Cyber Threat Brief — Issue #014

Attackers began exploiting CVE-2026-6875, a critical unauthenticated remote code execution vulnerability in the ServiceNow AI Platform, on July 18, 2026. This was five days after ServiceNow published the advisory on July 13 and the same day security firm Searchlight Cyber released technical details and proof-of-concept exploit code demonstrating how the sandbox escape works. ServiceNow AI Platform, formerly the Now Platform, is a workflow automation system that processes enormous volumes of enterprise data and connects to many other business systems. The vulnerability allows an attacker with no credentials to escape the platform's script sandbox and execute code remotely on the instance. Threat intelligence telemetry confirmed that wild exploitation began almost immediately using the exact payload disclosed in the public research, highlighting how rapidly attackers weaponize disclosed research against enterprise targets. ServiceNow-hosted instances were patched automatically starting in April. Self-hosted instances require manual patching that many organizations have not completed. Given ServiceNow's deep integration into enterprise workflows, a compromised instance provides a high-value launchpad for data exfiltration and lateral movement across connected networks.

Storm-2945, a sub-cluster of the Russian state threat actor Midnight Blizzard, has been compromising the sign-in portals of hospitality-related organizations since May 2026 to deliver malware to travelers. Midnight Blizzard, attributed to Russia's SVR foreign intelligence service, is the same group responsible for the SolarWinds supply chain attack and the 2024 breach of Microsoft's corporate email systems. This campaign targets the authentication portals that hotels and hospitality services use, turning a trusted login page into a malware delivery mechanism aimed at high-value travelers. The group has also conducted AI-augmented device code and OAuth phishing campaigns since February 2026. The hospitality targeting fits a long-established pattern of Russian intelligence operations against travelers of interest, using the places people trust while away from their home networks. Business travelers, government personnel, and executives staying at hotels should treat hotel network login portals with the same caution as any other untrusted authentication surface.

A new modular macOS information stealer called ClickLock has infected at least 100 victims worldwide since May 2026 through a social engineering technique known as ClickFix. Victims encounter a fake Cloudflare verification page, the kind of "prove you are human" check people see constantly online, that instructs them to open Terminal and paste a command to complete verification. The command installs the malware. Once running, ClickLock steals browser credentials, macOS Keychain data, password manager vaults, cryptocurrency wallet information, and shell history. It installs a modified GSocket backdoor for persistent remote access. To harvest additional credentials, the malware repeatedly closes visible applications to prompt the victim into re-entering their macOS password or approving Keychain access. Stolen data is exfiltrated through Telegram infrastructure. The ClickFix technique works because it turns the victim into the one who installs the malware, bypassing many automated defenses that would catch a traditional malicious download. The single most effective defense is awareness: no legitimate verification process ever asks a user to run a Terminal command.