Intelligence Feed

3mo ago · step-security

Harden-Runner v2.20.0 now extends egress block mode to macOS and Windows GitHub-hosted runners, enabling organizations to prevent secret exfiltration across all operating systems used in CI/CD pipelines. This update addresses critical attack vectors seen in campaigns like Megalodon and GhostAction, where compromised workflows or dependencies exfiltrated secrets via outbound calls. Previously limited to audit mode on non-Linux runners, teams can now enforce network policies to block unauthorized egress traffic, strengthening supply chain security.

3mo ago · step-security

Supply chain attacks targeting GitHub Actions workflows pose consistent risks regardless of the runner infrastructure used. Third-party runner providers like Bitrise, Blacksmith, Depot, Namespace, and Warp are increasingly adopted for performance and specialized hardware, but they inherit the same threat model as GitHub-hosted runners. Malicious dependencies or compromised actions can still access sensitive secrets and execute harmful payloads. Harden-Runner v2.20.0 now supports these third-party runners, providing runtime security through egress monitoring, policy enforcement, and threat detection.

3mo ago · unit42

The npm ecosystem has faced escalating supply chain attacks since the emergence of the Shai-Hulud worm in September 2025. These attacks have evolved into sophisticated, wormable campaigns that steal credentials, propagate across packages, and establish persistent access in CI/CD pipelines. Recent operations, including Mini Shai-Hulud and Miasma variants, have targeted major organizations like Red Hat and AsyncAPI, using novel initial access techniques and resilient C2 infrastructure. The public release of Mini Shai-Hulud tooling has increased the risk of copycat campaigns.

3mo ago · step-security

The article discusses the introduction of Device Policy by StepSecurity to help security teams enforce approved VS Code extensions across developer fleets. It highlights recent threats involving malicious IDE extensions, such as the IoliteLabs campaign and compromised Nx Console extension, which have led to backdoors and API key theft. The solution enables allow-listing of extensions using native IDE policies enforced via MDM or a standalone agent, ensuring tamper-resistant governance without requiring a proprietary enforcement layer.

3mo ago · bleeping-computer

Dutch police dismantled an international investment fraud ring responsible for stealing over €100 million monthly, with tens of thousands of victims worldwide. The criminal organization operated through 20 call centers across multiple countries, using social engineering to lure victims into fake investment platforms. Victims were manipulated into sending cryptocurrency, while the group used technical obfuscation to hide their identities and infrastructure. The main suspect, an Israeli-Polish national with prior hacking charges, was arrested in Poland and extradited to the Netherlands.

3mo ago · hacker-news

TuxBot v3 Evolution is a newly identified IoT botnet framework showing signs of large language model (LLM)-assisted development, though with functional flaws due to incomplete code. The malware targets IoT devices using brute-force attacks and known vulnerabilities, featuring a modular architecture with multiple C2 mechanisms including encrypted TCP, DGA, IRC, DNS, and P2P. It is attributed to the Keksec ecosystem based on shared infrastructure with Kaitori v3.9 and AISURU, indicating it is part of a broader portfolio of IoT botnets.

3mo ago · bleeping-computer

Zoom has disclosed a critical vulnerability, CVE-2026-53412, in its Windows desktop client and SDK that could allow unauthenticated attackers to perform account takeover via network access. The flaw is described as an improper input validation issue and affects multiple versions of Zoom Workplace, VDI Client, and Meeting SDK for Windows. Zoom recommends updating to the latest patched versions to mitigate the risk, as no active exploitation has been observed at the time of disclosure.

3mo ago · bleeping-computer

A Russian-speaking threat actor named 'bandcampro' abused Google's open-source Gemini CLI AI tool to operate a small-scale botnet and conduct hacking activities. The actor used the AI as an automated hacking agent to migrate command-and-control (C2) infrastructure, manage botnet operations via natural language, and attempt password guessing and data analysis. The botnet targeted systems in a dental clinic, accessing the OpenDental database, with operations sustained through simple but effective techniques including PowerShell agents and scheduled tasks. The malware lacked advanced evasion capabilities but was managed efficiently through AI-driven automation.

3mo ago · hacker-news

OkoBot is a malware framework targeting Windows users, active since April 2025, that injects phishing pages into legitimate cryptocurrency wallet applications like Ledger Live and Trezor Suite to steal recovery phrases. One of its modules, SeedHunter, hooks into Electron-based apps and waits for hardware wallet connections before displaying a malicious recovery page. The framework uses trojanized software and phishing lures to gain access, establishes persistent remote access via SSH and RDP, and deploys multiple surveillance and data-stealing plugins. Kaspersky attributes the campaign to an unknown actor but notes Russian-language artifacts and targeting patterns.

3mo ago · bleeping-computer

Intruder's AI-powered vulnerability research pipeline, combining code scanning with large language models, discovered a high-impact blind SQL injection vulnerability (CVE-2026-3985) in the Creative Mail WordPress plugin. The vulnerability allows unauthenticated attackers to extract sensitive database information, including admin password hashes and secret tokens, when WooCommerce is also installed. The exploit chain requires multiple requests and was automatically discovered and validated using AI, demonstrating the growing capability of AI in both offensive and defensive security research.

3mo ago · bleeping-computer

Five malicious versions of AsyncAPI npm packages were published in a supply-chain attack that delivered a credential-stealing remote access trojan. The attacker compromised GitHub repositories via a misconfigured CI/CD pipeline, leveraging legitimate workflows to publish trojanized packages with valid SLSA attestations. The malware, which resembles the Miasma backdoor, steals credentials, tokens, browser data, and other sensitive information, and communicates via HTTP, Nostr, Ethereum smart contracts, and libp2p. The exposure window lasted about four hours on July 14, 2026, and although the packages have been removed, existing installations may still be compromised.

3mo ago · wiz

A business-logic flaw in a B2B platform's data API allowed unauthorized access to premium contact data without spending credits. The vulnerability stemmed from the backend trusting a client-controlled boolean flag 'unmaskContactData' without validating user entitlements. This enabled free-tier users to bypass paywall restrictions and extract unmasked business emails, phone numbers, and personal information at scale. The flaw highlights a critical gap in server-side authorization enforcement, which traditional security tools failed to detect.

3mo ago · hacker-news

A critical vulnerability in the Cursor IDE on Windows allows malicious cloned repositories to trigger arbitrary code execution by placing a file named git.exe in the project root. When the repository is opened, Cursor automatically executes this binary without user consent, enabling attackers to run code with the user's privileges, including access to SSH keys and cloud tokens. Despite being reported in December 2025, no patch has been released, and the issue remains unaddressed in the latest version. Similar behavior has been observed in other AI-powered development tools, indicating a broader trend in untrusted search path vulnerabilities.

3mo ago · hacker-news

The article discusses the 'Approval Gap' in AI-era ad tech, where approved marketing tags can dynamically load unvetted fourth-party scripts, creating client-side security risks. These scripts operate with the same privileges as first-party code, potentially exposing sensitive customer data. The threat is exacerbated by AI-driven ad tech that rapidly evolves, making point-in-time security reviews insufficient. The piece emphasizes the need for continuous monitoring of digital supply chains to prevent unauthorized data access.

3mo ago · hacker-news

Security researcher Chaotic Eclipse has released a proof-of-concept (PoC) exploit named LegacyHive, which exploits a Windows User Profile Service vulnerability to load arbitrary hives and achieve privilege escalation. The exploit works on all supported Windows versions, including those updated with the July 2026 Patch Tuesday. The researcher claims the original version did not require additional credentials and could target any registry hive, raising concerns about potential misuse. This disclosure follows an ongoing dispute between the researcher and Microsoft over responsible vulnerability disclosure.

3mo ago · hacker-news

The article discusses how traditional SASE (Secure Access Service Edge) architectures are failing to keep pace with modern enterprise workflows involving SaaS applications, browsers, and generative AI tools. Due to encryption protocols like TLS 1.3 and HTTP/3, cloud proxies can no longer inspect traffic effectively, forcing organizations to bypass security for performance, creating blind spots. AI-driven workflows and autonomous agents now operate beyond network inspection, enabling potential data exfiltration through actions like pasting sensitive data into public LLMs. The solution proposed is shifting enforcement to the endpoint level, inspecting data at the point of interaction before it leaves the device.

3mo ago · hacker-news

Multiple critical vulnerabilities have been identified and patched in Firefox, Chrome, Adobe products, and VMware Avi Load Balancer. Mozilla warned of publicly available exploit code for two Firefox flaws, though no active exploitation has been observed. Adobe addressed 88 vulnerabilities across ColdFusion, Commerce, Experience Manager, and Illustrator, with several allowing arbitrary code execution. Broadcom patched a critical authentication bypass in VMware Avi Load Balancer that could allow network-accessible attackers to access the control plane.

3mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned administrators that three vulnerabilities in on-premises SharePoint Server instances are being actively exploited. These flaws allow attackers to bypass authentication, achieve remote code execution, and conduct post-exploitation activities such as stealing IIS machine keys and deploying malware. CISA urges immediate patching, enhanced monitoring, and network hardening to mitigate risks.

3mo ago · unit42

TuxBot v3 Evolution is a modular IoT botnet framework leveraging LLM-assisted development, capable of DDoS attacks, device infection via Telnet brute-forcing, and persistence across multiple architectures. The malware uses encrypted C2 communication with fallback mechanisms including DGA, P2P gossip, and IRC, though several components are non-functional due to development bugs. The operator is linked to the Keksec/Kaitori ecosystem, sharing infrastructure with known IoT threats, and has active C2 servers in Singapore and a dropper in Iceland.

3mo ago · hacker-news

SonicWall has identified active exploitation of two zero-day vulnerabilities in its SMA 1000 series appliances. CVE-2026-15409 is a critical SSRF flaw allowing unauthenticated remote attackers to manipulate internal requests, while CVE-2026-15410 is a post-authentication code injection vulnerability enabling arbitrary command execution with administrator privileges. The U.S. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by July 17, 2026. Indicators of compromise include suspicious log entries and unexpected configuration changes, prompting forensic analysis and system remediation.

3mo ago · hacker-news

Four compromised npm packages under the @asyncapi namespace have been used to distribute a multi-stage botnet loader that downloads the Miasma malware from IPFS. The malicious code executes when the package is loaded via require(), not during install, evading traditional detection. The malware supports multiple C2 channels, enables credential theft, lateral movement, and includes a dead man's switch. The attack leveraged compromised CI/CD pipelines with legitimate OIDC attestations, not stolen npm tokens.

3mo ago · bleeping-computer

U.S. authorities have charged three Russian nationals for operating bulletproof hosting services, Media Land and ML.Cloud, which provided infrastructure to ransomware groups such as Lockbit, Blacksuit, and Play. These services enabled cybercriminals to conduct malware delivery, command-and-control operations, DDoS attacks, and phishing campaigns while evading takedowns. The services caused over $62 million in damages globally and targeted critical infrastructure, including banks, schools, hospitals, and government entities across 21 U.S. states.

3mo ago · bleeping-computer

Microsoft has identified a compatibility issue between a recent Windows preview update (KB5095093) and Dell devices equipped with the Intel Innovation Platform Framework Processor Participant driver. The conflict causes unexpected shutdowns, performance degradation, increased heat, and battery drain. Microsoft is blocking the KB5101650 update on affected systems while working with Dell and Intel to resolve the issue.

3mo ago · bleeping-computer

SonicWall has warned of active zero-day exploitation of two vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in its SMA1000 appliances. CVE-2026-15409 is a critical SSRF flaw allowing unauthenticated remote attackers to force unintended requests, while CVE-2026-15410 is a post-authentication code injection vulnerability enabling arbitrary command execution. Both vulnerabilities are being actively exploited, with an overall CVSS score of 10.0, and affect multiple SMA1000 models. Immediate patching is advised, as no mitigations exist beyond updating to the latest hotfix releases.

3mo ago · socket-dev

A cyber threat campaign has distributed 11 malicious NuGet packages masquerading as game utilities and cheat panels targeting Russian-speaking communities. These packages act as first-stage downloaders that fetch and execute a second-stage Windows payload named pepesoft.exe from GitHub and Hugging Face under the operator-controlled account pepegit666. The payload enables host surveillance, including hardware fingerprinting, Google Sheets-based telemetry, remote ban-list checks, and in some variants, Telegram-based remote control with screenshot exfiltration capabilities.

3mo ago · talos

Microsoft's July 2026 Patch Tuesday addresses 622 vulnerabilities, including 57 rated critical, with two already exploited in the wild. Critical vulnerabilities include remote code execution (RCE), elevation of privilege, spoofing, and security feature bypass flaws across Windows, Office, SharePoint, and cloud services. Cisco Talos has released Snort rules to detect exploitation attempts for several of these vulnerabilities, particularly focusing on RCE and privilege escalation issues.

3mo ago · hacker-news

Microsoft's July 2026 Patch Tuesday addresses a record 622 vulnerabilities, including two actively exploited zero-days. CVE-2026-56164 is a privilege escalation flaw in SharePoint Server exploited by unauthenticated attackers over the network. CVE-2026-56155 is a local privilege escalation in Active Directory Federation Services exploited by authenticated attackers. Despite moderate severity ratings, both are under active attack and require immediate patching.

3mo ago · bleeping-computer

Spanish Police dismantled a cybercrime and money-laundering organization responsible for €140 million in losses through investment fraud and business email compromise (BEC) attacks. The group used over 800 bank accounts and 120 business accounts to launder funds, employing social engineering tactics like CEO fraud and false-invoice fraud. Four suspects were arrested across Spain, Portugal, and Panama, with law enforcement support from Interpol and Europol. The operation disrupted an extensive network involving 67 external accomplices and led to the seizure of digital devices and frozen assets.

3mo ago · hacker-news

Researchers have identified a vulnerability in the Claude for Chrome browser extension that allows rogue extensions to trigger unauthorized actions, such as reading Gmail, Google Docs, and Calendar data, by exploiting forged script-generated clicks. The flaw stems from the extension's failure to validate the authenticity of user interactions (event.isTrusted), enabling malicious extensions to simulate clicks and initiate sensitive tasks. If users have enabled 'Act without asking' mode, these actions execute silently without approval, increasing the risk to critical levels. The issue remains unpatched as of version 1.0.80, despite being reported to Anthropic in May 2026.

3mo ago · hacker-news

SAP has released security updates to address multiple critical vulnerabilities, including CVE-2026-44747, a CVSS 9.9 out-of-bounds write flaw in SAP NetWeaver ABAP that could allow authenticated attackers to cause memory corruption and potentially access or modify sensitive data. Two other critical flaws were also patched: CVE-2026-27690, an HTTP smuggling vulnerability in SAP Approuter, and CVE-2026-44761, a default credentials issue in SAP Commerce Cloud stemming from sample configuration scripts. Although no active exploitation has been observed, attackers could leverage these flaws to gain unauthorized access, manipulate data, or cause denial-of-service conditions if left unpatched.