Intelligence Feed

3mo ago · bleeping-computer

Microsoft has announced that Windows Server 2022 will reach the end of mainstream support on October 13, 2026, transitioning to extended support with continued security updates until 2031. Organizations are advised to upgrade to Windows Server 2025, the latest Long-Term Servicing Channel release, to remain protected and supported. The article highlights Microsoft's lifecycle policy and recent extensions to hotpatching and extended security updates for certain editions.

3mo ago · unit42

The Unit 42 2026 Global Incident Response Report highlights how AI is acting as a force multiplier for cyber attackers, accelerating existing attack methods rather than introducing new ones. Threat actors are leveraging AI to streamline malware development, automate phishing content, and enhance reconnaissance, reducing attack timelines significantly. Despite these efficiency gains, core tactics such as credential theft, phishing, and exploitation of known vulnerabilities remain unchanged. Defenders are advised to strengthen prevention controls and combine AI proficiency with human judgment to counter AI-enhanced threats.

3mo ago · bleeping-computer

A new macOS malware named ClickLock targets users through social engineering to steal login credentials, cryptocurrency assets, browser data, and password manager information. The malware forces victims into entering their system password by displaying fake authentication dialogs and terminating critical system processes. It establishes persistence via LaunchAgents, exfiltrates data through Telegram, and deploys a persistent backdoor using GSocket for remote access. The malware leverages compromised legitimate domains and evades detection by self-deleting modules and clean reputations of host infrastructure.

3mo ago · hacker-news

Owen Flowers and Thalha Jubair, alleged members of the Scattered Spider threat actor group, were sentenced to five and a half years each for their roles in a 2024 cyberattack on Transport for London (TfL) that disrupted 148 systems and affected 27,000 employees. The attack, which exfiltrated personal and financial data and nearly led to a network shutdown, caused £29 million in losses and recovery costs. The hackers also targeted US healthcare organizations, with threats to disrupt critical systems, and are linked to a broader campaign of social engineering, SIM swapping, and data extortion spanning hundreds of attacks from 2022 to 2025.

3mo ago · bleeping-computer

A vulnerability in Anthropic's Claude for Chrome extension allows malicious browser extensions to trigger predefined AI workflows by simulating untrusted click events. The flaw arises because the extension fails to validate the Event.isTrusted property, enabling unauthorized execution of actions in connected services like Gmail, Google Docs, Calendar, and Salesforce. Although the issue requires a malicious extension already installed by the user, it can abuse Claude's authenticated access to sensitive platforms without additional user consent.

3mo ago · bleeping-computer

The Coca-Cola Company disclosed that its Fairlife dairy subsidiary suffered a ransomware attack, leading to the temporary suspension of production across U.S. facilities. The attack impacted production-related systems, though product safety remains unaffected. Investigation is ongoing, with outside cybersecurity experts and law enforcement involved. No ransomware group has claimed responsibility, and details on data exfiltration or extortion remain undisclosed.

3mo ago · socket-dev

AI music generator Suno suffered a breach stemming from the Shai-Hulud worm, which compromised a developer's machine and exfiltrated GitHub and cloud credentials. The attacker, using the handle ellie.191, accessed Suno's source code, customer data, and payment information without the company's public notification. The breach highlights the ongoing impact of the Shai-Hulud campaign, which spreads via trojanized npm, PyPI, and Packagist packages and exfiltrates credentials to public GitHub repositories.

3mo ago · talos

Cisco Talos has identified a new campaign by UAT-11795, a financially motivated Russian-speaking threat actor, targeting users in the U.S. and Europe since at least June 2025. The group uses trojanized installers of legitimate software such as Webex, Zoom, and MobaXterm to deliver a custom Python-based remote access tool called 'Starland RAT'. This tool enables deployment of additional payloads, including the in-memory PowerShell-based 'WLDR agent', CastleStealer, and Remcos RAT, to steal credentials and cryptocurrency.

3mo ago · bleeping-computer

A new malicious framework named OkoBot has been active since January 2026, delivering over 20 payloads to steal cryptocurrency wallet seed phrases, credentials, and sensitive data. It spreads via ClickFix attacks and malicious GitHub repositories hosting trojanized software. The infection chain begins with the TookPS PowerShell script, which installs an SSH bot to deploy further modules. Victims are primarily in Brazil, with secondary targets in Vietnam, Canada, Mexico, and Turkey, and evidence suggests the threat actor may be Russian-speaking due to geoblocking and code comments.

3mo ago · hacker-news

ClickLock is a new macOS infostealer that uses social engineering via a fake Cloudflare CAPTCHA to trick users into pasting a malicious command into Terminal. Upon refusal to enter credentials, it initiates aggressive app-killing loops every 210ms to coerce compliance. It steals login passwords, browser credentials, crypto wallets, and Keychain data, exfiltrating via Telegram bots. The malware uses compromised websites for payload delivery and a modified open-source backdoor, with persistence via LaunchAgents.

3mo ago · hacker-news

A vulnerability in n8n's Enterprise token exchange feature, tracked as CVE-2026-59208, allowed attackers to log in as users from another issuer due to improper validation of JWT tokens. The flaw occurred when n8n matched incoming tokens solely on the 'sub' claim without verifying the 'iss' (issuer), enabling account takeover if two trusted issuers used overlapping subject identifiers. The issue affects n8n versions prior to 2.27.4 and 2.28.1, and while the feature is limited to Enterprise deployments in preview, it poses a high-severity risk for misconfigured systems.

3mo ago · hacker-news

Multiple cyber threat campaigns were observed in mid-2026, including malicious NuGet packages distributing spyware disguised as game cheats, fake installers delivering the Starland RAT and WLDR C2 implant, and a new ransomware family named Spirals that encrypted a South Asian IT firm's network within 24 hours. Threat actors exploited known vulnerabilities such as CVE-2026-46817 and CVE-2023-4346, while also leveraging social engineering via phishing eCards and OAuth device code attacks. Additional threats include large-scale infostealer distribution through fake GitHub repositories, Chrome Sync abuse for stalking, and dual monetization campaigns deploying Vidar stealer and XMRig miner.

3mo ago · hacker-news

A critical unpatched vulnerability in Shark robot vacuums allows attackers with access to a device's certificate to execute arbitrary commands on other vacuums within the same AWS region. The flaw stems from overly permissive AWS IoT policies that permit wildcard subscription and publishing to device shadows, enabling remote code execution, camera access, and Wi-Fi password theft. The issue affects older Shark vacuum models whose certificates were issued with unrestricted policies, and the fix requires server-side policy updates from SharkNinja, as no firmware update is needed. Despite being reported in March 2026, no patch or CVE has been issued as of July.

3mo ago · hacker-news

The article discusses the growing reliance on AI in offensive security and highlights the risks of treating AI-generated findings as validated vulnerabilities without proper human verification. It emphasizes that while AI can accelerate vulnerability discovery, it cannot replace human judgment in proving exploitability, impact, and real-world risk. The core message is that validation through technical knowledge and reproducible evidence remains essential to distinguish noise from genuine threats.

3mo ago · hacker-news

A China-linked threat actor has resurfaced with the Daxin kernel-mode rootkit, detected in 2026 within a Taiwan-based subsidiary of a multinational high-tech manufacturer. The compromised system was also infected with a previously undocumented backdoor, Stupig, which enables pre-login SYSTEM-level command execution by masquerading as a legitimate keyboard DLL. Both malware samples were compiled in 2013, suggesting long-term stealthy persistence, with Daxin using covert C2 via hijacked TCP connections and Stupig enabling credential theft before user login. The attack highlights sophisticated, sustained cyber espionage activity targeting critical infrastructure.

3mo ago · hacker-news

Researchers have identified a new class of attack called Agent Data Injection (ADI), which exploits how AI agents parse structured data by injecting malicious input disguised as trusted data elements like sender names or button IDs. Unlike traditional prompt injection, ADI corrupts underlying facts the agent trusts, enabling actions such as unintended clicks or execution of attacker-controlled commands. The attack affects multiple AI models including GPT-5, Claude, and Gemini, with success rates up to 50% despite existing defenses. No real-world exploitation has been reported, but proof-of-concept demonstrations show high effectiveness across web and coding agents.

3mo ago · hacker-news

The PhantomEnigma campaign has hijacked over 20 Brazilian government websites, leveraging compromised .gov.br domains and authenticated email accounts to distribute malware. The attack uses fake police-themed documents to lure victims, redirecting them through trusted government infrastructure to deliver a modular Inno/Node.js backdoor. This backdoor enables credential theft, remote access, and delivery of additional payloads, posing significant risks to banks and public agencies.

3mo ago · hacker-news

A new modular malware named TELEPUZ has been spreading since April 2026 via ClickFix social engineering lures, which use clipboard hijacking (pastejacking) to trick users into executing malicious PowerShell commands. The malware, written in C, performs anti-analysis checks, disables security monitoring, and establishes persistent command-and-control (C2) communication using multiple fallback methods. It is capable of data theft, command execution, and browser manipulation via Chrome DevTools Protocol, and is likely offered as malware-as-a-service (MaaS) based on active development and distribution patterns.

3mo ago · bleeping-computer

A Russian financially motivated threat actor, UAT-11795, has been conducting attacks since at least June 2025 by distributing trojanized installers of legitimate software such as WebEx, Zoom, and MobaXterm to deploy the Starland RAT. The malware establishes persistence, performs reconnaissance, steals credentials and cryptocurrency, and can deploy additional payloads like CastleStealer and Remcos RAT. The campaign targets users in the U.S., Germany, Romania, and Venezuela, using sophisticated techniques including registry manipulation, sandbox detection, and encrypted C2 communications via a PowerShell framework called WLDR.

3mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to patch a critical vulnerability, CVE-2026-46817, in Oracle E-Business Suite (EBS) by July 18, 2026, due to active exploitation in the wild. The flaw resides in the File Transmission component of Oracle Payments and allows unauthenticated attackers to take over systems via HTTP. Threat intelligence firm Defused confirmed exploitation after observing attacks on honeypots, despite the absence of public proof-of-concept code. CISA emphasizes prompt patching to prevent compromise of federal systems.

3mo ago · bleeping-computer

Microsoft has announced that Windows 11 24H2 Home and Pro editions will reach end of support on October 13, 2026, after which they will no longer receive security or non-security updates. This increases the risk of unpatched vulnerabilities being exploited on unupdated systems. Users are advised to upgrade to Windows 11 25H2 to remain protected against emerging threats.

3mo ago · bleeping-computer

Two key members of the Scattered Spider cybercrime group, Thalha Jubair and Owen Flowers, were sentenced to five years and six months in prison for their involvement in the August 2024 breach of Transport for London (TfL). The attack disrupted critical internal systems, forced 27,000 employees to reset passwords, and led to the theft of customer data. The group is also linked to over 120 network intrusions globally, including attacks on U.S. healthcare providers and critical infrastructure, resulting in over $115 million in extortions.

3mo ago · bleeping-computer

23andMe suffered a significant data breach in 2023 due to credential-stuffing attacks that went undetected for five months, resulting in the theft of genetic and personal data from 6.9 million customers. The breach was attributed to inadequate security controls, including lack of password blocklisting, multifactor authentication, and intrusion detection. The company faced multiple lawsuits, regulatory fines, and ultimately a bankruptcy filing, culminating in a $18 million settlement with a coalition of 43 attorneys general to resolve claims over its failure to protect user data.

3mo ago · bleeping-computer

AI agents are transforming enterprise environments by operating autonomously, accessing systems, and evolving faster than traditional security tools can track. This shift invalidates the old security model based on static, knowable environments, as agents can inherit human credentials and bypass conventional monitoring. The article argues that security teams must move beyond fixed workflows and vendor dashboards, instead building on a live identity foundation to maintain control over dynamic agent behaviors and access patterns.

3mo ago · talos

UAT-11795 is a financially motivated, Russian-speaking threat actor active since June 2025, targeting users in the U.S. and Europe. The group deploys a novel Python-based remote access tool (RAT) named Starland RAT and a bespoke PowerShell-based C2 implant, WLDR, using trojanized installers of legitimate software. The campaign focuses on stealing credentials and cryptocurrency wallets, utilizing a multi-stage infection chain involving HTA downloaders, Telegram beacons, and resilient C2 infrastructure, including a fallback mechanism via a Polygon smart contract.

3mo ago · talos

The article discusses the 'Hunter's Paradox' in cybersecurity, where human analysts can no longer keep up with the volume, velocity, and complexity of modern threats, necessitating the use of AI-driven threat hunting. However, AI systems are vulnerable to deception by attackers who operate through lies and obfuscation, making full trust in AI problematic. The author argues for redefining threat hunting as a reasoning-driven process rather than a human-only activity, advocating for a balanced approach where AI executes hunts under human-defined strategies and constraints. The path forward involves careful implementation of AI with guardrails, graduated autonomy, and continued human oversight in creative and strategic aspects.

3mo ago · hacker-news

Zoom has patched a critical vulnerability, CVE-2026-53412, in its Windows clients that could allow unauthenticated remote attackers to perform account takeover via improper input validation. Additionally, three high-severity vulnerabilities related to privilege escalation were addressed in various Zoom products for Windows. There is no evidence of active exploitation in the wild. Users are advised to update to the latest versions to mitigate these risks.

3mo ago · hacker-news

OpenAI has developed GPT-Red, an internal automated red-teaming model designed to identify and mitigate prompt injection vulnerabilities in its GPT series of models. GPT-Red simulates adversarial attacks by iterating through prompts to achieve malicious goals such as exfiltrating sensitive data or injecting malicious scripts, thereby improving the robustness of GPT-5.6 Sol. The model is used in adversarial training to harden production models against both direct and indirect prompt injections, significantly reducing failure rates compared to previous versions.

3mo ago · bleeping-computer

A new ransomware actor named Spirals successfully breached an IT services firm in South Asia, achieving full network encryption within 24 hours of initial access. The attackers exploited a publicly exposed IIS server, deployed an ASP.NET web shell, and used tools like PsExec, revsocks, and Chisel for lateral movement and persistence. The Spirals ransomware, written in Rust, uses AES-128 encryption protected by ECDH P-256 and employs intermittent encryption to speed up the process, threatening victims with data exposure unless a ransom is paid.

3mo ago · socket-dev

Next.js is transitioning to a scheduled security release model to address vulnerabilities in a predictable and coordinated manner, replacing ad-hoc patching. This change follows high-severity incidents like React2Shell (CVE-2025-55182), a critical remote code execution flaw in React Server Components that was widely exploited. The new program enables advance notice of patches, allowing organizations time to plan upgrades and implement mitigations. Vercel cites increasing vulnerability discovery rates due to AI-assisted tools as a driver for more frequent and structured releases.