Atlassian Data Center CVE-2026-21589 exploited within hours of PoC; BitB phishing targets AI ad portals; ShinyHunters member arrested
This SentinelOne weekly roundup (Week 41, 2026) covers law enforcement actions, a phishing campaign and an actively exploited vulnerability. The most urgent item is CVE-2026-21589, a critical (CVSS 9.3) unauthenticated arbitrary file access flaw in Atlassian Data Center products. Exploitation attempts began about two hours after a public PoC appeared, and a Nuclei template is now available. Researchers also uncovered a human-operated phishing platform that impersonates AI chatbot ad-management portals and uses Browser-in-the-Browser (BitB) windows to capture credentials and MFA codes. On the law enforcement side, Jordan reportedly detained Saif al-Din Khader ("Rey"), a suspected ShinyHunters member who is said to be cooperating with the FBI. Zohar Pinhasi (MonsterCloud) was indicted for fraud, and Raheim Hamilton received a 40-year sentence for Empire Market.
Detalhes técnicos
- CVE-2026-21589: Atlassian's web-resource path resolution improperly converts custom path traversal sequences into relative directory paths. Combined with specific plugin endpoints, this lets unauthenticated attackers read files in the web application root with a single HTTP request. Attackers need to know exact file names and paths, and directory enumeration is not possible.
- Affected products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye.
- Impact: Exposed configuration files may hold administrative credentials, enabling privilege escalation, rogue admin accounts and permission changes in Crowd and Jira. Early activity seen in honeypots from several IPs was mostly fingerprinting and sweeping for configuration files with embedded secrets.
- AI ad portal phishing: The lures impersonate ChatGPT, Gemini, Claude, Perplexity, Meta Muse and Manus ad portals and are delivered through fake invitation emails. They target agency staff, media buyers and account administrators, using landing pages such as museads[.]ai. The BitB window spoofs addresses such as accounts.google.com or Okta tenants. A human operator watches victims in real time over Socket.IO and steers them through SMS, authenticator, push and number-matching MFA challenges. The stack is Next.js and Socket.IO and is shared with refund and fake-careers phishing. One backend domain appeared in 73 archived scans across 25 page domains between late May and late June, and hundreds of victim submissions were observed. Hijacked ad manager accounts are used to run malicious ads or are sold on Telegram.
- Law enforcement: MonsterCloud allegedly paid ransomware operators for decryption keys while billing clients inflated fees, with over $8 million in secret ransom payments and $19 million in revenue. Empire Market facilitated over four million transactions worth $430 million (2018-2020), and Hamilton must forfeit 1,230 Bitcoin and 24.4 Ether and pay a $5 million fine.
Remediação
- Apply Atlassian's security updates for all affected Data Center products.
- Until patched, apply WAF rules, block the relevant requests in Tomcat and restrict internet exposure.
- Review exposed configuration files and rotate any credentials they may contain.
- Train advertising and marketing staff to verify login windows and treat unsolicited ad-platform invitations with suspicion. Prefer phishing-resistant MFA.
Linha do tempo
-
Atlassian Data Center CVE-2026-21589 exploited within hours of PoC; BitB phishing targets AI ad portals; ShinyHunters member arrested
ler a análise desta fonte ocultar
This SentinelOne weekly roundup (Week 41, 2026) covers law enforcement actions, a phishing campaign and an actively exploited vulnerability. The most urgent item is CVE-2026-21589, a critical (CVSS 9.3) unauthenticated arbitrary file access flaw in Atlassian Data Center products. Exploitation attempts began about two hours after a public PoC appeared, and a Nuclei template is now available. Researchers also uncovered a human-operated phishing platform that impersonates AI chatbot ad-management portals and uses Browser-in-the-Browser (BitB) windows to capture credentials and MFA codes. On the law enforcement side, Jordan reportedly detained Saif al-Din Khader ("Rey"), a suspected ShinyHunters member who is said to be cooperating with the FBI. Zohar Pinhasi (MonsterCloud) was indicted for fraud, and Raheim Hamilton received a 40-year sentence for Empire Market.
Technical Details
- CVE-2026-21589: Atlassian's web-resource path resolution improperly converts custom path traversal sequences into relative directory paths. Combined with specific plugin endpoints, this lets unauthenticated attackers read files in the web application root with a single HTTP request. Attackers need to know exact file names and paths, and directory enumeration is not possible.
- Affected products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, plus Crucible and Fisheye.
- Impact: Exposed configuration files may hold administrative credentials, enabling privilege escalation, rogue admin accounts and permission changes in Crowd and Jira. Early activity seen in honeypots from several IPs was mostly fingerprinting and sweeping for configuration files with embedded secrets.
- AI ad portal phishing: The lures impersonate ChatGPT, Gemini, Claude, Perplexity, Meta Muse and Manus ad portals and are delivered through fake invitation emails. They target agency staff, media buyers and account administrators, using landing pages such as museads[.]ai. The BitB window spoofs addresses such as accounts.google.com or Okta tenants. A human operator watches victims in real time over Socket.IO and steers them through SMS, authenticator, push and number-matching MFA challenges. The stack is Next.js and Socket.IO and is shared with refund and fake-careers phishing. One backend domain appeared in 73 archived scans across 25 page domains between late May and late June, and hundreds of victim submissions were observed. Hijacked ad manager accounts are used to run malicious ads or are sold on Telegram.
- Law enforcement: MonsterCloud allegedly paid ransomware operators for decryption keys while billing clients inflated fees, with over $8 million in secret ransom payments and $19 million in revenue. Empire Market facilitated over four million transactions worth $430 million (2018-2020), and Hamilton must forfeit 1,230 Bitcoin and 24.4 Ether and pay a $5 million fine.
Remediation
- Apply Atlassian's security updates for all affected Data Center products.
- Until patched, apply WAF rules, block the relevant requests in Tomcat and restrict internet exposure.
- Review exposed configuration files and rotate any credentials they may contain.
- Train advertising and marketing staff to verify login windows and treat unsolicited ad-platform invitations with suspicion. Prefer phishing-resistant MFA.