Intelligence Feed

2mo ago · bleeping-computer

A supply-chain attack on BdThemes, a developer of premium WordPress plugins, allowed a threat actor to compromise its infrastructure and inject malicious JavaScript into a remote JSON feed used by its plugins. This feed is loaded in the WordPress admin dashboard, where the attacker exploited a cross-site scripting (XSS) vulnerability in the Biggop Library to create rogue administrator accounts on affected sites. The attack was stealthy, required no user interaction, and used a webshell for persistence. The same actor is believed to be behind recent similar attacks on other WordPress plugins.

2mo ago · bleeping-computer

Valve notified European Steam hardware customers of a data breach resulting from a cyberattack on its shipping partner, CEVA Logistics, between July 29 and August 1, 2026. Attackers accessed CEVA's systems and likely exfiltrated customer data including names, addresses, phone numbers, email addresses, and details of hardware orders. Valve confirmed that no Steam account credentials, payment information, or other sensitive account data were exposed. The company warned customers about potential phishing attempts leveraging the stolen personal information.

2mo ago · hacker-news

A zero-day vulnerability in Metabase, a business intelligence platform, is being exploited in the wild, allowing unauthenticated remote attackers to perform SQL injection and gain full administrator access to affected instances. This enables attackers to steal database credentials, exfiltrate data, and modify configurations. The vulnerability has a CVSS score of 10.0 but lacks a CVE identifier. One confirmed victim is Framework. Additionally, Chinese-made Zbtlink routers were found shipping with a factory-installed backdoor that phones home to Chinese C2 servers every 35 seconds, affecting at least 20 models. The backdoor enables remote command execution. Separately, the threat actor UNC6671 is conducting vishing attacks against financial firms, using voice phishing to capture credentials and MFA tokens via adversary-in-the-middle infrastructure, then deploying scripts for data exfiltration from cloud environments.

2mo ago · hacker-news

Storm-1175, a China-linked financially motivated threat actor, has deployed a new ransomware named StormEncryptor, written in C++, which appends the '.encrypted' extension to encrypted files and drops a ransom note titled '!!!README_FIRST!!!.txt'. The group likely gained initial access by exploiting CVE-2026-18577, a patch bypass vulnerability in N-able N-central, which allows authentication bypass and account takeover. Storm-1175 has a history of exploiting vulnerabilities in internet-facing systems, rapidly moving from initial access to data exfiltration and ransomware deployment within days, using tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz for credential dumping.

2mo ago · bleeping-computer

A China-based threat actor tracked as Storm-1175, previously associated with the Medusa ransomware operation, has shifted to using a new ransomware variant called StormEncryptor. The actor exploits a vulnerability in the N-central RMM tool (CVE-2026-18577) to gain initial access, then uses tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz for lateral movement and credential dumping. StormEncryptor is written in C++, encrypts files appending the '.encrypted' extension, and drops a ransom note titled '!!!README_FIRST!!!.txt', threatening data leakage if payment is not negotiated within three days.

2mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting two recently patched vulnerabilities in SonicWall SMA1000 appliances, tracked as CVE-2026-15409 and CVE-2026-15410. These flaws, including a critical server-side request forgery (SSRF) vulnerability, were exploited in zero-day attacks as early as June 22, prior to public disclosure. A threat actor known as UTA0533 has been linked to the exploitation of these vulnerabilities to deploy custom malware such as KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL on vulnerable systems. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch within three days.

2mo ago · wiz

A zero-day SQL injection vulnerability in Metabase, tracked as GHSA-vwf4-m7j8-wcjf, has been exploited in the wild against Metabase Cloud and potentially self-hosted instances. The vulnerability exists in versions 1.58 and later, where an attacker can inject malicious SQL by including a 'user-id' parameter with a 'raw' SQL payload in the /api/session/reset_password endpoint. The flaw stems from improper handling of JSON input, merging of unvalidated user input, and unsafe use of HoneySQL's :raw directive, leading to arbitrary blind SQL injection. Wiz Research reverse-engineered the vulnerability after the patch was not publicly disclosed, and observed public proof-of-concept exploits as of August 10, 2026.

2mo ago · hacker-news

Kimsuky, a North Korean state-sponsored threat actor, is building an offline AI stack to enhance its phishing operations and automate malware development. The group has been observed deploying tools like Ollama, GPT4All, and Msty on its own infrastructure, with evidence of configured local document databases (localdocs_v3.db) indicating use of retrieval-augmented generation (RAG) for intelligence analysis. Additional tools such as LLaMaSharp, Microsoft Semantic Kernel, Whisper, and Cursor suggest efforts to integrate AI into custom malware development and speech-to-text processing. This activity supports the ongoing Operation GitPower, which abuses GitHub repositories as command-and-control channels and delivers AsyncRAT payloads.

2mo ago · securelist

In Q2 2026, multiple ransomware groups remained active, with Qilin emerging as the most prolific based on victims listed on data leak sites. Microsoft disrupted a malware-signing-as-a-service operation run by the threat actor Fox Tempest, which was used by several ransomware groups including Rhysida, Akira, and Qilin. CISA added a Windows local privilege escalation vulnerability (CVE-2026-33825, BlueHammer) to its KEV catalog due to active exploitation in ransomware attacks. Check Point attributed zero-day exploitation of a critical vulnerability in its Remote Access VPN (CVE-2026-50751) to the Qilin ransomware group. Additionally, the PayoutsKing group was observed using QEMU to deploy hidden Alpine Linux-based virtual machines as a stealthy backdoor technique.

2mo ago · hacker-news

The threat actor Head Mare has exploited vulnerabilities in unpatched TrueConf servers to replace legitimate client installers with malicious versions delivering the PhantomCore backdoor and RAT. The attack chain involves exploiting two vulnerabilities, KLCERT-26-057 and KLCERT-26-058, to achieve arbitrary code execution with SYSTEM privileges, deploy a web shell, and substitute legitimate installers. The attackers also deploy a secondary backdoor, PhantomGraph, composed of two DLLs that exfiltrate data via Microsoft OneDrive and establish persistence through PowerShell commands.

2mo ago · hacker-news

Recent research from SpecterOps, Unit 42, and independent researcher Dirk-jan Mollema reveals multiple attack vectors against passkey-based authentication systems despite their strong underlying cryptography. SpecterOps demonstrated a 'Pass-the-Passkey' attack leveraging CVE-2026-34348, where Windows stored YubiKey signatures in cleartext, enabling replay attacks that bypass phishing-resistant MFA in Microsoft Entra ID. Unit 42's 'Pass-ta-key' research shows how malware can extract or abuse Google Password Manager's synced passkeys by recovering the Security Domain Secret from memory, allowing recovery of private keys. Mollema's work reveals that malware in a compromised Windows session can use Windows Hello for Business keys without re-authenticating via PIN or biometrics, enabling unauthorized sign-ins to Entra ID. These findings highlight implementation flaws surrounding passkey systems rather than cryptographic weaknesses.

2mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that a critical command injection vulnerability, CVE-2026-8037, in Progress Kemp LoadMaster appliances is being actively exploited by attackers. The flaw allows unauthenticated remote attackers to execute arbitrary commands on unpatched systems due to unsanitized API inputs. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch affected systems within three days under Binding Operational Directive 26-04. Given the widespread use of LoadMaster in enterprise and government environments, including Fortune 500 companies and the U.S. Air Force, the risk of exploitation is considered high, and all organizations are urged to apply patches immediately.

2mo ago · hacker-news

Researcher Gareth Heyes from PortSwigger demonstrated novel CSS-based attacks that exploit rendering discrepancies in webmail clients to bypass security boundaries, enabling password theft, token leakage, and UI manipulation. The attacks affect multiple providers including Outlook, Gmail, Yahoo Mail, AOL, Fastmail, and Proton Mail, using techniques such as CSS mutation, label-jacking, paste-race conditions, and image-set() fallback abuse to exfiltrate sensitive data or spoof authentication interfaces. While some mitigations have been applied—such as Fastmail fixing CSS mutation bugs and Proton Mail proxy bypass no longer working—several vectors, including Outlook label-jacking and Gmail's image-set() bypass, remained exploitable at time of publication. The research highlights risks in AI-connected email systems, where injected CSS can manipulate AI tools like Anthropic's Cowork or OpenAI's Atlas to leak tokens or perform unintended actions.

2mo ago · hacker-news

A malicious Visual Studio Code extension named 'solidity-pro' has been identified as stealing cryptocurrency wallets, API keys, and credentials from developers. The threat delivers a browser wallet and credential stealer that exfiltrates sensitive data such as mnemonic phrases, SSH keys, GitHub tokens, AWS keys, and Telegram bot tokens via Telegram bots. The malware uses heavy obfuscation, delayed activation, and clean intermediate versions to evade detection by static scanners and sandbox environments.

2mo ago · bleeping-computer

The hacktivist group Head Mare breached unpatched TrueConf video conferencing servers to replace legitimate client installers with trojanized versions delivering the PhantomCore and PhantomGraph backdoors. Attackers exploited vulnerabilities in TrueConf Server, including CVE-2026-3502, to gain unauthorized access, execute arbitrary code, and deploy web shells for persistent access. The malicious installers are distributed to organization members and third parties connecting to compromised servers, enabling credential theft via LSASS memory dumping and remote command execution through a OneDrive-based C2 channel.

2mo ago · hacker-news

Security researchers from PromptArmor and Varonis independently discovered vulnerabilities in Atlassian Rovo that allow attackers to exfiltrate Jira and Confluence data via maliciously crafted inputs. Varonis identified a one-click attack using the 'rovoChatPrompt' URL parameter to preload malicious instructions, which Atlassian patched server-side on July 8, 2026. PromptArmor demonstrated an indirect prompt injection via uploaded files that causes Rovo to send sensitive data to attacker-controlled servers, a vector that remains unpatched as of August 5, 2026, with no CVE assigned.

2mo ago · bleeping-computer

In October 2025, Unlimited Technology Systems, a healthcare software provider, suffered a data breach that exposed sensitive personal and medical information of approximately 3.8 million individuals. The breach occurred due to unauthorized access to its commercial data center between October 5 and October 10, 2025, during which attackers accessed files containing personal, financial, and health-related data. The company detected the activity on October 19, 2025, and confirmed the breach in July 2026, though no threat actor has been identified and no ransomware or extortion claims were made.

2mo ago · hacker-news

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-8037, a critical command injection vulnerability in Progress Kemp LoadMaster, to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. The flaw allows unauthenticated attackers to execute arbitrary commands on affected devices via unsanitized input in multiple command endpoints. A total of 792 exploitation attempts have been observed from 65 unique IP addresses across 18 countries, with recent activity detected as of August 4, 2026. Federal agencies are urged to patch by August 10, 2026, per BOD 26-04.

2mo ago · hacker-news

N-able has released Hotfix 2 for its N-central Remote Monitoring and Management (RMM) product to address ongoing exploitation of a critical authentication bypass vulnerability, CVE-2026-18577, which has been actively exploited in the wild. The vulnerability, impacting versions prior to 2026.3.1.7, allows attackers to achieve remote administrative access and perform account takeover. Once inside, threat actors have used the Take Control feature to access managed systems and establish persistence via Cloudflare Tunnel services, even after N-central access was revoked.

2mo ago · hacker-news

A zero-day vulnerability in Metabase versions 1.58 and above is being actively exploited in the wild, allowing unauthenticated attackers to gain administrator access by injecting arbitrary SQL into the application database. The attack chain involves sending a POST request to '/api/session/reset_password' followed by a GET to '/api/user/current', which can be detected in logs as an indicator of compromise. Metabase Cloud instances have been patched, but self-hosted users are urged to update immediately. The PC maker Framework confirmed customer data was accessed, including names, IPs, addresses, phone numbers, and emails, though no payment data was involved.

2mo ago · hacker-news

UNC6671, a financially motivated threat actor group, is conducting vishing attacks to steal credentials and multi-factor authentication tokens by impersonating IT help desk personnel and contacting employees on their personal mobile devices. The attackers use adversary-in-the-middle (AitM) infrastructure to capture credentials and session tokens, enabling access to SaaS platforms such as Microsoft 365 and Okta. The group operates under multiple extortion brands including Redact, Pink, Helix, and Falcon, and has exfiltrated data from organizations in North America, Australia, and the U.K., collecting over $10.6 million in Bitcoin between January and May 2026. Google and CrowdStrike assess that the group leverages social engineering rather than technical vulnerabilities, highlighting the need for phishing-resistant MFA and improved session controls.

2mo ago · hacker-news

A large-scale npm supply chain campaign has distributed nearly 800 malicious packages designed to deliver a cross-platform RAT and infostealer. The packages bypass typical lifecycle hook detection by instructing developers to load them via require(), triggering a downloader named WEL1DROPPER that fetches payloads from Cloudflare Workers or fallback domains using DNS TXT record exfiltration. The payloads target Windows, Mac, and Linux systems, establishing persistence, evading detection, and deploying secondary malware such as Sliver C2. The campaign, tracked as Flooding Dropper, may target Russian financial institutions and appears to evolve from the earlier Moika campaign.

2mo ago · bleeping-computer

The North Carolina Ports Authority confirmed a cyberattack that disrupted IT systems and port operations at the Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. The incident was detected on August 4, 2026, leading to a systems-wide outage and operational delays starting August 5. The authority activated its cybersecurity contingency plan and began recovery efforts, but did not attribute the attack to a specific threat actor or confirm data exfiltration. Operations were gradually returning to normal by August 7, though delays were still expected.

2mo ago · hacker-news

ClickFix-style attacks are delivering a Go-based macOS stealer that profiles the system, escalates privileges via a fake system error prompt, and steals sensitive data including browser passwords, Apple iCloud Keychain, and cryptocurrency wallet contents. The malware includes a 'DRAIN' routine that siphons partial or full balances from wallets supporting Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP into attacker-controlled accounts. The infrastructure used in the attack is linked to Aeza Group, a Russian bulletproof hosting provider under international sanctions.

2mo ago · bleeping-computer

A critical unauthenticated SQL injection vulnerability in Metabase versions 1.58 and above was exploited in zero-day attacks to compromise customer instances, leading to data theft at organizations including Framework, Tally, and a third-party vendor used by LexisNexis. The vulnerability allowed attackers to gain administrator access to Metabase instances, enabling them to steal stored credentials, read accessible data, and export customer information. Metabase confirmed active exploitation and issued patches across multiple affected branches, urging self-hosted users to update immediately and rotate credentials.

2mo ago · hacker-news

A pre-authentication reflected cross-site scripting (XSS) vulnerability in WordPress, tracked as CVE-2026-64638, affects all versions and can be exploited without authentication. The XSS flaw exists in the login screen, where a malicious username can bypass sanitization and execute JavaScript on the failed-login error page. This XSS can be chained with the SOME technique to achieve PHP code execution on the server when an administrator interacts with an attacker-controlled page, enabling actions such as plugin installation or arbitrary ZIP upload without requiring the plugin to be activated.

2mo ago · hacker-news

A critical use-after-free vulnerability in Linux's SCTP implementation, tracked as CVE-2026-64564 and named SCTPhantom, has existed since 2008 and could allow local attackers to gain root privileges and escape containers. The flaw arises from improper handling of SCTP dynamic address reconfiguration, where a delete request is validated against one address but applied to another, leading to a use-after-free condition. Tencent's Zhuque Lab demonstrated successful exploitation on multiple Linux distributions, achieving host-level root access without requiring CAP_NET_ADMIN or CAP_SYS_ADMIN under specific conditions. The vulnerability was patched in Linux kernel versions 7.1.6, 6.18.42, 6.12.101, and 6.6.148, released on August 3, 2026.

2mo ago · hacker-news

TeamPCP, a threat actor active since at least 2020, has evolved from exploiting exposed Redis, Docker, Ray, and React infrastructure to conducting large-scale supply chain attacks. The group has used overlapping infrastructure and tradecraft across campaigns, including ShadowRay 2.0 (aka IronErn) and TA-NATALSTATUS, which targeted Redis servers to deploy cryptocurrency miners. More recently, TeamPCP has poisoned open-source libraries via GitHub Actions abuse and token theft, while also deploying destructive malware such as 'kube.py' that includes wiper functionality targeting Kubernetes clusters, particularly those in Iran.

2mo ago · hacker-news

Researchers at Novee Security identified critical vulnerabilities in Anthropic's Claude Code and Google's Gemini CLI that could allow unprivileged attackers to access CI workflow secrets or execute code on CI runners. CVE-2026-12537 in Gemini CLI enables OS command injection via a malicious .gemini/.env file, allowing pre-sandbox code execution on CI hosts. CVE-2026-54316 in Claude Code allows exfiltration of API keys one character at a time through Hugging Face's public download counter. Both vulnerabilities have been patched, with no evidence of active exploitation in the wild. The root cause across both systems was flawed 'harness' code that failed to properly validate or sandbox model-generated commands.

2mo ago · hacker-news

Researcher Dirk-jan Mollema demonstrated a technique where malware running in a signed-in Windows session can abuse Windows Hello for Business keys to silently authenticate to Microsoft Entra ID, enabling persistent cloud access without extracting private keys or requiring administrator privileges. By leveraging WebAuthn, the attacker can request a signed assertion from the compromised endpoint and use it to obtain a Primary Refresh Token (PRT), register a new device, and bypass phishing-resistant authentication requirements. The technique exploits legitimate Windows ticketing behavior and does not require device-specific access, allowing attackers to establish long-term access to cloud resources under certain tenant policies.