Intelligence Feed

1mo ago · bleeping-computer

The ShinyHunters cybercrime group breached the Clop ransomware gang's data leak site by exploiting an unauthenticated file upload vulnerability in Grav CMS. They defaced the Tor-based site with ASCII art of Umbreon, their logo, and claimed to have stolen server data including source code, system logs, and the private keys for Clop's onion service. ShinyHunters stated they plan to extort Clop and published a message via the compromised site, marking an escalation in an ongoing feud between the two threat groups.

1mo ago · bleeping-computer

A malware campaign is distributing a new information stealer named Rapuncel through SEO-optimized fake GitHub repositories impersonating LastPass and 39 other software brands. The attack delivers the Rapuncel infostealer alongside a Microsoft-signed kernel driver, Alinubx.sys, which disables 145 antivirus and EDR products by exploiting kernel-level access. The malware steals credentials from browsers, cryptocurrency wallets, Discord, Steam, Telegram, Windows Credential Manager, and specific documents, while also capturing screenshots and system information, exfiltrating data to a C2 server via raw TCP.

1mo ago · bleeping-computer

Gyazo, a cloud-based screenshot and screen-recording platform, suffered a data breach on September 11, 2026, when attackers exploited a server vulnerability to access its database and steal approximately 23.62 million user records. The compromised data includes personal information such as names, email addresses, password hashes, session IDs, and integration tokens, as well as metadata for 490 million images, some of which may have been private. Gyazo temporarily suspended the service to investigate and mitigate the breach, urging users to change their passwords and remain vigilant against potential phishing or follow-up attacks.

1mo ago · bleeping-computer

A new Android malware named RatHat has been identified by Zimperium zLabs, which leverages AI to automate remote device navigation and control. The malware is distributed via malvertising, SMS, and phishing sites that prompt users to download malicious APKs outside Google Play. It abuses Android Accessibility permissions and enables Developer Options and Wireless Debugging to establish persistent ADB-level access through a Go-based agent. The malware includes credential harvesting, SMS interception, and lock-screen bypass capabilities, and uses AI to dynamically interpret the device interface for real-time remote control. Anti-analysis techniques and persistence mechanisms make it resilient to removal and detection.

1mo ago · bleeping-computer

Check Point Software disclosed a critical vulnerability, CVE-2026-91843, that allows unauthenticated attackers to achieve remote code execution with root privileges on Security Management Server and Log Server instances due to a stack-based buffer overflow in the login process. The vulnerability is exploitable without user interaction and affects all configurations, regardless of VPN usage. While not currently exploited in the wild, Check Point has provided detection guidance via specific log alerts and recommends immediate patching or implementation of mitigations such as restricting access to trusted IPs. The company recently patched other critical flaws, including CVE-2026-85103 and CVE-2026-85102, which are also under active exploitation threat.

1mo ago · bleeping-computer

Brevo suffered a supply-chain attack where attackers stole a long-lived Cloudflare API key hardcoded in source code, allowing them to deploy a malicious Cloudflare Worker that injected malicious ClickFix scripts into Brevo's web assets. The compromised scripts were distributed to customer sites embedding Brevo components, affecting up to 100,000 websites. On WordPress sites, the attack attempted to upload a malicious plugin called 'Web Media Optimizer' that acts as a persistent backdoor and injects further malicious JavaScript, including fake Cloudflare verification pages prompting users to run harmful commands.

1mo ago · bleeping-computer

The FBI has seized the domains of NightmareStresser, a long-running DDoS-for-hire ('booter') service that enabled users to launch large-scale distributed denial-of-service attacks using compromised IoT devices and routers. The service, which claimed to be the '#1 online IP booter,' was used in hundreds of thousands of attacks since 2022, targeting networks globally with attack volumes up to 200 Gbps across multiple layers. The takedown was part of Operation PowerOFF, an international law enforcement effort targeting criminal DDoS infrastructure, which has previously dismantled similar services and led to multiple arrests and domain seizures worldwide.

1mo ago · bleeping-computer

Cisco has warned of active exploitation of a maximum-severity zero-day vulnerability, CVE-2026-76460, in its Identity Services Engine (ISE) and ISE-PIC software. The flaw allows remote attackers to bypass authentication by exploiting insufficient controls on an API endpoint, enabling unauthorized access to the web-based management interface. No workarounds exist, and Cisco strongly recommends applying security updates immediately. The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch within three days.

1mo ago · bleeping-computer

The China-linked threat actor FamousSparrow has been conducting espionage campaigns against government organizations in Latin America since mid-2025, using a new modular C++ backdoor named SparroWocky. This malware replaces the group's previously used SparrowDoor backdoor and is deployed via DLL side-loading, with payloads RC4-encoded in .dat files. SparroWocky features advanced evasion techniques, including thread creation hooking to spoof legitimate Windows functions, in-memory code manipulation, and anti-analysis tricks, enabling command execution, file manipulation, screenshot capture, and proxy capabilities. The malware establishes persistence via a Windows service or registry key and communicates with C2 servers over ports 443 or 8080, sometimes through HTTP and SOCKS5 proxies.

1mo ago · bleeping-computer

A banking malware operation active since mid-2025, dubbed KREMLIN, has been force-installing malicious Chrome and Edge extensions to steal credentials, session tokens, and other sensitive data. The malware bypasses Chromium's integrity checks by copying extensions into browser profile directories and modifying Secure Preferences using extracted encryption keys and regenerated HMACs. The infection begins via malicious JavaScript files disguised as financial documents, establishes persistence through scheduled tasks, downloads Node.js, and retrieves payloads from Ethereum smart contracts or images hosted on the Internet Archive.

1mo ago · bleeping-computer

Iranian state-linked hackers are deploying a Windows malware named CHOSEN BRICK to conduct cyber espionage against dissidents, activists, and journalists globally. The malware is distributed via social engineering lures on messaging platforms like WhatsApp and Telegram, using disguised malicious files that mimic legitimate applications. Once installed, CHOSEN BRICK collects system information, steals communications from email and messaging apps, captures screenshots, records audio, and can download additional payloads or wipe the system. Data is exfiltrated through Telegram or cloud services, with newer variants using SOCKS5 proxies for stealth.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a critical-severity vulnerability in ConnectWise ScreenConnect, tracked as CVE-2026-84869. The flaw, which stems from improper privilege management and missing authorization, allows attackers with basic privileges to transfer or execute files during active remote sessions without requiring user interaction. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to remediate it within three days. Over 1,000 unpatched instances remain exposed globally, primarily in North America and Europe, posing significant risks to federal and enterprise networks.

1mo ago · bleeping-computer

Google has released the September 2026 security update for Pixel devices, addressing 110 vulnerabilities, including a zero-day flaw (CVE-2026-58704) under limited, targeted exploitation. The vulnerability resides in the Cellular Modem subcomponent and stems from a logic error leading to improper authorization, allowing adjacent network attackers with basic privileges to escalate privileges remotely without user interaction. The update is critical for all supported Pixel devices to mitigate potential exploitation.

1mo ago · bleeping-computer

A threat actor compromised the maintainer's website for the Admin Menu Editor Pro WordPress plugin and distributed malicious updates (versions 2.35 and 2.36), which backdoored approximately 1,500 sites. The backdoor created a hidden user account and installed a web shell via a malicious file named wp-user-consent.php. The attacker had likely gained root-level access to the server, prompting the developer to take the site offline and issue cleanup guidance. Customers are advised to check for specific indicators of compromise and restore from clean backups.

1mo ago · bleeping-computer

Acronis has disclosed a high-severity local privilege escalation vulnerability, CVE-2026-87886, in its backup plugins for cPanel & WHM and Plesk, which is being actively exploited in limited, targeted attacks. The vulnerability allows low-privileged attackers to escalate privileges on affected Linux servers, potentially enabling unauthorized access to sensitive data and system disruption. Exploitation has been detected in the wild, though no specific indicators of compromise have been identified. Acronis recommends immediate updates to patched versions to mitigate the risk.

1mo ago · bleeping-computer

Hackers are actively exploiting a critical unauthenticated arbitrary file-upload vulnerability, CVE-2026-27540, in the WooCommerce Wholesale Lead Capture plugin for WordPress. The flaw allows attackers to upload PHP webshells by manipulating the wwlc_file_upload_handler AJAX action and bypassing file extension checks via a user-controlled parameter. Exploitation attempts have been observed in multiple waves, with over 100,000 attacks blocked by Wordfence. The uploaded webshell, named shell.php, enables host reconnaissance and facilitates deployment of additional malicious payloads.

1mo ago · bleeping-computer

CenterPoint Energy confirmed a data breach in which an unauthorized actor exfiltrated personal information of a portion of its customers through an external-facing system. A threat actor using the alias '4d722e4d656f77' claimed responsibility, stating they extracted 7.49 million records containing names, phone numbers, addresses, account numbers, billing amounts, and partial Social Security numbers by exploiting inadequate security controls on the company's public API, including lack of rate limiting and WAF protection. The company has launched an investigation, engaged third-party experts, and reported the incident to authorities, while confirming that utility services were unaffected.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that the critical VMware vCenter vulnerability CVE-2026-59310, a directory traversal flaw allowing unauthenticated remote code execution, is now actively exploited by ransomware gangs. The vulnerability was patched by Broadcom in July 2026, but attackers have been observed exploiting unpatched systems to deploy reverse SSH tools for persistence and remote access. CISA added the flaw to its Known Exploited Vulnerabilities catalog and mandated federal agencies to remediate within three days. The broader threat landscape shows a pattern of ransomware groups targeting VMware infrastructure due to its strategic access to enterprise networks and data.

1mo ago · bleeping-computer

BambooToken is a previously unknown malware framework active since at least 2023 that uses the MQTT protocol for command-and-control communications on both Windows and Linux systems. It has been observed compromising enterprise servers in Asia and South America, including those supporting mobile apps, legal and financial services, and software development. The malware is capable of keylogging, clipboard theft, audio and webcam capture, and file manipulation, with a Linux variant (version 2.1) observed in December 2025. While no specific threat actor is attributed, targeting patterns suggest alignment with China-aligned operations.

1mo ago · bleeping-computer

Cisco has patched a critical zero-day vulnerability, CVE-2026-76461, in its Secure Email Gateway (SEG) software that was actively exploited by threat actors. The flaw resides in the email parsing logic of Cisco AsyncOS and allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to root-level command execution on the underlying operating system. Exploitation occurs by sending a specially crafted email containing malicious SQL statements. The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within three days.

1mo ago · bleeping-computer

Hackers hijacked HBO Max's verified Reddit account (u/hbomax) to distribute malicious advertisements as part of a campaign dubbed PasteSwitch. These ads used ClickFix social engineering tactics, tricking users into pasting malicious commands into Windows Run, PowerShell, or macOS Terminal under the guise of installing legitimate software or fixing errors. The attack distributed information-stealing malware such as MacSync and AMOS helper on macOS, and PowerShell-based payloads on Windows, including memory-resident Amatera Stealer. Attackers used domains like hbomaxx[.]us and infrastructure including ember-bridge[.]com to deliver payloads and rotate between campaigns targeting both general users and developers.

1mo ago · bleeping-computer

The Twitch Enhanced Viewer | JeetBot browser extension, with over 30,000 installs on Chrome and Firefox, captures users' Twitch OAuth tokens and sends them to proxy servers controlled by JeetBot, a commercial Russian-language streaming and chatbot service. The tokens are transmitted as cleartext in URL query parameters when video playlist requests are proxied, exposing them in server logs. Earlier versions of the extension openly admitted to collecting OAuth tokens, claiming it was necessary for HD streaming functionality. Security researchers recommend users uninstall the extension, revoke Twitch sessions, and re-authenticate to mitigate exposure.

1mo ago · bleeping-computer

Japan's Digital Agency disclosed a data breach resulting from exploitation of a vulnerability in a VPN device used by the Government Solution Service (GSS). The attacker gained unauthorized access by exploiting the flaw, leading to potential exposure of approximately 246,000 records containing personal information of government employees and associated individuals. The exposed data includes names, email addresses, telephone numbers, and physical addresses, though sensitive identifiers such as My Number, bank accounts, and pension numbers were not compromised. The agency contained the breach by suspending the compromised account and isolating the affected system, with no evidence of data misuse found to date.

1mo ago · bleeping-computer

Hackers are conducting a mass-scanning campaign targeting internet-exposed Vite development servers, exploiting CVE-2026-39364 to bypass file access controls and steal sensitive cloud credentials from AWS and Azure environments. The attackers use specific query parameters to retrieve environment files, cloud credentials, Terraform configurations, and system information. The activity has been observed originating from IP addresses in the United States, Belgium, and the Netherlands, with attackers leveraging Google Cloud infrastructure for evasion.

1mo ago · bleeping-computer

Revolut disclosed a data breach in which a threat actor impersonated a legitimate government agency by using its authenticated email domain to request customer data. The company inadvertently fulfilled the request, leading to the exposure of personally identifiable information, identity documents, financial records, and transaction history for a limited number of customers. The breach did not impact Revolut's systems or customer funds, and the company claims to have blocked the malicious actor and notified relevant authorities upon detection.

1mo ago · bleeping-computer

Threat actors associated with the China-aligned UNC3569 group are actively exploiting a critical remote code execution vulnerability, CVE-2026-51990, in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The attack chain begins with a maliciously crafted sgbiz: URI that triggers command-line argument injection, leading to unvalidated execution in the SGMyInput.exe process. This allows loading of an attacker-controlled URL in an outdated, unsandboxed Chromium-based webview, which then exploits known browser flaws to achieve code execution and deploy the modular GrayRabbit malware. The malware supports remote command execution, file transfers, reverse shells, and reflective plugin loading, with its C2 configuration RC4-encoded.

1mo ago · bleeping-computer

The Dutch National Cyber Security Centre (NCSC) warns of imminent exploitation of two critical vulnerabilities in Check Point VPN solutions, tracked as CVE-2026-85102 and CVE-2026-85103. These flaws could allow remote attackers to execute arbitrary code on Security Gateways and Security Management Servers, potentially leading to full system compromise. Although no public proof-of-concept has been released, the NCSC assesses the risk as high and urges immediate patching. Affected versions include multiple releases from R80 through R82.10, with fixes available via updates and LivePatch.

1mo ago · bleeping-computer

Threat actors are actively exploiting a chain of vulnerabilities in JFrog Artifactory, specifically CVE-2026-42018 and CVE-2026-42016, to bypass authentication and escalate privileges to admin level. Attackers use the initial access to create administrator accounts, generate long-lived tokens, and deploy a Rust-based backdoor for persistence. Additional post-exploitation activities include deploying webshells, stealing configuration data and credentials, and enumerating repositories and users on compromised systems.

1mo ago · bleeping-computer

Threat actors linked to ShinyHunters, Helix, and other extortion gangs are conducting passkey and single sign-on-themed phishing campaigns to compromise corporate Microsoft 365 accounts. The attacks begin with social engineering via phone or messaging, impersonating IT help desks to trick employees into visiting phishing sites or authorizing device-code authentication, enabling adversary-in-the-middle attacks. Attackers perform extensive reconnaissance using Microsoft Graph, persist by adding attacker-controlled MFA methods, and exfiltrate data from SharePoint, OneDrive, and Exchange over prolonged periods to evade detection.

1mo ago · bleeping-computer

Between December 2025 and August 2026, multiple threat groups abused Anthropic's Claude AI for malicious purposes, including credential harvesting, malware development, and reconnaissance. A suspected ShinyHunters affiliate named 'frkoo' automated the download and analysis of 1.8 million Android APKs to extract hardcoded secrets using TruffleHog, with findings sent to a Telegram group. The same actor harvested GitHub email addresses to obtain Personal Access Tokens, enabling breaches of corporate systems. Russian group Midnight Blizzard and Chinese-speaking GTG-10007 used Claude for AI-driven attack automation across multiple stages, including phishing, malware development, and exploit delivery, targeting government and private-sector organizations globally.