Intelligence Feed

3mo ago · bleeping-computer

Microsoft released the July 2026 Patch Tuesday updates for Windows 11, including KB5101650 and KB5099414, to address 571 vulnerabilities and deliver minor feature improvements. The updates focus on security fixes, Bluetooth enhancements, accessibility features, and File Explorer refinements. No active exploitation of the patched vulnerabilities was reported at the time of release. The updates are mandatory and apply to Windows 11 versions 25H2, 24H2, and 23H2.

3mo ago · bleeping-computer

Microsoft's July 2026 Patch Tuesday addresses a record 570 vulnerabilities, including three zero-day flaws actively exploited or publicly disclosed. Two of the zero-days were exploited in the wild: CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in Microsoft SharePoint Server, both allowing privilege escalation. The third, CVE-2026-50661, is a publicly disclosed BitLocker security bypass that could allow attackers with physical access to bypass encryption protections.

3mo ago · bleeping-computer

Microsoft released the Windows 10 KB5099539 extended security update, which includes the July 2026 Patch Tuesday updates addressing a record 570 vulnerabilities, including two actively exploited and one publicly disclosed zero-day flaws. The update improves security features such as Secure Boot reporting and enforces TDI transport registration requirements, potentially affecting legacy applications. No active threat campaigns or malicious indicators are described in the article.

3mo ago · bleeping-computer

A threat actor has created nearly 300 fake GitHub repositories impersonating legitimate software projects to distribute an infostealer malware, primarily targeting credentials, cryptocurrency wallets, and sensitive data from browsers and messaging apps. The malicious repositories redirect users to spoofed download pages that deliver trojanized payloads, including a malicious libcurl.dll that executes the infostealer in memory. The malware, a variant of BoryptGrab, exfiltrates stolen data to a Russia-based C2 server and is designed for maximum data theft in a single execution without establishing persistence or anti-analysis measures.

3mo ago · hacker-news

Two critical vulnerabilities in RabbitMQ, CVE-2026-57219 and CVE-2026-57221, could allow unauthenticated attackers to leak OAuth client secrets and enable authenticated users to bypass tenant boundaries by accessing cross-tenant queue metadata. The flaws, present since early 2024, affect RabbitMQ versions 3.13.0 and later and have been patched in recent releases. CVE-2026-57219 exposes a misconfigured HTTP API endpoint that leaks sensitive OAuth secrets, posing high risk in cloud or multi-tenant environments with exposed management interfaces.

3mo ago · hacker-news

LabubaRAT is a Rust-based remote access trojan (RAT) that masquerades as NVIDIA software to evade detection and establish persistent access on Windows hosts. It supports multiple communication methods including HTTPS, WebView2, and DNS tunneling, and can be configured at runtime via command-line arguments or Base64-encoded input. The malware profiles the host environment, collects system information, and enables operators to execute commands, capture screenshots, transfer files, and route traffic via SOCKS5 proxy. Evidence suggests it may be distributed as malware-as-a-service (MaaS), with infrastructure linked to 'LabubaPanel'.

3mo ago · bleeping-computer

An ongoing phishing campaign is targeting LastPass and Bitwarden users with fake security alerts designed to mimic legitimate corporate communications. The emails direct recipients to fraudulent websites impersonating DocuSign, hosted on malicious domains, where users are prompted to download malicious files. Despite the use of domains resembling official services, LastPass confirms no compromise of its systems and warns users not to provide master passwords via email.

3mo ago · bleeping-computer

Progress Software confirmed a high-severity zero-day path traversal vulnerability in ShareFile Storage Zone Controller versions 5.x and 6.x, leading to the emergency shutdown of affected systems. The flaw allows authenticated administrative users to read arbitrary files, write malicious content, and enumerate the server filesystem. Although a CVE has been reserved, no evidence of customer breaches has been found. Security updates (versions 5.12.5 and 6.0.2) have been released to mitigate the vulnerability.

3mo ago · talos

The article discusses the evolving challenges in cybersecurity, where attackers are increasingly leveraging AI to dynamically alter malicious commands and adapt malware behavior. Cisco Talos Intelligence Integrations aims to help defenders by applying real-time threat intelligence across Cisco’s security technologies to identify and block malicious activity. The integrations assist in answering critical security questions, such as identifying malicious domains or unusual user behavior, by leveraging up-to-date threat intelligence. The article highlights the importance of visibility and context in defending against modern threats.

3mo ago · hacker-news

Two threat actor groups, UNK_pyreq2323 and UNK_OutFlareAZ, are exploiting OAuth client ID spoofing to validate stolen Microsoft Entra ID credentials without triggering successful sign-in events. By using spoofed but syntactically valid OAuth client IDs in ROPC authentication flows, attackers can enumerate valid accounts and passwords at scale while evading detection. The technique bypasses Conditional Access policies and leaves minimal telemetry, making it difficult for defenders to detect malicious activity.

3mo ago · hacker-news

The article discusses how Pentera leverages AI to transform security workflows by integrating validated attack path data into AI-driven decision-making. It emphasizes the importance of moving beyond theoretical risk signals to evidence-based validation of exploitable vulnerabilities. Pentera's platform safely emulates real-world attacks to identify actual attack paths, enabling security teams to prioritize remediation based on proven exploitability. The integration is facilitated through Pentera's MCP Server, which feeds validation data directly into AI workflows without exposing new network services.

3mo ago · hacker-news

A study of 85 crypto wallet browser extensions by KU Leuven researchers revealed widespread privacy leaks that enable tracking and potential de-anonymization of users. The wallets expose users' addresses through normal operations, allowing linkage of multiple addresses, persistent tracking across sites, and cross-site address leakage via embedded frames. Despite responsible disclosure, most wallet vendors did not classify these issues as bugs, citing design intent or low risk, leaving users exposed to identity correlation even without malicious exploitation.

3mo ago · hacker-news

Cybersecurity researchers have identified 11 outdated, Microsoft-signed UEFI shim bootloaders that can be exploited to bypass Secure Boot protections on UEFI-based systems. These vulnerable shims allow attackers to execute arbitrary code during the early boot phase, enabling deployment of persistent UEFI bootkits such as Bootkitty and BlackLotus. Although the Microsoft Corporation UEFI CA 2011 certificate expired in June 2026, affected systems remain at risk if the vulnerable shims are not explicitly revoked via hash. The issue highlights a supply chain exposure where outdated but still-trusted bootloaders undermine critical firmware security mechanisms.

3mo ago · bleeping-computer

The article discusses Microsoft's testing of a cleaner and faster version of Windows Search for Windows Insiders in the Experimental channel. The update prioritizes relevant local results over ads and promotional content, improves search reliability, and enhances user control via new privacy settings. There is no mention of malicious activity, threats, or cyber attacks in the article.

3mo ago · bleeping-computer

SAP has released its July 2026 security updates addressing 16 vulnerabilities across multiple products, including three critical flaws in NetWeaver, AppRouter, and Commerce Cloud. The critical vulnerabilities include a memory corruption issue in NetWeaver AS ABAP, an HTTP request smuggling flaw in AppRouter, and a default credentials issue in Commerce Cloud that could allow unauthorized data access. While no active exploitation has been observed yet, CISA has previously cataloged SAP vulnerabilities as exploited, and recent supply chain attacks highlight ongoing risks.

3mo ago · bleeping-computer

Two new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts using techniques that bypass multi-factor authentication (MFA). Jalisco leverages device-code phishing via OAuth 2.0 Device Authorization Grant, tricking users into authorizing attacker-controlled devices. OmegaLord uses a fake PDF reader login page to harvest credentials and phone numbers, aiding in MFA bypass. Both kits enable rapid data exfiltration from SaaS platforms like SharePoint, often within minutes of compromise.

3mo ago · bleeping-computer

Microsoft is transitioning to passkeys as the default authentication method for Entra ID starting September 2026, retiring SMS and voice authentication by February 2027. This shift aims to reduce reliance on phishable methods and improve security against credential theft and identity attacks. Threat actors, including the ShinyHunters group, have been targeting Entra ID SSO accounts using stolen credentials, with AI-enhanced phishing campaigns achieving high click-through rates. Organizations are urged to adopt phishing-resistant authentication methods to prevent sign-in disruptions and strengthen account protection.

3mo ago · bleeping-computer

The article discusses the shrinking window between vulnerability disclosure and exploitation, driven by the increasing volume of CVEs and the rapid weaponization of flaws using AI. It highlights the case of 'Nightmare-Eclipse,' a set of Windows zero-day exploits developed by a disgruntled security researcher, which enables local privilege escalation, credential theft, and evasion of Windows Defender. The article advocates for breach and attack simulation (BAS) techniques that validate exploitability without executing real exploits, allowing defenders to prioritize patching based on actual risk.

3mo ago · socket-dev

A supply chain attack has compromised three npm packages in the @asyncapi namespace, including @asyncapi/generator-helpers, @asyncapi/generator-components, and @asyncapi/generator. These packages deliver a multi-stage botnet loader known as Miasma, which downloads its second-stage payload from IPFS and establishes persistence on the victim's system. The malware supports command execution, credential harvesting, and evasion techniques, posing significant risk to development and CI environments.

3mo ago · step-security

A coordinated supply chain attack compromised two AsyncAPI GitHub repositories on July 14, 2026, by injecting malicious code into the CI/CD pipelines. The attacker gained push access to the 'next' and 'master' branches, leveraging legitimate GitHub Actions workflows to publish four malicious npm packages without stealing tokens. These packages delivered an obfuscated dropper that downloads and executes the Miasma RAT, a sophisticated payload with multi-channel C2 capabilities, credential harvesting, AI tool poisoning, and worm-like propagation features. The attack bypassed trust mechanisms like SLSA provenance by abusing authorized pipelines, highlighting risks in CI/CD security.

3mo ago · talos

Threat actors are increasingly targeting Python developers through malicious packages and supply chain attacks, leveraging trusted ecosystems like PyPI to distribute payloads. These attacks exploit native Python features such as setup.py, .pth files, and site hooks to execute arbitrary code during installation or runtime, achieving persistence or conditional execution. Techniques include build hook abuses and package content manipulation, enabling adversaries to hijack legitimate binaries, override functions, or exfiltrate data. The blog highlights defensive strategies including dependency auditing, version pinning, and isolated build environments to mitigate these risks.

3mo ago · hacker-news

Microsoft has identified three attack paths used by threat actors associated with ShinyHunters to compromise Salesforce environments over a year-long campaign from mid-2025 to mid-2026. The attackers exploited trusted OAuth integrations through vishing attacks, stole OAuth tokens from compromised third-party vendors like Drift, Gainsight, and Klue, and abused misconfigured guest access in Salesforce Experience Cloud sites. These methods allowed persistent access to CRM data without exploiting platform vulnerabilities, blending malicious activity with legitimate traffic. The campaigns targeted organizations across retail, education, and manufacturing sectors, leveraging social engineering, supply chain compromises, and poor identity governance.

3mo ago · hacker-news

A cyber threat campaign distributed 148 malicious npm packages disguised as student web proxies, which when accessed via browser turned devices into a DDoS botnet. The packages hosted a proxy application named 'Lucide' that appeared legitimate but silently loaded remote code and executed WebSocket-based attacks. The malicious infrastructure leveraged GitHub repositories and CDNs to deliver payloads, targeting a nursing school's domain and Wisp proxy servers. The operators maintained persistent control through mutable branches and could re-enable DDoS capabilities at any time.

3mo ago · hacker-news

The U.S. Treasury has sanctioned a Ukrainian individual and a Belarusian national for supporting ransomware operations through a malicious VPN service and cryptor sales. Dmytro Rashevskyi operated First VPN Service (1VPNS), which enabled ransomware groups to conceal their activities by providing anonymous access to infrastructure. Yegeniy Silayev sold cryptors to help cybercriminals obfuscate malware, contributing to attacks on U.S. businesses, hospitals, and government entities. The activity is linked to significant financial losses and exploitation of known vulnerabilities in network devices.

3mo ago · hacker-news

xAI's Grok Build coding CLI was found uploading entire Git repositories, including full commit history, to a Google Cloud Storage bucket without user consent. The data included tracked files and credentials, even when the 'Improve the model' setting was disabled. Although xAI later disabled the upload feature server-side, the incident exposed sensitive source code and secrets by design, raising serious data privacy and security concerns for developers using the tool.

3mo ago · bleeping-computer

The U.S. Treasury Department sanctioned two individuals and one entity for supporting ransomware operations by providing infrastructure and tools to conceal malicious activity. First VPN Service (1VPNS), a no-logs VPN provider used by ransomware groups, and its administrator Dmytro Rashevskyi were designated for enabling attackers to hide their identities. Additionally, Belarusian national Yegeniy Vladimirovich Silayev was sanctioned for selling crypters that help malware evade detection. These actions are part of a broader international effort to dismantle enablers of cybercrime, following the takedown of 1VPNS in Operation Saffron with European law enforcement.

3mo ago · bleeping-computer

A new macOS information-stealing malware named CrashStealer impersonates Apple's crash reporting tool to evade detection and steal sensitive data. It uses a signed and notarized installer to bypass macOS Gatekeeper, tricks users with a fake password prompt to access Keychain data, and targets browser credentials, crypto wallets, and password managers. The malware encrypts stolen data with AES-256-GCM before exfiltration, indicating a sophisticated and stealthy operation.

3mo ago · bleeping-computer

Hackers compromised the npm publishing credentials of Jscrambler and published malicious versions of its npm package (8.14, 8.16, 8.17, 8.20), which were downloaded nearly 1,500 times. The backdoored package executed an infostealer during the 'preinstall' hook, targeting source code, credentials, cloud secrets, cryptocurrency wallets, and browser data. The malware used ChaCha20-Poly1305 encryption for obfuscation, and Jscrambler has since deprecated the affected versions and enhanced its publishing pipeline security.

3mo ago · bleeping-computer

Japan's largest taxi operator, Nihon Kotsu, suffered a cyberattack involving unauthorized access and suspected malware infection, leading to the shutdown of critical systems including taxi dispatch, web booking, and reservation management. The company has disconnected affected systems to prevent further damage and is working with external cybersecurity experts to investigate potential data leaks. No ransomware group has claimed responsibility, and customers are warned against opening suspicious communications.

3mo ago · hacker-news

Researchers have identified a new attack technique called 'stealth memory injection,' dubbed MemGhost, that enables attackers to plant persistent false memories in AI agents through a single malicious email. The attack manipulates AI assistants that read emails and maintain persistent memory files, allowing an adversary to silently alter the agent's behavior in future sessions without detection. The technique was successfully tested against OpenClaw and Claude-based agents, with high success rates in background execution modes, highlighting a critical risk in AI systems that combine untrusted input processing with autonomous memory updates.