Intelligence Feed

1mo ago · talos

Cisco Talos has identified a new Rust-based remote access trojan (RAT) named msaRAT, deployed by the Chaos ransomware group. The malware leverages the Tokio asynchronous runtime and hijacks Chrome or Edge browsers via the Chrome DevTools Protocol (CDP) to establish a covert command-and-control (C2) channel. It is distributed through a deceptive MSI file impersonating a Windows update, enabling in-memory execution and evasion of traditional network detection. The RAT facilitates double-extortion ransomware attacks by enabling persistence and lateral movement.

1mo ago · hacker-news

A China-nexus threat actor tracked as JadeProx has been conducting cyberattacks against government, healthcare, and education sectors in Asia and Latin America using a previously undocumented Windows loader named TriBack Loader. The attacks leverage DLL sideloading techniques and phishing campaigns, including a fake Anthropic Claude website, to deploy backdoors such as Beagle and AdaptixC2. The operators also perform large-scale scanning for known vulnerabilities and maintain persistence via malicious startup entries and webshells.

1mo ago · hacker-news

The Chaos ransomware group is leveraging a Rust-based implant called msaRAT to route command-and-control (C2) traffic through headless instances of Chrome or Edge browsers. The malware uses the Chrome DevTools Protocol to drive the browser and establishes WebRTC data channels via Twilio's TURN service, effectively concealing the attacker's infrastructure. C2 traffic is relayed through legitimate services like Cloudflare Workers and Twilio, making detection difficult. The implant is delivered via a malicious MSI installer that mimics a Windows update and loads a DLL into memory.

1mo ago · hacker-news

A sandbox escape vulnerability named SharedRoot has been discovered in Anthropic's Claude Cowork, allowing an AI agent to break out of its Linux VM and access arbitrary files on the host macOS system. The flaw stems from the entire host filesystem being mounted read-write into the VM, enabling privilege escalation via exploitation of CVE-2026-46331 (pedit COW) in the guest kernel. Although Anthropic has not issued a direct fix, the latest version defaults to cloud execution, mitigating the risk for most users, but local execution remains vulnerable.

1mo ago · hacker-news

Recent cyber threats include malicious npm and PyPI packages delivering infostealers, counterfeit VS Code extensions exfiltrating machine data, and Android spyware disguised as legitimate safety apps. Iranian-affiliated actors are targeting PLC systems in critical infrastructure, while attackers leverage AI models for prompt injection and malware development. Campaigns also involve malvertising distributing SectopRAT and MarkiRAT, DNS tunneling by TrickBot for C2 communication, and exploitation of trust in legitimate platforms to deliver malware.

1mo ago · bleeping-computer

A widespread outage affecting Microsoft 365 services, including Teams, SharePoint, OneDrive, and the Admin Center, began on July 23, 2026, at 10:44 a.m. ET, primarily impacting users in North America. The issue has caused degraded functionality such as failed page loads, missing images in Teams, and inaccessible admin tools. Microsoft is investigating the incident, identified as MO1437424, and has initiated traffic rerouting to mitigate the impact, with partial recovery observed for some users.

1mo ago · bleeping-computer

Ukraine's CERT has identified a campaign by threat cluster UAC-0099 that abuses Notepad++ plugins to stealthily deploy malware. The attackers distribute a malicious archive containing a legitimate Notepad++ installation alongside a malicious plugin named NppExport.dll, which loads the LunchPoke utility to establish persistence. LunchPoke extracts and executes BurnyBear, a loader for the MatchBoil V2 malware, enabling further malicious activity including scheduled task creation and C2 communication.

1mo ago · bleeping-computer

Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting a patched zero-click XSS vulnerability (CVE-2025-66376) in Zimbra Collaboration Suite to steal email data, including credentials, 2FA tokens, and the Global Address List. The group targets organizations in the Defense Industrial Base, government, education, energy, and technology sectors, using both the vulnerability and adversary-in-the-middle phishing kits to bypass MFA and maintain persistent access. Stolen data is exfiltrated via DNS and HTTPS to attacker-controlled infrastructure using the 'Flowerbed' collection framework.

1mo ago · unit42

Unit 42 has identified a persistent cyberespionage campaign, tracked as CL-STA-1114, attributed to a Russian threat actor. The campaign targets Zimbra webmail users in government, defense, transportation, and financial sectors across NATO, Ukraine, CIS, and African countries. Attackers exploit CVE-2025-66376 to deliver a zero-click JavaScript payload that exfiltrates credentials, email archives, and 2FA tokens. The activity highlights ongoing state-sponsored threats leveraging unpatched vulnerabilities in widely used collaboration platforms.

1mo ago · hacker-news

Google has introduced a new selfie video verification feature to help users recover access to their accounts if locked out. The feature uses liveness detection through guided head movements and compares new selfie videos to a previously stored, encrypted video to verify identity. The feature is opt-in, not available for certain account types, and emphasizes privacy by not retaining videos beyond authentication purposes. Google also introduced a hand gesture verification system for reCAPTCHA using hand landmark data, which is deleted after verification.

1mo ago · hacker-news

Attackers have compromised GitHub repositories of a legitimate PHP developer, dinushchathurya, to distribute malicious GitHub Actions workflows. These workflows leverage GitHub-hosted runners to scan for and exploit cPanel and WHM servers vulnerable to CVE-2026-41940, an authentication bypass flaw. The campaign conducts large-scale server-side credential theft, harvesting sensitive data such as cloud keys, API tokens, and SSH credentials, while abusing legitimate development infrastructure for scalability and stealth.

1mo ago · hacker-news

The article discusses the emerging threat of synthetic identity fraud applied to machine identities, where attackers create non-human identities (NHIs) that were never legitimately provisioned. These fabricated identities blend real environmental attributes with fake ones to appear legitimate, evading detection since they have no human owner to raise alerts. As enterprises struggle to track growing numbers of NHIs and adopt agentic AI systems that dynamically create identities, the risk of undetected, privilege-accumulating fake machine identities increases significantly.

1mo ago · bleeping-computer

A race condition vulnerability in the Linux kernel's XFS filesystem, dubbed RefluXFS and tracked as CVE-2026-64600, enables local attackers to gain root privileges by exploiting reflink functionality. The flaw, present since Linux kernel 4.11, allows overwriting of protected files such as /etc/passwd or SUID-root binaries without triggering kernel logs or losing the SUID bit, making detection difficult. Exploitation is reliable, persistent across reboots, and bypasses standard security mechanisms like SELinux and KASLR. Immediate kernel patching is advised, as no practical mitigations exist.

1mo ago · bleeping-computer

The article reports on regulatory and financial penalties imposed on Google by the European Union for violations of the Digital Markets Act (DMA), including favoring its own services in search results and restricting app developers' ability to promote alternative purchase options on the Google Play store. These actions are part of broader antitrust enforcement, not cyber threat activity. There is no mention of malicious cyber operations, threat actors, or technical indicators of compromise.

1mo ago · bleeping-computer

The article discusses the transition from FedRAMP Rev5 to FedRAMP 20X, emphasizing a shift from point-in-time compliance to continuous, machine-readable assurance. It highlights the importance of Key Security Indicators (KSIs) that require ongoing validation through automated systems and trustworthy evidence. The change aims to improve security posture by ensuring controls remain effective in dynamic cloud environments, moving beyond static documentation to real-time operational resilience.

1mo ago · talos

Cisco Talos is presenting at Black Hat USA 2026, showcasing research on emerging threats involving AI agents, Warlock ransomware, and vulnerability discovery trends. The discussions emphasize the evolving tactics of adversaries using AI-driven tools and prompts to enhance attack efficiency. A main focus is on securing enterprise environments against autonomous systems acting as insider threats and improving defensive strategies using AI in security operations.

1mo ago · talos

Cisco Talos has identified a new Rust-based remote access trojan (RAT) named msaRAT, attributed to the Chaos ransomware group. The malware leverages Chrome DevTools Protocol (CDP) to hijack a browser and establish a covert command-and-control (C2) channel via WebRTC, using Cloudflare Workers and Twilio TURN for signaling and relay. This technique allows the RAT to avoid direct network communication, instead routing traffic through legitimate browser processes to evade detection and firewall rules.

1mo ago · hacker-news

Check Point has patched multiple critical vulnerabilities in its Security Management and Multi-Domain Security Management products, including CVE-2026-16232, an authentication bypass flaw under active exploitation. The vulnerability allows unauthenticated remote attackers to obtain full administrative access to the SmartConsole, enabling modification of security policies and configurations. Exploitation requires internet-accessible management interfaces without IP restrictions, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by July 25, 2026.

1mo ago · hacker-news

RefluXFS is a nine-year-old Linux kernel vulnerability (CVE-2026-64600) affecting XFS filesystems with reflink enabled, allowing unprivileged local users to escalate privileges to root by exploiting a race condition in copy-on-write operations. The flaw impacts default installations of Red Hat Enterprise Linux, Fedora Server, Amazon Linux, and related distributions. Exploitation modifies root-owned files like /etc/passwd or setuid binaries without altering metadata, making detection difficult. The vulnerability was discovered using an AI model, which also generated a working exploit and advisory.

1mo ago · bleeping-computer

Check Point has disclosed an actively exploited zero-day vulnerability, CVE-2026-16232, in its SmartConsole GUI admin panel. The flaw is an authentication bypass that allows unauthenticated attackers to obtain administrator-level application tokens. Exploitation enables changes to security policies and configurations, requiring exposed Management Server IPs and unrestricted Trusted Clients. CISA has added the vulnerability to its known exploited catalog and mandated federal agencies to patch by July 25, 2026.

1mo ago · bleeping-computer

Microsoft is addressing an ongoing issue in Exchange Online that has mistakenly quarantined user mailboxes since July 19, 2026, due to a recent infrastructure change causing excessive memory consumption. The out-of-memory condition triggered incorrect mailbox quarantines, blocking users from sending and receiving emails and accessing calendars. This incident, identified as EX1436407, is a recurrence of a previous issue (EX1434354), and Microsoft is performing cleanup operations to restore affected mailboxes.

1mo ago · bleeping-computer

The Chaos ransomware gang is deploying a new Rust-based backdoor named msaRAT that leverages Chrome or Edge browsers to route command-and-control (C2) traffic, evading detection by avoiding direct network connections. The malware uses the Chrome DevTools Protocol to control a headless browser session and establishes encrypted communication via WebRTC through Twilio TURN servers and a Cloudflare Workers endpoint. This dual-layer infrastructure hides the attacker's true C2 server and complicates traceback efforts, while also bypassing firewalls and allowlists by blending with legitimate web traffic.

1mo ago · hacker-news

A vulnerability chain dubbed HermeticReader in the Adobe Acrobat Chrome extension, tracked as CVE-2026-48294, allowed malicious websites to bypass the same-origin policy and steal data from WhatsApp Web sessions. The flaw exploited universal cross-site scripting (UXSS) to access session-bound content without requiring malware installation or credential theft. Attackers only needed to trick users into visiting a malicious page, which could silently extract WhatsApp chat lists, messages, contact names, and profile information.

1mo ago · socket-dev

A large-scale campaign has abused GitHub Actions by compromising repositories to exploit CVE-2026-41940, a cPanel and WHM authentication bypass vulnerability. Malicious workflow files were pushed to compromised repositories, triggering execution on GitHub-hosted runners that downloaded and ran a Linux-based scanner to target vulnerable servers. The payload scanned for exposed credentials, configuration files, and secrets, exfiltrating them to attacker-controlled infrastructure. This campaign extended beyond a single developer, leveraging distributed infrastructure for scanning, exploitation, and credential harvesting at scale.

1mo ago · step-security

Threat actors are increasingly targeting GitHub Actions secrets through campaigns like GhostAction and Megalodon, which exfiltrated thousands of secrets from public repositories. These attacks exploit the accumulation of unused, stale, or long-lived credentials that organizations fail to clean up. The Shai-Hulud worm exemplifies the risk, spreading by stealing npm tokens to publish malicious packages. Transitioning to OIDC-based authentication and eliminating unused secrets can reduce the attack surface significantly.

1mo ago · bleeping-computer

The Upbound Group, a fintech company formerly known as Rent-A-Center, disclosed a cybersecurity incident in which unauthorized actors accessed non-sensitive customer data and documents. The stolen information was used to fraudulently obtain goods through Acima's lease-to-own system, resulting in approximately $13 million in losses. The company has engaged external cybersecurity experts, implemented enhanced security controls, and notified law enforcement, but no ransomware group has claimed responsibility.

1mo ago · hacker-news

GitHub has restructured its public bug bounty program, reducing payout amounts by at least 50% across all severity levels and shifting higher rewards to a private VIP tier. The change aims to reduce noise from low-quality or AI-generated reports while incentivizing high-quality research through exclusive access and larger rewards. This shift reflects broader industry trends as AI tools increase the volume of vulnerability findings, making triage and validation more critical. Human expertise remains essential for identifying complex, high-impact vulnerabilities that AI alone cannot reliably uncover.

1mo ago · bleeping-computer

South Korea disclosed a data breach affecting diplomats worldwide after hackers compromised the National Diplomatic Academy's online education system. The breach occurred between April 2025 and February 2026, exposing personal information such as names, email addresses, IDs, and encrypted passwords of at least 6,000 individuals, including current and former Ministry of Foreign Affairs employees. The attack went undetected for ten months due to the server's location within MFA headquarters and lack of regular security scrutiny, with the National Intelligence Service ultimately uncovering the compromise.

1mo ago · hacker-news

A high-severity local privilege escalation vulnerability, CVE-2026-8933, exists in the snap-confine component of default Ubuntu Desktop installations (24.04, 25.10, 26.04), allowing unprivileged users to gain root access. The flaw arises from a race condition during sandbox initialization, enabling attackers to manipulate temporary file ownership and permissions. By exploiting symbolic links and FUSE file systems, an attacker can write malicious rules to sensitive system paths and achieve arbitrary code execution as root.

1mo ago · socket-dev

A new study analyzed five frontier large language models and found they frequently hallucinate non-existent software package names, with 53 of them still available for registration across PyPI and npm as of April 2026. This creates a risk for 'slopsquatting,' where attackers could register these commonly hallucinated names to distribute malware. Although no active exploitation has been observed, the convergence of hallucinated names across multiple models increases the potential impact of such an attack. The research highlights ongoing software supply chain risks associated with AI-generated code recommendations.