Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
Summary: Threat actors began exploiting two authentication-bypass and remote code execution flaws in the AhsayCBS backup utility on October 7, 2026, at 11:20 p.m. UTC, after CVE identifiers were published on October 4, 2026. Huntress reported that five organizations are estimated to have been affected as of October 8, 2026, with attackers dropping web shells and XMRig cryptominers named "edge.exe" to impersonate Microsoft Edge, plus a suspected AI-assisted PowerShell script that shuts down Windows Task Manager when it stays open too long overnight.
Key Takeaway: The flaws were reported fixed in version 10.3.4, but Huntress found that release is also impacted, so organizations running AhsayCBS have no patch and must restrict management interface access to trusted IPs or a VPN while hunting for compromise.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026