SharePoint Bypass, Lazarus Backdoor, Rogue VPN Extensions

Threat actors began exploiting a newly disclosed Microsoft SharePoint vulnerability, CVE-2026-55040, after a proof‑of‑concept code appeared online. The flaw lets attackers bypass authentication checks by manipulating HTTP headers; it is similar in concept to the BloodHound attack on Active Directory from 2017. Microsoft patched the issue as part of its July 2026 Patch Tuesday updates, which added stricter header validation rules on affected servers. Many organizations may still be vulnerable because they delayed patching despite timely notification ¹.

The North Korean threat actor known as Lazarus Group used a recently patched Windows zero‑day to gain SYSTEM access and deploy a backdoor targeting defense contractors across France, Germany, Brazil, and India. Operation Dream Job—ongoing since early 2023—has previously employed spear‑phishing emails with malicious documents that steal credentials before pivoting laterally within networks. Experts note that Lazarus tactics mirror those seen under APT38 or Hidden Cobra, where recruiters offering fake job interviews serve as initial infection vectors. The backdoor likely uses techniques described by Mandiant/FireEye regarding Cobalt Strike deployments observed against South Korea late 2022, suggesting further lateral movement inside victim networks that exploit trust relationships between organizations ¹.

A massive set of 737 free VPN and proxy extensions has been found routing browser traffic through hidden proxies, mainly targeting Russian‑speaking users seeking blocked services. Published across at least 40 Chrome Web Store developer accounts, these extensions accumulated 75 486 installs; many impersonate legitimate apps and use fraudulent certificates, making detection difficult without sophisticated monitoring tools like Wireshark. This scale indicates deliberate effort beyond simple financial gain; Russian state actors such as Fancy Bear Internet group have historically used proxy services in disinformation campaigns dating back to the Ukraine conflict (2014). Users should check their extension lists carefully even if the apps appear trustworthy because malicious code can be embedded silently ¹.