🖥️ cPanelSniper Mass Exploitation, 🐧 Copy Fail KEV, 🎣 Facebook Phishing 30K Accounts

The cPanelSniper exploit marks the escalation of the cPanel crisis from exploitation to mass compromise. The weaponized proof of concept needs no dependencies and automates a four-stage attack to an interactive root shell, and Shadowserver confirms 44,000 unique IP addresses are already compromised and scanning honeypots. Organizations relying on automatic updates are still exposed because the fix requires a manual upcp run. At this scale, every internet-facing cPanel and WHM instance should be treated as breached until proven otherwise.

Copy Fail moved from disclosure to CISA KEV with a two-week federal remediation deadline, and Microsoft reports activity consistent with attackers preparing to weaponize the kernel privilege escalation at scale. Cordial Spider and Snarky Spider, profiled yesterday, now show the full tradecraft: voice phishing into adversary-in-the-middle pages that clone SSO portals, registering attacker-controlled MFA devices, deleting legitimate ones, and auto-trashing security alert emails.

AccountDumpling has compromised more than 30,000 Facebook business accounts by abusing Google AppSheet to send authenticated phishing that passes SPF, DKIM, and DMARC. MacSync stealer is being distributed through more than 200 hijacked Google Ads accounts impersonating Homebrew and other macOS tools, with install instructions hosted on Evernote to ride its domain reputation.

Watchlist: run the cPanel fix immediately and check for root-level backdoors, patch kernels against Copy Fail, verify MFA device inventories, and review email gateway assumptions when senders sit on legitimate infrastructure.