Intelligence Feed

3mo ago · hacker-news

A threat actor tracked as O-UNC-066 is conducting vishing attacks to trick Microsoft 365 users into enrolling attacker-controlled passkeys through a phishing kit that mimics the legitimate Microsoft Entra passkey enrollment process. The attackers register domains with 'passkey' in the name and use voice calls to socially engineer victims into following a fake enrollment flow, ultimately granting unauthorized access to their accounts. The phishing kit is operator-controlled and adapts in real time to the victim's MFA method, allowing the attacker to capture credentials and approve passkey registration. This campaign targets multiple industries and abuses Microsoft's passkey adoption initiative as a social engineering lure.

3mo ago · hacker-news

Researchers at Binarly discovered six vulnerabilities in U-Boot, a widely used bootloader for embedded devices, which could allow attackers to crash devices or execute arbitrary code during the boot process. Two of the flaws enable memory corruption that could lead to code execution before OS loading, undermining the device's chain of trust. The vulnerabilities affect U-Boot versions since v2013.07 and are present in numerous vendor firmwares, though no active exploitation has been reported. Fixes have been merged upstream but are not yet available in a stable release, with the next version expected in October.

3mo ago · hacker-news

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and published a malicious npm package, @injectivelabs/sdk-ts@1.20.21, designed to steal cryptocurrency wallet private keys and mnemonic phrases. The malware was distributed through 17 additional scoped npm packages, increasing its reach to transitive users. The malicious code evaded detection by avoiding lifecycle scripts and exfiltrated sensitive data via HTTPS POST requests to a remote server.

3mo ago · bleeping-computer

Rossen G. Iossifov, a Bulgarian national serving prison time for operating a cryptocurrency exchange used to launder funds from online fraud, is accused of orchestrating the theft of $290,000 in government-seized cryptocurrency while incarcerated. He allegedly conspired with others to move the funds through multiple exchanges and mixing services to evade law enforcement. Iossifov previously operated RG Coins, a Bulgaria-based exchange that facilitated money laundering for a fraud ring targeting American victims via fake online listings.

3mo ago · bleeping-computer

Hackers are actively exploiting a critical authentication bypass vulnerability, CVE-2026-20896, in the official Gitea Docker image. The flaw allows unauthenticated attackers to impersonate any user, including administrators, by spoofing the X-WEBAUTH-USER header when reverse proxy settings are misconfigured. The vulnerability affects Gitea Docker images up to version 1.26.2 in default configurations, and exploitation has already been observed in the wild. Singapore’s Cybersecurity Agency (CSA) has issued a warning, urging users to upgrade to patched versions 1.26.3 or 1.26.4.

3mo ago · bleeping-computer

Progress Software has issued an urgent warning to ShareFile customers using on-premises Storage Zone Controllers, advising them to immediately shut down their servers due to a 'credible external security threat.' The threat targets Internet-accessible Storage Zone Controllers used in hybrid deployments, which manage file transfers between ShareFile's cloud and customer-owned storage. While no unauthorized access has been confirmed, Progress has temporarily disabled access as a precaution and is investigating with cybersecurity experts. The situation bears similarities to past attacks on enterprise file transfer platforms like the 2023 MOVEit breach.

3mo ago · bleeping-computer

The Dutch National Police suspect that Dutch hackers were involved in a February 2026 data breach at telecommunications provider Odido. A Dutch-speaking individual impersonated an IT employee in a phone call prior to the attack, enabling the threat actors to conduct phishing and steal personal data of up to 6.2 million customers. The ShinyHunters extortion gang claimed responsibility, publishing an 88GB archive with over 15 million records, continuing their pattern of targeting large organizations through social engineering and SSO compromises.

3mo ago · bleeping-computer

Karen Serobovich Vardanyan, a 34-year-old Armenian national, has pleaded guilty to providing initial access to corporate networks for the Ryuk ransomware operation between November 2019 and April 2020. He facilitated attacks on multiple U.S. organizations, including a Michigan company, a technology firm in Oregon, and a school in Texas, leading to approximately $15 million in ransom payments. Vardanyan was extradited from Kyiv and faces up to 15 years in prison, with sentencing scheduled for September 2026.

3mo ago · hacker-news

A study of 281 free Android VPN apps found widespread security and privacy issues, including traffic leaks, unencrypted data transmission, and tracking behaviors. Many apps failed to properly encrypt traffic, with five apps vulnerable to tunnel hijacking due to unencrypted configuration downloads. The research highlights poor maintenance, weak encryption practices, and misleading trust signals like Google's 'Verified' badge, undermining user privacy expectations.

3mo ago · hacker-news

A cybercrime group operating under the name WP-SHELLSTORM left a server exposed for 22 days, revealing their infrastructure and tools used to backdoor over 5,700 WordPress and Joomla sites. The group exploited known vulnerabilities in plugins like Breeze (CVE-2026-3844) and Joomla JCE (CVE-2026-48907), deploying webshells such as down.php and using the SNOWLIGHT dropper to install the VShell backdoor. The exposed server contained logs, exploit scripts, and target lists of over 1.4 million domains, highlighting a financially motivated, Chinese-speaking crew with poor operational security.

3mo ago · hacker-news

The article details how Lumen Technologies overhauled its exposure management by improving asset inventory accuracy, revealing a massive discrepancy between known and actual assets. By integrating data from over 40 systems using Axonius, they identified approximately 1.1 million devices—60 times more than initially believed. This enhanced visibility enabled faster zero-day response, improved application risk assessment, and informed strategic decisions like cloud migration and increased security investment. The case highlights the critical role of accurate asset data in effective cybersecurity and risk management.

3mo ago · hacker-news

A critical unpatched vulnerability dubbed XRING in Alibaba's XQUIC library allows remote clients to crash HTTP/3 servers using legitimate QPACK traffic. The flaw stems from an integer underflow during dynamic table resizing in QPACK, leading to out-of-bounds memory copy and server crash. The vulnerability affects all XQUIC versions up to v1.9.4 and impacts servers using HTTP/3 with default QPACK settings, including those behind Alibaba's Tengine web server. No patch or CVE has been assigned as of July 10, 2026.

3mo ago · hacker-news

The China-linked threat actor Silver Fox has been linked to a new Rust-based remote access trojan (RAT) named MODBEACON. This malware leverages gRPC streaming and reuses transport layers from the open-source Xray/V2Ray framework for encrypted command-and-control (C2) communications. It targets technology, education, and state-owned enterprises in Asia via counterfeit software installers distributed through SEO poisoning, enabling long-term access with capabilities including plugin loading, persistence, and data exfiltration.

3mo ago · hacker-news

Security researcher Chinmohan Nayak disclosed three high-severity vulnerabilities in the OpenClaw personal AI assistant, which together enable a 'WhatsApp-to-Host' attack chain. These flaws allow an attacker to execute arbitrary commands, bypass sandbox restrictions, and escalate privileges to achieve host-level code execution—all triggered via an external WhatsApp message. The vulnerabilities affect the host execution environment filtering and path traversal validation mechanisms, potentially exposing sensitive files like SSH keys and AWS credentials. OpenClaw has patched the issues in version 2026.6.6, urging operators to update and harden configurations.

3mo ago · bleeping-computer

Zimbra has urged customers to patch a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client, which could allow attackers to execute malicious code via specially crafted emails. The flaw affects Zimbra Collaboration Suite users and could lead to theft of session data, account settings, or mailbox contents. Although no CVE has been assigned yet, the vulnerability was reported by Google's Threat Analysis Group and is suspected to be exploited by state-backed actors, particularly Russian-linked groups.

3mo ago · bleeping-computer

The article discusses how AI agents and machine identities are outpacing traditional identity governance, creating a growing security gap. These non-human identities, such as service accounts and OAuth applications, often inherit excessive permissions and persist long after their original purpose, increasing the attack surface. A notable incident involved threat actor UNC6395 exploiting a trusted OAuth token from Salesloft's Drift integration to pivot across Salesforce, AWS, and Snowflake environments. The core issue is not new vulnerabilities, but the lack of ownership, visibility, and lifecycle management for machine identities.

3mo ago · hacker-news

Angelo Martino, a former ransomware negotiator, was sentenced to 70 months in prison for conspiring with BlackCat ransomware operators to extort victims by leaking confidential negotiation details. He collaborated with two cybersecurity professionals, Ryan Goldberg and Kevin Martin, to deploy BlackCat ransomware against multiple U.S. victims between April and November 2023. Martino betrayed clients by sharing their insurance limits and negotiation strategies, enabling higher ransom demands. The case highlights insider threats in cybersecurity and resulted in $10 million in seized assets.

3mo ago · hacker-news

Attackers have exploited a vulnerability dubbed 'Ill Bloom' in cryptocurrency wallet software that used weak randomness when generating recovery phrases, enabling them to predict and steal funds from vulnerable wallets. A coordinated attack on May 27 drained approximately $3.1 million from 431 wallets, primarily affecting older or lesser-known mobile wallets created as far back as 2018. The flaw does not impact hardware wallets or most mainstream software wallets, but users are urged to check their addresses on illbloom.org and migrate funds if their wallet is flagged as exposed.

3mo ago · bleeping-computer

A former ransomware negotiator, Angelo Martino, was sentenced to 70 months in prison for participating in BlackCat (ALPHV) ransomware attacks between April 2023 and April 2025. Alongside accomplices Kevin Tyler Martin and Ryan Clifford Goldberg, Martino targeted at least five U.S. organizations, leveraging insider knowledge of victims' insurance limits to maximize ransom demands. The attackers operated as BlackCat affiliates, paying 20% of ransom proceeds to the core group while extorting tens of millions from victims in financial services, healthcare, and education sectors.

3mo ago · bleeping-computer

The OpenMandriva Linux project faced an internal sabotage attempt allegedly carried out by Davide Beatrici, a developer associated with the Mumble project, following a dispute over project direction and contributor behavior. Beatrici deleted repositories and pushed an empty package to the Cooker repository, targeting the Gnome and Cosmic desktop environments. Although he denied malicious intent, claiming his actions were in response to disagreements over project governance, the OpenMandriva team is restoring affected systems and conducting a security audit. Legal action has been waived by the project despite the severity of the incident.

3mo ago · socket-dev

A malicious NuGet package named 'Braintree.Net' has been identified as a typosquatting campaign targeting developers using the legitimate Braintree payment SDK. The package intercepts live credit card data, steals merchant API credentials, and harvests environment secrets through a multi-stage .NET implant. It exfiltrates sensitive data to attacker-controlled domains and uses obfuscated C2 communications, particularly in companion dependencies like DependencyInjector.Core. The threat relies on production-only gating to avoid detection during development and testing.

3mo ago · talos

Cisco Talos identified multiple vulnerabilities in WolfSSL, GeoVision, and VTK-DICOM software. The vulnerabilities include improper input validation, integer underflow, memory corruption, OS command injection, buffer overflows, privilege escalation, XSS, and encryption weaknesses. These issues have been patched by the vendors, and Snort rules are available to detect potential exploitation attempts.

3mo ago · hacker-news

Microsoft has analyzed a destructive Windows backdoor named GigaWiper, which combines disk-wiping, fake ransomware, and spyware capabilities. The malware, written in Go, allows operators to choose from multiple destructive payloads, including full disk wiping, overwriting the Windows drive, and fake encryption with no decryption key. It also includes surveillance features such as screen recording, VNC streaming, and system reconnaissance. The same malware was independently identified as BLUERABBIT by Binary Defense and is linked to an Iran-nexus group targeting Israeli organizations, with ties to prior threats like Crucio and FlockWiper.

3mo ago · hacker-news

Multiple overlapping campaigns are actively enumerating corporate GitHub organizations, repositories, and user accounts using automated scraping tools and compromised or dormant GitHub accounts. Attackers leverage old 'ghost' accounts and exposed personal access tokens (PATs) to blend in with legitimate traffic and avoid detection while conducting reconnaissance. The activity includes querying public endpoints to map organizational structures and, in some cases, cloning private repositories. This behavior enables threat actors to gather intelligence for potential supply chain attacks.

3mo ago · bleeping-computer

Hackers compromised a contributor's GitHub account for the Injective Labs SDK project and published a malicious version (1.20.21) of the @injectivelabs/sdk-ts npm package. This supply-chain attack targeted developers building cryptocurrency-related applications, stealing wallet private keys and mnemonic seed phrases when SDK functions were used. The stolen data was exfiltrated via HTTP POST to a legitimate Injective Labs endpoint to blend in with normal traffic. The malicious package was downloaded 310 times before being deprecated, and 17 associated packages were also compromised.

3mo ago · wiz

The 2026 Verizon DBIR highlights that attackers are exploiting known vulnerabilities and trusted relationships at increasing speed and scale, with vulnerability exploitation now the leading initial access vector in 31% of breaches. Cloud environments are particularly at risk, as 40% of cloud intrusions begin with weaponized vulnerabilities. Attackers are leveraging AI to accelerate reconnaissance, exploit development, and post-compromise automation, while supply chain compromises and identity abuse further expand the attack surface.

3mo ago · wiz

The article describes how Wiz's Product Security (ProdSec) team leverages the Wiz platform to secure cloud environments through integrated threat detection, CI/CD security controls, and proactive threat modeling. The team employs Wiz CLI scanning, custom Cloud Configuration Rules (CCRs), and automated threat detection using the Wiz Blue Agent to identify and respond to risks in real time. Emphasis is placed on shifting security left into development workflows, contextualizing alerts for specialized infrastructure, and pressure-testing security tooling using AI-powered attack simulations like Red Agent.

3mo ago · step-security

On July 8, 2026, attackers compromised a trusted developer's account to inject a backdoor into the @injectivelabs/sdk-ts npm package, a core SDK for the Injective blockchain. The malicious code captured cryptocurrency wallet recovery phrases and private keys during wallet creation or loading and exfiltrated them to an attacker-controlled server disguised as legitimate infrastructure. The backdoor was distributed across 18 related npm packages for less than an hour before being detected and reverted, posing a significant risk to any application that installed the tainted versions during that window.

3mo ago · talos

Cisco Talos has identified activity from the China-nexus threat actor UAT-7810, which is expanding its Operational Relay Box (ORB) networks using custom malware to exploit vulnerabilities in unpatched Ruckus and ASUS routers. The group has deployed updated backdoors, including LONGLEASH and DOGLEASH, to create covert proxy infrastructure used by other APT groups. This infrastructure enables threat actors to mask their origins and bypass traditional defenses by routing traffic through compromised edge devices.

3mo ago · hacker-news

This week's threat landscape highlights a range of cyber activities, from cloud bucket hijacking and ransomware tooling overlaps to social engineering campaigns and supply chain attacks. Notable incidents include a global fraud operation resulting in nearly 6,000 arrests, typosquatting of payment SDKs on npm and PyPI, and the abuse of Microsoft Teams for delivering EtherRAT. Additionally, new techniques like Process Parameter Poisoning and ADFS token forgery underscore evolving evasion and privilege escalation methods.