eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Exploitation of Critical Zero-Day Vulnerability in cPanel and WHM Confirmed
Bottom Line: cPanel disclosed a critical authentication bypass vulnerability within cPanel and Web Host Manager, tracked as CVE-2026-41940. As exploitation of the vulnerability has been reported, organizations implementing cPanel should ensure that patches are applied as soon as possible.
On April 29th, 2026, cPanel announced CVE-2026-41940 (CVSS: 9.8), a critical vulnerability in the control panel solutions cPanel and Web Host Manager (WHM). The vulnerability was disclosed along with security patches. The flaw impacts all versions of cPanel and WHM after 11.40. If successfully exploited, an unauthenticated threat actor could bypass authentication requirements and access the control panel, thereby gaining access to associated websites, webmail, and databases.
On the same day, watchTowr Labs published research on CVE-2026-41940. The technical analysis of the vulnerability included Proof-of-Concept (PoC) exploit code. The hosting provider KnownHost has claimed that exploitation is already ongoing, and CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, giving Federal Civilian Executive Branch (FCEB) agencies a deadline of May 3rd, 2026, to apply relevant patches. On May 2nd, Ctrl-Alt-Intel disclosed specific details of exploitation of CVE-2026-41940, with confirmed attacks against government and military entities in South-East Asia, as well as MSPs and hosting providers in the Philippines, Laos, Canada, South Africa, and the United States. Attacks resulted in data theft, but no specific goal or attribution is provided.
eSentire Threat Intelligence Analysis:
Due to the high volume of cPanel and WHM control panels, the value of authentication bypass vulnerabilities, and the availability of PoC exploit code, it is likely that multiple threat actor groups are already exploiting the vulnerability, and additional groups will adopt the exploit. As there are confirmed reports of exploitation, organizations should immediately apply the available security patches. If patching isn’t possible, cPanel recommends blocking inbound traffic on ports 2083, 2087, 2095, and 2096 at the firewall, or stopping the cPanel service (cpsrvd and cpdavd). In addition to these actions, cPanel has provided a detection script that organizations may use to identify potential signs of compromise in vulnerable devices.
In response to the disclosure of CVE-2026-41940, eSentire released a security advisory including recommendations and response actions. Additionally, new detections were created in eSentire MDR for Network, and eSentire’s Managed Vulnerability Service (MVS) has plugins in place to identify vulnerable devices.
The Return of the Shai-Hulud Worm
Bottom Line: This week, several npm and PyPI packages were compromised, resulting in the delivery of information stealer payloads to victims.
On April 29th, 2026, Wiz released a report confirming that npm packages relating to SAP's Cloud Application Programming (CAP) development ecosystem were compromised with an information stealer malware, that has been labelled Mini Shai-Hulud. The campaign has been attributed to TeamPCP, a financially motivated threat actor known for conducting supply chain attacks within the npm and Python Package Index (PyPI) ecosystem.
The impacted npm packages were modified to include a preinstall script that executes during installation, executing a Bun runtime and an obfuscated payload that runs malicious code prior to installation completion. The second stage payload was identified as a credential stealer, designed to harvest sensitive data from infected hosts (including GitHub, npm, Kubernetes tokens, credentials, and cloud and GitHub Actions secrets). A public GitHub repository is created under the victim’s profile, with the description “A Mini Shai-Hulud has Appeared”, where the stolen data is exfiltrated. The malware also contains self-propagating capabilities, using the stolen credentials to enumerate packages that the victim maintains, infecting them with the malware and republishing them.
Since the identification of the Mini Shai-Hulud worm, additional npm and PyPI packages have been identified to be compromised, indicating the ongoing nature of the attack. On April 30th, Ox identified the intercom-client npm package as having been compromised, along with the PyPI package lightning, which is used within PyTorch models. Ox indicates that the monthly downloads for intercom-client are over 1.3 million, while lightning is over 8.3 million. Ox also highlights that between the SAP and lightning incidents, the number of public repositories on GitHub with stolen credentials rose from 1,200 to 1,800, highlighting its ongoing impact.
eSentire Threat Intelligence Analysis:
Shai-Hulud, named after the sandworm from Dune, is a self-propagating malware that was first identified in a series of supply chain attacks that occurred in September 2025, resulting in over 500 npm packages being compromised. A second wave of Shai-Hulud was observed in November 2025, where updates to the malware were identified, and the attacks resulted in over 700 packages being compromised. The changes made to the malware during this downtime indicate that its developers were continuing to improve it, with the likely aim of infecting a greater number of packages. Credentials that were leaked within these campaigns may have also been used to conduct further attacks. At the time of writing, the newly identified Mini Shai-Hulud campaign appears to be ongoing, and eSentire's Threat Intelligence team assesses with high confidence that additional popular npm and PyPI packages will be infected with the worm.
The attribution to TeamPCP by Wiz is notable, as the initial Shai-Hulud campaigns were not attributed to any threat actor or group. This attribution could suggest that TeamPCP were also behind the previous waves of Shai-Hulud, but this is not confirmed. TeamPCP has been active in recent months, behind many supply chain attacks, including the Trivy vulnerability scanner and Checkmarx KICS scanner. The group was also linked to a recent compromise of the Xinference PyPI package, but have since denied their involvement, suggesting another threat actor may be using their name to add credibility to their operation or obscure accurate attribution.
The Mini Shai-Hulud campaign is only one supply chain attack impacting npm and PyPI packages identified over the past week, with another attack involving the elementary-data package. This attack also involved the injection of an information stealer payload into a popular PyPI package, with the goal of harvesting credentials, secrets, and cryptocurrency wallet information. Based on the success rates that these types of supply chain attacks have had in recent months, it is likely that they will continue throughout 2026. To protect against these attacks, organizations should ensure that package versions are pinned to prevent automatic updates to malicious versions that may be published. Organizations also utilizing the impacted packages should evaluate if the malicious versions were deployed, and if so, rotate all credentials, secrets, and keys on impacted hosts as they should be considered compromised. eSentire's Threat Intelligence team continues to track the Mini Shai-Hulud campaign, and similar supply chain attacks, for additional information and detection opportunities.
Bluekit: AI-Integrated Phishing Kit
Bottom Line: The recently identified Phishing-as-a-Service (PhaaS) platform Bluekit features several capabilities, including credential harvesting, session hijacking and an AI Assistant, significantly lowering the barrier for threat actors to create complex phishing campaigns.
On April 30th, 2026, Varonis Threat Labs published an inside review of Bluekit after obtaining access to the kit, documenting how its integrated workflow reduces the operational overhead historically required to run phishing campaigns. The platform is designed to bring together multiple components of the phishing lifecycle that were previously sourced from separate vendors, including phishing page creation, domain registration, campaign delivery, credential capture, post-login session handling, and data exfiltration, all within a single operator-controlled panel. One of Bluekit’s most notable features is its extensive template library, which includes more than forty phishing templates targeting a wide range of consumer and enterprise services. These templates cover email and cloud service providers, developer platforms, social media applications, retail brands, and cryptocurrency services. Targeted brands include Apple ID, Gmail, Outlook, ProtonMail, GitHub, Zoho, Zara, and Ledger, among others.
The Bluekit operator dashboard provides centralized control over domain purchasing and registration, allowing attackers to acquire and manage phishing domains directly from the same panel used to configure phishing sites and review captured data. During site creation, operators can select a domain, choose an operational mode, and apply a specific brand template, after which they can further customize the site’s behavior.
Bluekit also exposes advanced configuration options that go beyond traditional credential-harvesting kits. The platform allows operators to define redirect behavior, spoofing logic, device and geolocation filtering, and anti-analysis or anti-bot checks from a single configuration view. In addition to capturing usernames and passwords, Bluekit is capable of collecting post-authentication data, including session state information, cookies, and browser local storage. The platform provides operators with a live view of victim activity after login.
Bluekit includes an integrated AI Assistant that is marketed as a tool to help operators design phishing campaigns. The assistant panel exposes multiple large language model options, including an abliterated Llama-based default model and references to commercial models such as GPT‑4.1, Claude Sonnet, Gemini, and DeepSeek. In testing conducted by Varonis, only the default model was usable, while the commercial models appeared to require additional configuration.
eSentire Threat Intelligence Analysis:
Although Bluekit currently lags behind some more mature phishing frameworks in terms of automation depth, it compensates for this gap through rapid development velocity and continuous feature expansion. When researchers tested using a detailed executive‑level phishing scenario, Bluekit’s AI Assistant produced a structured campaign outline rather than a fully deployable phishing flow. This indicates that the AI component functions primarily as a planning aid rather than an autonomous phishing copilot. Nevertheless, its inclusion signals the ongoing direction of phishing automation and reflects how threat actors are experimenting with AI to reduce preparation time and lower operational friction.
The Phishing-as-a-Service (PhaaS) model is maturing, bringing capabilities such as domain management, session hijacking, and AI‑assisted lure generation into packaged platforms that are accessible to lower‑skilled operators. These actors increasingly aim to streamline their workflows in order to scale attacks across larger victim pools. This consolidation lowers the technical barrier to entry and increases the likelihood of enterprise credential compromise, where post‑compromise access may be leveraged for account takeover, lateral movement, or follow‑on extortion attempts.
While Bluekit documentation references advanced features such as voice cloning, technical details around these capabilities remain limited in the available reporting. However, a separate report by Abnormal AI highlights the emergence of parallel tooling in adjacent attack domains. That report documents a cybercrime platform called ATHR, which consolidates the full Telephone‑Oriented Attack Delivery (TOAD) kill chain into a single commercial product. ATHR enables end‑to‑end vishing operations by combining AI‑driven voice agents with optional human operators, typically using urgent, security‑themed lures to direct victims into fake account recovery flows designed to extract verification codes and credentials. This parallel evolution in voice‑based fraud could potentially converge across phishing and vishing ecosystems.
While Bluekit may not yet be refined as some established phishing frameworks, its steady development and expanding functionality indicate that it is likely to appear in active phishing campaigns. Organizations that rely solely on password resets following phishing incidents should reassess their response procedures, as Bluekit’s ability to capture active session cookies and browser local storage introduces the risk of persistent session compromise. Additionally, defenders should avoid treating clean sandbox verdicts on inbound links as conclusive, particularly as modern phishing kits increasingly deploy anti‑analysis techniques that selectively evade automated inspection. Phishing and Security Awareness Training (PSAT) programs should be implemented to educate users on modern phishing techniques and evolving attack vectors. However, even with PSAT programs in place, there is no guarantee that users will not fall victim to phishing attacks. To mitigate overall risk, organizations should implement robust Endpoint Detection and Response (EDR) and centralized logging capabilities. These controls can help identify the initial attack vector, trace post‑compromise activity, and support timely incident response actions, including revoking compromised session tokens and terminating active sessions to prevent further attacker abuse.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
