ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories
A 296K-node IoT botnet and coordinated targeting of over 100 water systems represent escalating threats to critical infrastructure, while researchers have identified a SharePoint RCE exploit chain among emerging vulnerabilities. Social engineering tactics leveraging fake login pages, security scans, and productivity applications continue to serve as effective initial access vectors alongside more sophisticated techniques including AI-augmented botnets and command-and-control traffic obfuscation. The threat landscape this week demonstrates attackers' evolving methods from credential harvesting to supply chain compromise and delayed malware activation to evade detection systems.
Threat actors associated with Dark Caracal deployed GoCaracal, a previously undocumented Go-based malware framework, during a June 2026 intrusion against a communications organization in Venezuela. GoCaracal leverages an Ethereum smart contract to dynamically retrieve replacement command-and-control addresses, enabling operators to maintain persistence while evading detection. The malware provides remote shell access, payload execution, browser data theft, keylogging, and remote desktop control capabilities.
Threat actors operating a click-fraud botnet have discovered a new attack vector by compromising the update mechanisms of Android-based car head units to distribute malware. The attackers are exploiting legitimate system functionality meant for device updates, allowing them to spread infections across vulnerable vehicle infotainment systems.
Microsoft Threat Intelligence has documented attacks targeting exposed AI workloads, with threat actors exploiting LiteLLM gateways to harvest credentials and establish persistence on compromised systems. The research highlights how attackers are leveraging these compromised AI infrastructure components for cryptomining and other malicious purposes, underscoring the need for organizations to secure their AI gateways and control points against emerging threats.
Palo Alto Networks Unit 42 analyzed 405 AI-linked malware samples and found that while AI may accelerate malware development cycles, only 12 samples successfully reached production endpoints, suggesting minimal impact on attack effectiveness. The research indicates that despite AI's capability to speed up creation, the actual success rate of AI-generated malware remains low, implying that traditional detection and prevention measures continue to provide meaningful protection.