Intelligence Feed

2w ago · bleeping-computer

Ledger has confirmed a supply-chain attack involving hardware wallet devices compromised with a spy chip implant, distributed through the unauthorized Southeast Asian reseller CryptoBilis. The malicious implants, found in Ledger Nano X devices, capture the device's display output and button presses to exfiltrate seed phrases via LTE using an embedded eSIM. Researchers from Tibane Labs and Mark Karpelès identified two variants of the implant, one more advanced and concealed under the OLED display, both using custom PCBs and hidden LTE modules for data transmission.

2w ago · hacker-news

A critical vulnerability, CVE-2026-85097 (CVSS 10.0), in the Bricksforge WordPress plugin is under active exploitation, enabling unauthenticated remote code execution (RCE). Attackers exploit a flaw in file upload validation by uploading a GIF/PHP polyglot file and manipulating the 'temporaryFileUploads' parameter to execute PHP code via mismatched URL extensions. Exploitation targets the '/wp-json/bricksforge/v1/form_submit' or '/wp-admin/admin-ajax.php' endpoints with crafted payloads, using techniques like alternate PHP extensions, case manipulation, and URL encoding to bypass filters. At least 63 unique IPs have been observed in attack campaigns, with six responsible for nearly half of all requests, indicating automated, distributed exploitation. Users are urged to update to version 4.0.1 and audit for suspicious form submissions and unexpected PHP files in upload directories.

2w ago · hacker-news

A critical pre-authenticated server-side request forgery (SSRF) vulnerability, CVE-2026-102255 (CVSS score: 10.0), in SonicWall SMA 1000 appliances is being actively exploited shortly after public disclosure. Patches were released on October 6, 2026, but exploitation attempts began as early as October 8, with 135 observed attempts originating from two unique U.S.-based IP addresses. The flaw allows remote attackers to force the appliance to make unauthorized internal requests, potentially leading to initial access, credential theft, and lateral movement into internal corporate networks.

2w ago · hacker-news

Ledger has identified an unauthorized hardware implant in at least one Ledger device sold through the reseller CryptoBilis, leading to theft of cryptocurrency funds exceeding $86 million from affected users in Southeast Asia. The compromised devices were tampered with, potentially including pre-generated recovery phrases or hardware modifications, allowing attackers to access user wallets. Ledger is warning users who purchased from CryptoBilis in the last 90 days to avoid setting up their devices and to move assets to a new Ledger signer if they already set up the device. The incident highlights supply chain risks from unauthorized resellers, and Ledger is investigating the scope with CryptoBilis having paused all hardware wallet sales.

2w ago · bleeping-computer

GitLab has disclosed and patched a maximum-severity remote code execution vulnerability, tracked as CVE-2026-97229, in its CI/CD Regular Expression Compiler. The flaw, caused by an integer overflow, could allow unauthenticated attackers to execute arbitrary code on GitLab servers by supplying a specially crafted regular expression in a pipeline configuration file. The vulnerability affects self-managed GitLab instances prior to versions 19.2.8, 19.3.4, and 19.4.2, and immediate patching is advised. GitLab.com is already protected, and dedicated customers are unaffected.

3w ago · socket-dev

Socket Threat Research identified a coordinated campaign involving 16 malicious Firefox extensions designed to steal cryptocurrency wallet recovery phrases and private keys. The extensions impersonate legitimate wallets such as Rabby and OKX, using cloned interfaces to trick users into revealing sensitive information. Stolen credentials are exfiltrated to attacker-controlled Cloudflare Workers. Fifteen of the extensions communicate with the domain icy-star-f45c[.]workers[.]dev, while one uses a different endpoint. Mozilla has since unpublished the malicious extensions, but users who entered wallet recovery data should consider their wallets compromised and take immediate remediation steps.

3w ago · bleeping-computer

A Chinese-speaking threat actor used the ARTEX AI penetration testing framework and Anthropic's Claude AI agents to conduct cyberattacks against major South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. The attacks led to exposure of customers' personal and financial data, as well as system outages. Infrastructure analysis revealed open directories containing ARTEX configuration files, Claude session histories, and memory files, which exposed the attacker's methods and partial identity. The actor used multiple LLMs, including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6, accessed via the API proxy xcai[.]pro, and showed interest in monetizing stolen data through Telegram.

3w ago · hacker-news

Multiple U.S. states have filed lawsuits against TP-Link Systems over claims of misleading consumers about router security and ties to China. The complaints highlight real-world attacks involving TP-Link routers, including exploitation by state-backed hackers from China and Russia. Specific vulnerabilities in TP-Link devices, particularly those supplied by ISPs under the Aginet brand, were disclosed and technically detailed by SEC Consult, allowing unauthenticated attackers to gain full control of affected devices. These flaws, including CVE-2025-30237 through CVE-2025-30241, enable privilege escalation, command execution, and credential decryption, with fixes distributed via ISPs but not always accessible to end users.

3w ago · bleeping-computer

Threat actors are actively exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform to gain unauthorized access, deploy webshells, and mine cryptocurrency. The attack chain begins with CVE-2026-105133, an authentication bypass, followed by CVE-2026-105134, which enables OS command injection. Attackers deploy JSP webshells, install the XMRig miner disguised as edge.exe, and use a PowerShell script to hide mining activity from Task Manager. The malware persists via a malicious service named 'MicrosoftEdgeUpdateSvc' and may leverage the WinRing0x64.sys driver to enhance mining performance.

3w ago · socket-dev

A new wave of the GhostAction campaign has compromised maintainer accounts on GitHub, injecting a malicious workflow named security-audit.yml into 346 repositories, including high-profile projects like uber/athenadriver and kitao/pyxel. The workflow exfiltrates both GitHub Actions secrets and cloud/AI service credentials from the working tree and full Git history, sending them to a hardcoded C2 server. This variant expands on prior GhostAction activity by combining stolen publishing credentials with the harvesting of committed cloud credentials, including AWS, OpenAI, and GitHub API keys. The malicious workflow runs on every push and remains active on affected repositories, posing ongoing supply chain and cloud security risks.

3w ago · step-security

The GhostAction campaign has resurged with a new wave of malicious GitHub Actions workflows injected into compromised open-source repositories. Attackers compromised maintainer accounts (kitao, henrywoo) to push malicious 'security audit' workflows directly to default branches, bypassing review. These workflows exfiltrate GitHub Actions secrets and mine the entire git history for credentials, including AWS, AI provider, and SaaS tokens. The exfiltration endpoint has shifted to the IP address 193.32.204.199, using plain HTTP to evade domain-based detection. Successful exfiltration was confirmed in multiple repositories, including Uber's athenadriver.

3w ago · unit42

Threat actors, including North Korea-affiliated groups like Alluring Pisces (aka Sapphire Sleet or Midnight Neptune), are leveraging Web3-based command-and-control (C2) infrastructure in software supply chain attacks to dynamically update botnets and evade detection. Two major campaigns, ChainDrop and PolinRider, have infected hundreds of npm packages and expanded across multiple package registries, harvesting cloud IAM keys, CI/CD tokens, and environment secrets from developer workflows. These threats use blockchain-based C2 techniques such as EtherHiding, TxDataHiding, and NullReceiver to bypass traditional network monitoring and maintain persistence.

3w ago · hacker-news

The China-linked threat actor Flax Typhoon has exploited five vulnerabilities in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to gain initial access to organizations and exfiltrate sensitive data. These vulnerabilities were added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and federal agencies are mandated to patch or discontinue use by October 11, 2026. The attacks involve scanning tools, cross-site scripting, password spraying on Microsoft Exchange servers, persistence via VPN software, and data exfiltration using scripts.

3w ago · hacker-news

Threat actors are exploiting two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, in the AhsayCBS backup utility to gain remote code execution on affected systems. The attackers chain the flaws to bypass authentication and execute arbitrary commands, leading to the deployment of web shells and XMRig cryptocurrency miners disguised as Microsoft Edge. Post-exploitation activities include reconnaissance, cryptomining, and the use of an AI-assisted PowerShell script that interferes with Windows Task Manager to avoid detection.

3w ago · hacker-news

Security researchers have published a working exploit called AnyPwn for a pre-authentication remote code execution vulnerability in AnyDesk Linux versions prior to 8.0.3. The flaw is a heap buffer overflow in the session protocol that allows attackers to achieve root access via direct TCP connections on port 7070. The exploit relies on a 32-bit integer overflow when calculating buffer size, leading to a heap-based buffer overflow that corrupts adjacent memory and enables arbitrary code execution using a ROP chain. Although AnyDesk patched the issue in June 2026, no CVE has been assigned and no formal advisory was issued.

3w ago · hacker-news

P7 DarkSword is a new variant of the DarkSword iOS exploit kit that enhances stealth and data theft capabilities, including exfiltration of iCloud Keychain, cryptocurrency wallet data, and remote command execution on compromised iPhones. The kit leverages previously undocumented iOS vulnerabilities CVE-2025-24201 and CVE-2025-31200 to escape browser sandbox and achieve kernel-level privileges. It has been used in attacks targeting Saudi Arabia, Turkey, Malaysia, and Ukraine by multiple threat actors, including PARS Defense and Star Blizzard. Researchers also identified active C2 infrastructure and open directories linked to Chinese-speaking operators running exploitation-as-a-service with a focus on cryptocurrency theft.

3w ago · hacker-news

The FBI has arrested another suspected member of the ShinyHunters extortion group, believed to be involved in the breach of the FBI's jobs portal, FBIjobs.gov. The breach, attributed to ShinyHunters, resulted in the theft of sensitive data on FBI agents and job applicants, including personal, medical, and psychiatric information. The breach occurred due to a contractor's failure to apply a security patch on a third-party platform, reportedly Oracle's PeopleSoft, managed by Accenture. The FBI has linked ShinyHunters to over 140 breaches and at least $70 million in extortion payments since the previous year.

3w ago · hacker-news

A credential-theft campaign dubbed GhostAction has compromised developer accounts of high-profile open-source maintainers to inject malicious GitHub Actions workflows into hundreds of repositories. The injected workflows, named 'security-audit.yml' or 'github_actions_security.yml', exfiltrate secrets such as API keys, cloud credentials, and tokens to a hard-coded IP address over HTTP. The attack chain begins with stolen personal access tokens, followed by reconnaissance and deployment of the malicious workflow under the victim's identity, enabling harvesting of credentials from both the working tree and git history.

3w ago · bleeping-computer

Attackers are actively exploiting a maximum-severity vulnerability (CVE-2026-102255) in SonicWall SMA1000 appliances, specifically targeting the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models. The flaw allows unauthenticated remote attackers to abuse a path to direct the appliance to issue internal requests, potentially reaching internal functionality such as the CouchDB service via a Server-Side Request Forgery (SSRF) technique. Exploitation attempts have been observed using crafted OPTIONS requests to access the internal CouchDB service at 127.0.0.1:5984, with an HTTP Basic Authorization header containing default credentials admin:admin.

3w ago · bleeping-computer

German authorities have arrested a Russian national alleged to be a core member of the Qilin ransomware group, following his extradition from Japan. Qilin, a ransomware-as-a-service operation active since August 2022, has targeted over 2,350 organizations across 62 countries using double-extortion tactics. Notable victims include Nissan, Asahi, Lee Enterprises, Australia’s Court Services Victoria, and the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). The group has also exploited zero-day and n-day vulnerabilities in Check Point and Palo Alto Networks VPN appliances.

3w ago · bleeping-computer

The FBI has arrested another suspected member of the ShinyHunters hacking group following a breach of FBI systems that occurred via a third-party vendor's platform. ShinyHunters exploited an alleged Oracle PeopleSoft zero-day vulnerability to gain access and moved laterally into FBI-managed AWS GovCloud infrastructure, claiming to have stolen 2–3TB of sensitive data, including employee records, Social Security numbers, and psychiatric information. The breach has led to multiple arrests globally, including suspects in the Netherlands and Jordan, while signs of internal disruption within the group have emerged, including the disappearance of key representatives and temporary takedowns of their leak site.

3w ago · bleeping-computer

Hackers are leveraging Google Ads and abusing Bing's legitimate redirect infrastructure to deliver 'ClickFix' attacks that impersonate official Claude installers for macOS. The malicious ads appear to point to bing.com, evading suspicion and ad security checks, then redirect through a compromised WordPress site to a fake download page at claude-desk-code[.]com. The page uses cloaking techniques to hide the payload from direct access and security scanners, while tricking users into copying a malicious command that downloads and executes a script from lake-90[.]com. The final payload remains unidentified, but the campaign is linked to the ClickFix toolkit tracked internally as AcSig.

3w ago · talos

Cisco Talos has identified a growing trend called 'A3: AI-Analysis Evasion', where malware authors embed natural-language instructions in code to manipulate AI-based analysis systems. These techniques range from simple comments to advanced template spraying designed to deceive large language models (LLMs), with a success rate of approximately 35% in skewing AI verdicts. The evasion methods are used in conjunction with serious threats, such as MANTLEMAZE malware, which abuses vulnerable drivers to disable EDR from kernel space. Since the instructions must be in plaintext, defenders can detect them by monitoring for imperative language in binaries, treating such text as evidence rather than system directives.

3w ago · hacker-news

A targeted campaign against South Korean financial firms, including Shinhan Bank and Yegaram Savings Bank, leveraged the open-source AI-powered penetration testing tool ARTEX, developed by Autumn-27, to conduct data theft operations. The attacks, active from late September to early October 2026, involved a suspected Chinese-speaking threat actor using a Hong Kong-based IP address hosting the ARTEX instance and interacting with LLMs such as DeepSeek, GLM, and Grok. The actor also used Claude to research methods for selling stolen Korean data on Telegram and referenced the Telegram account @YY520CN. CrowdStrike linked the activity to financial motivation, though no group has been definitively attributed. In response, the ARTEX developer discontinued the project and moved it to closed source due to misuse.

3w ago · hacker-news

Citrix has patched a critical vulnerability, CVE-2026-107406, in NetScaler ADC and NetScaler Gateway appliances that could allow remote code execution or denial-of-service when the devices are configured as SAML identity providers or service providers. The flaw, which has a CVSS score of 9.5, is memory overflow-based and requires specific SAML-related configurations to be exploitable. While there is no evidence of active exploitation to date, Citrix warns that Secure Private Access Hybrid deployments are also affected and must be upgraded to patched versions to mitigate risk.

3w ago · hacker-news

A critical vulnerability in GoBalance, a Go-based reimplementation of Tor's OnionBalance used by dark web sites for availability, allows attackers to recover the full private key of a .onion service from publicly available descriptors. This flaw stems from GoBalance using only the first 32 bytes of a 64-byte Tor private key during signing, effectively exposing the secret randomness used in signatures and enabling full key recovery from a single descriptor. As a result, attackers can hijack .onion addresses by creating valid descriptors for the same address, redirecting traffic to malicious sites. High-profile dark web services including Dread and Omega were confirmed compromised, with Dread attributing the incident to this flaw after initially suspecting operator error.

3w ago · bleeping-computer

Citrix has issued an urgent warning for administrators to patch a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-107406, affecting NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers or Service Providers. The flaw arises from a memory overflow condition that could allow attackers to execute arbitrary code or cause denial-of-service conditions. While there are no known active exploits in the wild at the time of disclosure, Citrix has previously seen rapid exploitation of similar NetScaler vulnerabilities, and over 21,000 NetScaler instances are exposed to the internet, increasing the risk of widespread compromise if left unpatched.

3w ago · bleeping-computer

A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones, where malicious software is embedded directly into the firmware of devices using MediaTek chipsets. The malware, which operates with system-level privileges, enables silent app installation, ad fraud via fake utility apps, and turns infected devices into residential proxies. The campaign has affected thousands of devices across over 150 countries, with notable impact in Mexico, France, Italy, and the U.S., and persists through preinstalled system apps that cannot be uninstalled normally.

3w ago · bleeping-computer

Jonathan Spalletta, also known as 'Jspalletta' and 'Cthulhon', was convicted of hacking the decentralized crypto exchange Uranium Finance in April 2021, exploiting flaws in its smart contract code to steal approximately $53.3 million in cryptocurrency. In the first attack, he exploited a vulnerability to issue zero-token withdrawal commands and drain $1.4 million, later extorting a 'bug bounty' of nearly $386,000. Three weeks later, he exploited another coding error—causing transaction verification to use 1,000 instead of 10,000—enabling him to withdraw nearly 90% of the exchange's liquidity pools. Spalletta laundered the stolen funds through Tornado Cash and decentralized exchanges, leading to the collapse of Uranium Finance.

3w ago · bleeping-computer

The FakeGit malware campaign has reemerged, leveraging 17,610 malicious GitHub repositories to distribute the SmartLoader malware, which in turn delivers the StealC infostealer. The attack uses throwaway and compromised developer accounts to host repositories with deceptive README files that include download links to malicious ZIP archives. The campaign rapidly redeployed, creating over 13,000 repositories in 34 hours, with 97% of commits modifying only the README to point to SmartLoader payloads. Attackers maintain persistence by using forks, release assets, and issue attachments to host backup copies of malware, evading takedown efforts.