Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors are actively exploiting vulnerabilities in the AhsayCBS backup utility to compromise affected systems. The attack chain involves leveraging two recently disclosed flaws, including CVE-2026-105133, an improper authentication vulnerability in the checkSysPwd() function within the AhsayCBS Java codebase. Successful exploitation allows attackers to seize control of targeted devices. Post-exploitation activity includes deployment of web shells for persistent access and remote control. Attackers also deploy XMRig cryptocurrency miners disguised as Microsoft Edge to evade detection. The use of a legitimate application name as a disguise indicates deliberate obfuscation techniques. The campaign targets organizations using the AhsayCBS backup solution. The CVSS v4 score of 5.5 for the known CVE suggests moderate severity, but active exploitation elevates the overall risk.