Intelligence Feed

4mo ago · datadog-security-labs

Between June 16 and 19, 2026, a phishing campaign targeted AWS users using adversary-in-the-middle (AiTM) techniques to steal console credentials and multi-factor authentication (MFA) codes in real time. The attackers used domains impersonating AWS and SendGrid, hosted on Cloudflare, and delivered phishing emails through legitimate platforms like SendGrid to improve deliverability. The campaign employed a targeted approach with personalized URLs containing encrypted email identifiers, primarily aimed at US-based software engineers and engineering leadership.

4mo ago · datadog-security-labs

GuardDog 3.0 is an open-source security tool designed to detect malicious PyPI and npm packages by analyzing source code for suspicious behaviors. It introduces a new risk scoring engine that evaluates the likelihood of a package being malicious based on attack chain completeness, capability detection, and code sophistication. The tool now uses YARA for more efficient and scalable scanning, replacing Semgrep, and includes built-in sandboxing via nono-py to prevent exploitation during analysis. This release emphasizes improved accuracy, reduced false positives, and defense-in-depth against vulnerabilities in the scanner itself.

4mo ago · datadog-security-labs

The article outlines four new incident response scenarios featured in the Datadog expansion pack of the Backdoors & Breaches card game, designed to simulate real-world cyber threats. These scenarios reflect current trends such as supply chain compromises, cloud credential exposure, AI application vulnerabilities, and CI/CD pipeline attacks. Each scenario demonstrates attacker tactics across initial access, escalation, command and control, exfiltration, and persistence. The purpose is to train teams in detecting and responding to modern cloud and software supply chain threats.

3mo ago · datadog-security-labs

This article discusses the risks associated with Entra agent identities and blueprints, focusing on how compromised or over-privileged agent identities can lead to cross-tenant compromises. It emphasizes securing agent blueprints by restricting high-risk permissions, avoiding the use of secrets, and monitoring for suspicious activity. The guidance includes protective measures, detection strategies, and response steps for compromised agent identities within an Entra ID environment.

3mo ago · datadog-security-labs

Datadog Security Research has observed coordinated campaigns abusing GitHub API to enumerate corporate organizations, repositories, and user accounts. Attackers use ghost accounts, compromised tokens, and custom scraping tools with legitimate-sounding user agents to gather public data and, in some cases, access private repositories. The activity includes reconnaissance via GraphQL and REST endpoints, with rare instances of confirmed data exfiltration. Detection is challenging due to legitimate-looking traffic, but indicators such as suspicious user agents and token types can help identify malicious behavior.

3mo ago · datadog-security-labs

On July 8, 2026, a malicious version (1.20.21) of the npm package @injectivelabs/sdk-ts was published, containing a backdoored module that exfiltrated cryptocurrency wallet mnemonic phrases and private keys. The compromise occurred via a suspicious GitHub commit pushed directly to the main branch, originating from an unfamiliar timezone for the maintainer. Sensitive data was captured during wallet loading and sent via the X-Request-Id HTTP header to a malicious domain designed to mimic a legitimate Injective testnet service. The package was compromised for approximately 49 minutes before being reverted and replaced with a clean version.

3mo ago · datadog-security-labs

A supply-chain attack compromised four popular npm packages under the @asyncapi namespace, affecting over 3 million weekly downloads. The attacker exploited a vulnerable CI pipeline via a malicious pull request to steal credentials for the asyncapi-bot GitHub account, then injected malicious code into the packages. The payloads exfiltrate developer credentials and persist via IDE configuration hooks, leveraging decentralized C2 infrastructure including IPFS and Nostr for resilience.

3mo ago · socket-dev

A malicious Go module, github.com/kaleidora/dnsub-scanning-tool, serves as a lure to deliver a multi-stage Windows malware chain involving hidden PowerShell execution and encrypted payload resolution via public dead drops. The campaign, tracked as Operation Muck and Load, leverages a network of 222 GitHub repositories across 190 accounts to create credibility and scale for malicious or deceptive software projects. These repositories use synthetic activity to appear recently maintained, facilitating social engineering and malware distribution. The final payload includes RATs such as AsyncRAT, Quasar, and Remcos, along with infostealers like Vidar, enabling credential theft, screen capture, and persistence.

3mo ago · socket-dev

The White House launched the Gold Eagle initiative to coordinate and triage vulnerabilities discovered by AI systems, aiming to streamline validation, patching, and distribution across federal systems, critical infrastructure, and open source software. The initiative leverages Carnegie Mellon's VINCE platform for vulnerability reporting and coordination but has disclosed little about its operational structure, participants, or remediation processes. While designed to reduce duplicative scanning and improve response speed, the initiative faces challenges related to resource constraints, lack of enforcement authority, and sustainability, mirroring prior systemic issues in federal vulnerability management.

3mo ago · hacker-news

A critical unauthenticated remote code execution vulnerability, dubbed wp2shell, exists in WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The flaw stems from a REST API batch-route confusion and SQL injection issue, allowing anonymous attackers to execute code on affected sites. WordPress released versions 6.9.5 and 7.0.2 on July 17, 2026, to address the vulnerability, and no exploitation has been reported as of July 18. Due to the lack of a CVE identifier, tracking must rely on version numbers and active monitoring of the batch endpoint.

3mo ago · hacker-news

The HollowByte flaw in older versions of OpenSSL allows attackers to cause denial-of-service by sending malicious 11-byte TLS handshake requests, leading to memory exhaustion. The vulnerability stems from OpenSSL trusting unverified message length fields in TLS headers, causing the server to allocate up to 131 KB per connection without validation. Due to glibc memory management behavior, freed memory is not returned to the kernel, resulting in heap fragmentation and sustained high memory usage. Notably, OpenSSL did not classify this issue as a vulnerability, releasing a fix without a CVE or advisory.

3mo ago · bleeping-computer

Abbott Laboratories is investigating two unrelated cyber incidents. The first involves the ShinyHunters extortion gang, which claims to have accessed legacy Exact Sciences systems via a vishing attack compromising Microsoft Entra SSO credentials, exfiltrating sensitive customer and internal data. The second incident involves a threat actor named ShadowByt3$, who claims unauthorized access to Abbott's LabCentral portal using compromised customer credentials, allegedly stealing technical and regulatory documents. Abbott states that no critical operations were impacted and disputes claims that sensitive data was exposed in the LabCentral incident.

3mo ago · hacker-news

A software supply chain attack dubbed ViteVenom has targeted the Vite JavaScript ecosystem through seven malicious npm packages. The campaign, attributed to threat actor SuccessKey, uses a multi-tier blockchain-based command-and-control (C2) infrastructure across Tron, Aptos, and Binance Smart Chain to deliver a remote access trojan (RAT). The malware executes at import time to evade detection and retrieves payloads via blockchain transactions, making takedown efforts extremely difficult. Fallback mechanisms include direct HTTP retrieval from a C2 server.

3mo ago · bleeping-computer

A vulnerability named HollowByte allows unauthenticated attackers to cause a denial-of-service condition on OpenSSL servers by sending an 11-byte malicious payload during the TLS handshake. The flaw stems from improper memory allocation based on unvalidated message length headers, leading to memory bloat and heap fragmentation. Although the issue has been silently patched in OpenSSL versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, affected systems remain at risk until updated, particularly given the widespread use of OpenSSL in web servers, runtimes, and databases.

3mo ago · hacker-news

A threat actor cluster known as CylindricalCanine, linked to the broader GoldenEyeDog (APT-Q-27) group, was responsible for a breach at DigiCert in April 2026. The attackers compromised support analysts via a malicious .scr file delivered through a customer support chat, gaining access to initialization codes and stealing code-signing certificates. These certificates were then used to sign malware, including Zhong Stealer and Golden Gh0st RAT, enabling evasion of security detection. The group primarily targets finance organizations in the Asia-Pacific region using phishing and DLL side-loading techniques.

3mo ago · hacker-news

A Go-based botnet named NadMesh, discovered in early July 2026, actively targets exposed AI and cloud services to harvest cloud credentials, Kubernetes tokens, and model access. The malware prioritizes exploitation of MCP (Model Context Protocol) services, Docker APIs, Jenkins consoles, and Redis instances, with a focus on credential theft rather than host compromise. The operator uses self-propagating scanning infrastructure, persistence mechanisms, and obfuscation to evade detection, while targeting specific ports associated with AI tools like ComfyUI, Ollama, Gradio, and n8n. Researchers observed real-time exploitation traffic, though success rates for MCP exploitation remain low compared to other vectors.

3mo ago · hacker-news

North Korean threat actors linked to the Contagious Interview campaign are targeting software developers through fake job postings and coding challenges. They distribute malicious repositories that include SVG images with steganographically hidden payloads, which deploy the OtterCookie malware. This multi-stage malware steals browser credentials, cryptocurrency wallets, files, and clipboard data, while also enabling remote access via a Socket.IO-based backdoor.

3mo ago · bleeping-computer

Cybercriminals involved in carding are increasingly relying on 'clean' residential proxies to bypass fraud detection systems, but these proxies alone are no longer sufficient. They are now part of a broader identity-simulation strategy that includes matching geographic data, device fingerprints, and browser profiles to stolen identity information. As financial services improve detection, carders face challenges with proxy reputation degradation and provider restrictions, leading to a growing demand for finance-compatible proxy services.

3mo ago · bleeping-computer

Ernst & Young disclosed a data breach resulting from the compromise of a third-party support ticket system used by its IT personnel. The breach occurred between March 28 and April 12, during which an unauthorized party accessed and downloaded documents containing personal and financial data related to tax filings. The company detected anomalous activity on April 23, launched an investigation with external cybersecurity experts, and has since secured its systems. No threat actor has claimed responsibility, and there is no evidence of data misuse to date.

3mo ago · wiz

In July 2026, an attacker exploited a misconfigured GitHub Actions workflow in the AsyncAPI generator repository using a 'pwn request' technique to steal a privileged Personal Access Token. The attacker published five malicious npm packages under the @asyncapi namespace, which download and execute a multi-stage payload establishing persistence and connecting to C2 infrastructure. The payload targets developer credentials, including browser data, SSH keys, and cloud tokens, and communicates via HTTP, Nostr relays, Ethereum smart contracts, and IPFS. The attack leverages infrastructure and obfuscation techniques linked to the Miasma framework but shows distinct characteristics from prior campaigns.

3mo ago · unit42

Palo Alto Networks and Siemens collaborated to identify a chained exploit involving three zero-day vulnerabilities (CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949) in Siemens ROX II OT switches. The attack chain begins with arbitrary file disclosure, enables privilege escalation via command injection, and establishes persistent root-level access through the task scheduler. These vulnerabilities allow an unauthenticated attacker to gain full control of critical OT switches, potentially disrupting industrial operations. Siemens has released firmware updates, and virtual patching is available via Palo Alto Networks.

3mo ago · hacker-news

A previously undocumented malware named GoSerpent has been used in cyber espionage campaigns targeting government and diplomatic entities in Southeast Asia since late 2025. The malware enables long-term access, credential dumping, and data exfiltration through a suite of tools including Mimikatz, QuarksDumpLocalHash, and a custom file collection tool called ThumbcacheService. In May 2026, attackers returned to compromised environments to deploy evolved tools such as Stowaway and TmcLoader/TmcPayload for further data exfiltration. The activity shows operational overlaps with the TetrisPhantom threat actor, though definitive attribution remains unconfirmed.

3mo ago · hacker-news

ACR Stealer, an infostealer active since 2024, is being distributed through social engineering lures such as fake Claude AI assistant pages and malvertising. The malware uses fileless techniques and WebDAV shares to steal browser credentials, session tokens, and sensitive files from Microsoft 365, OneDrive, and SharePoint. It relies on user execution via pasted commands and does not exploit software vulnerabilities, making detection dependent on behavioral analysis and proactive controls.

3mo ago · hacker-news

Armenia has detained a Russian national, Aleksandr Ermakov, based on a U.S. extradition request related to alleged involvement in REvil (Sodinokibi) ransomware attacks. However, his legal team claims authorities have mistaken him for another individual with the same name—Aleksandr Gennadievich Ermakov—who was sanctioned in 2024 for cybercriminal activity including the Medibank data breach. The accused individual in custody, Aleksandr Yuryevich Ermakov, is a former prison-service lawyer with no known English proficiency, and lawyers argue insufficient identification was used for the arrest. The confusion stems from identical names and lack of patronymic or biometric verification in the extradition process.

3mo ago · hacker-news

The article discusses the growing emphasis on military autonomy and the need for trusted information infrastructure to support interconnected autonomous systems across defense forces. It highlights strategic investments by the U.S., UK, and NATO in autonomous technologies and underscores the importance of secure, cross-domain data sharing for mission effectiveness. The focus is shifting from deploying individual autonomous platforms to enabling secure, trusted, and interoperable information exchange across systems and coalition partners. The article promotes Everfox’s hardware-enforced separation solution as a means to achieve secure, high-assurance connectivity for autonomous military operations.

3mo ago · hacker-news

The European Commission has mandated Google to open access to Android's microphone, camera, screen, and other core features for rival AI assistants under the Digital Markets Act. This decision requires Google to implement a certification program allowing third-party AI assistants to access sensitive device functions, while also enforcing strict security and privacy safeguards. The move aims to promote competition but raises concerns about potential abuse of powerful device permissions by untrusted applications. Google must comply by August 2027, with certain features deferred to 2028.

3mo ago · bleeping-computer

A security researcher known as Nightmare Eclipse has released a Windows zero-day exploit named LegacyHive, which enables privilege escalation on fully patched systems by exploiting a flaw in the Windows User Profile Service. The proof-of-concept requires additional user credentials to limit weaponization, but successful exploitation allows non-admin users to manipulate registry hives and achieve automatic code execution upon administrator login. Microsoft has not yet assigned a CVE to this vulnerability, and the company has issued warnings against malicious use of such disclosures.

3mo ago · hacker-news

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the actively exploited SharePoint Server remote code execution vulnerability CVE-2026-58644 to its Known Exploited Vulnerabilities (KEV) catalog. This critical zero-day flaw allows authenticated attackers with Site Owner privileges to execute arbitrary code remotely on vulnerable SharePoint servers. CISA warns of ongoing exploitation and mandates federal agencies to apply patches by July 19, 2026. Additional SharePoint-related vulnerabilities are also being actively exploited, enabling remote code execution and post-exploitation activities such as theft of IIS machine keys.

3mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to urgently patch two actively exploited critical vulnerabilities in Fortinet's FortiSandbox platform, identified as CVE-2026-39808 and CVE-2026-25089. These flaws allow unauthenticated remote code execution via command injection with no user interaction required. Exploitation in the wild has been confirmed by threat intelligence firm Defused, prompting CISA to add the vulnerabilities to its known exploited catalog. Agencies must remediate by July 19, 2026, per Binding Operational Directive 26-04.

3mo ago · bleeping-computer

U.S. authorities charged Zhuoying Chen and Haojie Zhang for allegedly managing a money laundering network that processed at least $43 million from cyber-enabled investment fraud scams. The funds originated from 'pig butchering' or romance baiting schemes, where victims were lured into fraudulent investment opportunities via social media and messaging platforms. The defendants used 140 bank accounts under 45 shell companies to transfer stolen funds to China. This case highlights the growing scale of investment fraud, which accounted for 49% of scam incidents in the FBI's 2025 Internet Crime Report.