📋 Top Headlines at a Glance

1. Opera blocks ClickFix attacks with new clipboard protection feature
2. New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
3. FortiBleed credential-theft campaign linked to Lynx ransomware
4. Oracle E-Business Suite Flaw Under Active Attack, 950 Systems Exposed
5. Researchers spot exploitation of another critical Oracle defect

Executive Summary: Today’s intelligence highlights a dual focus on active exploitation of critical vulnerabilities and sophisticated social engineering tactics. Oracle E-Business Suite faces ongoing, widespread attacks leveraging a critical flaw, with hundreds of systems exposed. Concurrently, a new remote access trojan, ChocoPoC, is specifically targeting vulnerability researchers through deceptive proof-of-concept repositories. Adding to the threat, a significant credential theft campaign, FortiBleed, has been directly linked to ransomware operations. On a positive note, Opera has introduced a new feature to automatically counter clipboard-based ClickFix attacks, demonstrating proactive browser-level defense against common malware delivery vectors.

🌍 Technical Intelligence Breakdown

🛡️ Opera blocks ClickFix attacks with new clipboard protection feature

Opera has launched Paste Protect, a new clipboard protection feature integrated into its desktop browsers. This feature is designed to automatically prevent clipboard-based attacks, including hijacking and pastejacking.

Key details:

• Targeted Threat: ClickFix-based cyberattacks, which were responsible for over 50% of malware-delivery attacks in 2025. These attacks often begin with seemingly innocuous user interactions, such as clicking a video.
• Protection Mechanism: Paste Protect offers built-in protection and warnings.
• Availability: The feature is enabled by default in Opera’s desktop browsers, providing automatic protection without user configuration.
• Impact: Reduces the risk of users inadvertently pasting malicious content or having their clipboard data manipulated by attackers.

🎣 New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos

A new data-stealing trojan, named ChocoPoC, is actively being distributed by attackers. This malware specifically targets vulnerability researchers through a deceptive social engineering tactic.

Key attack vectors and capabilities:

• Attack Vector: ChocoPoC is embedded within fake Python proof-of-concept (PoC) repositories hosted on GitHub. These repositories falsely claim to exploit “hot new CVEs” to entice researchers.
• Target Audience: Vulnerability researchers, who are likely to download and execute PoC code.
• Malware Capabilities: Upon execution, ChocoPoC performs several malicious actions:
  • Exfiltrates saved passwords.
  • Steals browser cookies.
  • Lifts sensitive files from the compromised system.
  • Establishes a shell on the victim’s machine, granting attackers remote access.
• Mitigation: Exercise extreme caution when downloading and executing PoC code, especially from unverified sources. Validate the authenticity of repositories and their authors.

🔑 FortiBleed credential-theft campaign linked to Lynx ransomware

The extensive FortiBleed credential theft campaign has been definitively linked to known ransomware operations, specifically INC and Lynx ransomware.

Key implications:

• Campaign Objective: The primary goal of the FortiBleed campaign is the theft of Fortinet credentials.
• Strategic Link: Stolen credentials are not an end in themselves but serve as a precursor for future, more impactful network intrusions.
• Ransomware Connection: The association with INC and Lynx ransomware operations indicates that these stolen credentials are being leveraged to facilitate ransomware deployments, enabling initial access and lateral movement within target networks.
• Defensive Action: Organizations using Fortinet products should implement robust credential hygiene, multi-factor authentication, and continuous monitoring for suspicious login attempts.

🚨 Oracle E-Business Suite Flaw Under Active Attack, 950 Systems Exposed

A critical vulnerability, CVE-2026-46817, affecting Oracle E-Business Suite is currently under active exploitation. This flaw specifically impacts Oracle Payments.

Key details:

• Vulnerability: CVE-2026-46817
• Affected Product: Oracle E-Business Suite, specifically Oracle Payments.
• Affected Versions: Versions 12.2.3 through 12.2.15.
• Attack Path: Unauthenticated attacker -> Vulnerable Oracle Payments instance -> System takeover.
• Exposure: Approximately 950 internet-facing instances of Oracle E-Business Suite are currently exposed and vulnerable to this flaw.
• Impact: Allows unauthenticated attackers to gain full control over vulnerable systems.

⚠️ Researchers spot exploitation of another critical Oracle defect

Dataset provides limited detail regarding this specific critical Oracle defect. However, researchers have observed its active exploitation.

Key considerations:

• Target: The defect impacts a popular collection of Oracle business applications.
• Historical Context: These applications have been targeted by attackers in widespread attack sprees in the past.
• Defensive Actions: Given the active exploitation of critical Oracle flaws, organizations should prioritize:
  • Applying all available security patches for Oracle E-Business Suite and related applications immediately.
  • Conducting thorough vulnerability scans and penetration tests on internet-facing Oracle systems.
  • Implementing strong network segmentation to limit the blast radius of potential compromises.
  • Monitoring for unusual activity within Oracle environments.

📉 Threat Landscape & Trends

The current threat landscape is characterized by a high degree of opportunism and targeted precision. Active exploitation of critical vulnerabilities, particularly in widely used enterprise software like Oracle E-Business Suite, remains a primary concern for immediate risk. The emergence of ChocoPoC highlights a growing trend of highly targeted social engineering campaigns aimed at specific, high-value individuals or communities (e.g., vulnerability researchers) to gain initial access. Furthermore, the explicit link between credential theft campaigns (FortiBleed) and ransomware operations underscores the continuous evolution of the ransomware ecosystem, where initial access brokers and ransomware groups are increasingly intertwined. Proactive defensive measures, such as browser-level security features, are becoming essential layers in a comprehensive defense strategy.

📌 Strategic Takeaway

Organizations must adopt a multi-layered, proactive security posture focusing on rapid patching of critical vulnerabilities, enhanced user education against sophisticated social engineering, and robust identity and access management controls to mitigate credential theft. Continuous monitoring and threat intelligence integration are paramount to detect and respond to evolving attack methodologies, especially those leveraging supply chain vectors or targeting specific professional communities.

🔗 References

1. Opera blocks ClickFix attacks with new clipboard protection feature
2. New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
3. FortiBleed credential-theft campaign linked to Lynx ransomware
4. Oracle E-Business Suite Flaw Under Active Attack, 950 Systems Exposed
5. Researchers spot exploitation of another critical Oracle defect