SANS Stormcast Monday, March 30th, 2026: More TeamPCP: telnyx; Netscaler Exploit; macOS ClickFix Fix; Windows Smart Install

Summary

---

SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

Episode: Monday, March 30th, 2026
Host: Johannes B. Ullrich
Theme: Latest Threats—TeamPCP Activity, Telnix Python Package Compromise, Netscaler Exploit, New macOS Security Feature, Windows Smart Install Overview

---

Episode Overview

Johannes B. Ullrich presents a concise update on critical cybersecurity developments for March 30, 2026. The episode covers escalating TeamPCP supply chain attacks (notably targeting Telnix), fresh exploit activity against Citrix Netscaler appliances, a new security protection added to macOS to fight copy-paste attacks, and a deeper look at the Windows Smart Install feature for application download management.

---

Key Discussion Points & Insights

1. Escalating TeamPCP Attacks: Telnix Python Package Compromise

• TeamPCP Group’s Tactics: Continues targeting Python libraries, now compromising the Telnix package used for VoIP automation and AI chatbot integrations.
• Attack Vector: Instead of altering the GitHub source, attackers compromised the account on the Python Package Index (PyPI) and uploaded a tainted version.
• Impact & Mitigations:
  • If organizations pinned to previous versions, they were protected.
  • Different payloads were deployed for Windows and Linux/macOS.
  • Malicious code was obfuscated—delivered inside a WAV file.
• Broader Threat Context:
  • Increasing links between TeamPCP and ransomware operators—either as access brokers or by sharing/selling compromised credentials and tools on platforms like BreachForum.

Notable Quote:

“Some of the malicious code is being transported as a WAV file, so makes it a little bit more difficult to detect.”
(Johannes B. Ullrich, 01:45)

---

2. Citrix Netscaler Memory Overreach Vulnerability

• Updated Developments: Active exploitation following the patch release, public Proof of Concept (PoC), and Watchtower’s detailed technical write-up.
• Vulnerability Details:
  • Actually two similar vulnerabilities under a single CVE.
  • Similar to previous “Citrix Bleed” issues.
  • Exploitation Simplicity: Appending ?WTX (without an equal sign) to the vulnerable endpoint leaks memory as a base64-encoded cookie.
• Risks: Leaked memory can include sensitive information from prior requests.
• Vulnerable Configurations: Only Netscalers set as SAML endpoints are exploitable.
• Recommendation:

  “Definitely assume compromise if you find any unpatched Citrix Netscalers.”
  (Johannes B. Ullrich, 03:25)

Notable Quote:

“Very easy to exploit, as Watchtower points out, and it's already being exploited and probed for. So definitely assume compromise...”
(Johannes B. Ullrich, 03:15)

---

3. macOS ClickFix – New Copy-Paste Protection Feature

• Feature Overview: Latest macOS update brings safeguards against “ClickFix” attacks, where users are tricked into pasting malicious shell commands from browsers or messengers into Terminal.
• How It Works:
  • Triggers a warning dialog if the user copies text from an untrusted source (browser/messaging app) and is not a regular terminal user.
  • Designed to avoid alert fatigue by only targeting less experienced users and copy-pasting from the Internet.
• Implementation Notes: Limited official Apple documentation—most findings come from reverse engineering and user experimentation.

Notable Quote:

“Interesting logic. Probably meant to avoid false positives and flooding people with alerts, which often leads to alert fatigue.”
(Johannes B. Ullrich, 04:30)

---

4. Windows Smart Install: Enhanced Software Download Protection

• Feature Recap: Not new, but underutilized. Allows administrators to lock down download and execution of applications.
• Operating Modes:
  • Maximum: Only allows Microsoft Store downloads—non-store apps fail silently.
  • Intermediate: Warns about non-Store downloads or suggests Store alternatives.
  • Also affects certain “dangerous” file/document types that are often abused (they may be blocked from opening altogether).
• Recommendation: Review and consider deployment for better protection; link to Eric Law’s comprehensive blog post for more detailed technical guidance.

Notable Quote:

“If you do enable downloads only from the Microsoft Store, you will not receive any warnings. It will just silently fail if you try to run another application.”
(Johannes B. Ullrich, 06:10)

---

Timestamps for Key Segments

• 00:30 TeamPCP supply chain attack and Telnix Python package compromise
• 02:40 Malicious code hiding in WAV files; ransomware actor collaboration
• 03:10 Citrix Netscaler exploit details and risk assessment
• 04:15 Importance of rapid patching and compromise response
• 04:35 macOS ClickFix copy-paste protection feature deep dive
• 05:25 Real-world limits and user experience with new macOS warning dialogs
• 06:00 Windows Smart Install explanation, pros and cons
• 07:05 Effects on document types and reference to further reading

---

Memorable Moments & Quotes

• “Some of the malicious code is being transported as a WAV file, so makes it a little bit more difficult to detect.” (01:45)
• “Very easy to exploit ... already being exploited and probed for. So definitely assume compromise...” (03:15)
• “Interesting logic. Probably meant to avoid false positives and flooding people with alerts, which often leads to alert fatigue.” (04:30)
• “If you do enable downloads only from the Microsoft Store, you will not receive any warnings. It will just silently fail if you try to run another application.” (06:10)

---

Summary Takeaways

• TeamPCP remains a major software supply chain threat, with innovative techniques like code-in-WAV payload delivery and expanding collaborations with ransomware groups.
• Citrix Netscaler SAML endpoints should be prioritized for urgent patching due to easy, in-the-wild memory leak exploits.
• macOS is introducing smarter, user-tailored protection against copy-paste command injection, prioritizing user context to fight alert fatigue.
• Windows Smart Install is a powerful, underutilized option for restricting risky downloads and taming user exposure to malicious documents and installers.

---

For more technical breakdowns and actionable insights, refer to the SANS Internet Stormcenter blog and resource pages.

Transcript

[A]

Hello and welcome to the Monday, March 30, 2026 edition of the SANS Internet Storm Center's Stormcast. My name is Johannes Ulrich. We're recording today from Orlando, Florida and this episode is brought to you by the SANS Edu Graduate Certificate Program in incident response. Yes, and Team PCP is still keeping us busy. The latest update here from Ken that they have now a number of additional libraries being compromised, one of them being Telnix. Telnix is a voice over IP platform, so basically it allows you to automate phone calls and various chatbots and such. Of course this is a prime target to be then integrated with respective AI tools, AI chatbots and the like. And well, that's exactly sort of where the compromise is. They did compromise Python library that is actually then used to interface these tools with Telenux's REST API. Now in this case the actor wasn't able to compromise the GitHub repository. Instead they compromised the PYPI account for Telnix and as a result were able to publish a new version. So in this particular case version pinning should have protected you. And yes, only if you download the new compromised version then you have a problem. Slightly different payloads for Windows and Linux or macOS in this case. And another sort of interesting add on is that some of the malicious code is being transported as a WAV file, so that way it makes it a little bit more difficult to attack. Also there are now more and more links between the team, PCP crew and various ransomware actors. Looks like they're either kind of selling credentials, kind of working as an access broker here, or that they're in general communicating and collaborating with tools like for example breachforum to then turn what they have now into additional ransomware attacks. And last week I mentioned Citrix netscaler memory overreach vulnerability that was patched by Citrix and well, we now have exploit code for this vulnerability in additional details thanks to Watchtower. Watchtower actually published a two part blog post about this. One of the things they point out, it's actually two vulnerabilities, even though there was only one CVE assigned. Both vulnerabilities are similar. They are also similar to the prior Citrix Bleed vulnerability under certain circumstances. And one of the simpler to exploit ones here is where you just have question mark WTX at the end of the specific vulnerable endpoint. So no equal sign. That's kind of critical, no value. In that case, memory is being leaked and returned as a base64 encoded cookie. So very convenient. And also to parse and extract the data. And yes, this memory content does contain data from prior requests and that of course may contain additional sensitive data. Very easy to exploit, as Watchtower points out, and it's already being exploited and being probed for. So definitely assume compromise if you find any unpatched Citrix netscalers. In order to be exploitable, this netscaler has to be configured as a SAML endpoint, otherwise this is not vulnerable. So yes, definitely something that you must address this week. And like I said, assume compromise. And then we got an interesting new feature in the latest update of macOS that I haven't covered yet and it is security related and that's a protection for users from click Fix attack where the user is being tricked into copy pasting a shell command into a terminal macOS is using a little bit of tricky logic here to warn the user. So if the warning is triggered there is a pop up box basically telling the user that what they're about to do may possibly harm the computer and you may overwrite the warning and basically just go ahead with the paste anyway. But this warning is only displayed under fairly specific circumstances. First of all, the copy has to happen in a browser or a messaging app and then the user is only warned if they are not regularly using term terminal and if they haven't like copy pasted recently a string into terminal. So the idea here is to really only catch copy pastes from users that really usually don't use terminal, don't copy paste stuff into terminal, and if the source of the text they're pasting is basically an untrusted source from the Internet. So browsers and messengers. Interesting logic. Probably meant to avoid false positives and flooding people with alerts, which of course often leads to alert fatigue and has sort of counterproductive effects if you have experienced it or if you have sort of a good actually Apple write up, which I haven't seen yet. I've really only seen sort of reverse engineering that users have done by experimenting with that feature. And a little bit related and thanks for Caleb for alerting me of this blog post is a blog post by Eric Law that explains a little bit more detail how the Windows Smart install works. Not a new feature, but I don't really see it implemented quite quite often enough. And it's essentially intended to protect Windows users from downloading malicious software. Now typically on Windows you're by default allowed to just download software and run it. You'll get a warning that it's downloaded from the Internet. That's that famous mark of the web. But you can be more restrictive where you in the most restrictive case only allow software to be downloaded from the Microsoft Store. Or in sort of the intermediate cases, it'll tell you that there is a similar application in the Microsoft Store or just basically give you a warning that this particular application is not downloaded from the Microsoft Store. There are a couple interesting sort of facets to this. For example, if you do enable downloads only from the Microsoft Store, you will not receive any warnings. It will just silently fail if you try to run another application. Also, it may affect some other file types, not just just applications that are labeled as dangerous file types and for example things like some document types and such that are often being abused can be labeled as dangerous. And then you also won't be able to open those documents. So real good thorough blog post here to better understand how Windows Smart Install works and some of the little quirks and maybe unexpected side effects. Well, and this is it for today. So thanks for listening. Thanks for subscribing. Thanks to the listeners who actually looked me up today and picked up their sticker. So thanks and talk to you again tomorrow. Bye.