Loading story…
A fully weaponized exploit for the Spectre CPU vulnerability surfaced online, marking the first publicly identified sample described as capable of causing real harm rather than serving only as a proof of concept. Reporting said French researcher Julien Voisin found Windows and Linux samples uploaded to VirusTotal, including a Linux variant able to dump /etc/shadow, demonstrating a clear credential-theft use case against systems affected by the long-known speculative execution flaw documented at spectreattack.com.
The exploit was reportedly linked to a CANVAS module from Immunity, with wider circulation potentially driven by cracked copies of the CANVAS toolkit and expansion packs shared in underground and private channels. Although there was no confirmed evidence of active in-the-wild attacks, the appearance of the exploit on platforms such as Telegram, Discord, and potentially GitHub raised the risk that threat actors could adopt and repurpose Spectre for practical post-exploitation and data theft.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
A reference published on Reddit reported a native Spectre v2 exploit, identified as CVE-2024-2201, targeting the Linux kernel on Intel systems. This indicates a distinct newer Spectre-related exploit development beyond the earlier 2018 disclosure and 2021 weaponized samples.
A fully weaponized exploit for Spectre was uploaded to VirusTotal, including samples for Windows and Linux. The Linux variant could dump /etc/shadow, marking the first publicly identified Spectre exploit described as capable of causing real harm rather than serving as a benign proof of concept.
Recorded Future analyst Dmitry Smilyanets said cracked versions of the CANVAS toolkit had been circulating in private Telegram channels since at least October 2020. These cracked distributions were later assessed as the likely source of the Spectre exploit samples uploaded to VirusTotal.
Immunity had promoted a Spectre module for its CANVAS penetration-testing framework, indicating a working exploit capability existed in a commercial offensive security tool. This later became relevant to attribution of samples found online.
Early Spectre proof-of-concept exploits published in 2018 were regarded as benign research code rather than weaponized malware. Earlier VirusTotal samples tied to Spectre and Meltdown were likewise classified as harmless variations of public PoC code.
The Spectre CPU vulnerability was disclosed, exposing a hardware design flaw affecting Intel, AMD, and ARM processors. Its disclosure, alongside Meltdown, prompted major concern about CPU-level isolation failures.
Copies of the Spectre exploit were reported circulating in Discord and Telegram channels run by security researchers. The article warned that broader availability in such channels could increase the likelihood of abuse by threat actors.
An underground hacking forum post shared a cracked copy of Immunity CANVAS v7.26 along with cracked White Phosphorus and D2 expansion packs. The shared toolset reportedly included an exploit for CVE-2017-5715, the Spectre vulnerability identifier.
French researcher Julien Voisin found the new Spectre exploit samples on VirusTotal and identified both Windows and Linux variants. He also indicated attribution was straightforward, while public discussion pointed to a CANVAS module as the likely source.
Following the original disclosures, software patches were released to mitigate Spectre and Meltdown. The disclosures also forced CPU vendors, especially Intel, to reconsider processor design tradeoffs between performance and security.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcetherecord.media
Open sourcespectreattack.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed the **Meltdown** and **Spectre** hardware flaws, showing that speculative execution in modern processors could let attackers read sensitive data across security boundaries on affected devices. Reuters reported that **Meltdown** primarily affected Intel processors by breaking memory isolation, while **Spectre** impacted Intel, AMD, and ARM chips by tricking applications into leaking secrets such as passwords and other protected data. CERT/CC later summarized the broader issue as cache side-channel attacks against CPU hardware using speculative execution, underscoring that the weakness was architectural rather than limited to a single product line. Major vendors and cloud providers moved to contain the fallout with software, firmware, and microcode mitigations, including Microsoft Azure protections for hosted customers and public advisories from manufacturers such as Huawei. Subsequent research showed the problem persisted beyond the initial disclosures: the **ZombieLoad** attacks demonstrated additional Intel data-leakage paths tied to speculative execution, and a later **TSX Asynchronous Abort (TAA)** variant affected some processors previously thought to be resistant. Intel issued microcode updates, but researchers and vendors warned that mitigations reduced rather than eliminated risk, that exploitation generally required local code execution, and that fully disabling the underlying CPU behavior would carry significant performance costs.
Jun 29, 2026
Multiple weekly threat roundups and research posts reported a mix of active exploitation, new malware tradecraft, and breach claims. Ukraine’s CERT reported **APT28** rapidly weaponized a Microsoft Office zero-day (**CVE-2026-21509**) within roughly a day of Microsoft’s disclosure, using spearphishing emails with malicious DOC lures to deliver **Covenant** backdoors against Ukrainian government targets and EU-related entities. Separately, researchers described **ShadowHS**, a stealthy **fileless Linux** post-exploitation framework that runs in-memory (e.g., via `memfd`-style execution), uses encrypted multi-stage loading (AES-256-CBC), fingerprints defensive tooling (including major EDR agents), and retains operator-driven capabilities such as credential theft, lateral movement, and covert tunneling for exfiltration. Other reporting highlighted incident and exposure claims and defensive takeaways. Check Point described a **supply-chain compromise** affecting *eScan* (MicroWorld Technologies) in which malicious updates were pushed through the legitimate updater, prompting an emergency shutdown of global update services; it also noted **Crunchbase** confirmed a breach affecting **2M+ records** claimed by **ShinyHunters**, and cited extortion/leak claims involving **Qilin** (Tulsa International Airport) and **WorldLeaks** (Nike). Google’s legal/technical disruption of the **IPIDEA** residential proxy network was also cited as reducing available proxy nodes by millions and cutting off C2 domains used to route attacker traffic. Additional coverage described a phishing chain using a fake DHL invoice to abuse a signed Java utility via **DLL sideloading** (malicious `jli.dll`) and **process hollowing** into `AddInProcess32.exe` to run **Phantom Stealer**; detection-engineering updates emphasized new rules for Windows defense-evasion (e.g., tampering with Credential Guard/HVCI, disabling AMSI and the vulnerable driver blocklist) and expanded Kubernetes and Linux post-exploitation detections.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026