Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors are actively exploiting two AhsayCBS vulnerabilities (CVE-2026-105133 and CVE-2026-105134) — including a high-severity command injection — to bypass authentication, execute arbitrary commands, and deploy web shells and XMRig cryptominers (disguised as edge.exe). Exploitation began on October 7, 2026, impacted at least five organizations, and involves AI-assisted PowerShell scripts with anti-analysis checks and use of a vulnerable driver for potential kernel-level access; mitigations include limiting management interface access and restricting to trusted IPs or VPN.