Intelligence Feed

2mo ago · unit42

A vulnerability in the Google Cloud Vertex AI Python SDK versions 1.139.0 and 1.140.0 allowed attackers to hijack model uploads via bucket squatting, leading to cross-tenant remote code execution (RCE). By predicting and preemptively creating a default staging bucket, an attacker could intercept and replace legitimate model artifacts with malicious payloads exploiting pickle deserialization. The victim's model deployment would then execute the attacker's code, enabling credential theft and lateral movement within Google Cloud environments.

2mo ago · unit42

A universal bucket hijacking technique has been identified that exploits the global uniqueness of cloud storage bucket names across major cloud providers including Google Cloud, AWS, and Microsoft Azure. Attackers with permissions to delete a storage bucket can recreate it under their control, redirecting data streams such as logs, Pub/Sub messages, and storage transfers to their own environment, leading to silent data exfiltration. While no active exploitation has been observed, the architectural flaw enables long-term, undetectable compromise of sensitive data if proper IAM controls and monitoring are not in place.

2mo ago · unit42

OpenClaw's skill marketplace, ClawHub, has become a vector for AI supply chain attacks involving malicious skills that distribute infostealers, evade detection through file padding, and enable financial fraud via affiliate injection and front-running schemes. Multiple malicious skills were discovered between February and May 2026, leveraging paste-site redirects, C2 infrastructure, and dynamic payload delivery. These threats bypassed automated screening tools like VirusTotal and ClawScan, highlighting weaknesses in current detection mechanisms. Palo Alto Networks has collaborated with ClawHub and NVIDIA to improve skill verification and protect customers through advanced security services.

2mo ago · unit42

CL-STA-1062, a Chinese-speaking threat actor group active since at least March 2022, has been targeting government entities and critical infrastructure in Southeast Asia. The group, also tracked as UAT-7237, uses a hybrid toolkit combining open-source tools like SoftEther VPN, Mimikatz, and VNT with a custom backdoor named TinyRCT. This backdoor enables command execution, file exfiltration, screen capture, and self-destruction, and is deployed via AppDomainManager injection through a maliciously crafted archive. The campaign demonstrates a sustained regional focus, with attacks spanning from Taiwan to Southeast Asia, particularly targeting energy and government sectors.

2mo ago · unit42

Unit 42 has identified a large-scale password spraying and credential theft campaign dubbed 'FortiBleed' targeting Fortinet, Sophos, and MSSQL services. The threat actors use a curated password list derived from prior breaches and previously compromised credentials to conduct password spraying attacks, extract device configurations, and perform offline password cracking. An initial access broker has claimed responsibility on the Exploit[.]in forum, offering stolen credentials for sale. Palo Alto Networks recommends hardening remote access controls, enabling MFA, and monitoring for suspicious login patterns.

2mo ago · unit42

Unit 42 researchers identified a new threat called 'phantom squatting,' where adversaries register AI-hallucinated domains to exploit software supply chains. Large language models (LLMs) frequently generate fictitious domains for legitimate brands, and attackers preemptively register these domains to intercept traffic from AI systems and users. A real-world case involved the 'Montana Empire' phishing kit, which targeted a hallucinated domain 23 days before its registration, demonstrating AI-assisted attack development. The research uncovered 13,229 malicious URLs and approximately 250,000 unregistered hallucinated domains, highlighting a growing risk to AI-driven workflows and developer tooling.

2mo ago · unit42

This article details a research effort to implement WebAuthn redirection in a browser-based RDP client, reverse-engineering Microsoft's undocumented internal handling of WebAuthn in Windows. The research uncovered that Microsoft's mstsc.exe uses an undocumented internal plugin path in webauthn.dll to process hash-only WebAuthn requests from older Windows servers, while public APIs require full clientDataJSON. The work enabled the first non-Windows implementation of WebAuthn redirection in an RDP client, predating FreeRDP's support. The findings highlight critical gaps in Microsoft's documentation and the complexity of cross-platform WebAuthn implementation in RDP environments.

3mo ago · talos

Cisco Talos has expanded its Threat Hunting program to proactively identify advanced adversaries leveraging AI to evade traditional detection. The initiative recently uncovered a KongTuke command-and-control (C2) infrastructure, highlighting the need for hypothesis-driven threat hunting. As attackers increasingly use AI and legitimate tools to stay under the radar, Talos emphasizes continuous monitoring across endpoint, network, and identity data to detect sophisticated intrusions before signatures are available.

2mo ago · talos

Microsoft's June 2026 Patch Tuesday addresses 206 vulnerabilities, including 32 critical, with a focus on remote code execution (RCE) flaws in Windows services, Microsoft Office, and Azure components. Several vulnerabilities are deemed more likely to be exploited, including CVE-2026-42985 in Remote Desktop Client and CVE-2026-47291 in the HTTP Protocol Stack. Talos has released Snort rules to detect exploitation attempts, emphasizing proactive defense against potential attacks targeting these critical flaws.

2mo ago · talos

Cisco Talos intelligence highlights the growing threat of AI-driven vulnerability discovery, which is outpacing human patching capabilities and enabling rapid exploitation of zero-day vulnerabilities. Organizations are urged to move beyond patch-reliant strategies and adopt a resilient security posture centered on foundational controls, behavioral detection, and incident response readiness. The report emphasizes that some breaches are inevitable, making detection and response capabilities as critical as prevention.

2mo ago · talos

The article discusses a novel approach to reverse engineering VB6 binaries by leveraging vbdec's live COM object model, enabling AI agents to automate analysis without modifying the core tool. By exposing its parsed project data through the Windows Running Object Table (ROT), vbdec allows local AI agents like Claude Code to interact with and query the disassembler programmatically. This method supports scalable, repeatable, and exhaustive analysis tasks such as decompilation, call graph generation, and database export, all performed locally without uploading sensitive binaries. The technique demonstrates how existing tools can be transformed into queryable services through structured data exposure and simple scripting interfaces.

2mo ago · talos

Cisco Talos observed a large-scale credential-harvesting campaign targeting over 30,000 Fortinet devices across nearly 200 countries. The campaign leverages known vulnerabilities in Fortinet firewalls and VPN gateways to steal credentials and maintain persistent access. Additionally, fileless variants of Phantom Stealer malware are being used to target browser credentials, employing anti-analysis techniques to evade detection. These threats highlight ongoing exploitation of internet-facing infrastructure and the need for robust patching and multi-factor authentication.

2mo ago · talos

Component Object Model (COM) is a foundational Windows technology increasingly exploited by threat actors for malicious purposes such as persistence, lateral movement, execution, and evasion. Malware families like Qakbot, Gh0stRAT, and WarmCookie leverage COM interfaces to interact with Windows services including Task Scheduler, WMI, and BITS, often bypassing traditional detection mechanisms. These threats use indirect vtable calls and DCOM for stealthy operations, making static analysis more complex. Understanding COM usage is critical for effective threat hunting and reverse engineering.

2mo ago · talos

Cisco Talos highlights the increasing abuse of Windows Component Object Model (COM) by malware families such as Qakbot and WarmCookie for lateral movement, persistence, and evasion. COM's use of opaque GUIDs and indirect vtable calls complicates manual analysis and static detection, allowing attackers to blend malicious activities with legitimate system processes. Defenders are advised to enhance their ability to detect and interpret COM-related artifacts to uncover hidden stages of the infection chain.

2mo ago · talos

Cisco Talos identified ARToken, a phishing-as-a-service (PhaaS) platform affiliated with the EvilTokens infrastructure, targeting Microsoft 365 users via sophisticated device code phishing. The platform offers affiliates a comprehensive toolkit for token theft, persistence via Primary Refresh Tokens (PRT), business email compromise (BEC), and SharePoint/OneDrive exfiltration. ARToken leverages advanced anti-analysis techniques including client-side behavioral verification and XOR-encrypted payloads to evade detection, while operating through Cloudflare Workers and a React-based dashboard for management.

2mo ago · talos

Martin Lee, EMEA Lead at Talos, shares his journey from academic research in human virology to leading cybersecurity initiatives. He reflects on the early days of the internet, the evolution of cyber threats, and the accidental discovery of advanced persistent threats (APT) while developing early spam filters. His current role focuses on analyzing the threat landscape and communicating insights to customers and partners. The discussion highlights the importance of curiosity and adaptability in cybersecurity careers.

2mo ago · talos

Cisco Talos has identified ARToken, a sophisticated phishing-as-a-service (PhaaS) platform, which provides a wide range of capabilities including device code phishing, Primary Refresh Token (PRT) persistence, email access, business email compromise (BEC), and SharePoint exfiltration. The platform shares infrastructure and operational patterns with the previously documented EvilTokens platform. ARToken features a React-based dashboard and exposes over 80 API endpoints, indicating it is a mature BEC operations environment rather than a simple phishing kit.

2mo ago · hacker-news

Google, in collaboration with the FBI and other partners, has disrupted the NetNut residential proxy network, which leveraged over 2 million compromised home devices such as smart TVs and streaming boxes to route malicious traffic. The network, also known as Popa, was operated by publicly traded Israeli company Alarum Technologies and used deceptive apps to gain access without user consent. This infrastructure was exploited by cybercriminals and espionage groups for password-guessing attacks and to mask their locations. Google describes the action as a degradation rather than a complete takedown due to the network's reseller ecosystem, which allows it to persist under different brands.

2mo ago · hacker-news

PamStealer is a new macOS information stealer distributed via fake Maccy websites, impersonating a legitimate clipboard manager. It uses a two-stage infection chain, starting with a malicious AppleScript dropper that downloads a Rust-based payload. The malware validates the victim's login password using macOS PAM, establishes persistence, and steals credentials, browser data, cryptocurrency wallets, and iCloud Keychain contents before exfiltrating them to attacker-controlled servers.

2mo ago · hacker-news

Former European Parliament member Stelios Kouloglou was repeatedly targeted with Pegasus spyware during his tenure on the PEGA Committee, which investigated misuse of commercial spyware. Forensic analysis revealed two infections in October 2022 and March 2023, both exploiting a zero-click vulnerability in Apple's HomeKit (PWNYOURHOME) affecting iOS 15.5. The attacks coincided with key committee activities and may be linked to a Pegasus operator targeting multiple EU jurisdictions, possibly overlapping with a campaign against exiled journalists.

2mo ago · hacker-news

A threat actor known as Armored Likho is conducting cyber espionage and financially motivated attacks against government agencies and the power sector in Russia, Brazil, and Kazakhstan. The group uses a mix of modular RATs, infostealers, and tools like Go2Tunnel for remote access and data exfiltration. A new Python-based infostealer, BusySnake Stealer, has been identified, which steals credentials, cookies, screenshots, and documents while evading detection through obfuscation and dynamic code execution. The attacks begin with spear-phishing emails delivering malicious payloads via RAR archives or weaponized LNK files exploiting CVE-2025-9491.

2mo ago · hacker-news

A new modular malware framework dubbed Avalon has been discovered, capable of executing a multi-stage attack chain that includes credential theft, lateral movement, and ransomware deployment via its CrownX component. The attack begins with a phishing email containing a password-protected archive hosted on Proton Drive, which delivers a malicious ISO image. The framework employs advanced defense evasion techniques, disables recovery mechanisms, and exfiltrates sensitive data before encrypting systems. Notably, Avalon shows signs of AI-assisted development, lowering the barrier for less sophisticated actors to deploy complex malware.

2mo ago · hacker-news

A critical Linux kernel vulnerability dubbed 'Bad Epoll' (CVE-2026-46242) allows unprivileged users to escalate privileges to root, affecting Linux systems and Android devices. The flaw is a use-after-free race condition in the epoll subsystem, exploitable even from within Chrome's sandbox. A working proof-of-concept exists, though no active exploitation has been observed. The bug is patched in newer kernels, but older 6.1-based systems like the Pixel 8 remain unaffected.

2mo ago · hacker-news

Security firm runZero disclosed seven unpatched vulnerabilities in FatFs, a widely used filesystem library in embedded devices, which could allow attackers with physical access or control over firmware updates to achieve memory corruption and potential code execution. The most severe vulnerability, CVE-2026-6682, is a high-severity integer overflow in FAT32 volume mounting. Due to the decentralized nature of FatFs and lack of responsive upstream maintenance, downstream vendors must independently patch affected systems, increasing the risk of prolonged exposure across IoT, industrial, and consumer devices.

2mo ago · hacker-news

North Korean threat actors associated with the Contagious Interview campaign have launched the PolinRider operation, distributing 108 malicious packages and browser extensions across npm, Packagist, Go, and Google Chrome. The attack targets developers in the cryptocurrency sector through social engineering, compromising maintainer accounts to inject obfuscated JavaScript payloads into legitimate repositories. These payloads deliver second-stage malware such as DEV#POPPER RAT and OmniStealer by leveraging blockchain infrastructure and malicious VS Code task files, while using Git history manipulation to evade detection.

2mo ago · hacker-news

A U.S. government entity, likely Union County, Ohio, paid approximately $1 million to a threat actor named Kairos following a data theft extortion incident. Unlike traditional ransomware attacks, Kairos did not encrypt systems but instead exfiltrated sensitive data—including files from the prosecutor's office—and threatened to leak it unless paid. The attack highlights a growing trend of pure data-theft extortion, where the leverage is the threat of public data disclosure rather than encryption. The payment of 9.44 BTC was traced through blockchain to exchanges including Bybit, OKX, and the Russian service BELQI, but no confirmation of data deletion was verifiable.

2mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that a high-severity remote code execution vulnerability in Microsoft SharePoint, tracked as CVE-2026-45659, is now under active exploitation. The flaw allows authenticated attackers with low privileges to execute arbitrary code remotely on unpatched SharePoint servers without user interaction. Microsoft addressed the vulnerability in May 2026 updates, but over 10,000 exposed servers remain at risk. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by a strict deadline.

2mo ago · bleeping-computer

Cisco has confirmed active exploitation of a critical vulnerability (CVE-2026-20230) in its Unified Communications Manager (Unified CM) software. The flaw allows unauthenticated attackers to perform server-side request forgery (SSRF) attacks via crafted HTTP requests. Cisco urges customers to apply patches immediately or disable the vulnerable WebDialer service as a mitigation. The vulnerability follows a trend of repeated security issues in Cisco Unified CM devices.

2mo ago · bleeping-computer

Microsoft resolved a bug that caused Copilot buttons to disappear in Classic Outlook for Windows users with the Copilot Chat (Basic) license. The issue was fixed via a service update on June 29, 2026, and users are advised to restart Outlook or update to the latest build. Microsoft is also investigating Outlook crashes linked to Kaspersky Antivirus's Kaspersky Mail Checker (mcou.dll).

2mo ago · bleeping-computer

ConsentFix and ClickFix are social engineering attacks that hijack Microsoft 365 accounts by exploiting user trust in routine workflows. ClickFix tricks users into executing malicious commands via fake verification prompts, while ConsentFix abuses OAuth consent flows by luring victims into dragging a localhost callback link, surrendering OAuth tokens. These attacks bypass traditional security measures by mimicking legitimate processes, requiring no malware or credential theft. Attackers leverage publicly shared blueprints and common platforms like Dropbox to distribute lures.