ZeroDay Field Notes - Your Firewall is a Liar, and Your IDE is a Snitch

This week was a total blast for anyone who loves having their fundamental security beliefs shaken up. If you thought your patched firewall was actually safe or that your AI code assistant was just there to help you nail that perfect YAML, I've got some bad news. It felt like we were in a wild game of whack-a-mole, but the moles have admin credentials and are already halfway out the door with the loot.

Maybe that's a bit generous. It was more like finding out the moles not only have the keys to the prize closet, but they also helped build the arcade and have been pocketing quarters for a year. Let's dive in!

Fortinet's Never-Ending SSO Story

I hope you weren't getting too comfy behind your FortiGate firewalls, because attackers definitely have been. Two vulnerabilities, CVE-2025-59718 and CVE-2025-59719 are being actively exploited, and things are getting worse. We've mentioned these before, but they keep on giving, even into the new year. These flaws let an unauthenticated attacker bypass FortiCloud single sign-on by faking SAML responses. The initial advisory from Fortinet and Arctic Wolf's reporting laid out the attacker's playbook, which is brutally efficient.

The CONOP is simple:

1. Abuse the SSO bypass to gain administrative access.
2. Create a new local admin account with a generic name like secadmin or itadmin for persistence.
3. Immediately export the device's full configuration.

That config file is pure gold: VPN settings, network layout, credentials, you name it. It's a complete recon blueprint served up on a silver platter. But here's the twist. As multiple outlets began reporting, attackers were successfully compromising even fully patched devices. Fortinet's own PSIRT has since confirmed it is investigating these new attack paths.

The advice here is clear. Patching alone won't cut it. The best move for now is to disable FortiCloud SSO until this is fully resolved. From the CLI, it's config system globalthen set admin-forticloud-sso-login disable. After that, it's time for a full audit. Look for any unexpected local admin accounts, change all the credentials in the firewall config, and for goodness' sake, make sure your management interfaces aren't exposed on the public internet. Treat any device with sketchy SSO logins as totally compromised.

Malicious VS Code AI Assistants Steal Everything

Speaking of trusting your tools, researchers at Koi Security found that two popular AI coding assistant extensions in the VS Code Marketplace were actually sophisticated spyware. The extensions, ChatGPT - 中文版 by a publisher named WhenSunset and ChatMoss/CodeMoss by zhukunpeng, had a combined 1.5 million installations. That's a lot of developers.

These weren't just snatching a few snippets. The extensions had nasty code meant to steal a developer's whole workspace. This included everything: source code, .env files, credentials.json, SSH keys--you name it. The malware used multiple channels to send the data to a C2 server at aihao123.cn, including real-time monitoring of active files and server-triggered commands to hoover up everything at once. It also profiled developers, likely to identify high-value targets.

Last time I chatted about a sketchy VS Code extension flagged by Koi Security, it turned out to be a false alarm. But it seems like the team learned from that and has a solid case for a real supply chain disaster. The attackers turned the tools developers use into an insider threat. If you or your team used these extensions, the fix is challenging but necessary: uninstall them right away, block the C2 domain, and start rotating any secrets, keys, and credentials that might've been in a compromised developer's environment. This is another reminder that while third-party tools and extensions are convenient, they come with serious risks. Always vet your plugins.

Phishing Kits Move into Trustworthy Neighborhoods

The classic phishing trick is getting a makeover by hiding in plain sight. A report from Cyber Press shows a significant increase in phishing kits hosted on legitimate cloud and CDN platforms. We're talking Azure Blob Storage, Google Firebase, and AWS CloudFront. This makes it a real headache for defenders to block them. You can't just block blob.core.windows.net without messing up global commerce.

These aren't your grandpa's phishing pages anymore. Kits like Tycoon and EvilProxy are out there, running adversary-in-the-middle (AiTM) attacks. They don't just grab a password; they proxy the whole login session, snatching MFA tokens and session cookies right from the user. This easily bypasses most old-school MFA methods, such as OTPs. Plus, as Check Point and Malwarebytes pointed out, attackers are getting smart, using Google Cloud services to create these pages that look super legit. The best defense? Go for phishing-resistant MFA like FIDO2 hardware keys and stay suspicious of any login prompt, no matter where it seems to come from.

Quick Hits

Just a couple more things to keep on your radar this week.

• Sandworm Targets Polish Power Grid: ESET Research has attributed a wiper attack against Poland's power grid in late 2025 to the Sandworm APT. The malware called DynoWiper aimed to completely wipe out data. Luckily, the attack was stopped before it could trigger any blackouts, but it's a stark reminder of the dangers that lurk around critical infrastructure.
• On-Chain Statecraft: A cool report from Chainalysis took a deep dive into Iran's crypto scene, which is worth about $7.8 billion. They discovered that addresses linked to the Islamic Revolutionary Guard Corps (IRGC) received over $3 billion in 2025, using crypto to evade sanctions and support proxy networks. It also highlighted a spike in Bitcoin withdrawals to self-custody wallets by regular folks during big protests, showing real-time signs of unrest at home.

That's it from me this week. We're not even a month into 2026, and I'm already running out of ways to say that trust is a vulnerability in the cyber world. You need to verify your vendors, patches, and tools. So, go check your firewall logs, audit your IDE extensions, and maybe skip that login link from your "friendly" cloud provider. We'll be here, freezing our butts off, hoping we don't have to wrestle our cats for canned soup if the power goes out. Stay safe, stay warm, and as always, stay paranoid out there!

-- UncleSp1d3r