Emergency Action Required for Federal Agencies

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) moved quickly on Thursday, adding a freshly patched Microsoft SharePoint Server flaw to its Known Exploited Vulnerabilities (KEV) catalog. The designation means Federal Civilian Executive Branch (FCEB) agencies have a hard deadline: apply the fixes by July 19, 2026.

This isn’t a theoretical risk. The vulnerability, tracked as CVE-2026-58644, carries a CVSS score of 9.8 — critical, with a capital C. It’s a deserialization bug that attackers are already exploiting in the wild.

What Makes CVE-2026-58644 So Dangerous?

Deserialization flaws are nasty. They let an attacker manipulate serialized data passed to the application, potentially executing arbitrary code on the server. For SharePoint, that’s a crown jewel target — the server often sits deep inside corporate networks with broad access to files, credentials, and other systems.

The CVSS score of 9.8 reflects the severity: no user interaction required, low attack complexity, and the potential for full compromise of the affected server. Think about what a successful exploit means. An attacker gains a foothold, then moves laterally. SharePoint is frequently the starting point for ransomware gangs and nation-state actors alike.

Why the Zero-Day Label?

Microsoft patched the flaw before CISA’s announcement, but the fact that it was exploited before a fix existed makes it a zero-day. The window between discovery and patch is when the damage happens. CISA’s KEV listing confirms that window was used — and likely continues to be used by threat actors targeting unpatched systems.

What Federal Agencies Must Do Now

The binding operational directive (BOD) 22-01 requires FCEB agencies to remediate KEV-listed vulnerabilities by the specified due date. For CVE-2026-58644, that’s July 19, 2026. Miss it, and you’re in violation of federal policy. But the real cost isn’t bureaucratic — it’s the risk of a breach.

Beyond the federal sphere, CISA’s KEV catalog has become a de facto checklist for security teams everywhere. If you run Microsoft SharePoint Server, consider this your wake-up call. Patch immediately. Don’t wait for the 19th.

Practical Steps for SharePoint Administrators

Here’s what you should do today, not next week:

• Apply the latest Microsoft security update — the patch for CVE-2026-58644 is included in the June 2026 Patch Tuesday release. Verify your installation is current.
• Check your logs — look for unusual deserialization activity or unexpected process executions on SharePoint servers. Indicators of compromise may exist if you were targeted before patching.
• Harden your environment — restrict network access to SharePoint servers, enforce least-privilege accounts, and monitor for anomalous behavior.
• Review CISA’s KEV catalog regularly — it’s updated frequently. Make it part of your weekly threat intelligence routine.

Broader Implications for Enterprise Security

This isn’t an isolated incident. SharePoint has been a recurring target — remember the ProxyLogon and ProxyShell issues in Exchange? The pattern is consistent: on-premises collaboration servers are high-value targets. They hold data, they’re often internet-facing, and they’re complex to patch.

If you’re running SharePoint Server on-premises, the message is clear. You’re in the crosshairs. The shift to cloud-based services like SharePoint Online might reduce some risk, but hybrid deployments still carry on-premises components that need attention.

For security teams, the KEV catalog is a gift. It tells you exactly what’s being exploited right now. The hard part is acting on it. Prioritize CVE-2026-58644. Schedule the maintenance window. Communicate the urgency to stakeholders.

One more thing: don’t assume your vulnerability scanner caught this. Deserialization bugs can be tricky to detect. Manual verification of the SharePoint build number is a good sanity check.

The bottom line? This is a critical, actively exploited vulnerability with a federal deadline. Treat it with the seriousness it deserves. Patch. Verify. Monitor. That’s the playbook.

The Hidden Web of Ad Tracking, Now Visible

Ever wonder who’s actually behind those ads that follow you around the internet? Or which companies are quietly harvesting your data from the apps on your phone? The answers have always been semi-public, but buried in technical files that most people can’t parse.

That’s changing. A new free service called DecryptAds scrapes and cross-references the adtech declaration files that websites and apps are required to publish. The result? You can now see the full roster of companies tracking you on any site — often dozens or even hundreds of them.

What DecryptAds Reveals About Your Favorite Sites

Type in a domain like espn.com, and DecryptAds pulls together data from three key public files:

• ads.txt — lists all adtech companies and data brokers allowed to run ads or collect data on a site
• app-ads.txt — the same info for mobile and smart TV apps
• buyers.json / sellers.json — shows who’s buying, selling, or reselling ad inventory

For ESPN, that reveals 143 ad partners and 19 registered data brokers. Nearly half of those brokers are collecting geolocation data from visitors who aren’t blocking ads. Three others openly admit to device fingerprinting and collecting sensitive personal information.

Data Broker Registrations Are Growing

This data broker information is becoming available thanks to new laws in California, Oregon, Texas, and Vermont that require brokers to register if they buy or sell consumer data from those states. DecryptAds founder Zach Edwards, a threat researcher at security firm Infoblox, says the service was built to approach adtech from a security perspective.

“It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.”

High-Risk Ad Partners You Never Knew About

One of the most striking features is the Geo-Risk warning. DecryptAds flags adtech partners based in countries like China, Russia, Cyprus, and the UAE — places with strong financial or political ties to adversarial nations.

Take the military news sites. A search across armytimes.com, airforcetimes.com, defensenews.com, and others shows they all allow a Russian adtech firm called Between Digital to serve ads and track users. The company lists a New York address, but its publisher offers are processed through Alfa Bank — one of Russia’s largest banks, placed under U.S. sanctions in 2022.

Between Digital is collecting ad data on approximately 55,000 partner websites. And here’s the kicker: on about two-thirds of those sites, the company is listed as both a publisher and a reseller.

“It means they are basically playing both sides of the bidding equation, which creates opportunities to direct client spend at your owned and operated properties,” Edwards explained. “For years we’ve had almost no one policing these ads.txt and app-ads.txt files.”

Opera Browser’s Chinese Ties Exposed

Many users don’t know that Opera has been majority-owned by Chinese company Kunlun Tech since 2016. DecryptAds shows Opera.com has 27 registered data brokers collecting information — including 15 adtech partners in the UAE, six in China, three in Cyprus, and two in Russia. That’s still only seven percent of Opera’s total adtech partners.

Legal Dossiers and Quiet Removals

The Legal Dossier lookup is a rabbit hole. It takes several minutes per search but returns a treasure trove: who owns a domain, when it was registered, and how it connects to other adtech entities.

For example, a dossier on a dormant domain linked to the Fengwo Group — the same Chinese company behind malicious streaming stick apps — revealed a shared seller ID with a gaming website. Pivoting on that ID exposed hundreds of low-quality sites within Russia’s Yandex ad system.

DecryptAds also tracks quiet removals — when ad exchanges silently remove a seller from their sellers.json file without public explanation. This practice lets dodgy adtech firms escape accountability. The quiet removals feed records and correlates these removals across exchanges, making patterns visible.

Malvertising and the Rise of AI Slop Sites

Edwards says malicious ads are increasingly found on AI-generated content farms rather than major sites like ESPN.

“None of these slop AI content farms are paying for that kind of protection,” he said. “They’re just signing up the lowest quality partners, and it essentially becomes a greased rail to target the users of those sites with malicious ads.”

These AI slop sites cover everything from home improvement to recipes, and they’re prime vectors for malvertising attacks. The fix, Edwards argues, is for ad networks to share the supply chain object (SCO) — structured data attached to each bid request that reveals every intermediary in the ad delivery chain. Currently, that data is only served server-side, making it nearly impossible to trace malicious ads back to their source.

What You Can Do Right Now

The obvious takeaway? Block ads everywhere. Security experts broadly endorse this because it also blocks the tracking that powers these ad networks.

Here’s what works:

• uBlock Origin — the gold standard for desktop browsers, also works on Android via Firefox
• Adblock Plus — a decent option for iPhone and iPad users
• NoScript — blocks all non-approved JavaScript, but requires patience to manage
• Pi-hole on a Raspberry Pi — blocks ads network-wide for every device in your home, the most secure and scalable option

But here’s a warning: ad blockers do little against tracking inside mobile apps. And more sites are pushing apps — not because the experience is better, but because apps make it easier to collect precise data and resell it.

“The cold truth is that big web destinations tend to get pushy with their apps because they make it easier to keep you on their platforms longer,” Edwards says. Many of these apps also opt users into training AI models by default.

So before you install that next app, check its DecryptAds listing. It might just show you who’s really behind it.

The Invisible Browser Trick

Imagine an attacker opening Chrome on your computer, logging into your bank, and transferring money — all while you stare at a perfectly normal screen. That’s the reality of MedusaHVNC, a remote access trojan (RAT) sold as malware-as-a-service (MaaS).

Security researchers at BlackFog recently dissected this threat. Their findings reveal a sophisticated use of a legitimate Windows feature: hidden desktops. These are separate virtual desktops that Windows supports natively, often used by specialized software. Malware rarely exploits them. MedusaHVNC does.

The result is a RAT that operates completely out of sight. The user sees nothing. The attacker sees everything.

What Is MedusaHVNC?

MedusaHVNC is a remote access trojan distributed through its own website and a Telegram channel. It’s a commercial product in the cybercrime underground, offered as a service to other criminals. The name comes from its core feature: hidden virtual network computing (HVNC).

This technique allows the operator to create a hidden desktop session on the victim’s machine. On that invisible desktop, they can launch legitimate applications — Chrome, Edge, or Firefox — and interact with them as if they were sitting at the keyboard.

The victim’s own desktop remains untouched. No windows pop up. No cursor moves. The attack happens in a parallel digital space.

The 5-Stage Infection Chain

Getting to that hidden desktop requires a carefully orchestrated sequence. BlackFog’s analysis uncovered a five-stage infection chain that’s both clever and concerning.

Stage 1: The JScript Launcher

It starts with wscript.exe, a legitimate Windows script host. The script waits for just over 7.5 seconds — a delay likely designed to evade sandbox analysis. Then it builds its embedded files under %TEMP%Nx2981Okkr2.

Stage 2: Persistence

Several files are written to disc, including an encrypted payload and a .bat file in the Startup folder. That ensures the malware survives a reboot.

Stage 3: Decryption via AutoIT

Windows AutoIT is used to decrypt the payload and launch charmap.exe — the Windows character map utility. This is a classic process hollowing technique. The benign utility becomes the host for malicious code.

Stage 4: Double Encryption

The loader inside charmap.exe contains two more layers of protection. BlackFog’s researchers describe the process in detail:

“The first applies a 16-byte repeating XOR operation to 1,009,152 bytes from the .data section. The second uses ChaCha20 to decrypt 998,912 bytes of ciphertext with a 32-byte key, a 12-byte nonce, and an initial counter value of 1.”

This dual-layer approach makes analysis significantly harder.

Stage 5: The Final Payload

The final payload is an unsigned PE32+ x86-64 console executable. It contains a .pay section and the family string “MedusaHVNC.” It phones home to a hardcoded C2 address: 51.89.204.28:4444.

Living Off the Land

What makes MedusaHVNC particularly dangerous is its reliance on legitimate Windows functions. The malware uses BitBlt, EnumWindows, and PrintWindow for screen and window capture. SendInput and SetWindowsHookExW handle synthetic input and interaction.

Clipboard functions are also in play. OpenClipboard, GetClipboardData, and SetClipboardData provide another channel to move information in or out of the hidden session.

This is living-off-the-land at its finest. The attacker uses Windows’ own tools against the victim, making detection by traditional antivirus far more difficult.

Why Hidden Desktops Are a Problem

The hidden desktop approach has a significant advantage for attackers: it’s nearly invisible. The C2 is hardcoded, but it’s relatively safe from observation. The operator can browse the web, access internal resources, or exfiltrate data without raising a single flag.

This is a stealthy, persistent RAT. And it’s available to anyone willing to pay.

How to Defend Against MedusaHVNC

There’s no magic bullet. But BlackFog points to one critical mitigation: monitoring data exfiltration.

The logic is simple. Even if the RAT operates on a hidden desktop, the stolen data must eventually leave the network. Detecting unexplained data leaving your perimeter is always a red flag.

Here are practical steps to consider:

• Monitor outbound traffic: Look for unusual data transfers, especially to unfamiliar IPs.
• Hunt for hidden desktops: Use EDR tools to detect unusual desktop creation or charmap.exe anomalies.
• Restrict script execution: Limit wscript.exe and AutoIT usage where possible.
• Watch the Startup folder: Unexpected .bat files there are a clear indicator.

For more on related threats, check out our coverage of HVNC malware used by Russian cybercriminals and the Lobshot hVNC malware that surfaced recently. Also see how TrickBot targets Outlook and browser data.

The hidden desktop is a clever trick. But it’s not unbeatable. With the right visibility into network traffic, defenders can still catch the data as it tries to escape.