],{"type":61,"value":62,"context":63},"cve","CVE-2026-6973","Ivanti EPMM improper input validation flaw allowing authenticated RCE; actively exploited",{"type":61,"value":65,"context":66},"CVE-2026-0300","Palo Alto Networks PAN-OS authentication portal memory corruption zero-day; unauthenticated RCE with root privileges; ~263,000 exposed hosts",{"type":37,"value":68,"context":69},"Quasar Linux RAT (QLNX)","Modular Linux RAT with P2P mesh, kernel rootkit, PAM backdoors, persistence; targets supply chain and cloud infrastructure",{"type":37,"value":71,"context":72},"PCPJack","Successor to TeamPCP malware; used to steal cloud credentials and clean infected environments",[18,21,23],{"controls":75,"vendors":158},[76,105,133],{"slug":77,"name":78,"problem":79,"products":80},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":106,"name":107,"problem":108,"products":109},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[110,117,125],{"vendor_slug":111,"vendor_name":21,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xpanse","Cortex Xpanse","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xpanse","External attack surface discovery and remediation.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":134,"name":135,"problem":136,"products":137},"patch-management","Automated patch management","Known holes get closed in days, not months.",[138,146,150],{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":134,"product_name":147,"url":148,"description":149},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[159,165,170],{"slug":160,"name":161,"logo_path":162,"roles":163},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png",[164],"reported_by",{"slug":166,"name":18,"logo_path":167,"roles":168},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[169],"affected",{"slug":111,"name":21,"logo_path":112,"roles":171},[169]]