Morning Review in IT Security — September 1, 2026

September 1st brings critical security developments across infrastructure, supply chains, and endpoint threats. Organizations face active exploitation campaigns targeting network devices, malicious package distribution, and social engineering attacks designed to establish persistent access.

Chinese Fire Ant Hackers Turn Cisco Routers Into Spying Platforms

Researchers have discovered that the Chinese threat group Fire Ant is exploiting Cisco IOS XR routers to establish covert surveillance infrastructure. The attackers deployed a malware variant called BridgeAgent through Generic Routing Encapsulation (GRE) tunnel interfaces that appeared on compromised routers without corresponding entries in running configurations or commit histories, making detection significantly more difficult. The campaign leverages remote access capabilities tracked under MITRE ATT&CK techniques T1021.001, T1021.002, and T1021.004, combined with data exfiltration methods T1041 and defense evasion tactics T1562.008. Source: Bleeping Computer

This attack pattern demonstrates how sophisticated threat actors continue to target network infrastructure as a means to maintain persistent access and monitor traffic flows across compromised networks. The use of hidden tunnel interfaces represents an evolution in router-based compromise techniques.

Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

Socket's Threat Research Team identified thirteen malicious Composer theme packages distributed across five vendor namespaces on Packagist that target Vietnamese movie and comic streaming sites. The packages inject JavaScript that executes two distinct attack chains: a mobile ad-fraud and gambling-redirect operation, and on iPhones, a sophisticated WebKit-to-kernel exploit chain that installs spyware capable of harvesting cryptocurrency wallet seeds. The malicious packages include vsmov/theme-dy, vsmov/theme-rrdyw, vsmov/theme-motchill, vsmov/theme-vsmov, vsphim/theme-heovl, vsphim/theme-thempho, haiau009/kkphim-legend, haiau009/kkphim-motchill, chilltvcms/theme-legend, ophimcms/theme-dy, ophimcms/theme-motchill, ophimcms/theme-pcc, and ophimcms/theme-rrdyw.

The iOS exploit chain weaponizes two WebKit vulnerabilities, CVE-2025-31277 affecting iOS 18.4 to 18.5 and CVE-2025-43529 for iOS 18.6 and later, both now public and patched. The attack progresses through a renderer stage that builds arbitrary read and write capabilities via JavaScriptCore corruption, a GPU process pivot using IOSurface and mach messaging, and finally a kernel escape through the AppleM2ScalerCSCDriver IOKit user client. The final payload exfiltrates keychain databases, Wi-Fi passwords, SMS messages, contacts, Photos, browser cookies, call history, location data, and cryptocurrency wallet seeds from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX. The operators redeployed the entire iOS chain on August 12, 2026, with fresh filenames and rotated infrastructure, and added crypto-wallet theft capabilities that roughly doubled the payload size.

The campaign infrastructure runs on FUNNULL, a sanctioned provider administered by Liu Lizhi and designated by OFAC on May 29, 2025, for facilitating over 200 million dollars in cryptocurrency scams. The Vietnamese-operated theme group operates on UTC+07:00 timestamps and uses FUNNULL as infrastructure tenants rather than owners. Apple confirmed that the kernel escape was already addressed in iOS and macOS 26.1, meaning devices updated to iOS 26.2 or later are not exposed to the known stages. Source: Socket

Site operators using OphimCMS or KKPhim should audit installed theme packages immediately and remove any themes from the five compromised vendor namespaces, rotate credentials, and inspect shipped jQuery and theme scripts for appended loaders. Security teams should block the identified network indicators, hunt for session-storage keys rce_locked and uid, monitor for beacons to cloudfareintcdn[.]com/wd-status.html, and prioritize updating iPhones off iOS 18.6.x and earlier.

McKesson Copes with Fallout from Data Theft Extortion Attack

The major healthcare sector vendor McKesson has become the target of a data theft extortion attack claimed by ShinyHunters, a prolific threat group with an increasing focus on healthcare organizations. The attackers have not been formally identified by McKesson, but the group's public claim of responsibility indicates a significant breach affecting sensitive healthcare data. Source: CyberScoop

This incident underscores the ongoing vulnerability of critical healthcare infrastructure to extortion-driven attacks and the continued targeting of the sector by organized threat groups seeking high-value data and ransom payments.

Microsoft Warns of TerminalFix Attacks Deploying Reverse Tunnels

Microsoft has alerted organizations to a new variant of the ClickFix attack framework now called TerminalFix that exploits user trust through fake Cloudflare CAPTCHA prompts displayed on compromised websites. When users encounter these fake CAPTCHAs, they are socially engineered into running malicious PowerShell commands directly in Windows Terminal, which deploy reverse tunnels for persistent access. The campaign uses the domain gitnow[.]dev as part of its infrastructure. Source: Bleeping Computer

The TerminalFix variant represents an evolution in ClickFix social engineering tactics by leveraging the Windows Terminal application to execute commands with elevated privileges, providing attackers with direct command-and-control access to compromised systems.

These four major incidents demonstrate the breadth of current threats spanning network infrastructure compromise, supply chain poisoning through legitimate package repositories, healthcare sector extortion, and sophisticated social engineering attacks. Organizations should prioritize patching, dependency auditing, and user security awareness training as immediate response measures.