Interconnected blocks illustrating diverse cyber threats from RCE to iPhone exploits.

Daily Cybersecurity News - March 25, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

March 25, 2026 6:05 PM 8 min read

PTC Warns of Critical RCE Flaw

Critical

Executive Summary

PTC has issued a warning for a critical remote code execution (RCE) vulnerability, identified as CVE-2026-4681, affecting its Windchill and FlexPLM products. While patches are still in development, PTC has provided mitigation steps and stated there is no current evidence of active exploitation against its customers.

Vulnerability Details

Affected Product: Windchill and FlexPLM, including most supported versions and all critical patch sets (CPS).
Identifier: CVE-2026-4681
CVSS Score: 10.0 (Critical) via CVSS v3.1 and 9.3 (Critical) via CVSS v4.0.
Exploitation Status: No confirmed exploitation, but the threat is considered imminent.

Risk & Impact

Triage: Immediate action is required to apply mitigations, especially on internet-facing systems.
Attack Vector: The vulnerability can be exploited remotely through the deserialization of untrusted data, requiring no user interaction or authentication.
Ease of Exploit: Low. An attacker can exploit this vulnerability from the network without needing special privileges or user involvement.

Action Plan

Immediate Action: Patches are currently under development.
Workaround: Apply the vendor-provided Apache or IIS server rule to deny access to the vulnerable servlet path on all Windchill, FlexPLM, and file/replica servers. If mitigation is not possible, disconnect affected systems from the internet or shut them down.
Detection: Monitor for webshells (e.g., GW.class, payload.bin, dpr_<random>.jsp) and check for suspicious requests containing patterns like "run?p= / .jsp?c=".

Relevant professional terms

Remote Code Execution (RCE): A class of software vulnerability that allows a malicious actor to execute arbitrary commands or code on a target machine or in a target process over a network.
Deserialization of Untrusted Data: A vulnerability that occurs when an application deserializes data from an untrusted source without proper validation, potentially allowing an attacker to manipulate application logic or execute arbitrary code.

Source: BleepingComputer

TeamPCP Poisons AI Package for Secrets

Executive Summary

The threat actor TeamPCP trojanized the popular LiteLLM open-source Python library to exfiltrate cloud credentials, API keys, and CI/CD secrets. Malicious versions 1.82.7 and 1.82.8 were published to PyPI, targeting the extensive user base of the AI-focused tool.

Key TTPs

Initial Access: Supply chain compromise by publishing malicious packages to the PyPI repository.
Execution: Malicious code was executed upon package import or, in a more advanced version, on any Python interpreter startup.
Defense Evasion: The malware abused Python's `.pth` mechanism for stealthy, persistent execution and used double base64 encoding to obfuscate its payload.

Campaign Analysis

This attack is a continuation of TeamPCP's campaign targeting critical points in the software supply chain, including security and developer tools. By compromising a widely used AI library, the actor gains access to high-value credentials within cloud and development environments.

Targeting & Infrastructure

Target Profile: Developers and organizations using the LiteLLM library, which is present in 36% of cloud environments.
Infrastructure: The malware exfiltrated stolen data to attacker-controlled domains designed to impersonate legitimate services.

Actionable Intelligence

Domains: models[.]litellm[.]cloud, checkmarx[.]zone

Relevant Terms

.pth Mechanism: A feature in Python that allows files with a .pth extension to specify additional directories for packages, which can be abused to execute arbitrary code at interpreter startup.
Exfiltration: The unauthorized transfer of data from a computer or network. In this case, stealing credentials and sending them to an attacker-controlled server.

Source: Wiz

GlassWorm Exploits Solana for Crypto Theft

Executive Summary

The GlassWorm campaign delivers a self-propagating worm through malicious VS Code extensions to steal developer credentials and cryptocurrency assets. The malware utilizes a multi-stage framework and installs a Remote Access Trojan (RAT) to achieve comprehensive data theft.

Key TTPs

Initial Access: Compromising developer environments via malicious extensions on the VS Code and OpenVSX marketplaces.
Execution: Using staged JavaScript execution, often with a time delay to evade sandbox detection.
Defense Evasion: Hiding malicious code within extensions using invisible Unicode characters and leveraging the Solana blockchain for C2 communications.

Campaign Analysis

This campaign marks a significant evolution in supply chain attacks, combining autonomous worm-like propagation with sophisticated evasion techniques. Its use of blockchain for an immutable C2 infrastructure represents a resilient and growing threat to the developer ecosystem.

Targeting & Infrastructure

Target Profile: Developers using VS Code, particularly those working with cryptocurrency wallets and macOS systems.
Infrastructure: Uses the Solana blockchain and Google Calendar events for resilient, decentralized command-and-control (C2) dead drops.

Actionable Intelligence

IPs: 217.69.3[.]218, 199.247.10[.]166, 45.32.150[.]251, 45.32.151[.]157
Domains: calendar[.]app[.]google/M2ZCvM8ULL56PD1d6

Relevant Terms

RAT (Remote Access Trojan): Malware that provides an attacker with complete control over a victim's computer, allowing them to steal data and install other malicious software.
C2 (Command and Control): The server infrastructure that attackers use to send commands to compromised systems and receive stolen data.

Source: The Hacker News

Trivy Hack Sparks Widespread Extortion Wave

Executive Summary

Attackers compromised the popular open-source scanner Trivy, distributing malicious versions to inject credential-stealing malware into CI/CD pipelines. This supply chain attack has impacted over 1,000 organizations, with warnings that the number of downstream victims could grow to 10,000.

Key TTPs

Initial Access: Exploited a misconfigured GitHub Actions workflow to steal a privileged access token. The attackers then used these compromised credentials, which were not fully rotated after a previous incident, to gain access.
Execution: Injected a credential-stealing payload into official releases and GitHub Actions by force-pushing malicious code to existing version tags. This caused CI/CD pipelines to automatically pull and execute the malicious code.
Defense Evasion: The malicious script ran silently before executing the legitimate Trivy scanner, making the CI/CD workflow appear to complete normally without any indication of compromise.

Campaign Analysis

This sophisticated attack turns a trusted security tool into a weapon, abusing the inherent trust in automated software delivery pipelines. The attackers, identified as TeamPCP, are now collaborating with aggressive extortion groups like Lapsus$, signaling a dangerous escalation in tactics and a high potential for widespread financial and data loss.

Targeting & Infrastructure

Target Profile: Downstream users of the Trivy open-source scanner, particularly organizations using it within their automated CI/CD pipelines.
Infrastructure: The attack leveraged GitHub Actions and multiple software distribution channels, including Docker Hub, GHCR, and Amazon ECR, to distribute the compromised software.

Actionable Intelligence

Domains: scan[.]aquasecurtiy[.]org

Relevant Terms

Supply Chain Attack: A cyberattack that targets a trusted third-party vendor or software that has access to a victim's systems or data. In this case, the Trivy scanner was the compromised link in the chain.
CI/CD Pipeline: Continuous Integration/Continuous Delivery is an automated process for building, testing, and deploying software. Attackers targeted this process to execute malicious code.

Source: CyberScoop

Cloud Phones Escalate Financial Fraud

Executive Summary

Threat actors are leveraging cloud-based Android phones to conduct financial fraud at an industrial scale, bypassing traditional security measures like device fingerprinting and emulator detection.

Key Findings

Cloud phones appear as legitimate devices, making them difficult for modern fraud detection systems to identify.
These virtual devices are used to create mass numbers of "dropper accounts" for money laundering.
The technique has facilitated significant fraud, contributing to hundreds of millions in losses annually.

The Bottom Line

The rise of cloud phone fraud marks a strategic shift in cybercrime, rendering many device-centric security controls obsolete. This necessitates a pivot towards behavioral analysis and anomaly detection to identify fraudulent patterns, as relying solely on device reputation is no longer a viable defense strategy.

Relevant Terms

Cloud Phone: A virtual mobile device that runs on remote servers in a data center, accessed over the internet, mimicking a real physical phone.
Dropper Account: A bank account used as an intermediary to receive illicit funds and obscure the money trail before transferring it to the fraudster.

Source: Infosecurity Magazine

Identity Theft Fuels Industrial Attacks

Executive Summary

SentinelOne's latest threat report reveals a "mass-marketed impersonation crisis," with attackers systematically abusing legitimate credentials and identity systems to launch attacks at an industrial scale.

Key Findings

Attackers are shifting focus from initial access to abusing trusted enterprise systems like identity and automation infrastructure.
Compromised identities are the root cause of over 70% of cloud breaches, a figure expected to grow with AI-driven credential harvesting.
Nearly 46% of recent zero-day exploits have targeted edge devices, which often serve as the initial entry point to compromise broader systems.

The Bottom Line

The industrialization of identity-based attacks signifies a fundamental shift in the threat landscape. Adversaries using valid credentials appear as legitimate employees, bypassing many traditional security controls. This reality forces a strategic pivot from perimeter defense and simple authentication to a more sophisticated model of continuous behavior monitoring and identity threat detection to distinguish malicious activity from normal operations.

Relevant Terms

Compromised Credentials: Login details (like usernames and passwords) that have been stolen by an unauthorized party, often through phishing or data breaches.
Identity-Based Attack: A cyberattack where adversaries use stolen or legitimate user credentials to gain unauthorized access to systems and data, effectively impersonating a trusted user.

Source: Infosecurity Magazine

Leaked Spyware Democratizes iPhone Exploits

Executive Summary

DarkSword is a sophisticated exploit chain leaked on GitHub that makes elite, nation-state-level hacking tools available to a wider audience. It targets vulnerabilities in iOS 18 to compromise iPhones through malicious websites, posing a significant threat to millions of users with outdated devices.

Key Features

Zero-Click Infection: Compromises devices when a user simply visits a malicious website in Safari, requiring no further interaction.
Full-Chain Exploit: Utilizes a sequence of up to six vulnerabilities to bypass iOS security layers, achieving remote code execution and privilege escalation.
Broad Data Exfiltration: Designed for rapid "smash-and-grab" theft of sensitive data, including keychain passwords, messages, and crypto wallet credentials.

Use Case (The "So What?")

The public leak of DarkSword dramatically lowers the barrier to entry for attacking iOS devices. Red Teams can now easily repurpose this code for engagements. Blue Teams and SOCs face a heightened threat, as a wider range of adversaries, from criminal groups to state-sponsored actors, can now deploy these advanced "watering hole" attacks.

Availability

A version of the tool is publicly available and open-source on GitHub following a recent leak.

Relevant Terms

Exploit Chain: A series of multiple, linked vulnerabilities used in sequence to progressively bypass security controls and compromise a system.
Watering Hole Attack: A cyberattack strategy where an attacker compromises a website likely to be visited by a specific target group, rather than attacking the targets directly.

Source: Cyberscoop