SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

SANS Stormcast Wednesday, July 29th, 2026: AutoIT Payload Injector; Appele Patches; SourTrade Malware; NGINX Exploit

7 min

•Jul 29, 2026about 1 month ago

Summary

This episode covers four critical cybersecurity threats: an AutoIT malware variant using PowerShell obfuscation and shellcode injection into charmap.exe, Apple's release of 200+ security patches across its ecosystem with no zero-days, the SourTrade malware targeting crypto traders with unique per-victim encryption, and a new working exploit for an NGINX remote code execution vulnerability that bypasses ASLR.

Insights

AutoIT continues to evolve as an attack vector, with attackers leveraging legitimate Windows utilities like charmap.exe as injection vessels to evade detection
Apple's patch volume remains high but lacks zero-day exploits, suggesting either better vulnerability management or slower adoption of AI-assisted vulnerability discovery compared to competitors
SourTrade demonstrates sophisticated malware delivery using per-victim seed-based encryption and in-browser assembly, making network-level detection significantly more difficult
NGINX vulnerability exploitation is now practical and reliable even with modern defenses like ASLR enabled, elevating patch urgency from theoretical to critical
Phishing campaigns continue to use legitimate file formats (RAR archives) and social engineering (fake bank statements) as initial infection vectors

Trends

Increased use of legitimate Windows binaries as injection targets to evade endpoint detectionShift toward per-victim malware customization and assembly to defeat signature-based detectionTargeting of cryptocurrency traders as high-value victims with sophisticated malware rather than simple scamsProof-of-concept exploits for patched vulnerabilities becoming available faster, reducing patch windowsMulti-stage PowerShell obfuscation becoming standard in email-based malware delivery chainsApple's vulnerability patch cadence remaining high but potentially lagging in AI-assisted vulnerability discoveryMalvertising and malware delivery through advertising networks as persistent attack vector

Topics

AutoIT Malware and Shellcode Injection PowerShell Obfuscation Techniques Process Injection and Living-off-the-Land Attacks Phishing with RAR File Attachments Apple Security Patches and Vulnerability Management Zero-Day Exploitation Trends SourTrade Malware Analysis Cryptocurrency Trader Targeting Malware Encryption and Obfuscation NGINX Remote Code Execution Vulnerability Heap-Based Buffer Overflow Exploitation Address Space Layout Randomization (ASLR) Bypass Endpoint Detection and Response Evasion Malvertising and Advertising Network Threats Vulnerability Patch Prioritization

Companies

Apple

Released approximately 200 security patches across iOS, macOS, iPadOS, tvOS, and watchOS with no zero-day exploits

Confiant

Published research on SourTrade malware targeting cryptocurrency traders through malvertising campaigns

Application Security Lab Depth First

Created proof-of-concept exploit for NGINX vulnerability that reliably bypasses ASLR defenses

SANS

Sponsor of the podcast and provider of the Undergraduate Certificate Program in Applied Cybersecurity

SANS Internet Storm Center

Publisher of this daily cybersecurity podcast covering emerging threats and vulnerabilities

People

Johannes Ulrich

Host of the Stormcast podcast, recording from Jacksonville, Florida

Xavier

Discovered AutoIT malware sample with novel shellcode injection technique targeting charmap.exe

Quotes

"AutoIT is back. I'm not sure if it ever left, but Xavier found an AutoIT sample that actually has a new trick up its sleeve."

Johannes Ulrich•Opening segment

"The binary that's being used here is charmap.exe...it launches charmap.exe and then injects the malicious shellcode in it, basically sort of using it as a vessel to hide the malicious activity."

Johannes Ulrich•AutoIT malware segment

"With this particular technology, the attacker is able to essentially deliver a unique byte stream to every victim. And that, of course, makes it more difficult to detect this attack on the network."

Johannes Ulrich•SourTrade malware segment

"This proof of concept exploit does work around address space layout randomization so it is a reliable exploit for this vulnerability even on most larger servers."

Johannes Ulrich•NGINX vulnerability segment

Full Transcript

Hello and welcome to the Wednesday, July 29th, 2026 edition of the SANS Internet Storm Center's Stormcast. My name is Johannes Ulrich, recording today from Jacksonville, Florida. And this episode is brought to you by the SANS.edu Undergraduate Certificate Program in Applied Cybersecurity. Well, and AutoIT is back. I'm not sure if it ever left, but Xavier found an AutoIT sample that actually has a new trick up its sleeve. Xavier noticed a large number of emails, that's of these fake bank emails that claim to have some kind of statement, account details also attached. That's a RAR file. Now, once unpacked, and then it turns out that there is several levels of PowerShell obfuscation to go through in this particular script. But what you end up with in the end is a PowerShell script that is interesting because it will actually inject shellcode into a binary. The binary that's being used here is charmap.exe. If you're not familiar with Windows, it's like the little sort of keyboard picker that you have as an option to basically select some of the less used characters if you ever would like to type them. Now, it launches charmap.exe and then injects the malicious shellcode in it, basically sort of using it as a vessel to hide the malicious activity. interesting kind of strategy and of course we have seen a similar sort of shellcode injections in different tools before but using scripting language like AutoIT for it And to me at least the use of charmap is also kind of unique here And probably they're using this tool because it's not that often used, but also does not necessarily raise a suspicion if it's running on a system. And Apple yesterday did its usual update of everything. And with this, it did again patch multiple security vulnerabilities, close to 200 if you sort of count across the different operating systems. There are updates now for iOS, macOS, iPadOS, tvOS, watches, essentially anything Apple publishes. So we are now up to iOS and macOS version 26.6. And we also got updates for macOS 14 and 15. The vulnerabilities themselves are not very remarkable. It's sort of the usual mix that you get from Apple. What's sort of interesting is that there's actually no serendate this time. Nothing that is already being exploited. The number is a little bit higher than what we have seen sort of in prior similar releases. Also, remember, that was a few weeks ago, sort of a just security release without any functional updates that was sort of released to patch more vulnerabilities. There's certainly a little bit of impact here of sort of not AI reported vulnerabilities, but overall, it's not as drastic as we have seen it from other companies like Microsoft or Oracle lately. maybe Apple is a little bit still behind here and sort of picking up on the AI stuff or maybe some of the minor vulnerabilities were not included here Can really tell from the release As usual the descriptions are very short And Confiant, a company that is dealing with intelligence and information around advertising risks, so malvertising and like, has published a blog post with an interesting piece of malware that they're calling Sour Trade. Now, where SourTrade is different is how it actually creates the malware on the victim's system. It starts out with the usual, it's malware-tizing, particular crypto traders are being targeted here, not with the usual crypto scams, but instead with malware. When the malware starts to get downloaded, it first downloads a configuration file. this configuration file does actually install or deliver a unique seed that's then being used to create a pseudorandom stream of bytes that is then being used to decrypt the matter as it's being pulled from various servers and then assembled in the client. Now, with this particular technology, the attacker is able to essentially deliver a unique byte stream to every victim. And that, of course, makes it more difficult to detect this attack on the network. And also, since it's assembled then in the browser on the endpoint, that makes it a bit more difficult for any endpoint protection products to intercept the malware before it being executed Overall interesting and fairly complex scheme I wonder if maybe it a little bit too fragile and how well this all works But yeah if you into malware analysis definitely something to look at in case you're running into some variation of this particular system in your environment. And researchers from Application Security Lab Depth First have created a proof-of-concept exploit for an nginx vulnerability that was patched around the 15th i think i mentioned it back then because it's a remote code execution vulnerability it is a heat-based buffer overflow so there wasn't some idea that address space layout randomization may prevent effective exploitation well this proof of concept exploit does work around address space layout randomization so it is a reliable exploit for this vulnerability even on most larger servers and the like that often do employ this defensive mechanism so it's not just one of those iot vulnerabilities as was originally sort of proposed interesting to have a proof concept that soon in particular one that's as complete as this one so definitely make sure that you're patching nginx as quickly as possible if you haven't done that yet well and this is it for today so thanks for listening thanks for liking thanks for recommending this podcast and thanks for subscribing to it and talk to you again tomorrow bye Thank you.