Intelligence Feed

3mo ago · hacker-news

Multiple threat actors are leveraging compromised software supply chains, AI-driven attacks, and unpatched vulnerabilities to deploy malware, steal credentials, and conduct ransomware operations. Notable activities include the exploitation of Citrix Bleed 2 (CVE-2025-5777) for DragonForce ransomware deployment, a compromised npm package distributing a Rust-based stealer, and the emergence of HalluSquatting attacks targeting AI coding assistants. Additionally, new backdoors like GigaWiper and RedHook are being used for persistent access and data exfiltration across Windows and Android platforms.

3mo ago · hacker-news

Google and Microsoft removed the ModHeader browser extension, which had approximately 1.6 million installs, after researchers discovered a dormant browsing-history collector embedded in its code. The collector, capable of gathering and exfiltrating encrypted browsing data, was inactive due to an empty allow-list but could be activated remotely via a routine update. The extension had been pinging tracking domains and logging request metadata, raising concerns about supply chain integrity and the stealthy potential of signed, popular extensions to harvest user data.

3mo ago · hacker-news

CrashStealer is a newly identified macOS information stealer written in native C++ that evades Gatekeeper by using a signed and Apple-notarized dropper. It harvests credentials from browsers, cryptocurrency wallets, password managers, and keychain data, encrypts the stolen data using AES-GCM, and exfiltrates it to an attacker-controlled server. The malware employs analysis resistance techniques such as control-flow flattening and anti-debugging, and uses a multi-stage delivery chain involving a GitHub-hosted payload.

3mo ago · bleeping-computer

CISA has issued a warning about actively exploited remote code execution (RCE) vulnerabilities in two Joomla extensions, iCagenda and Balbooa Forms. The vulnerabilities, CVE-2026-48939 and CVE-2026-56291, allow attackers to upload arbitrary files, including malicious PHP scripts, leading to full website compromise. These flaws were exploited in automated attacks before patches were released, with exploitation occurring just days prior to vendor fixes.

3mo ago · wiz

The article discusses the importance of Infrastructure-as-Code (IaC) coverage as a security metric for cloud environments. It emphasizes that IaC coverage enables traceability, resilience, and compliance by ensuring cloud resources are defined and governed in code. The article introduces a funnel model—supportable, tracked, and mapped—to measure how well cloud infrastructure is governed through IaC, highlighting that higher coverage enables machine-speed remediation and better security posture.

3mo ago · hacker-news

An unknown threat actor leveraged a suspected AI-generated PowerShell script to perform aggressive Active Directory enumeration following initial access via RDP with compromised credentials. The script conducted reconnaissance by mapping users, computers, domains, and other AD components, then exported data into CSV and HTML files. The attacker later deployed legitimate tools like s5cmd and SharpShares for further data discovery and exfiltration. This incident highlights how AI is being used as a force multiplier to accelerate traditional attack chains, lowering the barrier for less-skilled attackers to conduct damaging campaigns rapidly.

3mo ago · hacker-news

The article discusses the application of Daniel Kahneman's dual-process theory of human cognition to security operations centers (SOCs), advocating for a two-tiered AI architecture that mirrors 'System 1' (fast, automatic processing) and 'System 2' (slow, deliberate thinking). It highlights that 98% of security alerts can be autonomously resolved using fast, forensic-grade AI, while only 2% require human judgment and deeper analysis. The core argument is that misapplying human or AI resources to inappropriate tasks leads to missed threats and analyst burnout. The recommended model integrates autonomous investigation for scale and AI copilots for human-augmented decision-making, creating a feedback loop that improves over time.

3mo ago · hacker-news

Meta has filed a patent for an AI system capable of continuously monitoring a user's voice, biometrics, and device usage to infer emotional states throughout the day. The system could run on smart glasses, phones, or smart home devices, logging emotional data with timestamps, location, and activity context. While not currently implemented in any product, the technology raises significant privacy concerns due to its extensive data collection, including voice tone, pupil size, blink rate, and app usage. The EU AI Act has already restricted emotion-inference technologies in workplaces and schools, and similar consumer-facing systems may face regulatory scrutiny.

3mo ago · hacker-news

A phishing-as-a-service (PhaaS) platform named Forg365 is targeting Microsoft 365 users through sophisticated attack chains involving device code phishing, adversary-in-the-middle (AitM) session theft, and AI-generated lures. The service is offered via Telegram for $400/month and leverages legitimate email services like Amazon SES and SendGrid to evade detection. It enables low-skilled attackers to conduct large-scale phishing operations with post-compromise capabilities such as token vaulting, cookie injection, and AI-assisted email drafting.

3mo ago · bleeping-computer

UK authorities have charged five individuals in connection with Russian Coms, a caller ID spoofing platform used by criminals to conduct over 1.8 million scam calls since 2020. The platform enabled scammers to spoof numbers of financial institutions, telecoms, and law enforcement agencies to steal personal data and funds from victims. It was marketed on Telegram, Snapchat, and Instagram, offering encrypted calls, voice-changing, and no-logs services, leading to an estimated £9,400 average loss per victim across more than 107 countries.

3mo ago · bleeping-computer

Varonis Threat Labs created 'Breach at the Beach,' a hands-on Capture the Flag (CTF) training exercise focused on detecting real-world attacks in Microsoft Entra ID environments. The CTF simulates modern identity-based threats, particularly those involving non-human identities and AI-powered workflows, to educate defenders on data exfiltration techniques. It emphasizes detection of legitimate feature abuse rather than misconfigurations and is designed to be resilient to AI-based solving, promoting deep learning through practical experience.

3mo ago · bleeping-computer

Lidl disclosed a data breach affecting customers in Germany, Belgium, and the Netherlands following a cyberattack on a third-party service provider. The attackers accessed a file containing personal information such as names, phone numbers, email addresses, dates of birth, and customer numbers. While the online shop system was not compromised, Lidl cannot rule out exposure of passwords, payment details, and addresses, urging customers to remain vigilant against phishing and identity fraud.

3mo ago · hacker-news

A misconfigured server exposed three active Evilginx phishing operations targeting Microsoft 365 users, enabling attackers to bypass MFA through proxy-based login interception and abuse of Microsoft's legitimate device code flow. The operations, attributed to threat actors codemado, mail-argenta, and saroula01, leveraged custom forks of open-source Evilginx hosted on public GitHub repositories. One campaign used AI-assisted development, and all three harvested corporate credentials, with sessions maintained via long-lived cookies and token refresh mechanisms. The incident highlights the growing accessibility of phishing-as-a-service and the need for robust Conditional Access policies.

3mo ago · bleeping-computer

Cybersecurity agencies from the US and allied nations have issued a joint advisory warning of Russian state-sponsored hackers, attributed to FSB Center 16, targeting critical infrastructure by exploiting misconfigured routers and known vulnerabilities. The threat actor scans for devices using default SNMP credentials and exploits CVE-2018-0171 in Cisco Smart Install to gain control of network devices. Sectors at risk include energy, healthcare, defense, and government services. The advisory emphasizes mitigation steps such as disabling vulnerable features, upgrading to SNMPv3, and blocking unauthorized protocols at firewalls.

3mo ago · bleeping-computer

The European Union and the United Kingdom have jointly imposed sanctions on Russian individuals and entities linked to state-sponsored cyberattacks. The targeted groups include GRU officers, FSB-affiliated hackers such as the Turla group, and cybercriminals involved in operations like the Lumma Stealer malware. These actors are accused of conducting cyberespionage, targeting critical infrastructure across Europe, and supporting disinformation campaigns. The sanctions follow a series of attacks on energy grids and government institutions, including failed attempts to disrupt Poland's power infrastructure.

3mo ago · hacker-news

The U.S. CISA has added two critical vulnerabilities in Joomla extensions iCagenda and Balbooa Forms to its Known Exploited Vulnerabilities catalog due to active zero-day exploitation. CVE-2026-48939 and CVE-2026-56291, both rated 10.0 CVSS, allow unauthenticated remote code execution via arbitrary file upload. These flaws are being exploited in automated attacks to deploy web shells on vulnerable Joomla sites. Australia's ACSC has also warned of a global campaign exploiting similar CMS vulnerabilities.

3mo ago · bleeping-computer

OpenAI temporarily relaxed usage limits for its GPT-5.6 Sol model due to high demand, removing the five-hour usage restriction for Plus, Pro, and Business plans and resetting usage counters. The change allows users to perform more coding and agentic tasks without hitting previous limits. OpenAI also improved model efficiency, likely by reducing token consumption, to extend available usage.

3mo ago · bleeping-computer

Anthropic has extended access to its Claude Fable 5 model for paid subscribers until July 19, 2026, allowing continued use within weekly subscription limits. The extension applies to Pro, Max, Team, and premium Enterprise plans, with no changes required to activate the benefit. Fable 5 consumes usage limits faster than other models, and once the 50% weekly allowance is exhausted, users must either switch models or use paid credits. This is not a security-related threat event but a product update.

3mo ago · bleeping-computer

The RedHook Android malware has evolved to leverage Wireless ADB for shell-level access without requiring device rooting. By tricking users into enabling Accessibility permissions, the malware enables Developer Options and Wireless Debugging, then pairs with the device's ADB service via loopback to gain elevated privileges. It uses the legitimate Shizuku framework to execute privileged commands, enabling screen streaming, keystroke logging, app manipulation, and persistence through multiple mechanisms, all while evading detection by mimicking legitimate system behavior.

3mo ago · hacker-news

Cyber espionage campaigns targeting Pakistani law enforcement agencies, including the Balochistan Police, have been conducted by suspected China- and India-aligned threat actors between February 2024 and April 2026. The attackers exploited web applications such as the Complaint Management System to deploy custom malware, including PlugX, ShadowPad, Cobalt Strike, and Remcos RAT. These operations targeted sensitive data including biometric records, criminal files, and personnel information, with infrastructure overlaps linking some activity to known threat groups like Mysterious Elephant. The compromise of public-facing portals extended the attack surface to both law enforcement and citizens.

3mo ago · hacker-news

A malicious version (8.14.0) of the jscrambler npm package was published with a preinstall hook that drops a cross-platform Rust infostealer. The payload targets developers by stealing cloud credentials, cryptocurrency wallets, password manager data, and API keys from AI coding tools. It establishes persistence and communicates with attacker-controlled infrastructure, including hard-coded IP addresses and Tor. The compromised version remains on npm, posing ongoing risk to systems using outdated clients that automatically execute install scripts.

3mo ago · socket-dev

The jscrambler npm package was compromised in a supply chain attack via the release of version 8.14.0 on July 11, 2026. This malicious version introduced an undocumented preinstall hook that executes dist/setup.js, which in turn runs hidden native binaries for Windows, macOS, and Linux. These binaries are embedded in an obfuscated CSI container and are automatically executed during installation, posing a risk to developer environments, CI systems, and build pipelines without requiring any explicit use of the package.

3mo ago · step-security

On July 11, 2026, a malicious version (8.14.0) of the jscrambler npm package was published, containing a preinstall hook that drops and executes a platform-specific native binary on Linux, Windows, and macOS. The payload, hidden inside a file named dist/intro.js with a custom magic header, is a Rust-compiled binary designed to steal browser credentials and cryptocurrency wallet data. The attack leverages kernel-level capabilities on Linux via eBPF, anti-analysis techniques on Windows and macOS, and communicates with known malicious domains and IPs. The compromised package represents a high-impact supply chain attack targeting development and CI/CD environments.

3mo ago · bleeping-computer

The Australian Cyber Security Centre (ACSC) has issued a warning about a global campaign targeting vulnerabilities in content management systems (CMS) and plugins, affecting numerous small- to medium-sized businesses in Australia. Threat actors are actively scanning for exposed CMS platforms and deploying webshells to gain persistent access, enabling credential theft, service disruption, and lateral movement. The campaign exploits known vulnerabilities across multiple CMS platforms including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE, with potential AI assistance to accelerate exploitation.

3mo ago · hacker-news

A critical stored cross-site scripting (XSS) vulnerability in Zimbra's Classic Web Client could allow attackers to execute malicious scripts in user sessions via specially crafted emails. If exploited, the flaw could enable access to mailbox data, session information, and account settings. While Zimbra has not confirmed active exploitation, similar XSS flaws in Zimbra have been historically targeted. Users are advised to update to Zimbra Collaboration Suite version 10.1.19 for protection.

3mo ago · bleeping-computer

The 'Ghostcommit' attack exploits a review gap in AI code review systems by hiding malicious prompt injection instructions within a PNG image referenced in a pull request. The image contains text instructing the AI agent to read and exfiltrate environment variables (.env) by encoding them as integers in a seemingly benign module constant. Since reviewers and automated tools typically do not inspect image content, the malicious payload bypasses detection and is later executed by AI coding agents, leading to secret exfiltration.

3mo ago · unit42

The Gentlemen, also known as Storm-2697, is a Ransomware-as-a-Service (RaaS) operation active since July 2025, believed to have evolved from the Qilin RaaS affiliate ArmCorp. They offer affiliates an unusually high 90% ransom payout, contributing to rapid growth, with over 580 victims claimed across 77 countries by mid-2026. The group uses diverse initial access methods, custom tools like the 'GentleKiller' EDR killer, and exploits vulnerabilities in edge devices and protocols to target enterprises, particularly in manufacturing.

3mo ago · bleeping-computer

Six vulnerabilities in the U-Boot bootloader have been discovered, potentially allowing attackers to execute arbitrary code or crash devices during the boot process. These flaws affect the FIT signature verification functionality and could enable stealthy, persistent firmware-level attacks on embedded systems. Exploitation may not require physical access, especially on systems supporting remote firmware updates like BMCs. The vulnerabilities impact over 50 U-Boot releases and downstream vendor implementations, with older devices potentially remaining unpatched.

3mo ago · hacker-news

Researchers at Ledger's Donjon security team demonstrated a laser fault injection attack that can reset the password on Tangem crypto wallet cards without requiring the original password or a backup card. The attack requires physical access to the card and sophisticated, expensive equipment, making it impractical for widespread use. However, because Tangem cards lack firmware update capability, the vulnerability cannot be patched, leaving all existing cards permanently exposed. The risk is highest for lost or stolen cards containing significant cryptocurrency value.

3mo ago · hacker-news

Progress Software has instructed ShareFile customers to immediately shut down their Storage Zone Controllers due to a credible external security threat. The affected component is the self-hosted Storage Zone Controller, which is internet-facing and thus exposed to potential exploitation. While Progress states there is no evidence of unauthorized access to accounts or data, it has not disclosed the nature of the threat or the responsible actor. The lack of a patch and the directive to fully power down systems suggest a critical, unpatched vulnerability or potential compromise of credentials or internal systems.