CISA Flags Exploited Fortinet Flaws as ClickLock macOS Malware and Fairlife Ransomware Lead July 17 Threats

Top Stories

CISA urges immediate action on actively exploited Fortinet flaws

CISA warned federal agencies to rapidly patch two actively exploited Fortinet FortiSandbox vulnerabilities, with deadlines pushed to this weekend according to BleepingComputer’s reporting (source).

Why this matters: when CISA adds flaws to operational remediation requirements and describes active exploitation, defenders should assume opportunistic scanning and follow-on intrusion attempts are already underway.

What to do now: - Identify all FortiSandbox instances, including lab, DR, and rarely used appliances. - Confirm installed version and patch status. - Review internet exposure and management plane access controls. - Pull logs for anomalous admin logins, config changes, and unexpected outbound connections since at least the public warning date. - If patching cannot happen immediately, isolate management interfaces and restrict access via VPN or jump host.

Technical Notes

Start with fast asset discovery and exposure checks:

# Example: find known Fortinet hosts in internal DNS exports or CMDB data
grep -i "forti\|sandbox" assets.csv

# Example: scan for HTTPS management interfaces on expected ranges
nmap -sV -p 443,8443 10.0.0.0/16

Review perimeter logs for management access spikes:

# Example grep against reverse proxy or firewall logs
grep -E "fortisandbox|/admin|/login" /var/log/* 2>/dev/null

Look for: - Logins from new source IPs - Access outside normal admin windows - Configuration export/download activity - Unexpected outbound callbacks from the appliance

---

South Korea accelerates sovereign AI plans for cybersecurity

South China Morning Post reports South Korea is racing to build a sovereign AI model for cybersecurity, reflecting broader concern over dependence on foreign AI stacks for sensitive security workflows (source).

Why this matters: sovereign AI in cyber is becoming an operational issue, not just a policy one. Security teams handling regulated data, threat intel, source code, or citizen records increasingly need to know where model weights, prompts, logs, and retrieval data reside.

What to do now: - Inventory AI-enabled security tooling in the SOC. - Verify data residency, retention, and model training terms with vendors. - Separate low-risk AI use cases from high-risk ones involving sensitive telemetry or customer data. - Require approval gates before connecting AI tools to email, docs, calendars, ticketing, or CRM systems.

---

New ClickLock macOS malware forces password entry

Researchers highlighted a new macOS information stealer called ClickLock that reportedly kills visible processes to coerce the user into entering their login password, according to BleepingComputer (source).

Why this matters: this is a user-manipulation technique layered onto malware execution. It is not just about malicious binaries; it is about convincing users that a forced password prompt is legitimate.

What to do now: - Alert macOS users that sudden process termination followed by password prompts is suspicious. - Hunt for parent-child process anomalies and mass app termination events. - Ensure EDR captures process execution, TCC events, and credential access attempts. - Restrict unsigned or unnotarized applications where feasible.

Technical Notes

Useful macOS collection points:

# Unified log searches for suspicious auth prompts or process terminations
log show --last 24h --predicate 'eventMessage CONTAINS[c] "authentication" OR eventMessage CONTAINS[c] "terminated"'

Check recent application execution and quarantine artifacts:

sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 \
'select LSQuarantineTimestamp, LSQuarantineAgentName, LSQuarantineDataURLString from LSQuarantineEvent order by LSQuarantineTimestamp desc limit 20;'

Look for: - Unexpected binaries launched from Downloads, DMG mounts, or temp directories - Multiple GUI apps terminating in a narrow timeframe - Repeated password prompts not tied to standard macOS update flows

---

Coca-Cola says Fairlife ransomware attack halted US dairy production

The Coca-Cola Company disclosed that a ransomware incident affecting Fairlife disrupted operations and temporarily halted US production, per BleepingComputer (source). Bloomberg also covered the operational suspension (source).

Why this matters: ransomware remains an availability problem first. Even organizations with mature corporate security can still face production disruption at the subsidiary or plant level.

What to do now: - Re-check OT and plant network segmentation. - Validate offline recovery paths for manufacturing and warehouse systems. - Review privileged access into production environments from enterprise IT. - Confirm backup restoration time for ERP, scheduling, and line-control support systems. - Make sure business continuity plans account for cyber-driven supply interruption.

Technical Notes

Immediate ransomware readiness checks:

# Example: verify backup job success on Linux-based backup servers
grep -iE "success|failed|error" /var/log/backup*.log | tail -n 50

# Example: identify recent domain admin logons on Windows via PowerShell
Get-WinEvent -LogName Security | Where-Object {$_.Id -in 4624,4672} | Select-Object -First 50

Prioritize detections for: - Sudden disablement of security tools - PsExec, WMI, RDP, SMB admin share lateral movement - Mass file rename or encryption behavior - Backup deletion or tampering - Hypervisor and storage admin account misuse

---

Cedar Crest College reports significant cyber incident

Local reporting says Cedar Crest College experienced a significant cybersecurity incident affecting college technology services (source).

Why this matters: higher education environments remain difficult to defend because they blend enterprise IT, research systems, student devices, decentralized administration, and broad third-party access.

What to do now: - Review MFA coverage for faculty, staff, and contractor accounts. - Tighten remote access to SIS, LMS, payroll, and identity infrastructure. - Hunt for suspicious OAuth grants and compromised student worker accounts. - Segment research and lab networks from core administrative systems. - Rehearse outage communications for registration, email, and learning platforms.

---

Claude Chrome extension flaw could let malicious extensions trigger AI actions

BleepingComputer reports a flaw affecting Anthropic’s Claude for Chrome extension that could allow a malicious browser extension to simulate user clicks and trigger predefined AI actions in connected apps such as Gmail, Google Docs, Google Calendar, and Salesforce (source).

Why this matters: browser extensions are becoming privilege pivots into AI-connected workflows. If an AI extension has delegated access to business systems, a weaker extension may become the practical attack path.

What to do now: - Audit installed browser extensions across managed endpoints. - Remove unnecessary extensions and block sideloading. - Review what AI assistants are authorized to access. - Apply least privilege to connected SaaS scopes. - Watch for suspicious automated actions in email, docs, calendars, and CRM tools.

Technical Notes

For managed Chrome environments, review extension policy and inventory:

{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "approved_extension_id_1",
    "approved_extension_id_2"
  ]
}

Admin checks should include: - Newly installed extensions in the last 7 days - Extensions requesting broad tabs, activeTab, scripting, or host permissions - AI extensions with cross-app integrations - Unexpected OAuth grants tied to browser-based assistants

---

OkoBot delivers multi-payload theft operations

A newly observed framework called OkoBot is delivering more than 20 payloads focused on credential theft, wallet seed phrase theft, and other data theft activity, according to BleepingComputer (source).

Why this matters: modular crimeware increases dwell time and monetization options. A single foothold can pivot from infostealing to wallet theft, persistence, remote access, and secondary payload deployment.

What to do now: - Hunt for archive extractors, script interpreters, and LOLBins launching from user profile paths. - Block known malicious download channels and monitor short-lived staging directories. - Pay extra attention to developer workstations and finance users with browser-saved credentials or wallet tooling. - Reset credentials and revoke tokens when infostealer activity is suspected.

---

Critical Vulnerabilities

CVE-2026-45336: HireFlow authentication bypass via hard-coded Flask secret

• CVSS: 10.0
• Affected: HireFlow 1.2 and earlier
• Fixed in: 1.3
• Summary: A hard-coded Flask secret_key allows unauthenticated attackers who know the publicly exposed value to forge session cookies and impersonate an admin, according to the GitHub advisory and release notes (advisory, fix).

So what? If your app trusts client-side session cookies signed with a known secret, authentication is effectively broken.

Action: - Upgrade to 1.3. - Rotate the Flask secret immediately. - Invalidate all active sessions. - Review admin actions for unauthorized account creation or data export.

Technical Notes

Check common Flask session exposure patterns:

app.secret_key = "hardcoded-secret"

Operational response:

# Search code and env files for embedded Flask secrets
grep -Rni "secret_key\|SECRET_KEY" .

---

CVE-2026-46512: Frogman directive injection in Asterisk dialplan generation

• CVSS: 9.9
• Affected: Frogman before 1.6.2
• Fixed in: 1.6.2
• Summary: A caller with PERM_WRITE can inject arbitrary Asterisk directives through template parameters when applying dialplans, as described in the GitHub advisory (advisory, fix release).

So what? In PBX environments, directive injection can become command execution, call routing abuse, eavesdropping risk, or service disruption.

Action: - Upgrade to 1.6.2. - Review who has PERM_WRITE. - Audit recent dialplan changes and generated config files. - Monitor for suspicious use of System(), SHELL(), Goto, or Macro.

Technical Notes

Search for risky directives in Asterisk custom config:

grep -RniE "System\(|SHELL\(|Goto\(|Macro\(" /etc/asterisk

---

CVE-2023-49899: Unauthenticated remote command execution

• CVSS: 9.8
• Summary: Claroty Team82 describes unauthenticated remote command execution caused by improper origin verification of a communication channel (source).

So what? This class of flaw often means perimeter-exposed devices or management interfaces can be commandeered without credentials.

Action: - Review the vendor and product details in the Claroty disclosure dashboard. - Identify exposed systems matching the affected technology. - Restrict network access until remediation is confirmed. - Assume compromise if internet-exposed and unpatched.

---

CVE-2023-49900: Unauthenticated RCE via unsanitized SetParameter input

• CVSS: 9.8
• Summary: Claroty Team82 reports a remote code execution issue caused by insufficient sanitization in the SetParameter command (source).

So what? Input-handling flaws in device or appliance command channels can enable straightforward exploit chains and persistent footholds.

Action: - Validate exposure of affected systems. - Apply vendor remediation once confirmed. - Add network controls or ACLs around management interfaces. - Capture configs and logs before change in case forensic review is needed.

---

CVE-2026-45695: Kopia unauthenticated command execution risk in HTTP server mode

• CVSS: 9.8
• Affected: Kopia before 0.23.0
• Fixed in: 0.23.0
• Summary: Kopia’s HTTP server started with --without-password can accept attacker-supplied SFTP storage configuration and pass malicious SSH arguments that result in command execution, per the GitHub advisory and release notes (advisory, fix).

So what? Backup systems are high-value targets. Unsafe unauthenticated service modes can turn a backup controller into an attacker staging point.

Action: - Upgrade to 0.23.0. - Search for any Kopia service started with --without-password. - Restrict HTTP listener exposure. - Review command history and process execution around ssh invocations.

Technical Notes

Find unsafe service definitions:

ps aux | grep kopia
systemctl cat kopia 2>/dev/null
grep -Rni -- "--without-password" /etc/systemd /opt /srv 2>/dev/null

Look for suspicious SSH argument injection patterns:

grep -Rni "ProxyCommand" /var/log /etc 2>/dev/null

---

What Defenders Should Do Today

1. Patch the highest-risk exposed systems first

Focus on: - FortiSandbox instances called out by CISA (source) - Kopia servers reachable over HTTP - Any exposed systems tied to the Claroty disclosures - Internal business apps using weak or hard-coded secrets

2. Hunt for user-driven credential theft on macOS

Specifically look for: - Sudden app termination followed by password prompts - Execution from Downloads, mounted images, or temp folders - New persistence items such as LaunchAgents or login items

Example checks:

launchctl list | grep -vi apple
ls -la ~/Library/LaunchAgents

3. Reassess browser extension risk

Do this today: - Export extension inventories - Remove unapproved extensions - Review AI assistant integrations - Revoke excess SaaS scopes

4. Validate ransomware resilience, not just backup existence

Ask: - Can we restore critical operations, not just files? - Are backup admins separated from domain admins? - Are offline or immutable copies actually recoverable? - Do plant, warehouse, and ERP teams know their manual fallback process?

5. Improve detection content around these stories

Add or tune alerts for: - New admin logins on network appliances - Browser extension installs and permission changes - Mass process termination on macOS - SSH executions with unusual arguments - PBX dialplan modifications containing command-like directives

---

Bottom Line

Today’s cybersecurity threats are a mix of immediate exploitation risk, user-focused malware tradecraft, browser-to-AI privilege abuse, and classic ransomware disruption. The most time-sensitive item is the Fortinet patching push tied to active exploitation (source). After that, defenders should tighten macOS detections, reduce extension sprawl, and review backup and operational recovery paths before the next incident tests them.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.