The Lyceum: Cyber Intelligence Daily — Jul 29, 2026

Three ordinary actions—finishing corporate training, importing a JavaScript package, and accepting a code contribution—opened paths to database theft, malware execution, and server takeover. The deeper pattern is uncomfortable but familiar: attackers are turning trusted workflows into execution environments, while Mirage Kitten is turning compromised computers into hidden network infrastructure.

• CVE-2026-60004 — Gitea 1.17 through 1.27.0: patched in 1.27.1; no NVD score yet; repository writers can install a malicious Git hook and execute commands as the Gitea service account.
• CVE-2026-63230 — Koollab Learning Management System 5.3.2: Three Learning’s cloud instances were patched April 26; no NVD score yet; an unauthenticated attacker could extract sensitive database contents and valid authentication tokens.
• DEV#POPPER-linked Joyfill implant: malicious beta releases of @joyfill/layouts and @joyfill/components activate when imported into Node.js; Socket linked the payload to the DEV#POPPER malware family but did not attribute the compromise to a specific operator.

Singapore’s Cyber Security Agency disclosed 16 vulnerabilities in Koollab Learning Management System 5.3.2 overnight. The collection included unauthenticated SQL injection, account takeover, two-factor authentication bypass, webshell uploads, exposed assessment answers, and hard-coded Amazon Web Services credentials capable of reaching shared storage and messaging resources.

Three Learning patched its cloud-hosted instances on April 26. That closes the software path, but not necessarily the incident: learning systems contain employee identities, compliance records, tokens, and—in this case—connections to shared cloud infrastructure.

The decision for Koollab customers is therefore whether to treat this as completed maintenance or a retrospective investigation. Reports of token misuse, altered training records, or cross-tenant access predating April 26 would move the disclosure firmly into breach-response territory.

Kaspersky disclosed a previously undocumented toolkit used by Mirage Kitten, the Iranian espionage group also tracked as Nimbus Manticore, UNC1549, and Smoke Sandstorm. (Iran’s Mirage Kitten Built a Backdoor—and Two Secret Network Tunnels)

NightLedger, the toolkit’s Windows backdoor, executes programs, transfers files, captures screenshots, and surveys processes and networks. BridgeHead and ArcBridge create encrypted tunnels through compromised machines, letting Mirage Kitten route additional operations through networks that defenders already trust. (Iran’s Mirage Kitten Built a Backdoor—and Two Secret Network Tunnels)

Kaspersky identified victims in Egypt, Jordan, Tanzania, Pakistan, Ethiopia, and Burkina Faso across aerospace, aviation, defense, telecommunications, government, and finance. Some malware samples ran only under specific usernames, suggesting prior reconnaissance rather than indiscriminate distribution. (Iran’s Mirage Kitten Built a Backdoor—and Two Secret Network Tunnels)

If NightLedger and its tunnelers remain confined to those sectors and countries, this is a tailored regional espionage operation. If Kaspersky’s indicators begin appearing elsewhere—or on systems reached through the victim relays—the toolkit is becoming reusable infrastructure for a broader campaign. (Iran’s Mirage Kitten Built a Backdoor—and Two Secret Network Tunnels)

Socket found malicious code in two npm beta releases published July 28: @joyfill/[email protected] and @joyfill/[email protected].

The malware did not need an installation script. It activated when Node.js imported the package, then fetched instructions through transactions recorded on the Tron, Aptos, and BNB Smart Chain blockchains. A detached process could survive after the original build or test ended.

That design challenges a common supply-chain control: blocking dangerous install hooks does nothing when ordinary application execution is the trigger. Socket linked the implant to DEV#POPPER, a malware family previously associated with North Korean operations, but did not attribute this compromise to a specific actor.

Affected systems need investigation, not merely package removal. The signal that containment failed will be continued outbound blockchain lookups, detached processes, or credential use after the poisoned versions disappear from locklocks and caches.

Gitea released version 1.27.1 to fix CVE-2026-60004, a critical vulnerability affecting versions 1.17 through 1.27.0. A repository writer can submit a crafted patch that installs a malicious Git hook—a script Git executes automatically—and run shell commands as the Gitea service account. (A Normal Gitea Account Can Become a Server Shell—Patch to 1.27.1)

The authentication requirement offers less comfort than it appears. Default installations allow public registration and repository creation, meaning an outsider may be able to grant themselves the necessary write access. The advisory includes public proof-of-concept code; Gitea has not reported real-world exploitation. (A Normal Gitea Account Can Become a Server Shell—Patch to 1.27.1)

Successful exploitation could expose repositories, application secrets, OAuth tokens, database credentials, and internal services reachable from the host. Disabling registration buys deployment time, but only upgrading to 1.27.1 closes the flaw; exploitation telemetry would signal that the public proof of concept has already crossed into operational use. (A Normal Gitea Account Can Become a Server Shell—Patch to 1.27.1)

Russian publication Xakep published an account of Nightmare Eclipse and eight zero-day vulnerabilities affecting Microsoft. Xakep frames the disclosure process as an increasingly personal conflict rather than a routine vendor-researcher exchange. The operational details require further primary-source confirmation, but eight alleged zero-days make the underlying research worth watching for advisories, CVE assignments, or Microsoft patches. Source: Xakep — Russian. No English-language coverage confirmed at time of publication.

Xakep reports that Russian media have linked account takeovers at Beeline to fraudulent eSIM issuance. An eSIM swap moves a subscriber’s number to an attacker-controlled device, potentially exposing text-message authentication and password-reset flows. Western defenders should watch for comparable abuse wherever mobile carriers permit remote eSIM activation with weak identity checks. Source: Xakep — Russian. No English-language coverage confirmed at time of publication.

A training portal with the master keys, a JavaScript import that refuses to clock out, and a code contribution that installs its own shell: trust had a very productive night.

Somewhere, a security-awareness course is asking employees not to click suspicious links while its own backend quietly hands out AWS credentials.

Keep the logs close.

Forward this to whoever still thinks “authenticated attacker” means “trusted user.”