Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors are exploiting two vulnerabilities in the AhsayCBS backup utility to gain control of devices and deploy malware. The vulnerabilities are being used to install web shells and XMRig cryptocurrency miners, with the miners disguised as Microsoft Edge. One of the flaws is an improper authentication vulnerability in the checkSysPwd() function, which has a CVSS v4 score of 5.5 and is identified as CVE-2026-105133. This vulnerability is located in the ApiStructsAction.java file. The exploitation of these flaws allows attackers to seize control of affected devices.