Intelligence Feed

2mo ago · hacker-news

Two critical vulnerabilities in Paperclip, an open-source AI agent control plane, allow remote code execution on server or developer machines via malicious agent imports. CVE-2026-41679 enables unauthenticated attackers to register and import a malicious agent configuration that executes commands with server privileges due to insufficient access controls during company creation. A second path exploits DNS rebinding in local_trusted mode, where a malicious website can trigger command execution on localhost by rebinding a hostname to 127.0.0.1 and invoking the import API. A third vulnerability, GHSA-xfqj-r5qw-8g4j, exposes sensitive API routes without proper authentication, potentially leaking control-plane details and allowing unauthorized access to heartbeat data and system health information.

2mo ago · hacker-news

A macOS-focused threat operation leveraging over 250 front-end domains employs browser fingerprinting to selectively serve malware lures to genuine Mac users while evading crawlers and sandbox environments. The fingerprinting script collects navigator properties, screen dimensions, WebGL signals, timezone, iframe detection, touch support, developer console activity, and codec capability checks to determine if the visitor is a real Mac user. Qualified users are presented with a fake GitHub-themed 'Download for macOS' page that delivers the Atomic Stealer (AMOS) infostealer via an obfuscated Terminal command. The command retrieves additional scripts from a /curl/<id> endpoint and executes payloads that target credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files.

2mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned federal agencies of active exploitation of three critical vulnerabilities in IBM Langflow, N-able N-central, and Apache Tomcat. The Langflow flaw (CVE-2026-9198) allows unauthenticated remote code execution by chaining API endpoints, with proof-of-concept exploits publicly available. A second Langflow vulnerability (CVE-2026-0770) is also being exploited for root-level remote code execution. The N-central vulnerability (CVE-2026-18576) enables attackers to hijack administrative accounts without authentication, despite prior patching attempts. The Apache Tomcat flaw (CVE-2026-34486), stemming from an incomplete fix for a prior encryption issue, is being exploited by a Chinese-speaking threat actor to deploy reverse shells. CISA has added all three CVEs to its Known Exploited Vulnerabilities catalog and mandated mitigation within three days.

2mo ago · bleeping-computer

A phishing campaign impersonating COLDCARD is distributing a malicious batch file named Coldcard_Diagnostic_Tool.bat, which installs ScreenConnect remote access software to gain persistent control over victims' systems. The attack leverages fears around a recent COLDCARD wallet vulnerability and a $88.6 million Bitcoin theft, using spoofed emails and a fake website (coldcardcompliance.com) to trick users into downloading the payload. The batch file drops and executes a signed ScreenConnect installer disguised as a legitimate diagnostic tool, connecting to a command-and-control server at activeretirementrelocation[.]com, enabling remote access, data theft, and potential ransomware deployment.

2mo ago · hacker-news

Veeam, HashiCorp, and Django have released patches for critical vulnerabilities in their software. Veeam's Service Provider Console has two critical flaws: CVE-2026-58073 allows unauthenticated attackers to impersonate managed agents and steal credentials (CVSS 9.5), and CVE-2026-58072 enables arbitrary file write leading to remote code execution with low-privilege access (CVSS 9.0). HashiCorp's Terraform MCP Server has a CVSS 10.0 cross-tenant vulnerability (CVE-2026-16498) due to improper session isolation in stateless HTTP mode, allowing token reuse across users. Django patched a high-severity flaw in GeoDjango (CVE-2026-15307) that could allow file writes and potentially remote code execution via spatial lookups accessible to staff users.

2mo ago · hacker-news

GitGuardian researchers identified 321 exposed and still-valid n8n API tokens in public GitHub commits, enabling unauthorized access to sensitive automation workflows, execution data, and stored credentials. Attackers can exploit these tokens to enumerate users, read or exfiltrate data, use or extract stored credentials (e.g., OpenAI API keys), and map high-risk configurations via the audit endpoint—all without exploiting a software vulnerability. The tokens remain valid due to missing expiration dates and poor credential hygiene, with some instances hosted on managed services like n8n.cloud. Responsible disclosure efforts met limited success, highlighting ongoing exposure risks.

2mo ago · hacker-news

A critical vulnerability in Gitea, tracked as CVE-2026-59774, allows unauthenticated attackers to read arbitrary files accessible by the Gitea service account by exploiting the Org-mode markup renderer. The flaw exists in versions 1.22.1 through 1.27.0 and is triggered via a crafted Org-mode #+INCLUDE directive processed by the /{owner}/{repo}/markup endpoint. Although not direct remote code execution, attackers can chain the file-read capability with reading app.ini to extract the INTERNAL_TOKEN and subsequently inject Git hooks to achieve command execution. The vulnerability was discovered by XBOW Security and independently reported by Shai Rod, with no known in-the-wild exploitation observed at the time of disclosure.

2mo ago · hacker-news

A memory corruption vulnerability in the Linux kernel's Open vSwitch (OVS) datapath, tracked as CVE-2026-64531 and dubbed OVSwrap, allows local users to escalate privileges to root. The flaw stems from a 16-bit length field wraparound when processing Netlink attributes in OVS flow installation, which can be triggered without requiring existing OVS bridges or daemons. A public proof-of-concept exploit achieves reliable local privilege escalation by chaining kernel pointer leaks, arbitrary reads, and targeted decrements to modify credentials and gain root access. The exploit supports around 800 kernel builds and leaves behind modified sudoers files and persistent root shells. Default installations of numerous Linux distributions are vulnerable if Open vSwitch is enabled and unprivileged user namespaces are allowed.

2mo ago · hacker-news

A long-standing supply chain attack has affected QuickFox, a VPN and network acceleration tool, since at least August 2025. The malicious Windows installer, starting from version 3.0.51.0, delivers a backdoor called FDMTP via a trojanized Electron-based application. The attack uses a JavaScript loader that fingerprints the victim endpoint and downloads the payload from a malicious domain, cdns3.51quickfox[.]cn, which mimics the legitimate domain. The malware employs DLL side-loading to execute FDMTP, which communicates with a C2 server to exfiltrate system information and download additional plugins, targeting users such as Chinese expatriates and professionals interacting with Chinese speakers.

2mo ago · hacker-news

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. These include a critical remote code execution flaw in Langflow (CVE-2026-9198), a sensitive data encryption bypass in Apache Tomcat (CVE-2026-34486), and an authentication bypass in N-able N-central (CVE-2026-18556 and CVE-2026-18577). Exploitation of CVE-2026-34486 has been linked to a Chinese-speaking threat actor using the aliases knaithe and KnYuan, who leveraged AI-powered offensive tools like DeepSeek via the Hermes Agent framework to autonomously target internet-exposed systems. The actor combined autonomous reconnaissance with manual exploitation of known vulnerabilities in Citrix NetScaler, Marimo, and IKE VPN, among others, targeting over 460 organizations.

2mo ago · hacker-news

Open VSX removed 77 malicious 'evil twin' extensions that impersonated legitimate developer tools but were designed to exfiltrate sensitive developer environment data. The extensions, uploaded between July 26 and August 1, 2026, sent system information, workspace details, and CI/CD context to the domain mangorbit[.]com. Nineteen of them were more advanced reconnaissance payloads that collected Git metadata, installed extensions, CI environment variables, and telemetry settings. The malware included fallback mechanisms via DNS TXT records and persistence logic to distinguish between human and configuration-driven installations.

2mo ago · bleeping-computer

The Greatness phishing-as-a-service (PhaaS) platform has evolved to conduct adversary-in-the-middle and device-code phishing attacks, primarily targeting Microsoft 365 accounts. It abuses the trusted reputation of RingCentral by spoofing emails from service@ringcentral[.]com, using lures like fake voicemail and performance review notifications to bypass email filters. Victims are redirected to phishing pages that capture MFA-approved tokens, enabling persistent access to mailboxes, Teams, SharePoint, and other Microsoft 365 services. The attackers may have leveraged data from a recent RingCentral breach to target legitimate users.

2mo ago · bleeping-computer

TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada business networking devices, which could be exploited to achieve remote code execution and network infiltration. The flaws, discovered by Forescout’s Vedere Labs, include hard-coded keys, information disclosure, device hijacking, and spoofing, and can be chained with previously disclosed command-injection vulnerabilities (CVE-2025-7850, CVE-2025-7851). Attackers could exploit a race condition during cloud adoption, use default credentials, and inject JavaScript to steal administrator credentials and reconfigure devices or establish unauthorized VPN access.

2mo ago · hacker-news

Google removed three AI agent workflows from its Agent Development Kit (ADK) Python repository after Pillar Security demonstrated a supply chain attack vector. A malicious GitHub issue could trigger a prompt injection in a triage agent, leading to execution of a privileged code-fixing agent via a trusted bot account. This allowed arbitrary code execution on the CI runner and exfiltration of sensitive credentials, including a bot personal access token (PAT), a Google API key, and a Google Cloud service-account credential. Although no in-the-wild exploitation was observed, the attack chain exploited overly broad permissions and insufficient isolation between automation components.

2mo ago · bleeping-computer

Manifold Security discovered a campaign involving 77 malicious extensions on the Open VSX marketplace that impersonated legitimate developer tools to harvest system and development environment metadata. These 'evil twin' extensions exfiltrated information such as hostnames, workspace paths, Git metadata, CI/CD environment details, and developer identifiers to a common infrastructure at mangorbit[.]com. While source code and credentials were not accessed, the collected data could be used to profile organizations and private repositories. The extensions used tracking identifiers, supported fallback communication via DNS TXT records, and were removed from Open VSX by August 3, 2026, though manual removal from developer systems is required.

2mo ago · bleeping-computer

A new variant of the XCSSET malware, version 40, is targeting macOS developers by compromising Xcode projects and GitHub repositories. The malware spreads when developers build infected projects, enabling it to propagate across systems and deploy 17 modules for credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration. This variant includes new capabilities such as a Chrome hijacker that enables real-time web traffic interception and a Telegram trojanizer that replaces the legitimate Telegram Desktop app with a malicious version. The malware employs advanced evasion techniques, disables macOS security features, and uses encrypted, build-unique ciphers to avoid detection.

2mo ago · securelist

Threat actors are leveraging legitimate cloud platforms such as Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS to host phishing infrastructure and bypass multi-factor authentication (MFA). The attack uses a multi-stage adversary-in-the-middle (AitM) technique involving contact harvesting, transparent proxy initialization via service workers, and browser-in-the-browser (BitB) spoofing to intercept credentials and session tokens. Phishing pages are hosted on trusted domains with good reputations, making detection difficult and enabling large-scale, low-cost deployment of malicious sites.

2mo ago · hacker-news

The Greatness PhaaS (Phishing-as-a-Service) platform has added device code phishing capabilities to bypass Multi-Factor Authentication (MFA) by abusing the OAuth 2.0 Device Authorization Grant. This enables attackers to steal authentication tokens without presenting fake login pages, making detection more difficult. The service supports multiple phishing methods including adversary-in-the-middle (AiTM) attacks, OAuth consent abuse, and phishing for iCloud, Yahoo, and Google Workspace. Post-compromise, attackers use stolen tokens to access Microsoft 365 resources via Microsoft Graph API and establish persistence by registering new devices to obtain Primary Refresh Tokens (PRTs).

2mo ago · bleeping-computer

A massive supply-chain attack dubbed ChainDrop has compromised over 1,300 npm packages with a combined 2 billion monthly downloads. The attack began with the compromise of the Keyv maintainer's GitHub account, allowing the threat actor to push malicious code directly to main branches and publish poisoned versions through legitimate CI/CD workflows. The malware, named ChainDrop and based on the Shai-Hulud worm, includes a dropper (setup.mjs) and an obfuscated infostealer (Math_Symbol.js) that collects developer and cloud credentials, encrypts them, and exfiltrates them to a public GitHub repository. The attack spreads laterally by self-propagating to other packages maintained by developers whose environments were infected.

3mo ago · datadog-security-labs

On August 4, 2026, a worm compromised several high-profile npm packages, including keyv, file-entry-cache, and flat-cache, each with around 150 million monthly downloads. The malicious commit (174f6a5) in the keyv package introduced a backdoor designed to propagate to adjacent npm packages, indicating a supply chain attack aimed at widespread distribution. The campaign represents a significant open-source software supply chain compromise with potential for broad impact due to the popularity of the affected packages.

2mo ago · step-security

A self-propagating worm dubbed ChainDrop is actively compromising npm packages by publishing malicious versions using stolen maintainer credentials. The malicious packages include heavily obfuscated files such as setup.mjs and math_init.js, which execute during installation via preinstall scripts, enabling credential harvesting in CI/CD environments. The worm uses Ethereum-based dead-drop command-and-control infrastructure, and over 435 packages with more than 1,550 compromised versions have been identified since August 4, 2026. Organizations using affected packages should assume compromise and rotate all associated credentials and secrets.

2mo ago · unit42

A significant portion of malware samples bypass DNS by communicating directly to IP addresses, evading DNS-based security controls. Analysis of 4 million dynamic reports shows 45.32% of malware with command-and-control (C2) activity used direct-to-IP (D2IP) connections, accounting for 23.17% of all C2 attempts. Threats identified include Phorpiex ransomware droppers, a data exfiltration campaign using obfuscated \GET requests, SectopRAT deployments targeting educational institutions, and IoT botnets like Mozi and a new Mirai variant named Boatnet. These threats leverage hard-coded IP addresses and custom HTTP methods to avoid detection and maintain persistence.

2mo ago · hacker-news

cPanel has patched a critical vulnerability, CVE-2026-58048 (CVSS 4.0: 9.4), that allows an authenticated hosting customer to execute SQL commands with full administrative database privileges, effectively crossing the privilege boundary into the server's root database context. The flaw resides in the database-renaming process, where SQL mode is not preserved, leading to execution in root context. This could lead to full operating system compromise depending on configuration. Two additional vulnerabilities were patched in the same release: CVE-2026-58047, an HTTP request-smuggling issue in cpsrvd, and a local privilege escalation in Exim via unsafe string expansion in .forward files.

2mo ago · hacker-news

An active multi-wave campaign dubbed SMOKE#SCREEN by Securonix uses fake Adobe and Zoom update lures, along with business document themes, to deliver Remote Monitoring and Management (RMM) tools like ConnectWise ScreenConnect. The attack begins with spear-phishing emails containing obfuscated VBScript droppers that perform anti-analysis checks before deploying payloads. These payloads ultimately install ScreenConnect, providing attackers with persistent remote access through attacker-controlled relay servers. A separate but related campaign distributes the Powercat Java-based information stealer via fake Xeno Roblox cheat installers, enabling credential theft, surveillance, and remote control.

2mo ago · hacker-news

A malicious npm package worm originating from keyv@6.0.0 has spread to hundreds of packages across multiple organizations, leveraging preinstall scripts to steal developer and CI credentials, including repository, cloud, and private-key material. The payload can propagate by republishing compromised packages using stolen npm credentials and includes secondary execution paths via .claude and .vscode hooks that activate when a user trusts the workspace. The attack leveraged legitimate GitHub Actions workflows, resulting in valid SLSA and OIDC provenance, making detection more difficult. The malware family is linked to prior PyPI compromises and is associated with the Shai-Hulud campaign, though the specific threat actor remains unidentified.

2mo ago · socket-dev

An active supply chain attack has compromised multiple popular npm packages in the 'keyv' and 'cacheable' namespaces, attributed to a compromised maintainer account (Jaredwray). Malicious preinstall hooks in the packages execute a two-stage payload that downloads a standalone Bun runtime, harvests cloud credentials (including AWS, GCP, Azure, Kubernetes, HashiCorp Vault, GitHub Actions, and npm tokens), and self-propagates by republishing trojanized versions of other packages using stolen npm tokens. The attack leverages obfuscated JavaScript, exfiltrates data via DNS and GitHub repositories, and establishes persistence through autostart hooks in developer environments. The malicious packages remain live on npm, and the campaign is actively evolving with new packages being published.

2mo ago · talos

Cisco Talos researchers analyzed how adversaries are weaponizing AI across multiple attack vectors, including malicious software development, criminal force multiplication, and vulnerability research. Threat actors with varying skill levels are using AI to create DDoS tools, bulk-email validation platforms, credential harvesters, and cryptojacking fleets, often bypassing model guardrails through simple evasion techniques like ownership claims or CTF labeling. A francophone actor developed an automated 'Token Pipeline' to exploit React2Shell vulnerabilities and harvest credentials from exposed Git configurations, while a Turkish-speaking actor leveraged AI to manage a Monero-mining operation via compromised torrent clients. Spanish and Russian-speaking actors used AI to conduct autonomous pentesting, build scam chatbots, and target Telegram Mini Apps for cryptocurrency theft.

2mo ago · hacker-news

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability, CVE-2026-18577, in N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. The flaw, stemming from incomplete patching of a prior vulnerability (CVE-2026-18556), enables authentication bypass and account takeover, allowing attackers to gain administrative access and pivot to managed endpoints using the Take Control feature. Indicators include malicious use of legitimate tools like Cloudflared and connections from specific IP addresses associated with Mullvad and NordVPN exit nodes. While no specific threat actor has been attributed, exploitation has been observed across multiple organizations, with attackers conducting reconnaissance, lateral movement, and persistence.

2mo ago · hacker-news

The DOUBLECUP loader-as-a-service (LaaS) is being used by threat actors to deliver malware such as CountLoader and a previously undocumented Python-based remote access trojan (RAT) called DeviceManager. The attack begins with social engineering lures via fake CRM login pages using ClickFix, which trigger the download of steganographically encoded PNG images into the browser cache. These images contain hidden payloads that, when extracted, execute malicious code to deploy the final malware. CountLoader uses environmental keying based on the victim's public IP address for decryption and establishes persistence by modifying browser shortcuts, while DeviceManager leverages blockchain-based C2 resolution via Ethereum/Polygon smart contracts using EtherHiding.

3mo ago · bleeping-computer

Security researchers from Palo Alto Networks' Unit 42 identified three novel attacks, collectively named 'Pass-ta-key,' that exploit weaknesses in Google Password Manager's handling of passkeys on Windows devices with TPM. The attacks allow malware on an already-compromised device to hijack synced passkeys, impersonate trusted devices, register attacker-controlled verification keys, and extract the master encryption key (security domain secret) from Chrome's memory. While the cryptography of passkeys remains intact, the attacks bypass user verification and enable account takeover, particularly on services that fail to properly validate user verification flags. eBay was found vulnerable but has since patched the issue.