Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations
2026-03-04T23:31:52Z•4d4996770532456e4b4ef3cfa2676dc1f782e68a6219762aadffe92cea284020
CVE-2026-0628CVE-2026-20127CVE-2026-21385CVE-2026-21513APT28Aeternum blockchain C2Cisco SD‑WANCyberStrikeAIFortinet FortiGateFreePBX web shellsGemini/Google Cloud API key exposureHavoc C2MFA bypassOAuth redirect abuseScarCruftSloppyLemmingStarkillerUNC2814malicious npm/Go/NuGet packagesphishingsupply chain
What happened
A broad set of active campaigns and high‑severity vulnerabilities were reported: a fake tech‑support spam campaign distributed the Havoc C2 framework; an open‑source AI testing tool (CyberStrikeAI) was leveraged in FortiGate attacks across 55 countries; the Starkiller phishing suite proxies legitimate login pages to bypass MFA; Microsoft warned of OAuth redirect abuse targeting government organizations. Multiple high‑severity and exploited flaws were disclosed, including a Cisco SD‑WAN 0‑day (CVE‑2026‑20127) actively exploited since 2023, MSHTML bypass (CVE‑2026‑21513), a Chrome WebView/priv.‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 4d4996770532456e4b4ef3cfa2676dc1f782e68a6219762aadffe92cea284020
- Enrichment time
- 2026-03-04T23:31:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.