Intelligence Feed

2w ago · bleeping-computer

Hirudo is a new Android malware that targets banking applications by replacing legitimate apps with malicious, modified versions to bypass security checks such as app-signature verification, Accessibility service detection, and Google Play Integrity. The malware is distributed through seemingly legitimate third-party apps for shopping, adult content, and short dramas, which act as loaders and prompt users to grant Accessibility permissions. Once installed, Hirudo can steal banking credentials, payment PINs, SMS messages, and device unlock secrets, while also enabling real-time remote control, screen streaming, audio recording, and camera access. The malware has primarily targeted banks in Indonesia but also affects financial institutions in China, India, Mexico, Morocco, and Thailand.

2w ago · bleeping-computer

Ledger discovered hardware implants in cryptocurrency wallets sold by reseller CryptoBilis, which were modified to steal 24-word recovery phrases and transmit them via LTE using a provisioned eSIM. The implant operates as a separate component that does not alter the Secure Element or Ledger OS, making it undetectable by Ledger's self-checks. Ledger has instructed resellers across Southeast Asia and Hong Kong to halt sales while investigations continue, and users have reported compromised devices from other retailers including Metapod and MediaMarkt.

2w ago · bleeping-computer

The U.S. Department of Justice disrupted operations of the North Korean threat group Famous Chollima (also known as WageMole), arresting two U.S. nationals and charging 14 individuals in connection with a scheme involving remote IT worker fraud. The group used stolen or fabricated identities to obtain technology jobs at U.S. companies, remotely accessed company-issued laptops hosted in 'laptop farms' in Texas, and laundered approximately $3 million to North Korea. The FBI operation, codenamed 'Lonestar Roundup,' seized 187 laptops and KVM devices used in the scheme, which ran from 2019 to July 2025 and impacted around 70 organizations.

2w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned organizations to immediately patch a critical authentication bypass vulnerability in Ivanti Connect Secure (ICS) appliances, tracked as CVE-2026-104935, which has been exploited as a zero-day since at least October 1, 2026. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands, enabling credential theft and data exfiltration. Cybersecurity firm Volexity observed a threat actor, tracked as UTA0576, chaining this flaw with other vulnerabilities to achieve unauthenticated root-level code execution and target Active Directory credentials, including LAPS passwords and BitLocker recovery keys.

2w ago · bleeping-computer

A global law enforcement operation disrupted a large-scale phishing ecosystem responsible for over 1 billion malicious messages targeting more than 75,000 organizations across 150 countries. The infrastructure, linked to the Chinese-language marketplace YAM Store (Storm-3119), provided phishing kits such as CoGUI, Haozi, and Iron Man System (Storm-2990) that enabled cybercriminals to launch sophisticated campaigns using AI-generated fake organizations and compromised cloud environments. These kits delivered phishing messages via email and SMS, primarily targeting Microsoft 365 users, with lures including delivery issues, tolls, and account verifications, often bypassing MFA through device-code phishing. Microsoft, in collaboration with Japanese authorities, Resecurity, and other partners, seized domains, deactivated 20,000 accounts, and blocked 100,000 malicious domains to dismantle the network.

2w ago · bleeping-computer

Docker Hub disclosed a critical vulnerability, CVE-2026-105445, that allowed attackers to impersonate users and tamper with container images by exploiting a flaw in the personal access token (PAT) reassignment process during account-to-organization conversion. Attackers could create a personal account, generate a PAT, convert the account to an organization, and assign a target user as the owner, causing the PAT to be reassigned to that user without consent or token rotation. This enabled unauthorized access to the target's repositories, posing a significant software supply chain risk. Docker patched the flaw within four hours of receiving the report on September 30, 2026, and found no evidence of exploitation after analyzing over 300,000 image pushes.

2w ago · bleeping-computer

Ivanti has disclosed an actively exploited zero-day vulnerability, CVE-2026-104935, in its Connect Secure (ICS) remote access gateway, affecting multiple versions. The flaw allows unauthenticated remote attackers to execute arbitrary commands without user interaction. A threat actor tracked as UTA0576 has been exploiting this vulnerability since at least October 3, 2026, chaining it with two other unpatched flaws to achieve unauthenticated root-level code execution on fully patched devices, while avoiding detection by tampering with logs and not deploying traditional malware or web shells.

2w ago · bleeping-computer

Microsoft's October 2026 Patch Tuesday addresses 1,411 vulnerabilities, including three zero-day flaws actively exploited or publicly disclosed. One actively exploited zero-day is CVE-2026-96951, a Windows Shell security feature bypass that allows command injection and enables attackers to bypass Mark of the Web protections. The other two zero-days are CVE-2026-108398, a .NET Framework security feature bypass that can bypass Windows Defender Application Control, and CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp. These updates are critical for preventing unauthorized code execution and privilege escalation.

2w ago · bleeping-computer

A critical heap buffer overflow vulnerability in Ghostscript (CVE-2026-39919) allows remote code execution via maliciously crafted PDF files, particularly when processed by systems like WordPress that use Ghostscript for thumbnail generation. The flaw affects Ghostscript versions 9.21 through 10.07.1 and can be exploited if an attacker uploads a PDF that triggers the vulnerability during rendering. Researchers at Wordfence developed proof-of-concept exploits and demonstrated successful remote code execution in lab environments, though reliability depends on system configuration. Artifex released a patch in version 10.08.0, and administrators are advised to update or disable PDF rendering to mitigate risk.

2w ago · bleeping-computer

Retail giant Ahold Delhaize confirmed a cybersecurity incident that forced the company to take some systems offline to protect its infrastructure. The attack disrupted internal systems, affecting employee access to schedules and pay stubs at Stop & Shop in the U.S., and customer-facing platforms including websites, apps, and customer service at several European brands. This is the second major cyber incident for Ahold Delhaize in recent years, following a 2024 ransomware attack by INC Ransom that compromised over 2.2 million individuals' personal and financial data.

2w ago · bleeping-computer

AvisLoader is a Windows malware loader discovered by Varonis Threat Labs that uses the Tox encrypted peer-to-peer (P2P) network for command-and-control (C2) communications, making takedowns more difficult. The infection begins with a ClickFix lure hosted on Cloudflare Workers, mimicking a DocuSign signing request, which tricks users into pasting and executing a malicious command. The loader employs shortcut modification for persistence, includes a UAC bypass helper referencing UACME technique 41, and uses a DLL to hook system calls for process hiding. The associated AvisLoader Command Center allows operators to manage clients, execute remote commands, and distribute payloads over Tox.

2w ago · bleeping-computer

A cyberattack targeted Danfoss refrigeration controllers used by multiple French supermarket chains, including Intermarché, Carrefour Market, Leclerc, and Coopérative U, disrupting cold storage systems and causing food spoilage. Attackers exploited vulnerable, internet-exposed Danfoss AK-SM 8xxA Series controllers, potentially leveraging known authentication bypass (CVE-2025-41450) and command injection vulnerabilities (CVE-2025-41451) to trigger unauthorized defrost cycles. The attack affected 250 to 350 stores, prompting investigations by French authorities and raising concerns about the security of critical infrastructure in the food retail sector.

2w ago · bleeping-computer

Ledger has confirmed a supply-chain attack involving hardware wallet devices compromised with a spy chip implant, distributed through the unauthorized Southeast Asian reseller CryptoBilis. The malicious implants, found in Ledger Nano X devices, capture the device's display output and button presses to exfiltrate seed phrases via LTE using an embedded eSIM. Researchers from Tibane Labs and Mark Karpelès identified two variants of the implant, one more advanced and concealed under the OLED display, both using custom PCBs and hidden LTE modules for data transmission.

2w ago · bleeping-computer

GitLab has disclosed and patched a maximum-severity remote code execution vulnerability, tracked as CVE-2026-97229, in its CI/CD Regular Expression Compiler. The flaw, caused by an integer overflow, could allow unauthenticated attackers to execute arbitrary code on GitLab servers by supplying a specially crafted regular expression in a pipeline configuration file. The vulnerability affects self-managed GitLab instances prior to versions 19.2.8, 19.3.4, and 19.4.2, and immediate patching is advised. GitLab.com is already protected, and dedicated customers are unaffected.

3w ago · bleeping-computer

A Chinese-speaking threat actor used the ARTEX AI penetration testing framework and Anthropic's Claude AI agents to conduct cyberattacks against major South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. The attacks led to exposure of customers' personal and financial data, as well as system outages. Infrastructure analysis revealed open directories containing ARTEX configuration files, Claude session histories, and memory files, which exposed the attacker's methods and partial identity. The actor used multiple LLMs, including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6, accessed via the API proxy xcai[.]pro, and showed interest in monetizing stolen data through Telegram.

3w ago · bleeping-computer

Threat actors are actively exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform to gain unauthorized access, deploy webshells, and mine cryptocurrency. The attack chain begins with CVE-2026-105133, an authentication bypass, followed by CVE-2026-105134, which enables OS command injection. Attackers deploy JSP webshells, install the XMRig miner disguised as edge.exe, and use a PowerShell script to hide mining activity from Task Manager. The malware persists via a malicious service named 'MicrosoftEdgeUpdateSvc' and may leverage the WinRing0x64.sys driver to enhance mining performance.

3w ago · bleeping-computer

Attackers are actively exploiting a maximum-severity vulnerability (CVE-2026-102255) in SonicWall SMA1000 appliances, specifically targeting the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models. The flaw allows unauthenticated remote attackers to abuse a path to direct the appliance to issue internal requests, potentially reaching internal functionality such as the CouchDB service via a Server-Side Request Forgery (SSRF) technique. Exploitation attempts have been observed using crafted OPTIONS requests to access the internal CouchDB service at 127.0.0.1:5984, with an HTTP Basic Authorization header containing default credentials admin:admin.

3w ago · bleeping-computer

German authorities have arrested a Russian national alleged to be a core member of the Qilin ransomware group, following his extradition from Japan. Qilin, a ransomware-as-a-service operation active since August 2022, has targeted over 2,350 organizations across 62 countries using double-extortion tactics. Notable victims include Nissan, Asahi, Lee Enterprises, Australia’s Court Services Victoria, and the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). The group has also exploited zero-day and n-day vulnerabilities in Check Point and Palo Alto Networks VPN appliances.

3w ago · bleeping-computer

The FBI has arrested another suspected member of the ShinyHunters hacking group following a breach of FBI systems that occurred via a third-party vendor's platform. ShinyHunters exploited an alleged Oracle PeopleSoft zero-day vulnerability to gain access and moved laterally into FBI-managed AWS GovCloud infrastructure, claiming to have stolen 2–3TB of sensitive data, including employee records, Social Security numbers, and psychiatric information. The breach has led to multiple arrests globally, including suspects in the Netherlands and Jordan, while signs of internal disruption within the group have emerged, including the disappearance of key representatives and temporary takedowns of their leak site.

3w ago · bleeping-computer

Hackers are leveraging Google Ads and abusing Bing's legitimate redirect infrastructure to deliver 'ClickFix' attacks that impersonate official Claude installers for macOS. The malicious ads appear to point to bing.com, evading suspicion and ad security checks, then redirect through a compromised WordPress site to a fake download page at claude-desk-code[.]com. The page uses cloaking techniques to hide the payload from direct access and security scanners, while tricking users into copying a malicious command that downloads and executes a script from lake-90[.]com. The final payload remains unidentified, but the campaign is linked to the ClickFix toolkit tracked internally as AcSig.

3w ago · bleeping-computer

Citrix has issued an urgent warning for administrators to patch a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-107406, affecting NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers or Service Providers. The flaw arises from a memory overflow condition that could allow attackers to execute arbitrary code or cause denial-of-service conditions. While there are no known active exploits in the wild at the time of disclosure, Citrix has previously seen rapid exploitation of similar NetScaler vulnerabilities, and over 21,000 NetScaler instances are exposed to the internet, increasing the risk of widespread compromise if left unpatched.

3w ago · bleeping-computer

A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones, where malicious software is embedded directly into the firmware of devices using MediaTek chipsets. The malware, which operates with system-level privileges, enables silent app installation, ad fraud via fake utility apps, and turns infected devices into residential proxies. The campaign has affected thousands of devices across over 150 countries, with notable impact in Mexico, France, Italy, and the U.S., and persists through preinstalled system apps that cannot be uninstalled normally.

3w ago · bleeping-computer

Jonathan Spalletta, also known as 'Jspalletta' and 'Cthulhon', was convicted of hacking the decentralized crypto exchange Uranium Finance in April 2021, exploiting flaws in its smart contract code to steal approximately $53.3 million in cryptocurrency. In the first attack, he exploited a vulnerability to issue zero-token withdrawal commands and drain $1.4 million, later extorting a 'bug bounty' of nearly $386,000. Three weeks later, he exploited another coding error—causing transaction verification to use 1,000 instead of 10,000—enabling him to withdraw nearly 90% of the exchange's liquidity pools. Spalletta laundered the stolen funds through Tornado Cash and decentralized exchanges, leading to the collapse of Uranium Finance.

3w ago · bleeping-computer

The FakeGit malware campaign has reemerged, leveraging 17,610 malicious GitHub repositories to distribute the SmartLoader malware, which in turn delivers the StealC infostealer. The attack uses throwaway and compromised developer accounts to host repositories with deceptive README files that include download links to malicious ZIP archives. The campaign rapidly redeployed, creating over 13,000 repositories in 34 hours, with 97% of commits modifying only the README to point to SmartLoader payloads. Attackers maintain persistence by using forks, release assets, and issue attachments to host backup copies of malware, evading takedown efforts.

3w ago · bleeping-computer

IDC Frontier, a Japanese cloud provider subsidiary of SoftBank Group, suffered a ransomware attack on its IDCF Cloud service in the East Japan Region 1, leading to a system outage and impacting 495 organizations, including government clients. The attackers claimed to have encrypted 225 databases (3.6 PB), accessed 239 hypervisors, sealed 16,000 VM disks, and wiped over 554,000 snapshots. The company has isolated affected systems, disabled customer console access proactively, and is investigating the intrusion vector and full impact.

3w ago · bleeping-computer

ASOS confirmed a data breach resulting from a social engineering attack in which an attacker impersonated a trusted contact to steal an employee's login credentials. The compromised credentials were used to access third-party platforms used by ASOS, leading to the exposure of customers' full names, contact details, and certain non-personal account-related information. The threat actor, identifying itself as 'Xuanye Group,' sent malicious in-app notifications to users, but ASOS confirmed that payment card information and account passwords were not accessed.

3w ago · bleeping-computer

Advantest Corporation confirmed a ransomware attack that occurred on February 15, 2026, during which a threat actor breached its network and exfiltrated sensitive personally identifiable information (PII). The stolen data includes contact information, dates of birth, Social Security Numbers, national ID numbers, driver’s license numbers, passport numbers, medical information, financial information, and other ID numbers. While the company has not identified the specific threat actor or confirmed data misuse, it has offered affected individuals 18 months of free identity and credit monitoring services through Kroll to mitigate risks of identity theft and fraud.

3w ago · bleeping-computer

The FBI has issued a warning about ongoing FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways, where threat actors use leaked or stolen credentials to gain access and lock out legitimate administrators. Attackers extract authentication data and crack password hashes offline using distributed GPU clusters with tools like Hashcat and Hashtopolis. The compromised access is used as an initial entry point for ransomware affiliates, including INC/Lynx and Payload ransomware groups, who establish persistence, move laterally, and in some cases, sell access. The original FortiBleed leak exposed plaintext credentials for over 86,000 devices, and attackers have been observed creating new admin accounts, deleting existing ones, and preparing compromised access for sale.

3w ago · bleeping-computer

A critical unauthenticated file-access vulnerability, CVE-2026-21589, affecting multiple self-hosted Atlassian products including Jira, Confluence, and Bitbucket, is being actively exploited in the wild. The flaw allows attackers to perform directory traversal via a shared web-resource library that converts double colons into forward slashes, enabling unauthorized access to sensitive files such as crowd.properties containing plaintext credentials. Exploitation attempts were observed within hours of a public proof-of-concept release by watchTowr, and a Nuclei template has since been published, accelerating automated scanning and exploitation. Affected organizations are urged to patch immediately or apply mitigations such as WAF rules or network access restrictions.

3w ago · bleeping-computer

The PoeLLM malware is a cryptomining campaign targeting exposed AI servers, particularly those running LiteLLM, Ollama, Gotenberg, and Gitea. It uses an ELF file named libgcrypt that retrieves command-and-control (C2) addresses by extracting keywords from a poem hosted on GitHub, which are then mapped to IPv4 addresses via a hardcoded dictionary. The malware enables remote shell access, deploys XMRig and Iron cryptocurrency miners, and turns infected servers into scanners to propagate further, exploiting CVE-2026-42271 and potentially chaining it with CVE-2026-48710 for unauthenticated RCE. Over 3,400 servers have been compromised, primarily in the US and Western Europe, with C2 infrastructure showing signs of Italian origin.