Daily · 2026-07-26
🎯 Steam ClickFix Drops XMRig, 🔧 SourTrade In-Browser Malware, 🎭 ShinyHunters Sextortion, ⚠️ FastJson CVE-2026-16723 Active RCE, ⚠️ Certighost AD CS PoC Public
Steam forums abused for ClickFix cryptomining, SourTrade malvertising builds malware in browser memory, ShinyHunters data fuels sextortion campaign, FastJson CVE-2026-16723 actively exploited with no patch available, and Certighost AD CS domain takeover PoC goes public.
The FastJson story is the day's defining story because there is no patch. CVE-2026-16723 is a critical RCE in the Java library's 1.x line, works under stock configuration, and is under active attack against financial, health care and retail targets in the US, Singapore and Canada. The latest 1.x release remains vulnerable, so mitigation is configuration and segmentation rather than an update: SafeMode, WAF rules on @type payloads, and removal of Fastjson 1.x from internet-facing Spring Boot services.
Certighost is the second problem with a public exploit. A low-privilege domain user can forge a Domain Controller certificate and extract the krbtgt secret for Golden Ticket access. Certighost was fixed in the July 14 Patch Tuesday, so this is patch plus audit, but AD CS keeps producing domain-level failures.
The rest is consumer-scale but broad: Steam forum ClickFix lures install XMRig miners through copy-pasted PowerShell, SourTrade builds malware in browser memory through Service Workers, and ShinyHunters leak data is fueling a $2,000 sextortion wave.
Watchlist: Fastjson 1.x inventory and compensating controls, AD CS certificate template and TGT audits, and PowerShell execution policy on gaming workstations.