Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Inside the Stealthy Agent Tesla Infection Chain

Part of the CVE-2026-54420 story · since 15 Jun

Quiet for 6 weekslast report 15 Sep8 articles4 outlets
15 Jun · CISA first31 Jul23 Aug15 Sep8 OctNowThis article4th of 8
  • Mon 15 Jun, 19:40 UTC. CISA, first report. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:16 UTC. CISA. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline, its first report on the story. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV. This article, 4th of 8.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts. Cites a CVE in CISA KEV.

The article highlights two critical vulnerabilities detected today: CVE-2026-54420 related to a LiteSpeed cPanel Plugin and CVE-2026-20262 involving Cisco Catalyst SD-WAN Manager. It elaborates on an advanced malware infection chain, specifically Agent Tesla, illustrating how a seemingly benign phishing email can lead to significant system compromise.

This involves a multi-stage infection process utilizing heavily obfuscated scripts to disable local security, facilitate PowerShell launches, and employ techniques like process hollowing for stealthy execution. The malware incorporates anti-analysis capabilities to evade detection by security measures, and it targets sensitive data through a keylogger and screenshots, exfiltrating information via normal network traffic protocols. The article stresses the importance of advanced cybersecurity measures and employee training to counter such threats.

How the story developed

All 8 articles
Quiet for 6 weekslast report 15 Sep8 articles4 outlets

8 articles from 4 outlets since 15 Jun. Quiet since 15 Sep. This was the 4th report, 13 hours after the first.

Now15 Jun171814 Sep1617First reportCISA · 15 Jun, 19:40This article4th of 8 · day 1
  • Mon 15 Jun, 19:40 UTC. CISA, first report. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:16 UTC. CISA. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline, its first report on the story. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV. This article, 4th of 8.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Mon 15 JunDay 02
    1. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue19:40 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability20:16 · CISA · official · Known exploited CVE
  2. Tue 16 JunDay 14
    1. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed01:30 · SecurityOnline · Known exploited CVE
    2. Inside the Stealthy Agent Tesla Infection Chain08:21 · SecurityOnline · Known exploited CVE · This article, 4th of 8
    3. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack09:29 · Security Affairs · Known exploited CVE
    4. Could Apple Build Its Own OpenClaw Competitor?09:30 · SecurityOnline · Known exploited CVE
  3. Wed 17 JunDay 21
    1. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root07:50 · SecurityWeek · Known exploited CVE

  4. Quiet for 13 weeks

    Tue 15 SepDay 921
    1. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts13:13 · Security Affairs · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in