Intelligence Feed

2w ago · hacker-news

The U.S. Department of Justice has charged 14 individuals and dismantled over 40 laptop farms linked to a North Korean IT worker fraud scheme known as Famous Chollima, purpledelta, and Wagemole. The operation involved North Korean IT workers using fake identities to obtain remote jobs at more than 70 U.S. companies, funneling salaries back to the DPRK to fund its nuclear and military programs. Facilitators in the U.S., including two arrested nationals, hosted company-issued laptops and laundered funds, while the threat actors used social engineering, identity theft, and laptop redirection tactics to evade detection. The FBI warns of escalating tactics, including subcontracting work to freelancers in South Asia and West Africa, and using threats of violence to coerce cooperation.

2w ago · hacker-news

Cisco has confirmed active exploitation of a critical vulnerability, CVE-2026-76519, in its Secure Email Gateway appliances. The flaw allows an unauthenticated attacker to write files to the operating system and potentially execute commands as root by sending a maliciously crafted email attachment. The vulnerability affects systems with the File Reputation service enabled and running a vulnerable version of the Content Scanner Tools package (prior to 25.3.0.5525). Cisco has released fixes via both AsyncOS updates and a standalone Content Scanner Tools update, and advises immediate remediation due to active attacks.

2w ago · bleeping-computer

Hirudo is a new Android malware that targets banking applications by replacing legitimate apps with malicious, modified versions to bypass security checks such as app-signature verification, Accessibility service detection, and Google Play Integrity. The malware is distributed through seemingly legitimate third-party apps for shopping, adult content, and short dramas, which act as loaders and prompt users to grant Accessibility permissions. Once installed, Hirudo can steal banking credentials, payment PINs, SMS messages, and device unlock secrets, while also enabling real-time remote control, screen streaming, audio recording, and camera access. The malware has primarily targeted banks in Indonesia but also affects financial institutions in China, India, Mexico, Morocco, and Thailand.

2w ago · bleeping-computer

Ledger discovered hardware implants in cryptocurrency wallets sold by reseller CryptoBilis, which were modified to steal 24-word recovery phrases and transmit them via LTE using a provisioned eSIM. The implant operates as a separate component that does not alter the Secure Element or Ledger OS, making it undetectable by Ledger's self-checks. Ledger has instructed resellers across Southeast Asia and Hong Kong to halt sales while investigations continue, and users have reported compromised devices from other retailers including Metapod and MediaMarkt.

2w ago · bleeping-computer

The U.S. Department of Justice disrupted operations of the North Korean threat group Famous Chollima (also known as WageMole), arresting two U.S. nationals and charging 14 individuals in connection with a scheme involving remote IT worker fraud. The group used stolen or fabricated identities to obtain technology jobs at U.S. companies, remotely accessed company-issued laptops hosted in 'laptop farms' in Texas, and laundered approximately $3 million to North Korea. The FBI operation, codenamed 'Lonestar Roundup,' seized 187 laptops and KVM devices used in the scheme, which ran from 2019 to July 2025 and impacted around 70 organizations.

2w ago · hacker-news

A critical vulnerability in the Linux kernel's vhost subsystem, tracked as CVE-2026-74580 and named Vghost, allows local unprivileged users to achieve root privilege escalation by exploiting a flaw in memory mapping validation. The vulnerability also enables a virtual machine guest to break out to the host by writing to the host's memory via a QEMU process hijack when specific virtualization configurations are used. The bug existed due to a cache inconsistency introduced across two code changes in 2017 and 2020, affecting kernels from version 4.11 to 7.2-rc4. Tencent Zhuque Lab discovered the flaw using an AI-assisted research pipeline called Corvus AI and released a fix in August 2026, with a public write-up and working demos provided in October.

2w ago · hacker-news

Hirudo is a new Android banking trojan that replaces legitimate banking apps with tampered versions to bypass built-in security checks. The malware is distributed via dropper apps disguised as shopping, adult video, and entertainment apps, which prompt fake in-app updates to install the payload. It enables on-device credential theft, remote control, screen and camera capture, and SMS theft by leveraging accessibility services and bypassing Play Protect using a non-functional VPN. The trojan specifically targets eight Indonesian banking apps but also has credential harvesting capabilities for users in China, India, Mexico, Morocco, and Thailand.

2w ago · hacker-news

Researchers at XBOW leveraged OpenAI's GPT-5.6 Sol model to rapidly develop a full-chain Chrome exploit within six days, chaining three previously unknown vulnerabilities to achieve remote code execution on Windows without user interaction. The exploit bypassed Chrome's dual sandbox layers by exploiting flaws in V8, the animated WebP decoder, and Crashpad. Google has since patched all three vulnerabilities and awarded XBOW a $250,000 bug bounty. The demonstration highlights a significant reduction in the time and resources required to develop sophisticated browser exploits, raising concerns about future offensive capabilities.

2w ago · hacker-news

A high-severity use-after-free vulnerability in curl and libcurl, tracked as CVE-2026-92392, allows a malicious HTTP/2 server to achieve client-side code execution during file uploads under specific conditions. The flaw affects versions 8.12.0 through 8.22.0 and was patched in version 8.23.0. Successful exploitation requires precise knowledge of the client's build, architecture, and memory layout, making reliable code execution difficult; crashes are more likely than full compromise. The vulnerability was discovered via Anthropic's OSS Scanner and reported through HackerOne by researcher Luna Tong.

2w ago · hacker-news

CISA has urged immediate updates to Ivanti Connect Secure (ICS) appliances due to active exploitation of a critical authentication bypass vulnerability, CVE-2026-104935, which allows unauthenticated remote code execution. The flaw affects multiple ICS versions and is being exploited in the wild, with honeypots detecting 105 exploit attempts originating from 50 unique IP addresses. Threat actor UTA0576 has been observed leveraging the vulnerability in conjunction with a privilege escalation flaw to achieve root-level access, conduct credential theft, exfiltrate Active Directory metadata, and deploy tools for Kerberoast attacks and LDAP reconnaissance.

2w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned organizations to immediately patch a critical authentication bypass vulnerability in Ivanti Connect Secure (ICS) appliances, tracked as CVE-2026-104935, which has been exploited as a zero-day since at least October 1, 2026. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands, enabling credential theft and data exfiltration. Cybersecurity firm Volexity observed a threat actor, tracked as UTA0576, chaining this flaw with other vulnerabilities to achieve unauthenticated root-level code execution and target Active Directory credentials, including LAPS passwords and BitLocker recovery keys.

2w ago · bleeping-computer

A global law enforcement operation disrupted a large-scale phishing ecosystem responsible for over 1 billion malicious messages targeting more than 75,000 organizations across 150 countries. The infrastructure, linked to the Chinese-language marketplace YAM Store (Storm-3119), provided phishing kits such as CoGUI, Haozi, and Iron Man System (Storm-2990) that enabled cybercriminals to launch sophisticated campaigns using AI-generated fake organizations and compromised cloud environments. These kits delivered phishing messages via email and SMS, primarily targeting Microsoft 365 users, with lures including delivery issues, tolls, and account verifications, often bypassing MFA through device-code phishing. Microsoft, in collaboration with Japanese authorities, Resecurity, and other partners, seized domains, deactivated 20,000 accounts, and blocked 100,000 malicious domains to dismantle the network.

2w ago · hacker-news

Microsoft released patches for 1,413 vulnerabilities in its October 2026 Patch Tuesday, including three critical flaws actively exploited or publicly disclosed. The most notable is CVE-2026-96951, a command injection vulnerability in Windows Shell that allows attackers to bypass Mark of the Web (MOTW) defenses by tricking users into interacting with a malicious file. The vulnerability has been exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by October 16, 2026. Another critical flaw, CVE-2026-108398 in .NET Framework, enables local attackers to bypass Windows Defender Application Control without user interaction, making it a dangerous post-compromise technique.

2w ago · hacker-news

Researchers from Doyensec demonstrated a proof-of-concept exploit against a Windows VBS enclave (SFAPE.dll) used by Microsoft Defender SmartScreen's Enhanced Phishing Protection, achieving code execution within the isolated environment. The attack leveraged a four-byte write vulnerability and a timing bug to bypass memory isolation, ultimately allowing an attacker with local SYSTEM access to load and execute arbitrary code inside the enclave. The vulnerability, tracked as CVE-2026-83498, was patched by Microsoft in the September 8, 2026 update (KB5124008). Although not exploited in the wild, the research highlights risks from loadable vulnerable enclaves, as older flawed enclaves like one affected by CVE-2023-36880 remain allowed to load despite known exploits.

3w ago · talos

Cisco Talos identifies a new malware archetype, 'A3: AI-Analysis Evasion,' where malware embeds natural-language instructions to manipulate AI-based analysis systems. This technique exploits ambiguity in AI pipelines by injecting prompts that attempt to mislead models into classifying malicious files as benign or refusing analysis. Four malware families—FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE—demonstrate evolving tactics including template spraying across multiple LLM formats, intimidation messages, and false claims of intellectual property or government affiliation. These evasion methods are detectable due to their plaintext nature, and while simple instructions can influence AI verdicts, more complex attempts often backfire or have limited impact.

2w ago · hacker-news

GitHub has implemented changes to npm's trusted publishing mechanism after a vulnerability was discovered that allowed attackers to hijack over 1,500 packages by exploiting repository name reuse (slug reuse). The flaw, named SlugFest by Bloom Security, stemmed from npm's reliance on mutable repository slugs rather than immutable IDs for trusted publishing configurations, enabling attackers to claim abandoned repository paths and publish malicious versions of legitimate packages without credential theft. The attack could lead to large-scale supply chain compromises, especially when combined with AI agents that automatically pull dependencies without human oversight. GitHub now expires unvalidated trusted publishing configurations after 48 hours and requires re-validation upon repository changes to mitigate the risk.

2w ago · hacker-news

SAP disclosed a critical CVSS 10.0 vulnerability, CVE-2026-89111, in its Cloud SDK for Python that allows server-side request forgery (SSRF), enabling attackers to steal OAuth2 client credentials from multi-tenant applications on SAP Business Technology Platform (BTP). The flaw occurs when an attacker controls the tenant subdomain passed to the SDK, which can result in the SDK sending the application's client ID and client secret to an attacker-controlled server. The vulnerability was introduced in version 0.45.2 and reappeared in versions 0.53.0 through 0.55.0 due to a missing validation check in shared token request code, with the fix reintroduced in version 0.55.1. Older versions in the 0.36 line, including 0.36.1 and 0.36.2, also lack the necessary validation.

2w ago · hacker-news

A threat actor tracked as UTA0576 exploited three zero-day vulnerabilities in Ivanti Connect Secure appliances to achieve root-level command execution without authentication. The attack chain combines an authentication bypass and remote code execution (CVE-2026-104935) with an unpatched privilege escalation flaw to gain full system access. The exploitation was observed in the wild starting October 3, 2026, on fully patched systems, indicating active targeting. The attacker exfiltrated LDAP credentials, performed password spraying, and avoided persistence mechanisms by re-executing the exploit for each command.

2w ago · hacker-news

Docker fixed a critical vulnerability, tracked as CVE-2026-105445, that existed in Docker Hub from August 26, 2024, until September 30, 2026. The flaw allowed a user to convert a personal account into an organization and transfer ownership of personal access tokens (PATs) to another user without consent or notification, enabling unauthorized access to repositories. This could allow an attacker to push, pull, or delete images under another user's identity, including publishing malicious images under legitimate names. Docker found no evidence of exploitation despite reviewing over 304,000 pushes, and the vulnerability was reported by researchers Peter Molnar and Krisztian Hozak of mptrdev.com, who named it GhostPat.

2w ago · bleeping-computer

Docker Hub disclosed a critical vulnerability, CVE-2026-105445, that allowed attackers to impersonate users and tamper with container images by exploiting a flaw in the personal access token (PAT) reassignment process during account-to-organization conversion. Attackers could create a personal account, generate a PAT, convert the account to an organization, and assign a target user as the owner, causing the PAT to be reassigned to that user without consent or token rotation. This enabled unauthorized access to the target's repositories, posing a significant software supply chain risk. Docker patched the flaw within four hours of receiving the report on September 30, 2026, and found no evidence of exploitation after analyzing over 300,000 image pushes.

2w ago · bleeping-computer

Ivanti has disclosed an actively exploited zero-day vulnerability, CVE-2026-104935, in its Connect Secure (ICS) remote access gateway, affecting multiple versions. The flaw allows unauthenticated remote attackers to execute arbitrary commands without user interaction. A threat actor tracked as UTA0576 has been exploiting this vulnerability since at least October 3, 2026, chaining it with two other unpatched flaws to achieve unauthenticated root-level code execution on fully patched devices, while avoiding detection by tampering with logs and not deploying traditional malware or web shells.

2w ago · bleeping-computer

Microsoft's October 2026 Patch Tuesday addresses 1,411 vulnerabilities, including three zero-day flaws actively exploited or publicly disclosed. One actively exploited zero-day is CVE-2026-96951, a Windows Shell security feature bypass that allows command injection and enables attackers to bypass Mark of the Web protections. The other two zero-days are CVE-2026-108398, a .NET Framework security feature bypass that can bypass Windows Defender Application Control, and CVE-2026-92707, a denial-of-service flaw in MessagePack-CSharp. These updates are critical for preventing unauthorized code execution and privilege escalation.

2w ago · bleeping-computer

A critical heap buffer overflow vulnerability in Ghostscript (CVE-2026-39919) allows remote code execution via maliciously crafted PDF files, particularly when processed by systems like WordPress that use Ghostscript for thumbnail generation. The flaw affects Ghostscript versions 9.21 through 10.07.1 and can be exploited if an attacker uploads a PDF that triggers the vulnerability during rendering. Researchers at Wordfence developed proof-of-concept exploits and demonstrated successful remote code execution in lab environments, though reliability depends on system configuration. Artifex released a patch in version 10.08.0, and administrators are advised to update or disable PDF rendering to mitigate risk.

2w ago · hacker-news

Low-cost Android smartphones, primarily built on MediaTek platforms, have been found shipping with preinstalled malware named 'Midnight Mimosa' by Bitdefender. The malware, disguised as 'com.android.system.lite', runs with system-level privileges and enables remote operators to silently install and uninstall apps, conduct ad fraud, and turn devices into residential proxies. It communicates with external command-and-control servers to download additional payloads and has been linked to at least 13 apps on Google Play that exhibit similar behavior. The campaign has affected thousands of devices across over 150 countries, with a majority located in Mexico, and is believed to stem from a supply chain compromise involving firmware signed by Shenzhen Zediel Co., Ltd.

2w ago · hacker-news

GitLab has patched a critical vulnerability, CVE-2026-97229, with a CVSS score of 10.0, affecting its Community and Enterprise Editions. The flaw is an integer overflow issue that could allow unauthenticated users to execute arbitrary code on the GitLab server by exploiting insufficient validation of regular expressions in CI/CD configurations. The vulnerability impacts multiple versions prior to 19.4.2, 19.3.5, and 19.2.8, and users are urged to update immediately to remediate the risk.

2w ago · hacker-news

Attackers remotely hijacked Danfoss AK-SM and AK-SC series refrigeration controllers used in French supermarkets, raising fridge temperatures to as high as 50°C and causing significant food spoilage. The attack affected hundreds of stores across major retail chains including Intermarché, Carrefour, and Monoprix. CERT-FR issued an alert urging operators to disconnect or tightly filter access to these controllers, which are often exposed to the internet. While no specific vulnerability or intrusion method was confirmed, older unsupported models (AK-SM 800, AK-SC 355) were primarily targeted, and Danfoss had previously disclosed CVEs in newer models that could allow authentication bypass and remote code execution.

2w ago · hacker-news

Multiple active threats were reported this week, including exploitation of a critical Atlassian Data Center vulnerability (CVE-2026-21589) within hours of disclosure. A new variant of the DarkSword iOS exploit kit, P7 DarkSword, enables on-device keychain and crypto-wallet theft via watering hole attacks. The Russia-aligned threat actor UAC-0099 continues to evolve its MATCHBOIL malware for persistent execution and payload updates. Google disclosed unauthorized HTTPS certificates were issued after attackers hijacked ccTLDs for .gh, .as, and .sl by compromising third-party operators. A vulnerability in GoBalance allowed attackers to hijack TOR .onion sites, including the darknet forum Dread. Additionally, the FBI disrupted infrastructure linked to the China-aligned Flax Typhoon group.

2w ago · bleeping-computer

Retail giant Ahold Delhaize confirmed a cybersecurity incident that forced the company to take some systems offline to protect its infrastructure. The attack disrupted internal systems, affecting employee access to schedules and pay stubs at Stop & Shop in the U.S., and customer-facing platforms including websites, apps, and customer service at several European brands. This is the second major cyber incident for Ahold Delhaize in recent years, following a 2024 ransomware attack by INC Ransom that compromised over 2.2 million individuals' personal and financial data.

2w ago · bleeping-computer

AvisLoader is a Windows malware loader discovered by Varonis Threat Labs that uses the Tox encrypted peer-to-peer (P2P) network for command-and-control (C2) communications, making takedowns more difficult. The infection begins with a ClickFix lure hosted on Cloudflare Workers, mimicking a DocuSign signing request, which tricks users into pasting and executing a malicious command. The loader employs shortcut modification for persistence, includes a UAC bypass helper referencing UACME technique 41, and uses a DLL to hook system calls for process hiding. The associated AvisLoader Command Center allows operators to manage clients, execute remote commands, and distribute payloads over Tox.

2w ago · bleeping-computer

A cyberattack targeted Danfoss refrigeration controllers used by multiple French supermarket chains, including Intermarché, Carrefour Market, Leclerc, and Coopérative U, disrupting cold storage systems and causing food spoilage. Attackers exploited vulnerable, internet-exposed Danfoss AK-SM 8xxA Series controllers, potentially leveraging known authentication bypass (CVE-2025-41450) and command injection vulnerabilities (CVE-2025-41451) to trigger unauthorized defrost cycles. The attack affected 250 to 350 stores, prompting investigations by French authorities and raising concerns about the security of critical infrastructure in the food retail sector.