ISC Stormcast For Tuesday, March 17th, 2026 https://isc.sans.edu/podcastdetail/9852, (Tue, Mar 17th)
2026-03-17T07:23:45Z•f73a021113eb3cfc8de7efd244f03d94820a5807946357443a476e71fd05cec6
CVE-2026-0866clickfixcredential-harvestdefault-credentialsemailjshoneypotiotmalware-campaignphishingproxy-abuseproxy-scanningratreactremcossmartapesgvulnerabilityzombie-zip
What happened
ISC SANS diary feed (Mar 11–17, 2026) covering multiple security observations: increased /proxy/ URL scans and probe patterns observed in honeypots (including use of IP addresses and host-header tricks to find open proxies); SmartApeSG campaign that uses a ClickFix page to deliver Remcos RAT; a React-based phishing page that exfiltrates credentials via the legitimate EmailJS service; commentary on IoT devices logging in as admin (risk of default/embedded credentials); and publication/analysis of a new vulnerability tracked as CVE-2026-0866 (“Zombie Zip”).
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- f73a021113eb3cfc8de7efd244f03d94820a5807946357443a476e71fd05cec6
- Enrichment time
- 2026-03-17T07:23:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.