Intelligence Feed

1mo ago · bleeping-computer

Japan's Digital Agency disclosed a data breach resulting from exploitation of a vulnerability in a VPN device used by the Government Solution Service (GSS). The attacker gained unauthorized access by exploiting the flaw, leading to potential exposure of approximately 246,000 records containing personal information of government employees and associated individuals. The exposed data includes names, email addresses, telephone numbers, and physical addresses, though sensitive identifiers such as My Number, bank accounts, and pension numbers were not compromised. The agency contained the breach by suspending the compromised account and isolating the affected system, with no evidence of data misuse found to date.

1mo ago · hacker-news

A suspected Chinese threat actor known as Red Heron has exploited CVE-2026-60004, a critical remote code execution vulnerability in Gitea, to compromise 13 organizations across six countries. The campaign targeted sectors including defense, government, energy, and telecommunications, using automated exploitation to gain initial access, steal source code, and establish persistent access. The attackers deployed a custom Linux backdoor named JITTERLY and a novel LD_PRELOAD rootkit called SIXZUT to maintain stealth and enable post-exploitation activities such as credential theft, lateral movement, and data exfiltration.

1mo ago · hacker-news

A vulnerability in Telegram Desktop versions 4.15.1 through 6.9.3 allowed malicious bots to embed hidden JavaScript within inline keyboard buttons, which could be executed when users opened HTML chat exports in a browser. The script could exfiltrate all messages in the exported file or rewrite the page content, such as displaying a fake verification form. The flaw was fixed in versions 6.9.4 (beta) and 7.0.1 (stable) released in July 2026, but previously exported HTML files remain vulnerable if opened in browsers with JavaScript enabled. No CVE has been assigned, and Telegram did not publicly acknowledge the issue despite confirmation and a declined bug bounty.

1mo ago · hacker-news

An attacker gained and maintained persistent access within the network of 3BB, a major Thai broadband provider, by deploying a hidden MeshCentral backdoor configured to report to a malicious command-and-control server. The attacker used legitimate administrative tools and scripts to escalate privileges, conduct internal reconnaissance, and target RADIUS databases containing subscriber credentials. Indicators show active administrative control over internal systems, password spraying, and attempts to exfiltrate sensitive authentication data. The intrusion was discovered via an exposed external server containing attacker tools, though the initial access vector remains unconfirmed despite evidence of exploit capabilities for CVE-2024-21762 in FortiGate devices.

1mo ago · hacker-news

Researchers have disclosed a hardware-based attack called DDRop that exploits a design flaw in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP confidential computing technologies. The attack uses a low-cost interposer device inserted between the processor and memory module to silently drop memory writes, allowing an attacker to manipulate encrypted memory by forcing the reuse of stale data. This enables privilege escalation, memory read/write access to victim virtual machines, and tampering with attestation mechanisms. The vulnerability stems from the lack of a freshness check in memory encryption designs, and no software patch can fully mitigate it due to its hardware-level nature.

1mo ago · bleeping-computer

Hackers are conducting a mass-scanning campaign targeting internet-exposed Vite development servers, exploiting CVE-2026-39364 to bypass file access controls and steal sensitive cloud credentials from AWS and Azure environments. The attackers use specific query parameters to retrieve environment files, cloud credentials, Terraform configurations, and system information. The activity has been observed originating from IP addresses in the United States, Belgium, and the Netherlands, with attackers leveraging Google Cloud infrastructure for evasion.

1mo ago · hacker-news

A malicious browser extension named 'Twitch Enhanced Viewer | JeetBot' has leaked OAuth tokens of nearly 31,000 users by forwarding them to proxy servers controlled by a Russian commercial bot service. The extension, available on Chrome and Firefox, sends the user's Twitch OAuth token via an &auth= query parameter during video playlist requests, exposing sensitive credentials that allow access to private messages, chat, and account settings. The token leakage occurs for all channels except a hardcoded list of 10 Russian streamers. While the developer has released a patched version (85.8.7) for Firefox, older versions continue to transmit tokens, and previously exposed tokens are not automatically revoked.

1mo ago · bleeping-computer

Revolut disclosed a data breach in which a threat actor impersonated a legitimate government agency by using its authenticated email domain to request customer data. The company inadvertently fulfilled the request, leading to the exposure of personally identifiable information, identity documents, financial records, and transaction history for a limited number of customers. The breach did not impact Revolut's systems or customer funds, and the company claims to have blocked the malicious actor and notified relevant authorities upon detection.

1mo ago · hacker-news

Anthropic identified multiple threat actors, dubbed Generative Threat Groups (GTGs), leveraging its Claude AI models to automate cyber attacks, including reconnaissance, exploitation, and data exfiltration. These groups include state-sponsored, financially motivated, and ideologically driven actors from Russia, China, Iran, and elsewhere, conducting operations such as credential harvesting, supply chain compromises, AI model theft, and influence campaigns. Specific activities include exploiting a WordPress re-installation race condition, deploying web shells, stealing API keys, and building surveillance platforms. The report highlights the use of autonomous multi-agent frameworks that operate with minimal human intervention across global victims in government, tech, finance, and political sectors.

1mo ago · hacker-news

Microsoft identified two distinct attack campaigns targeting enterprise cloud environments. The first involved a large-scale phishing campaign using CEO impersonation and AI-generated content to trick finance teams into executing fraudulent ACH transfers. The second, more technically sophisticated campaign used social engineering around passkey and MFA updates to compromise Microsoft cloud identities, enabling persistent access through adversary-in-the-middle attacks and abuse of Microsoft Graph API for reconnaissance and data exfiltration. The activity is attributed to multiple threat actor groups, including Storm-3121 and Storm-3032 (UNC6671), with infrastructure linked to known cybercrime collectives.

1mo ago · bleeping-computer

Threat actors associated with the China-aligned UNC3569 group are actively exploiting a critical remote code execution vulnerability, CVE-2026-51990, in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The attack chain begins with a maliciously crafted sgbiz: URI that triggers command-line argument injection, leading to unvalidated execution in the SGMyInput.exe process. This allows loading of an attacker-controlled URL in an outdated, unsandboxed Chromium-based webview, which then exploits known browser flaws to achieve code execution and deploy the modular GrayRabbit malware. The malware supports remote command execution, file transfers, reverse shells, and reflective plugin loading, with its C2 configuration RC4-encoded.

1mo ago · security-com

Multiple threat actors have revived the abuse of Node.js to evade detection by executing malicious JavaScript payloads through the legitimate, signed node.exe runtime. The attacks, observed since February 2026, targeted government departments, technology companies, and hotels. In one campaign, attackers used a ClickFix-style lure to deploy PowerShell scripts, established persistence, and leveraged Node.js to connect to Ethereum blockchain gateways (EtherHiding) for command retrieval. A related intrusion involved the deployment of a Rust-based backdoor, C2Looper, linked to ransomware operations. The same actors used shared infrastructure, including the C2 domain datalayerservice[.]com and IP 45.158.196[.]23:8888, across multiple victims.

1mo ago · hacker-news

CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including flaws in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. Attackers are chaining CVE-2026-42016 and CVE-2026-42018 in Artifactory with CVE-2026-82329 to bypass authentication, escalate privileges, and gain administrative control, enabling deployment of backdoors and malicious Groovy plugins. The ScreenConnect vulnerability CVE-2026-84869 has been exploited to execute unauthorized file transfers and run malicious VBScript payloads during active remote sessions, while two MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, are being exploited in an attack chain dubbed 'MikroTrick' to achieve kernel memory disclosure, denial-of-service, and privilege escalation without authentication.

1mo ago · unit42

Unit 42 discovered a long-running pay-per-install (PPI) malware campaign tracked as CL-CRI-1171, which has operated under the radar for at least two years by distributing multiple payloads through a shared loader infrastructure. The campaign uses YouTube channels and SEO poisoning to distribute trojanized software, targeting both gamers and corporate users. The loader, dubbed OfferLoader, delivers various malware families including the previously undocumented Docro Hijacker and ARKTunnel, as well as a new variant of the Insomnia RAT. These payloads enable backdoor access, browser hijacking, and WebSocket tunneling, with infrastructure designed to evade detection through domain rotation and gating mechanisms that filter out scanners.

1mo ago · hacker-news

In May 2026, a coordinated attack on RubyGems involved over 2,000 malicious packages uploaded by what researchers believe were autonomous OpenAI agents. These agents exploited a design flaw in RubyDoc.info's documentation build process, specifically the evaluation of the '.yardopts' file, to achieve remote code execution and scrape public data from U.K. government ModernGov portals. The campaign, dubbed GemStuffer, used the RubyGems registry to exfiltrate data and potentially steal API keys, with some packages attempting to exploit a previously unpatched CDN caching vulnerability. The agents used identifiable naming patterns, including 'oai' in package names and author fields, and left self-identifying comments in code such as '# malicious crawler/exfil'.

1mo ago · bleeping-computer

The Dutch National Cyber Security Centre (NCSC) warns of imminent exploitation of two critical vulnerabilities in Check Point VPN solutions, tracked as CVE-2026-85102 and CVE-2026-85103. These flaws could allow remote attackers to execute arbitrary code on Security Gateways and Security Management Servers, potentially leading to full system compromise. Although no public proof-of-concept has been released, the NCSC assesses the risk as high and urges immediate patching. Affected versions include multiple releases from R80 through R82.10, with fixes available via updates and LivePatch.

1mo ago · hacker-news

Russian state-sponsored threat actor GTG-20006, linked to APT29 (Cozy Bear), has been using AI platform Claude to automate the rebuilding of malware upon detection, enabling evasion of static security defenses. The group targets Ukrainian and European government, diplomatic, defense, and U.S. foreign policy-related entities through a multi-platform toolkit including Windows, Android, and iOS malware delivered via phishing, DNS hijacking, and ClickFix lures. The actor abuses AI to dynamically modify malware, register domains, manage infrastructure, and monitor command-and-control channels, while also exploiting stolen data from compromised hotel Wi-Fi systems and surveillance platforms to identify and target high-value individuals.

1mo ago · hacker-news

A critical path traversal vulnerability in GitLab, tracked as CVE-2026-85706 with a CVSS score of 10.0, has been actively exploited in the wild within hours of its public disclosure. The flaw exists in the repository commits API and allows unauthenticated attackers to read arbitrary files, including sensitive configuration files and credentials, provided at least one public project exists. The U.S. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by September 14, 2026. Another critical insecure deserialization flaw, CVE-2026-87719, was also patched in GitLab EE, which could allow authenticated users with Duo Chat access to extract sensitive instance configurations via a crafted GraphQL subscription.

1mo ago · bleeping-computer

Threat actors are actively exploiting a chain of vulnerabilities in JFrog Artifactory, specifically CVE-2026-42018 and CVE-2026-42016, to bypass authentication and escalate privileges to admin level. Attackers use the initial access to create administrator accounts, generate long-lived tokens, and deploy a Rust-based backdoor for persistence. Additional post-exploitation activities include deploying webshells, stealing configuration data and credentials, and enumerating repositories and users on compromised systems.

1mo ago · bleeping-computer

Threat actors linked to ShinyHunters, Helix, and other extortion gangs are conducting passkey and single sign-on-themed phishing campaigns to compromise corporate Microsoft 365 accounts. The attacks begin with social engineering via phone or messaging, impersonating IT help desks to trick employees into visiting phishing sites or authorizing device-code authentication, enabling adversary-in-the-middle attacks. Attackers perform extensive reconnaissance using Microsoft Graph, persist by adding attacker-controlled MFA methods, and exfiltrate data from SharePoint, OneDrive, and Exchange over prolonged periods to evade detection.

1mo ago · socket-dev

A malicious browser extension named 'Twitch Enhanced Viewer | JeetBot' available on Chrome and Firefox has been exfiltrating users' live Twitch OAuth session tokens to proxy servers controlled by a Russian commercial bot service. The extension, marketed as a quality-of-life tool for Twitch users, forwards the tokens via URL query parameters during video playlist proxying, exposing approximately 30,000 Chrome and 552 Firefox users to potential account compromise. Earlier versions actively collected and POSTed tokens to dedicated endpoints, while current versions silently leak tokens through inline forwarding, except for a hardcoded allowlist of ten Russian streamer channels.

1mo ago · bleeping-computer

Between December 2025 and August 2026, multiple threat groups abused Anthropic's Claude AI for malicious purposes, including credential harvesting, malware development, and reconnaissance. A suspected ShinyHunters affiliate named 'frkoo' automated the download and analysis of 1.8 million Android APKs to extract hardcoded secrets using TruffleHog, with findings sent to a Telegram group. The same actor harvested GitHub email addresses to obtain Personal Access Tokens, enabling breaches of corporate systems. Russian group Midnight Blizzard and Chinese-speaking GTG-10007 used Claude for AI-driven attack automation across multiple stages, including phishing, malware development, and exploit delivery, targeting government and private-sector organizations globally.

1mo ago · bleeping-computer

Threat actors are exploiting trusted AI platforms such as Claude, ChatGPT, and Grok by weaponizing shareable content features to distribute malware. Attackers created malicious Claude Artifacts and shared conversations that mimic legitimate software install guides or troubleshooting advice, hosted on the official domains of these platforms, to bypass user skepticism. These lures trick users into downloading SectopRAT, MacSync stealer, or AMOS stealer via malicious commands or redirects, leveraging the inherent trust in well-known domains. The campaigns are short-lived but effective, relying on SEO poisoning and sponsored search results to increase visibility.

1mo ago · bleeping-computer

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a data breach of its DAVID driver database, which was accessed using compromised credentials from a Plant City Police Department employee's personal device. The ShinyHunters extortion group claimed responsibility, stating they exploited a password reset vulnerability to gain access to multiple accounts, including those of DMV employees and an FBI agent, then scraped driver records by iterating through record IDs. ShinyHunters provided a screenshot of a Jeffrey Epstein DAVID record as proof of compromise and later claimed they had lost access, likely due to patching. The breach impacted at least 200,000 driver records, though FLHSMV has not confirmed the exact number.

1mo ago · hacker-news

Attackers exploited a chain of two vulnerabilities in self-hosted JFrog Artifactory instances—CVE-2026-42018 and CVE-2026-42016—to escalate privileges from unauthenticated access to full administrator control. By exploiting the first flaw to obtain an internal anonymous user token and then abusing the second to elevate it to admin scope, attackers created backdoored administrator accounts and deployed malicious Groovy plugins for code execution. In parallel, a separate critical vulnerability, CVE-2026-82329, allowed unauthenticated attackers to gain admin privileges directly, leading to theft of cluster join keys and deployment of custom Rust-based backdoors on compromised servers.

1mo ago · bleeping-computer

A Russian-speaking threat actor leveraged AI-powered agents to rapidly develop and deploy exploits for CVE-2026-81578 and CVE-2026-82078, targeting vulnerable PaperCut NG/MF servers. The campaign, active since August 31, 2026, compromised at least 440 servers across 395 organizations in 48 countries, with a focus on the education sector. Attackers achieved rapid domain compromise using techniques like pass-the-hash, noPac, and DCSync, often gaining full domain admin access within minutes. The actor used AI models such as OpenAI’s Codex and DeepSeek to accelerate exploit development and target selection via Netlas scanning.

1mo ago · wiz

Wiz Research has identified active in-the-wild exploitation of three vulnerabilities in JFrog Artifactory: CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329. Attackers are chaining CVE-2026-42018 and CVE-2026-42016 to escalate privileges from an unauthenticated state to admin access, while CVE-2026-82329 allows direct unauthenticated administrative access. Post-exploitation activities include creation of persistent admin accounts, deployment of malicious Groovy plugins, execution of ad-hoc commands, and installation of Rust-based backdoors for C2 communication. Multiple threat actors have been observed exploiting these flaws across self-hosted Artifactory instances, with evidence of configuration exfiltration, credential theft, and persistence mechanisms.

1mo ago · talos

Cisco Talos identified a complex WebDAV-based infection chain used in an attack against a Ukrainian government organization. The campaign is attributed to the Russian threat actor UAT-10820 and delivers multiple payloads, including the Amatera stealer, ZigCryptoStealer, and NetSupport Manager. The attackers abuse legitimate infrastructure such as the BNB Smart Chain for hosting and use fake CAPTCHA prompts to evade detection. The operation is assessed as opportunistic, focused on stealing cryptocurrency and credentials, with techniques including memory-resident malware, DLL sideloading via 'rundll32.exe', and use of vulnerable drivers to disable EDR solutions.

1mo ago · hacker-news

A suspected Russian-speaking threat actor has exploited CVE-2026-81578 and CVE-2026-82078, a vulnerability chain in PaperCut NG/MF involving authentication bypass and remote code execution, to compromise at least 440 instances across 395 organizations in 48 countries. The attacker used AI agents powered by OpenAI Codex and DeepSeek, along with offensive tools like Mimikatz and Impacket, to automate exploitation and post-compromise activities including credential harvesting and domain reconnaissance. The campaign targeted primarily the education sector and demonstrated rapid lateral movement, with some attacks achieving domain administrator access in under seven minutes. The actor’s ultimate objectives remain unclear, though activity suggests potential initial access brokering or preparation for follow-on attacks such as data theft or ransomware.

1mo ago · hacker-news

Multiple threat actor clusters have exploited two critical vulnerabilities in Cisco's Secure Firewall Management Center (FMC) to gain unauthorized access, steal credentials, and deploy ransomware. CVE-2026-20079, a critical authentication bypass flaw (CVSS 10.0), allowed unauthenticated remote attackers to execute scripts and gain root access. CVE-2026-20316, a lower-severity flaw, enabled access via a low-privilege account and was used in conjunction with other vulnerabilities for privilege escalation. Three distinct post-compromise activity clusters were identified: UAT-12197 deployed JSP web shells and JAR-based command executors; UAT-11823 delivered Netcat reverse shells and a Cyclops Blink variant; and UAT-11988, a ransomware operation, used living-off-the-land techniques to deploy Qilin ransomware.