wp2shell PoCs went public within hours of disclosure, and we are seeing active exploitation. Pre-auth RCE in WordPress Core. No plugins required. CVE-2026-63030 and CVE-2026-60137. We ran the Icex0 PoC end-to-end with Elastic Defend. On the host, every run ends the same way. The web server writes PHP under wp-content/plugins/, then spawns a shell. 4 rules caught it: - Payload Execution by Web Server: EDR, kills the shell on launch - PHP File Creation in WordPress Plugin Directory: catches the drop before execution - Suspicious Command Execution via Web Server: flags discovery commands from the web parent - Unusual Command Execution via Web Server: alerts on command lines the host has never run The PoC self-cleans after running. A missing plugin folder doesn't mean a clean host. Patch to 7.0.2 or 6.9.5. Hunt the IOCs while tooling is still stock. Full rule walkthrough, process lineage, and Attack Discovery correlation: go.es.io/4wW8NpB

7 trojanized repos targeting developers. Zero detections across every AV vendor. Elastic Security Labs is tracking a new Contagious Interview campaign (REF9403) where DPRK-aligned actors distribute fake coding challenges through Slack job postings. The repos masquerade as real Next.js e-commerce projects. The code was copied from a legitimate template called GoCart. The difference is steganography. Base64 payload fragments are hidden inside HTML comments in SVG flag images. A script reassembles them alphabetically, decodes with a custom function, and runs on server start. What deploys: - Credential stealer targeting 25 crypto wallet extensions plus browser login data - File stealer scanning for .env, .pem, .ssh, .aws, documents, images, shell history, and source code - Socket. IO RAT providing real-time interactive shell access - Clipboard stealer polling every 500ms, plus a Windows dropper downloading 3 disguised executables from the C2 Full analysis from Elastic Security Labs by @danielstepanic : go.es.io/4fqEhgp

We tracked a new activity cluster targeting Mexican banking customers. Elastic Security Labs discovered REF6045, an operator-assisted banking fraud campaign targeting customers of Mexican banks, fintechs, and cryptocurrency platforms through ClickFix fake-CAPTCHA lures. The operation exhibits a reliance on AI-generated code and suffers from significant operational security (OPSEC) failures that exposed their infrastructure and their toolkit. The toolkit gives operators a full fraud workflow from: •Vishing overlay: lock the screen behind a fake bank warning •Browser redirect: paste a phishing URL via automated keystrokes •Clipboard swap: replace CLABE or card numbers mid-transfer •Remote access: install Remote Utilities for hands-on takeover Research by @k33b0i and @soolidsnakee. Full analysis from Elastic Security Labs: go.es.io/4eP6VZF

We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto. The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault. Full analysis: go.es.io/4cld0dB

ElasticSecurityLabs detects the Axios npm supply chain attack across Linux, Windows & macOS. Our behavioral detections caught it without relying on static indicators. Full malware analysis dropping soon: go.es.io/488UwvJ

APT confirmation used to take hours. Now it takes 4 minutes. Attack Discovery correlates alerts into a single narrative. A workflow triggers the agent. The agent: • Looks up the hash on VirusTotal • Runs ES|QL queries across your logs • Finds the on-call analyst • Creates a case • Opens a Slack incident channel All before you read the threat intel report.