Researchers say the campaign uses a browser-based JavaScript VM to hide credential theft and intercept MFA at scale.
CVE-2026-41940 exploitation by 2,000 IPs enabled Filemanager backdoor attacks, causing credential theft and persistent access ...