Researchers published a working exploit on July 24 for Certighost, an Active Directory Certificate Services flaw that lets a low-privileged domain user obtain a certificate for a domain controller and authenticate as that machine. Because domain controller accounts hold directory replication rights, the resulting credential can extract the krbtgt secret through DCSync, effectively handing over the whole domain. Microsoft patched it in the July 14 updates as CVE-2026-54121, an improper authorization issue scored 8.8. Exploitation needs only network access and an ordinary domain account, with no administrator rights or user interaction, and it was tested against a default enterprise certificate authority setup.
Socket and StepSecurity confirmed three malicious node-ipc releases (9.1.6, 9.2.3, 12.0.1, with 12.0.1 tagged as 'latest') uploaded to npm on May 14, 2026 by co-maintainer account 'atiertant.' Each version carries a byte-identical 80KB obfuscated payload appended as an IIFE to node-ipc.cjs, so it fires on every require('node-ipc') without using install scripts. The malware fingerprints the host, sweeps for 100+ credential and config targets, archives them, and exfiltrates via DNS rather than HTTP. Permiso's Ian Ahl traced the likely attack chain: the maintainer's recovery domain atlantis-software[.]net expired in Jan 2025, was re-registered by an attacker on May 7, 2026, then used to reset the npm password.
TrustStrike Labs