Intelligence Feed

1mo ago · hacker-news

A critical unpatched vulnerability dubbed XRING in Alibaba's XQUIC library allows remote clients to crash HTTP/3 servers using legitimate QPACK traffic. The flaw stems from an integer underflow during dynamic table resizing in QPACK, leading to out-of-bounds memory copy and server crash. The vulnerability affects all XQUIC versions up to v1.9.4 and impacts servers using HTTP/3 with default QPACK settings, including those behind Alibaba's Tengine web server. No patch or CVE has been assigned as of July 10, 2026.

1mo ago · hacker-news

The China-linked threat actor Silver Fox has been linked to a new Rust-based remote access trojan (RAT) named MODBEACON. This malware leverages gRPC streaming and reuses transport layers from the open-source Xray/V2Ray framework for encrypted command-and-control (C2) communications. It targets technology, education, and state-owned enterprises in Asia via counterfeit software installers distributed through SEO poisoning, enabling long-term access with capabilities including plugin loading, persistence, and data exfiltration.

1mo ago · hacker-news

Security researcher Chinmohan Nayak disclosed three high-severity vulnerabilities in the OpenClaw personal AI assistant, which together enable a 'WhatsApp-to-Host' attack chain. These flaws allow an attacker to execute arbitrary commands, bypass sandbox restrictions, and escalate privileges to achieve host-level code execution—all triggered via an external WhatsApp message. The vulnerabilities affect the host execution environment filtering and path traversal validation mechanisms, potentially exposing sensitive files like SSH keys and AWS credentials. OpenClaw has patched the issues in version 2026.6.6, urging operators to update and harden configurations.

1mo ago · bleeping-computer

Zimbra has urged customers to patch a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client, which could allow attackers to execute malicious code via specially crafted emails. The flaw affects Zimbra Collaboration Suite users and could lead to theft of session data, account settings, or mailbox contents. Although no CVE has been assigned yet, the vulnerability was reported by Google's Threat Analysis Group and is suspected to be exploited by state-backed actors, particularly Russian-linked groups.

1mo ago · bleeping-computer

The article discusses how AI agents and machine identities are outpacing traditional identity governance, creating a growing security gap. These non-human identities, such as service accounts and OAuth applications, often inherit excessive permissions and persist long after their original purpose, increasing the attack surface. A notable incident involved threat actor UNC6395 exploiting a trusted OAuth token from Salesloft's Drift integration to pivot across Salesforce, AWS, and Snowflake environments. The core issue is not new vulnerabilities, but the lack of ownership, visibility, and lifecycle management for machine identities.

1mo ago · hacker-news

Angelo Martino, a former ransomware negotiator, was sentenced to 70 months in prison for conspiring with BlackCat ransomware operators to extort victims by leaking confidential negotiation details. He collaborated with two cybersecurity professionals, Ryan Goldberg and Kevin Martin, to deploy BlackCat ransomware against multiple U.S. victims between April and November 2023. Martino betrayed clients by sharing their insurance limits and negotiation strategies, enabling higher ransom demands. The case highlights insider threats in cybersecurity and resulted in $10 million in seized assets.

1mo ago · hacker-news

Attackers have exploited a vulnerability dubbed 'Ill Bloom' in cryptocurrency wallet software that used weak randomness when generating recovery phrases, enabling them to predict and steal funds from vulnerable wallets. A coordinated attack on May 27 drained approximately $3.1 million from 431 wallets, primarily affecting older or lesser-known mobile wallets created as far back as 2018. The flaw does not impact hardware wallets or most mainstream software wallets, but users are urged to check their addresses on illbloom.org and migrate funds if their wallet is flagged as exposed.

1mo ago · bleeping-computer

A former ransomware negotiator, Angelo Martino, was sentenced to 70 months in prison for participating in BlackCat (ALPHV) ransomware attacks between April 2023 and April 2025. Alongside accomplices Kevin Tyler Martin and Ryan Clifford Goldberg, Martino targeted at least five U.S. organizations, leveraging insider knowledge of victims' insurance limits to maximize ransom demands. The attackers operated as BlackCat affiliates, paying 20% of ransom proceeds to the core group while extorting tens of millions from victims in financial services, healthcare, and education sectors.

1mo ago · bleeping-computer

The OpenMandriva Linux project faced an internal sabotage attempt allegedly carried out by Davide Beatrici, a developer associated with the Mumble project, following a dispute over project direction and contributor behavior. Beatrici deleted repositories and pushed an empty package to the Cooker repository, targeting the Gnome and Cosmic desktop environments. Although he denied malicious intent, claiming his actions were in response to disagreements over project governance, the OpenMandriva team is restoring affected systems and conducting a security audit. Legal action has been waived by the project despite the severity of the incident.

1mo ago · socket-dev

A malicious NuGet package named 'Braintree.Net' has been identified as a typosquatting campaign targeting developers using the legitimate Braintree payment SDK. The package intercepts live credit card data, steals merchant API credentials, and harvests environment secrets through a multi-stage .NET implant. It exfiltrates sensitive data to attacker-controlled domains and uses obfuscated C2 communications, particularly in companion dependencies like DependencyInjector.Core. The threat relies on production-only gating to avoid detection during development and testing.

1mo ago · talos

Cisco Talos identified multiple vulnerabilities in WolfSSL, GeoVision, and VTK-DICOM software. The vulnerabilities include improper input validation, integer underflow, memory corruption, OS command injection, buffer overflows, privilege escalation, XSS, and encryption weaknesses. These issues have been patched by the vendors, and Snort rules are available to detect potential exploitation attempts.

1mo ago · hacker-news

Microsoft has analyzed a destructive Windows backdoor named GigaWiper, which combines disk-wiping, fake ransomware, and spyware capabilities. The malware, written in Go, allows operators to choose from multiple destructive payloads, including full disk wiping, overwriting the Windows drive, and fake encryption with no decryption key. It also includes surveillance features such as screen recording, VNC streaming, and system reconnaissance. The same malware was independently identified as BLUERABBIT by Binary Defense and is linked to an Iran-nexus group targeting Israeli organizations, with ties to prior threats like Crucio and FlockWiper.

1mo ago · hacker-news

Multiple overlapping campaigns are actively enumerating corporate GitHub organizations, repositories, and user accounts using automated scraping tools and compromised or dormant GitHub accounts. Attackers leverage old 'ghost' accounts and exposed personal access tokens (PATs) to blend in with legitimate traffic and avoid detection while conducting reconnaissance. The activity includes querying public endpoints to map organizational structures and, in some cases, cloning private repositories. This behavior enables threat actors to gather intelligence for potential supply chain attacks.

1mo ago · bleeping-computer

Hackers compromised a contributor's GitHub account for the Injective Labs SDK project and published a malicious version (1.20.21) of the @injectivelabs/sdk-ts npm package. This supply-chain attack targeted developers building cryptocurrency-related applications, stealing wallet private keys and mnemonic seed phrases when SDK functions were used. The stolen data was exfiltrated via HTTP POST to a legitimate Injective Labs endpoint to blend in with normal traffic. The malicious package was downloaded 310 times before being deprecated, and 17 associated packages were also compromised.

1mo ago · wiz

The 2026 Verizon DBIR highlights that attackers are exploiting known vulnerabilities and trusted relationships at increasing speed and scale, with vulnerability exploitation now the leading initial access vector in 31% of breaches. Cloud environments are particularly at risk, as 40% of cloud intrusions begin with weaponized vulnerabilities. Attackers are leveraging AI to accelerate reconnaissance, exploit development, and post-compromise automation, while supply chain compromises and identity abuse further expand the attack surface.

1mo ago · wiz

The article describes how Wiz's Product Security (ProdSec) team leverages the Wiz platform to secure cloud environments through integrated threat detection, CI/CD security controls, and proactive threat modeling. The team employs Wiz CLI scanning, custom Cloud Configuration Rules (CCRs), and automated threat detection using the Wiz Blue Agent to identify and respond to risks in real time. Emphasis is placed on shifting security left into development workflows, contextualizing alerts for specialized infrastructure, and pressure-testing security tooling using AI-powered attack simulations like Red Agent.

1mo ago · step-security

On July 8, 2026, attackers compromised a trusted developer's account to inject a backdoor into the @injectivelabs/sdk-ts npm package, a core SDK for the Injective blockchain. The malicious code captured cryptocurrency wallet recovery phrases and private keys during wallet creation or loading and exfiltrated them to an attacker-controlled server disguised as legitimate infrastructure. The backdoor was distributed across 18 related npm packages for less than an hour before being detected and reverted, posing a significant risk to any application that installed the tainted versions during that window.

1mo ago · talos

Cisco Talos has identified activity from the China-nexus threat actor UAT-7810, which is expanding its Operational Relay Box (ORB) networks using custom malware to exploit vulnerabilities in unpatched Ruckus and ASUS routers. The group has deployed updated backdoors, including LONGLEASH and DOGLEASH, to create covert proxy infrastructure used by other APT groups. This infrastructure enables threat actors to mask their origins and bypass traditional defenses by routing traffic through compromised edge devices.

1mo ago · hacker-news

This week's threat landscape highlights a range of cyber activities, from cloud bucket hijacking and ransomware tooling overlaps to social engineering campaigns and supply chain attacks. Notable incidents include a global fraud operation resulting in nearly 6,000 arrests, typosquatting of payment SDKs on npm and PyPI, and the abuse of Microsoft Teams for delivering EtherRAT. Additionally, new techniques like Process Parameter Poisoning and ADFS token forgery underscore evolving evasion and privilege escalation methods.

1mo ago · hacker-news

GitHub has released npm version 12, disabling install scripts by default to reduce supply chain risks. The update requires explicit user approval for lifecycle scripts, Git dependencies, and remote URL resolutions. Additionally, granular access tokens (GATs) that bypass 2FA are being restricted from performing sensitive account and package management actions, with full publishing capabilities removed in a future update. These changes aim to harden npm's security posture against automated attacks and token misuse.

1mo ago · bleeping-computer

Microsoft anticipates an increase in Windows security updates due to the use of artificial intelligence in identifying vulnerabilities within its codebase. The company is leveraging its AI-powered system, MDASH, to scan and validate potential security flaws in critical Windows binaries, leading to faster discovery and remediation. While AI accelerates defensive efforts, Microsoft also acknowledges its use by threat actors to exploit zero-day vulnerabilities. As a result, Microsoft is updating its Secure Development Lifecycle to integrate AI earlier in development and counter emerging AI-enabled attack techniques.

1mo ago · bleeping-computer

A new data-extortion group named Helix has emerged, conducting SharePoint data theft attacks using vishing, device code phishing, and MFA abuse. The group targets organizations by impersonating employees or managers to gain account access, then exfiltrates data for extortion or resale. Helix exhibits operational similarities to ShinyHunters and BlackFile, with potential ties based on infrastructure and tactics. The group's consistent use of automated SharePoint enumeration and exfiltration from a specific IP and user-agent provides a strong technical fingerprint.

1mo ago · socket-dev

A compromised version of the @injectivelabs/sdk-ts npm package (1.20.21) was published with malicious code designed to exfiltrate cryptocurrency wallet private keys and mnemonic phrases. The backdoor was introduced via a compromised developer account and spread to 17 additional scoped packages that pinned the malicious version. The stolen data was exfiltrated via POST requests to a seemingly legitimate Injective Labs infrastructure endpoint, enabling attackers to reconstruct and access victims' wallets. Although the incident was quickly detected and mitigated, the malicious package versions remain downloadable.

1mo ago · hacker-news

The GodDamn ransomware, attributed to the threat actor Hyadina, leverages the Microsoft-signed PoisonX kernel driver (g11.sys) to disable endpoint defenses via a bring your own vulnerable driver (BYOVD) technique. The attack chain includes credential harvesting with NirSoft tools, lateral movement using PsExec, and remote access via AnyDesk, which is deployed through PowerShell scripts and registered as a persistent service. This ransomware is considered a rebrand of Beast, which evolved from Monster, and demonstrates an escalation in defensive evasion capabilities through signed malicious drivers.

1mo ago · hacker-news

The article discusses the emergence of 'clearinghouses' for managing pre-disclosure vulnerabilities in open source software, driven by AI-powered security research. These platforms aim to centralize vulnerability data, but the real value lies in automated actuation—turning findings into patched, signed software artifacts quickly. The author emphasizes that scale, speed of remediation, and upstream patching are critical for effectiveness, while warning that many announced clearinghouses are superficial. The long-term goal is to move beyond patching toward 'secure by design' systems that prevent vulnerabilities altogether.

1mo ago · hacker-news

The article discusses the increasing speed of cyberattacks powered by artificial intelligence, emphasizing that tasks which previously took days can now be executed in minutes. It highlights the use of AI models like Mythos to automate and scale attack operations, enabling rapid lateral movement and exploitation. The focus is on defensive strategies, particularly Zero Trust, to counter these fast-moving threats by reducing attack surface, blocking lateral movement, and deploying early detection mechanisms.

1mo ago · bleeping-computer

Cybercriminals exploit reduced IT and security staffing during summer months to increase attack success rates, leveraging slower response times and reduced oversight. There is a 40% increase in cyberattacks during holiday periods, with phishing and Business Email Compromise (BEC) campaigns becoming more effective due to AI-driven social engineering. Lean staffing extends attacker dwell time, allowing for lateral movement, data theft, and ransomware deployment before detection.

1mo ago · bleeping-computer

A new phishing-as-a-service (PhaaS) platform named Forg365 targets Microsoft 365 accounts using AI-generated lures, adversary-in-the-middle (AiTM) phishing, and device-code authentication exploits. The platform provides attackers with a comprehensive dashboard for campaign management, token handling, and persistent access via a browser extension called ForgCookie. It leverages legitimate services like Amazon SES and Cloudflare Pages to blend malicious activity with normal traffic, evading detection while enabling post-compromise persistence through OAuth token and cookie theft.

1mo ago · hacker-news

Microsoft has patched a privilege escalation vulnerability in the Microsoft Malware Protection Engine, dubbed RoguePlanet and tracked as CVE-2026-50656, which could allow attackers to gain SYSTEM-level privileges. The flaw stems from a race condition that can be exploited to spawn a privileged shell, even with real-time protection enabled. It affects systems updated with the June 2026 Patch Tuesday updates, and no customer action is required as updates are applied automatically. This is the fourth such vulnerability disclosed by researcher Chaotic Eclipse, following previous flaws like BlueHammer and UnDefend.

1mo ago · bleeping-computer

Operation First Light 2026, a global law enforcement initiative coordinated by INTERPOL, targeted social engineering fraud and money laundering across 97 countries, resulting in 5,811 arrests and the seizure of $293 million in illicit assets. The operation identified over 142,000 victims and disrupted thousands of financial fraud cases, including business email compromise, romance scams, and investment fraud. This effort is part of a broader series of coordinated actions, including Operation Synergia II and Operation Red Card 2.0, aimed at dismantling transnational cybercrime networks.