Intelligence Feed

2mo ago · bleeping-computer

AmnesiaStealer is a macOS-targeting information-stealing malware distributed via ClickFix campaigns using fake GitHub download pages. It steals browser profiles, passwords, cryptocurrency wallets, Apple Notes, keychain data, and documents. A key capability is its 'stream_module' component, which enables remote operators to control a headless browser instance loaded with the victim's cloned Chromium profile, allowing interactive access to authenticated web sessions via WebSocket-based remote control. This provides attackers with live screencast access and full input control (keyboard, mouse) over the victim's active sessions.

2mo ago · security-com

Jewelbug, a China-based APT group also known as Earth Alux or REF7707, conducts parallel espionage and cryptocurrency fraud operations using shared infrastructure and a unified control panel called XG-Web. The group targets government ministries in the Middle East, Southeast Asia, and South Asia through browser-based attacks and watering-hole compromises, while simultaneously running a for-profit crypto fraud scheme targeting Chinese-speaking users. Their primary malware includes the Antino Windows backdoor and a malicious 'PDF Viewer' browser extension, both deployed via fake software installers and HTA downloaders. The group leverages compromised hosting providers to scale attacks, stealing over 580,000 browser cookies and more than one million implant check-ins in under three months.

2mo ago · talos

Microsoft's August 2026 Patch Tuesday addresses 421 vulnerabilities across various products, including 62 labeled as 'critical'. One actively exploited vulnerability, CVE-2026-68820, is an elevation of privilege issue in the Windows Ancillary Function Driver for WinSock. Multiple remote code execution vulnerabilities are present in Windows, SharePoint, Office, Azure, and other Microsoft services, with several rated high or critical severity. Cisco Talos has released Snort rules to detect exploitation attempts against some of these vulnerabilities, emphasizing those deemed more likely to be exploited, such as CVE-2026-62893 in Windows Deployment Services and CVE-2026-65665 in SharePoint Server.

2mo ago · bleeping-computer

Evooo1Bot is a new Mirai-based modular Linux botnet targeting internet-facing routers and gateway devices to turn them into SOCKS5 traffic relay nodes. It exploits known vulnerabilities in devices from vendors including Alcatel, NETGEAR, Tenda, and D-Link, and includes capabilities such as SSH brute-forcing, credential sniffing, DDoS attacks, and encrypted C2 communications over port 443. The malware performs anti-analysis checks, establishes persistence via multiple methods, and supports file transfer and interactive shell access for remote control by attackers.

2mo ago · securelist

In Q2 2026, mobile threats continued to evolve with a notable presence of banking Trojans, particularly variants of Mamont and Creduz. Attackers increasingly used malicious loaders distributed through Google Play, including trojanized apps like a PDF reader and the Cleanova app, to deliver banking malware such as Anatsa. These loaders employed sophisticated evasion techniques, including conditional payload delivery based on installation source telemetry, to bypass app store reviews and target specific users.

2mo ago · socket-dev

A large-scale malicious Chrome extension campaign involving 737 extensions has been identified, primarily targeting Russian-speaking users seeking access to blocked services like Instagram and YouTube. These extensions impersonate 66 legitimate VPN brands—including Proton VPN, NordVPN, and AmneziaVPN—and route all browser traffic through attacker-controlled SOCKS5 proxies on port 1082, enabling man-in-the-middle attacks. The campaign uses DNS-over-HTTPS for evasion, falsely advertises premium server locations that do not exist, and employs post-approval code substitution to bypass store review. One threat actor behind the operation runs a subscription-based business under the name 'Myxa VPN', which also sells access to the malicious extensions.

2mo ago · bleeping-computer

The Netherlands' National Cyber Security Centre (NCSC) has issued a warning that attackers are actively exploiting a macOS Screen Sharing vulnerability, CVE-2026-65400, to gain unauthorized access to systems with exposed port 5900. The flaw allows network-based attackers to bypass authentication and obtain root access without valid credentials. In confirmed attacks, the threat actors have deployed Monero cryptocurrency miners on compromised systems. Apple has patched the vulnerability in recent macOS updates, including Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.

2mo ago · bleeping-computer

A critical remote code execution vulnerability, CVE-2026-58231, in SAP Commerce Cloud is being actively exploited in the wild just three days after the patch was released. The flaw, which has a CVSS score of 10.0, stems from improper authorization in the Data Hub Adapter extension, allowing unauthenticated attackers to execute arbitrary code by exploiting a default authentication client. Threat intelligence firm Defused confirmed exploitation attempts are already occurring, as observed through honeypot traffic, despite the absence of a public proof-of-concept. The vulnerability affects internet-exposed SAP Commerce Cloud instances, with over 4,200 such systems identified globally, primarily in Europe and North America.

2mo ago · bleeping-computer

The Clop ransomware gang claimed responsibility for stealing 89GB of data from energy giant Shell, allegedly exploiting a critical vulnerability, CVE-2026-12569, in Internet-exposed PTC Windchill and FlexPLM instances. The same vulnerability was actively exploited to target other major companies, including General Electric and Philips, with attackers deploying JSP webshells to exfiltrate sensitive data such as engineering drawings, project plans, and facility reports. U.S. CISA and German BSI issued urgent advisories urging immediate patching, and the flaw has been added to CISA's Known Exploited Vulnerabilities catalog.

2mo ago · bleeping-computer

In July 2026, the ShinyHunters extortion group breached RingCentral through a sophisticated social engineering campaign, exfiltrating personal information from 1.6 million customer accounts. The stolen data included names, email addresses, phone numbers, and physical addresses. After RingCentral refused to pay a ransom, ShinyHunters leaked a 280GB compressed archive of the stolen data on their dark web leak site. The breach did not impact RingCentral's core platform, and no further unauthorized activity has been observed since remediation efforts were implemented.

2mo ago · securelist

The HoneyMyte APT group, also known as Mustang Panda, has upgraded its CoolClient backdoor with a kernel-mode Windows rootkit to enhance stealth and persistence. The new variant uses a signed kernel driver, msagent.sys, deployed as a Windows service to hide malicious processes, files, registry keys, and network connections. The malware chain begins with DLL sideloading via a renamed Sangfor executable (defender.exe), establishes persistence through scheduled tasks and registry entries, performs UAC bypass using RPC techniques, and injects into synchost.exe before deploying the driver. The driver communicates with user-mode components via IOCTLs and employs minifilter and registry callbacks to protect its artifacts.

2mo ago · securelist

In May 2026, the Armored Likho (aka Eagle Werewolf) threat actor group expanded its cyber-espionage operations targeting individuals and organizations in Russia through a fake donation app dropper written in Rust using the Tauri framework. The campaign delivers a new Rust-based toolkit called Still Toolkit, consisting of two components: Still Sync, which steals Telegram session data and exfiltrates chat logs and media via the Telegram API, and Still Audio, an audio surveillance implant that records microphone input when voice activity is detected. The malware uses gRPC and FlatBuffers for C2 communication, leverages the SeBackupPrivilege for file access, and employs a Dead Drop Resolver via a GitHub repository to retrieve updated C2 addresses.

2mo ago · bleeping-computer

An Akira ransomware affiliate gained initial access via an exposed SonicWall VPN without MFA, then used RDP to move laterally and exfiltrate data. The attacker rebooted the compromised host into Safe Mode with Networking to disable EDR and AV solutions, including the Huntress agent and Microsoft Defender. Data was stolen using s5cmd and uploaded to an attacker-controlled S3 bucket, while AnyDesk was installed and configured to persist in Safe Mode. The ransomware payload (akira.exe) failed to execute due to low virtual memory, preventing encryption. Despite the failure, the actor exfiltrated sensitive data within five hours.

2mo ago · talos

Cisco Talos discovered 'JWR', a previously undocumented real-time phishing framework and likely variant of the 'The Outsider' phishing-as-a-service platform. JWR uses open WebSocket connections to enable attackers to monitor victim keystrokes in real time and dynamically guide them through fake login and checkout flows. The campaign is currently distributed via SMS lures impersonating regional toll and postal authorities, allowing threat actors to steal payment data, two-factor authentication (2FA) codes, identity documents, and device fingerprints.

2mo ago · bleeping-computer

Microsoft has patched a Windows zero-day vulnerability known as 'LegacyHive' (CVE-2026-62832), which affects the Windows User Profile Service and allows authenticated local attackers to gain administrator privileges by exploiting improper link resolution during registry hive loading. The vulnerability was publicly disclosed and demonstrated by security researcher Nightmare Eclipse, who criticized Microsoft's disclosure practices. Exploitation does not require user interaction and enables privilege escalation by modifying another user's registry hive when they log in.

2mo ago · bleeping-computer

The China-based threat actor Jewelbug (also known as Earth Alux and REF7707) has been conducting espionage operations against government and military organizations in the Middle East, Southeast Asia, and South Asia, while simultaneously running a large-scale cryptocurrency fraud operation. The group compromised a shared webmail platform used by multiple government tenants, injecting a malicious script into login and mailbox pages to steal cookies and credentials. Successful compromises led to the deployment of the Antino backdoor via fake Adobe Flash installers, enabling further payload delivery, including a malicious browser extension called 'PDF Viewer' that steals credentials and injects JavaScript. Symantec uncovered the group's infrastructure, revealing over one million implant check-ins, more than 580,000 stolen browser cookies, and extensive cryptocurrency fraud operations using AI-generated content and lookalike domains impersonating Binance and OKX.

2mo ago · step-security

Team PCP, a threat actor active in 2026, executed a widespread software supply chain attack by compromising trusted open source projects such as Trivy, KICS, telnyx, and LiteLLM. The group injected credential stealers into CI/CD pipelines, exfiltrating 78,330 secrets from 2,186 organizations between March 19 and 24, 2026. These stolen credentials included cloud access keys, API tokens, and private keys, enabling further pivoting across organizations. The attack targeted CI/CD environments due to their weak security posture despite handling highly privileged credentials.

2mo ago · bleeping-computer

Trezor disclosed a data breach affecting nearly 14,000 customers due to a compromise of its shipping provider, ShipMonk, which was breached via a zero-day SQL injection vulnerability in the analytics platform Metabase. The attackers accessed customer order data including names, email addresses, phone numbers, and shipping addresses. ShipMonk confirmed the breach stemmed from exploitation of a critical vulnerability in Metabase, which was also used to attack other companies like Framework and Tally. Trezor emphasized that its own systems were not compromised and device security remains intact, but warned affected users of increased phishing risks. The ShinyHunters extortion group has claimed responsibility, sending extortion emails to ShipMonk.

2mo ago · bleeping-computer

A critical directory traversal vulnerability in VMware vCenter Syslog Server (CVE-2026-59310) is being actively exploited to gain remote code execution. Attackers are deploying the open-source reverse_ssh framework to establish reverse SSH connections for persistence and remote access. Compromised systems have been observed connecting to attacker infrastructure starting August 3, with 361 victim IPs identified across 47 countries by August 7. The campaign is suspected to be conducted by an advanced persistent threat (APT) actor, though attribution remains unconfirmed.

2mo ago · talos

Cisco Talos identified a new phishing framework named JWR, likely a variant of the 'Outsider' PhaaS platform, used in active smishing campaigns targeting users in Southeast Asia and the Middle East. The framework enables real-time, operator-driven session manipulation via AES-CTR encrypted WebSocket connections, allowing threat actors to harvest payment data, login credentials, 2FA codes, identity documents, and full device fingerprints. The client engine uses Vue.js to render 44 phishing pages and supports live keystroke streaming, enabling actors to monitor victim input as it is typed. The campaign delivers the phishing kit via SMS lures impersonating toll, postal, and courier services, with operator interfaces in Simplified Chinese, indicating a Chinese-speaking actor.

2mo ago · hacker-news

Threat actors are actively exploiting a critical authentication bypass vulnerability in Microsoft SharePoint, tracked as CVE-2026-55040 (CVSS score: 9.1), following the public release of a proof-of-concept (PoC) exploit by Rapid7. The flaw allows unauthenticated attackers to forge JWT tokens and impersonate SharePoint users by exploiting weaknesses in the JWT validation pipeline, specifically within SPJsonWebSecurityTokenHandlerV2 and SPJsonWebSecurityBaseTokenHandlerV2 classes. Exploitation enables unauthorized access to files and data modification on vulnerable servers. Telemetry shows a spike in exploitation attempts originating from multiple countries, with 12 observed attempts as of mid-August 2026, eight of which occurred immediately after the PoC release.

2mo ago · bleeping-computer

A new Android malware campaign combines WindRelay, an NFC relay tool, with the SpyNote remote administration trojan to enable real-time financial fraud. Attackers socially engineer victims by impersonating bank employees, tricking them into sideloading a malicious APK that grants Accessibility Services, enabling remote device control. The attackers then install WindRelay to capture NFC payment card data and PINs during live phone calls, allowing them to conduct fraudulent transactions or take out loans in the victim's name. The attack chain was executed entirely over a 13-minute call, highlighting a shift toward real-time, voice-mediated social engineering without requiring persistent malware access.

2mo ago · bleeping-computer

The City-Forum data theft campaign targets misconfigured Salesforce Experience Cloud and ServiceNow portals by exploiting overly permissive guest user access. Attackers use a single server at IP 158.220.87.79 to enumerate and steal data exposed to unauthenticated users via custom techniques on both legacy Aura and newer Lightning Web Runtime (LWR) frameworks in Salesforce, as well as the ServiceNow Service Portal search API. The campaign has been active since at least March 2025, with increasing activity across multiple sectors including finance, telecom, and public-sector organizations. No vulnerability is exploited; instead, the theft relies on misconfigurations that allow public access to sensitive records.

2mo ago · bleeping-computer

Hackers are actively exploiting a critical vulnerability, CVE-2026-71362, in Adobe Commerce and Magento platforms to hijack customer accounts without authentication or user interaction. The flaw stems from improper handling of customer identity in account sessions, allowing attackers to switch between customer accounts. Security firm Sansec has observed exploitation attempts in the wild and confirms that the vulnerability enables unauthorized access to private customer data. Adobe released patches as isolated updates, urging administrators to apply them immediately to mitigate risk.

2mo ago · hacker-news

The North Korean threat actor Lazarus Group has exploited a Windows zero-day vulnerability, CVE-2026-68820, in the AFD.sys driver to escalate privileges to SYSTEM and deploy a new in-memory backdoor named Troy. The attack is part of Operation Dream Job, a long-running cyber espionage campaign using fake job offers on LinkedIn to lure victims into downloading trojanized software or opening malicious PDFs. Two infection chains were observed: one using DLL side-loading with the malicious libmupdf.dll and another via a trojanized SecurityPDF viewer that triggers payload execution upon detecting a specific marker in a PDF. The attackers also use compromised legitimate infrastructure, including WordPress, SharePoint, and vulnerable Roundcube servers (CVE-2025-49113), to host C2 communications and distribute the ForestTiger (ScoringMathTea) backdoor.

2mo ago · bleeping-computer

Researchers Alejandro Hernando and Borja Martínez disclosed 'Plug and Pwn' attack techniques that exploit Windows Plug and Play to gain SYSTEM privileges by emulating malicious USB devices. The attacks abuse signed vendor software installed automatically by Windows during device enumeration, leveraging vulnerabilities in co-installers, services, or insecure update mechanisms. One variant, 'NoPlug & Pwn', abuses RDP USB redirection to perform the attack remotely without physical access. A demonstrated chain uses emulated Sierra Wireless and Sony FeliCa devices to manipulate DNS and hijack unencrypted downloads, ultimately achieving code execution as SYSTEM. Another RDP-based variant emulates an Intel RealSense camera to exploit DLL hijacking in a co-installer for privilege escalation.

2mo ago · hacker-news

A large-scale campaign involving 737 malicious Chrome VPN and proxy extensions has been uncovered, primarily targeting Russian-speaking users. These extensions impersonate 66 legitimate VPN brands and route users' entire browser traffic through SOCKS5 proxies controlled by a single threat actor, enabling adversary-in-the-middle (AitM) monitoring of destinations, IP addresses, SNI values, and unencrypted HTTP traffic. The extensions bypass Chrome Web Store policies by submitting false claims, using code obfuscation, and performing post-approval code substitution to hide malicious behavior, including non-existent premium tiers and affiliate monetization schemes.

2mo ago · hacker-news

A high-severity vulnerability, CVE-2026-20349, in Cisco Secure Firewall ASA and FTD software is being actively exploited in the wild to trigger remote denial-of-service (DoS) conditions. The flaw stems from insufficient error checking when processing crafted HTTP requests sent to the Remote Access SSL VPN service, allowing unauthenticated attackers to cause affected devices to reload. Cisco confirms the vulnerability was discovered internally and has been exploited, with no workarounds available. The U.S. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by August 14, 2026.

2mo ago · hacker-news

Threat actors are actively exploiting CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter, to achieve remote code execution and establish persistence via malicious cron jobs. The attackers deploy reverse_ssh, an open-source tool, to create reverse SSH connections to their infrastructure, enabling them to bypass inbound security controls. Forensic evidence from QUIRSO confirms successful compromises beginning August 3, with 361 victim IPs across 47 countries. While the specific actor is not identified, the campaign exhibits characteristics consistent with an advanced persistent threat, and exploitation closely follows public disclosure of the vulnerability.

2mo ago · hacker-news

Adobe has released security updates to address multiple critical vulnerabilities in ColdFusion, Commerce, and Campaign Classic. The most severe flaws include three with a CVSS score of 10.0, which could allow arbitrary code execution or privilege escalation if exploited. These vulnerabilities affect on-premise and hybrid deployments of Campaign Classic, while Adobe-hosted instances have already been patched. Although no active exploitation has been observed, Adobe assigns a Priority 1 rating to these updates due to their high risk, urging administrators to apply patches within 72 hours.