Intelligence Feed

3mo ago · hacker-news

Account takeover (ATO) attacks are shifting from traditional credential stuffing to targeting identity verification and recovery processes, as stronger authentication like passkeys reduces the value of stolen passwords. Attackers now exploit weak points in magic-link flows, SIM swaps, and use generative AI to conduct sophisticated impersonation fraud with deepfakes and synthetic documents. Defenders must adopt biometric liveness detection, intent binding, and network-scale fraud pattern analysis to counter these evolving tactics.

3mo ago · hacker-news

A vulnerability in GitHub's commit verification system allows attackers to rewrite signed Git commits into new hashes without breaking their signatures, resulting in multiple valid hashes for the same content. This undermines trust in commit hashes as unique identifiers, enabling potential bypasses of blocklists and provenance systems that rely on them. The issue stems from signature malleability in GPG and S/MIME schemes, which GitHub does not normalize before verification.

3mo ago · hacker-news

A threat actor dubbed REF6045 is targeting Mexican banking and financial users through a malware toolkit named SCMBANKER, delivered via fake CAPTCHA lures. The attack uses social engineering to trick victims into executing a malicious command, leading to the installation of PowerShell-based malware that enables session monitoring, clipboard hijacking, browser redirection, and remote access. The operation shows signs of AI-assisted development, with poor operational security enabling researchers to recover infrastructure details. Victims are actively monitored and targeted based on financial activity, indicating ongoing live attacks.

3mo ago · hacker-news

A new 'ghost phishing' campaign dubbed EvilTokens is targeting businesses in the US and Europe, leveraging encrypted HTML content that remains hidden until decrypted in the browser. This technique bypasses traditional email and URL security checks, enabling Microsoft 365 account takeover via legitimate Microsoft login flows without directly stealing passwords. The attack exploits browser-level decryption to reveal phishing content post-load, making detection more difficult and increasing the risk of unauthorized access to sensitive data and cloud services.

3mo ago · bleeping-computer

Japanese telecommunications company KDDI disclosed a data breach affecting over 12 million users, resulting from an attack on May 16 that exploited a zero-day vulnerability in third-party software used by multiple ISPs. The breach exposed email addresses and passwords, with some credentials stored in hashed or encrypted form. KDDI detected and blocked the attackers on June 17, implemented EDR solutions, and is enforcing password resets for affected accounts.

3mo ago · bleeping-computer

DuckDuckGo has introduced a new feature in its browser that blocks YouTube video ads by leveraging community-maintained filter lists from uBlock Origin and its own compatibility rules. The feature is enabled by default on iOS, Mac, and Windows, while Android users can enable it manually. This functionality enhances user experience by reducing ad interruptions without requiring third-party extensions, aligning DuckDuckGo with browsers like Brave and Opera.

3mo ago · bleeping-computer

AI is increasingly being leveraged by threat actors to enhance service desk attacks through more convincing impersonation, accelerated reconnaissance, and scalable social engineering. These attacks exploit the urgency and trust inherent in service desk operations, particularly during employee onboarding, to gain unauthorized access. Attackers use AI to generate realistic communication, personalize phishing attempts, and bypass traditional identity verification methods, making detection more difficult for security teams.

3mo ago · socket-dev

The pnpm 11.10 release introduces security enhancements to prevent registry token redirection attacks in the npm ecosystem. A new _auth configuration ensures registry credentials are bound to their intended registry URL, preventing malicious project files from redirecting valid tokens to attacker-controlled hosts. This update mitigates supply chain risks by limiting the privileges of repository-controlled files and hardening authentication mechanisms.

3mo ago · hacker-news

China-linked threat actor UAT-7810 is expanding its Operational Relay Box (ORB) network by deploying updated malware variants such as LONGLEASH, DOGLEASH, and JARLEASH. The group targets internet-facing networking devices, including Ruckus and ASUS routers, leveraging known vulnerabilities to establish persistent access. These relay nodes are used to support secondary threat actors like UAT-5918 in conducting cyber attacks against high-value targets, particularly in critical infrastructure sectors. The continued development and testing of malware on MIPS-based platforms indicate ongoing refinement of their capabilities.

3mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to patch a critical vulnerability, CVE-2026-48282, in Adobe ColdFusion by a strict deadline due to active exploitation in the wild. The flaw allows unauthenticated remote attackers to achieve code execution on unpatched systems with low attack complexity. Adobe released patches one week prior and warned of high exploitation risk, with evidence of attacks emerging within hours of disclosure.

3mo ago · bleeping-computer

Ubiquiti has disclosed and patched seven critical vulnerabilities in its UniFi OS platform, including a maximum-severity command injection flaw tracked as CVE-2026-50746 in the UniFi Connect Application. The vulnerabilities, affecting various UniFi products such as UniFi Talk, Access, and Protect, allow for low-complexity attacks without user interaction and could enable remote command execution. Internet-exposed UniFi OS instances remain a concern, with over 100,000 instances detected online, making them attractive targets for state-sponsored and cybercriminal groups. Previous incidents have shown exploitation of similar flaws to build botnets for cyberespionage and malicious traffic proxying.

3mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to urgently patch CVE-2026-55255, an authentication bypass vulnerability in the Langflow AI development platform. This flaw allows authenticated attackers to access other users' workflows by manipulating the /api/v1/responses endpoint with a victim's flow_id, enabling data theft and resource abuse. Exploitation in the wild has been observed since June 25, with attackers pursuing financial gain through compute resource hijacking and credential theft. CISA has also added related Langflow vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2025-3248 and CVE-2026-33017, exploited by ransomware actors.

3mo ago · hacker-news

CISA has added four actively exploited vulnerabilities in Adobe ColdFusion, Joomla Page Builder, and Langflow to its Known Exploited Vulnerabilities (KEV) catalog. Exploitation of these flaws, including path traversal and improper access control, has been observed in the wild, leading to remote code execution and unauthorized access. Attackers have deployed web shells and targeted AI orchestration platforms to steal credentials, with activity linked to opportunistic, financially motivated campaigns. Federal agencies are urged to patch by July 10, 2026.

3mo ago · hacker-news

GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel vulnerability that enables local users to escalate privileges to root and escape containers, affecting most Linux distributions since 2011. The flaw stems from a use-after-free condition in kernel threading code, allowing reliable exploitation without special permissions or network access. Although no in-the-wild exploitation has been reported, a public exploit has been released, increasing the risk. The vulnerability is particularly dangerous when chained with remote entry vectors like browser exploits, such as the Firefox flaw CVE-2026-10702.

3mo ago · step-security

Recent attacks like Sha1-Hulud and Megalodon have used public GitHub repositories to exfiltrate stolen credentials, leveraging random UUID-named repositories for rapid distribution. GitHub's new public monitoring feature helps detect such leaks by scanning public content across github.com, including repositories not owned by the enterprise. However, this detection occurs post-exposure and does not cover secrets exfiltrated to external attacker-controlled infrastructure or exposed through CI/CD logs. A layered defense combining detection and runtime egress control is recommended to prevent real-time exfiltration.

3mo ago · unit42

In April 2026, a financially motivated campaign distributed the Vidar stealer and XMRig cryptocurrency miner via malvertising, targeting users searching for cracked software. The attackers used password-protected archives with fake code signing certificates to evade detection and deliver payloads. The malware employed file inflation, DLL sideloading, and AMSI bypass techniques to avoid sandbox analysis and security controls. Victims were primarily located in the U.S. and EU, with data exfiltrated to C2 servers and Monero mining initiated through a configured pool.

3mo ago · hacker-news

A critical vulnerability dubbed 'Rogue Agent' in Google Dialogflow CX allowed attackers with edit permissions to compromise other agents within the same Google Cloud project. The flaw stemmed from a shared, writable runtime environment where a malicious Code Block could overwrite a critical execution file, enabling data theft, phishing, and message manipulation across all agents. Although Google has patched the issue and no exploitation was observed, the attack could bypass logging and security perimeters due to insufficient isolation and excessive network access.

3mo ago · bleeping-computer

Accenture confirmed a security breach after a threat actor named '888' claimed responsibility for stealing over 35 GB of data, including source code, authentication keys, and configuration files. The actor posted a screenshot showing access to an Azure DevOps repository hosted under a redacted accenture.com subdomain and offered the data for sale on a cybercrime forum. Accenture stated the issue was isolated and remediated with no impact on operations, but did not confirm the scope or method of the breach.

3mo ago · socket-dev

A coordinated campaign across npm and PyPI registries has been identified, distributing 17 malicious packages that typosquat popular payment SDKs such as PaySafe, Skrill, and Neteller. The packages mimic legitimate SDKs to harvest environment variables containing sensitive data like API keys, tokens, and credentials. The stolen data is exfiltrated to an AWS-hosted C2 server using ngrok infrastructure, with anti-sandboxing and obfuscation techniques employed to evade detection.

3mo ago · hacker-news

RedWing is a new Android malware-as-a-service (MaaS) operation rented via Telegram, enabling low-skilled attackers to conduct bank fraud. It delivers ready-made payloads that bypass security tools and use phishing links to trick users into installing malicious apps from unofficial sources. The malware abuses Android Accessibility services to steal banking credentials, intercept one-time codes, and enable real-time remote control of infected devices. It primarily targets Russian financial institutions and operates through custom-built droppers with dynamically configurable overlay attacks.

3mo ago · bleeping-computer

A hidden authentication backdoor in multiple Tenda router firmware versions allows attackers to gain full administrative access to the device's web interface by using an undocumented password comparison mechanism. The vulnerability, tracked as CVE-2026-11405, is located in the '/bin/httpd' binary and remains unpatched as the vendor could not be reached. Successful exploitation enables attackers to reconfigure the device, alter network settings, and disable security features, posing significant risk to the local network.

3mo ago · bleeping-computer

Chinese threat actor UAT-7810 is expanding its Operational Relay Box (ORB) network by deploying updated and new malware variants, including LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST. These tools are used to compromise internet-facing networking devices, primarily unpatched Ruckus and ASUS routers, leveraging known vulnerabilities. The ORB infrastructure enables other China-aligned APTs to proxy traffic through compromised regional devices to evade detection and hinder attribution.

3mo ago · hacker-news

A critical session isolation vulnerability in Writer, an enterprise AI platform, dubbed WriteOut, allowed attackers to hijack user accounts across tenants by exploiting the live preview feature. By tricking a logged-in user into clicking a malicious preview link, attackers could steal session cookies and gain full access to the victim's account, including sensitive data and administrative privileges. The vulnerability bypassed input filters by fetching and executing remote malicious scripts within a sandboxed environment.

3mo ago · hacker-news

U.S. prosecutors have linked 19-year-old Peter Stokes, allegedly part of the Scattered Spider hacking group, to a May 2025 breach of a luxury jewelry retailer. The attackers used social engineering to manipulate the IT help desk into resetting passwords and bypassing multifactor authentication, then deployed tunneling tools like ngrok and Teleport to exfiltrate over 77 GB of data. Despite ransomware deployment being blocked, the attackers demanded $8 million in cryptocurrency. The FBI traced Stokes via a persistent Windows device ID tied to Microsoft account activity and correlated IP addresses from his online accounts.

3mo ago · hacker-news

Researchers at Noma Security discovered a technique called GitLost that exploits indirect prompt injection to manipulate GitHub Agentic Workflows into leaking private repository data. The attack involves a malicious public GitHub issue that tricks an AI agent with read access into pulling and publicly commenting sensitive contents from private repositories. This highlights an architectural risk in AI agents that combine access to private data, untrusted input, and public output channels, creating a data exfiltration path without requiring stolen credentials or direct access.

3mo ago · hacker-news

A phishing campaign leveraging Microsoft's device-code flow has been observed targeting Microsoft 365 accounts using collaboration-themed lures. The attack abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass MFA, tricking users into authorizing an attacker-controlled session. The campaign, linked to reusable tooling called DEBULL, shares tactics with Storm-2372 and is part of a growing trend in phishing-as-a-service (PhaaS) platforms like EvilTokens and ARToken that enable account takeover and business email compromise.

3mo ago · bleeping-computer

In June 2026, researchers at Novee Security identified a critical CI/CD vulnerability pattern named Cordyceps affecting widely used open-source projects, including those from Microsoft, Google, and Apache. The issue stems from the composition of GitHub Actions workflows that misuse privileged triggers like pull_request_target and workflow_run, enabling attackers to execute code in trusted contexts via pull requests. Despite passing all standard security checks, these pipelines allowed potential theft of long-lived credentials and persistent access to critical systems, highlighting a systemic gap in supply chain governance.

3mo ago · bleeping-computer

Spanish authorities have arrested a man suspected of being an active member of the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest. He allegedly provided logistical and operational support to a Ukrainian hacker within CARR and facilitated escape routes to Russia. The groups have been linked to attacks on critical infrastructure in the U.S. and Europe, including SCADA systems, and are loosely associated with the Russian state-backed APT44 (Sandworm). The suspect also participated in operations attributed to the hacktivist group NoName057(16), which promotes pro-Russian and anti-Western narratives.

3mo ago · talos

UAT-7810, a China-nexus advanced persistent threat (APT) actor, continues to expand its Operational Relay Box (ORB) networks by deploying new malware variants including LONGLEASH, DOGLEASH, and JARLEASH. The group exploits known vulnerabilities in Ruckus and ASUS routers to compromise devices and establish backdoors. These backdoors enable remote command execution, file management, and network tunneling, supporting further exploitation by secondary threat actors. Cisco Talos has identified new infrastructure and malware samples associated with ongoing campaigns.

3mo ago · hacker-news

The integration of AI into software development pipelines has significantly expanded the software supply chain attack surface. AI coding assistants, autonomous agents, and model context protocols (MCP) introduce new risks, such as malicious dependency suggestions, poisoned tool descriptions, and prompt injection attacks. Traditional security scanning is insufficient as threats now originate from models, agents, and their configurations, not just code artifacts.