Intelligence Feed

1mo ago · bleeping-computer

Threat actors are exploiting trusted AI platforms such as Claude, ChatGPT, and Grok by weaponizing shareable content features to distribute malware. Attackers created malicious Claude Artifacts and shared conversations that mimic legitimate software install guides or troubleshooting advice, hosted on the official domains of these platforms, to bypass user skepticism. These lures trick users into downloading SectopRAT, MacSync stealer, or AMOS stealer via malicious commands or redirects, leveraging the inherent trust in well-known domains. The campaigns are short-lived but effective, relying on SEO poisoning and sponsored search results to increase visibility.

1mo ago · bleeping-computer

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a data breach of its DAVID driver database, which was accessed using compromised credentials from a Plant City Police Department employee's personal device. The ShinyHunters extortion group claimed responsibility, stating they exploited a password reset vulnerability to gain access to multiple accounts, including those of DMV employees and an FBI agent, then scraped driver records by iterating through record IDs. ShinyHunters provided a screenshot of a Jeffrey Epstein DAVID record as proof of compromise and later claimed they had lost access, likely due to patching. The breach impacted at least 200,000 driver records, though FLHSMV has not confirmed the exact number.

1mo ago · bleeping-computer

A Russian-speaking threat actor leveraged AI-powered agents to rapidly develop and deploy exploits for CVE-2026-81578 and CVE-2026-82078, targeting vulnerable PaperCut NG/MF servers. The campaign, active since August 31, 2026, compromised at least 440 servers across 395 organizations in 48 countries, with a focus on the education sector. Attackers achieved rapid domain compromise using techniques like pass-the-hash, noPac, and DCSync, often gaining full domain admin access within minutes. The actor used AI models such as OpenAI’s Codex and DeepSeek to accelerate exploit development and target selection via Netlas scanning.

1mo ago · bleeping-computer

A new Android malware named Mantax Otax, distributed by Indonesian operators via malicious APKs outside Google Play, combines ransomware and spyware capabilities. It encrypts files on devices running Android 9 or older, steals sensitive data including lock-screen PINs, SMS, call logs, WhatsApp and Telegram messages, and enables real-time screen streaming. The malware also harasses victims using full-screen overlays, jumpscare images, and text-to-speech messages to pressure ransom payments, while communicating with C2 infrastructure hosted on Firebase.

1mo ago · bleeping-computer

Following a breach of Brevo, a third-party email provider used by Trezor, threat actors sent phishing emails to approximately 347,000 Trezor customers who had opted into newsletters. The phishing emails, appearing to come from help@trezor.io, claimed a 'hardware microcontroller vulnerability' in Trezor wallets and contained a malicious link designed to trick users into downloading a fake app and revealing their wallet backup seeds. Trezor confirmed the incident affected 2,500 users who clicked the link before the malicious domain was taken down within 20 minutes. No Trezor internal systems were compromised.

1mo ago · bleeping-computer

A new exploit kit named 'BlueMoon' has been observed in the wild, leveraging chained zero-day vulnerabilities in Google Chrome and Microsoft Windows to achieve remote code execution and privilege escalation. The kit has been used by multiple cyber-espionage groups, including JungleBamboo (APT31) and UTA0560, in targeted attacks against NGOs, aerospace, defense, and manufacturing sectors. BlueMoon exploits three specific flaws: two in Chrome's V8 engine and one in Windows ALPC, enabling sandbox escape and local privilege escalation. The attacks are delivered via spearphishing, with payloads including malware loaders and in-memory backdoors such as Grimwedge and ShadowPad.

1mo ago · bleeping-computer

Cisco Talos identified three threat clusters exploiting two recently patched vulnerabilities in Cisco Secure Firewall Management Center (FMC): CVE-2026-20079 (authentication bypass, CVSS 10.0) and CVE-2026-20316 (static credentials, CVSS 5.3). UAT-11988, linked to Qilin ransomware affiliates, used static credentials to deploy ransomware after reconnaissance and lateral movement. UAT-11823, attributed to the Sandworm APT group, exploited both flaws to deploy a Cyclops Blink variant for persistent access and credential theft. UAT-12197 deployed a JSP web shell and malicious JAR file to steal credentials. Cisco confirmed exploitation of both vulnerabilities in active attacks.

1mo ago · bleeping-computer

IDScan, an identity verification company, confirmed a data breach in which an unauthorized third party may have accessed or copied customer information stored on its IDScan.net cloud platform. The breach is linked to a dark-web service called 'Nexus' that advertised access to over 153 million driver's license scans, along with millions of other government-issued IDs. The exposed data includes full names, government-issued identification numbers, and scanned images of driver's licenses. IDScan has engaged third-party specialists, is cooperating with federal law enforcement including the FBI, and is offering credit monitoring to affected individuals.

1mo ago · bleeping-computer

Trezor has warned customers about a phishing campaign exploiting a breach of its third-party email provider. Users received fake 'critical security alert' emails from help@trezor.io, claiming a vulnerability in STM32 microcontrollers used in Trezor wallets could expose recovery seeds. The emails were phishing attempts containing malicious links, and Trezor confirmed the domain used in the attack has been taken down. This incident follows prior breaches involving ShipMonk and a support ticketing portal, with attackers leveraging stolen data for further targeting.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting a critical remote code execution vulnerability, CVE-2025-14733, in WatchGuard Firebox firewalls. The flaw allows unauthenticated attackers to execute arbitrary code remotely due to an out-of-bounds write issue, particularly affecting systems with IKEv2 VPN configurations. Despite patches being available since December 2025, nearly 9,000 vulnerable devices remain exposed online, posing ongoing risks to organizations. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch it within one week.

1mo ago · bleeping-computer

Veradigm, a healthcare technology company, disclosed a data breach resulting from a cybersecurity incident at a third-party vendor, which led to unauthorized access to patient data via compromised API credentials. The Gentlemen ransomware group claimed responsibility, stating they exfiltrated 3.5 million patient records containing personally identifiable information, including names, addresses, Social Security numbers, and email addresses. The group threatens to leak the data if a ransom is not paid, with a deadline of September 11, 2026. While clinical data was not accessed, the breach involved sensitive personal information, and Veradigm has initiated incident response procedures and customer notifications.

1mo ago · bleeping-computer

The Skullcandy Dime 3 wireless earbuds (model S2DCW) running firmware version 1.0.0.28 are vulnerable to Bluetooth hijacking due to a missing authentication flaw in the Airoha Bluetooth Audio SDK. This high-severity vulnerability, tracked as CVE-2025-20701, allows nearby attackers to pair with the device without user interaction or PIN confirmation. Once paired, the attacker's device becomes trusted and can automatically reconnect, enabling audio hijacking, microphone access, and connection disruption. Although Skullcandy released a fix in firmware version 1.0.0.30, there is no user-accessible method to update existing vulnerable units, leaving them permanently exposed.

1mo ago · bleeping-computer

AdaptHealth, a healthcare provider, confirmed a cyberattack in July 2026 that exposed the personal and health information of 4.1 million individuals. The breach resulted from a social engineering attack that compromised a third-party contractor's privileged account, allowing attackers to exfiltrate data from cloud-based systems. The ShinyHunters threat group claimed responsibility for the attack, which involved the theft of full names, contact details, demographic data, health insurance, and health information. The company detected the intrusion on June 5 and received a ransom demand on June 15, but has found no evidence of data misuse to date.

1mo ago · bleeping-computer

Cisco has confirmed active exploitation of a critical authentication bypass vulnerability, CVE-2026-20079, in its Secure Firewall Management Center (FMC) software. The flaw, rated CVSS 10.0, allows unauthenticated remote attackers to execute commands as root by sending crafted HTTP requests. Indicators of compromise, including a specific log entry referencing '/var/tmp/license.tmp', were observed as early as July 23, 2026, suggesting exploitation began before Cisco's public awareness in August. The U.S. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by September 12, 2026.

1mo ago · bleeping-computer

Google has patched a new Chrome zero-day vulnerability, CVE-2026-87491, which has been actively exploited in the wild. The vulnerability is a high-severity out-of-bounds write issue in the V8 JavaScript and WebAssembly engine, allowing remote attackers to execute arbitrary code within the browser sandbox by luring users to malicious HTML pages. Exploitation can lead to heap corruption, data exposure, or browser crashes. Google has not disclosed further details about the ongoing attacks to avoid exposing technical details before most users are patched.

1mo ago · bleeping-computer

An anonymous security researcher known as Nightmare Eclipse disclosed a new zero-day exploit named 'ShieldCrash' that exploits an incomplete patch for the previously patched Microsoft Defender privilege escalation vulnerability CVE-2026-69414 (ShieldBreak). The exploit allows attackers to achieve arbitrary file read with SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. This disclosure is part of an ongoing dispute between the researcher and Microsoft over bug bounty and vulnerability disclosure practices. Microsoft has not yet patched this newly revealed bypass.

1mo ago · bleeping-computer

Over 36,000 internet-exposed Plex Media Server instances remain unpatched against multiple security vulnerabilities disclosed by Plex in September 2026. Affected versions include v1.43.2 and earlier. Plex has released version 1.43.3 to address these issues, but CVE identifiers have not yet been assigned, limiting visibility and response within the security community. Attackers could reverse-engineer the patches to develop exploits, especially given the history of prior vulnerabilities in Plex being exploited for credential theft and remote code execution.

1mo ago · bleeping-computer

The ShinyHunters extortion gang claims to have breached the Florida Department of Motor Vehicles' 'DAVID' (Driver and Vehicle Information Database) system via a password-reset vulnerability, stealing over 200,000 driver records. As proof, they published a screenshot of Jeffrey Epstein's DMV record containing sensitive personal information. The attackers claim they accessed the system using compromised accounts belonging to DMV employees and an FBI agent, then exfiltrated data by iterating through driver IDs. They state they have since lost access and that the vulnerability is being patched, while also indicating plans to disclose breaches of other state DMVs in the near future.

1mo ago · bleeping-computer

Microsoft's September 2026 Patch Tuesday addresses 966 security vulnerabilities, including two actively exploited zero-day flaws. The first, CVE-2026-81963, is an elevation of privilege vulnerability in the Windows Update Stack that allows attackers to gain SYSTEM privileges through improper link resolution. The second, CVE-2026-85880, is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) that enables local privilege escalation to SYSTEM. Both vulnerabilities were actively exploited in the wild before patches were released, though technical details on exploitation are not disclosed. The update marks Microsoft's largest Patch Tuesday to date, attributed to the use of AI-powered vulnerability discovery.

1mo ago · bleeping-computer

Adobe has patched a critical zero-day vulnerability, CVE-2026-75650 (StyleSmuggler), actively exploited in the wild to backdoor Magento and Adobe Commerce servers. The flaw allows arbitrary code execution, and attackers have deployed PHP web shells to exfiltrate server data. A second threat actor using different tooling has also been observed exploiting the same vulnerability. Sansec discovered the attacks, which began at least on September 4, 2026, and recommend immediate application of Adobe's hotfix and credential rotation.

1mo ago · bleeping-computer

An Elasticsearch cluster named 'pax-info', linked to a Vietnamese organization and hosted in Viettel-assigned IP space, was found exposed online due to chained security misconfigurations. The database contained over 220 million traveler and crew records spanning from January 2017 to April 2026, including personally identifiable information such as names, passport details, flight data, and nationalities. The system was accessible via default credentials after initial HTTP 401 authentication was bypassed through a cloud-based path, and it was secured on June 8 following disclosure by Kinryū Labs. It remains unknown whether the data was accessed or exfiltrated by malicious actors prior to remediation.

1mo ago · bleeping-computer

ConnectWise has identified a vulnerability in its ScreenConnect remote access platform that affects both cloud and on-premises deployments, specifically related to insecure file transfer behavior. A CVE ID has not yet been assigned, and no patch is currently available, though temporary mitigations are recommended. The vulnerability could allow attackers to abuse file transfer permissions during sessions, posing a risk to managed service providers and IT support teams. Given the history of exploitation of ScreenConnect flaws by ransomware groups and state-backed actors, this issue is considered high risk.

1mo ago · bleeping-computer

A zero-day vulnerability dubbed 'StyleSmuggler' in Magento and Adobe Commerce is actively exploited to achieve remote code execution and deploy a Rust-based Linux backdoor. The exploit leverages PHP code injection via Magento's template system to trigger malicious activity, including the creation of a disguised backdoor process and a persistent cron job. The backdoor communicates with C2 infrastructure using spoofed NTP traffic on UDP port 123 to evade detection, and checks for tracing before beaconing. Adobe has not yet released a patch, but mitigation advice includes disabling GraphQL.

1mo ago · bleeping-computer

A data breach at Trezor's shipping provider, ShipMonk, has impacted 81,000 customers, with personal data including names, email addresses, phone numbers, and shipping addresses exposed. The breach originated from a critical SQL injection zero-day vulnerability in the third-party analytics platform Metabase, which was exploited by the ShinyHunters extortion gang. Trezor warns affected users of increased phishing and physical security risks, though its own systems and devices remain secure.

1mo ago · bleeping-computer

Mathspace disclosed a data breach affecting over 1 million individuals, primarily students, staff, and parents in Australia and New Zealand, following the exploitation of a critical SQL injection vulnerability in its self-hosted Metabase instance. The attackers gained unauthorized access on August 10, 2026, and exfiltrated data from the Australian reporting database on August 27. The compromised data included personal information, though academic records, credentials, and authentication tokens were not exposed. The breach is part of a broader campaign by the ShinyHunters extortion gang, which has targeted multiple organizations through similar Metabase vulnerabilities.

1mo ago · bleeping-computer

The BigBear 2.0 phishing-as-a-service platform has been used to bypass multi-factor authentication (MFA) and steal over 5,000 Microsoft 365 credentials from 258 organizations. The service leverages an Evilginx2-based adversary-in-the-middle (AiTM) framework to intercept passwords, session cookies, and MFA tokens by proxying traffic between victims and Microsoft's legitimate authentication infrastructure. Attackers use the 'offy' configuration to capture credentials and session data, which is then exfiltrated in real time to affiliate operators via Telegram bots. The platform also employs custom JavaScript to disable FIDO2/WebAuthn support in browsers, forcing users toward weaker authentication methods, and uses geo-matched residential proxies across 69 countries to evade detection.

1mo ago · bleeping-computer

N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) vulnerability, CVE-2026-86218, affecting its N-central remote monitoring and management platform. The flaw allows unauthenticated attackers to execute arbitrary code on exposed on-premises instances with low attack complexity. Although N-able has not confirmed active exploitation, Huntress warns it may be a zero-day and notes ongoing attacks targeting unpatched systems. The vulnerability follows previous incidents involving N-central, with hundreds of internet-exposed instances still potentially vulnerable despite prior patches.

1mo ago · bleeping-computer

Hackers are actively exploiting a chain of two critical vulnerabilities in MikroTik RouterOS to hijack routers with SSH exposed to the internet. The first, CVE-2026-67276, is an SSH authentication bypass that allows login without the private key by exploiting weak RSA public key validation. The second, CVE-2026-86060, is an SSH privilege escalation flaw enabling full administrative access via a crafted username. The exploit chain, dubbed 'MikroTrick' by Poland's CERT, is already being used in the wild. MikroTik has released patches in several updated RouterOS versions, and indicators of compromise include specific log entries and malicious IP addresses.

1mo ago · bleeping-computer

Threat actors are using a technique called ASCII smuggling, inserting invisible Unicode characters (from the Tags block U+E0000–U+E007F) into finance-related keywords in phishing emails to evade detection by email security filters. Microsoft observed a large-scale campaign peaking at 2.37 million messages per day, primarily using sender domains associated with the ActiveCampaign email platform. The obfuscation splits words like 'funding' into 'fun[Unicode]ding' to bypass keyword-based detection, though most messages were still caught by other signals such as sender reputation. Microsoft recommends normalizing or stripping invisible Unicode characters to defend against this tactic in both email filtering and AI prompt processing.

1mo ago · bleeping-computer

A large-scale cybercriminal campaign has compromised over 5,400 websites, primarily built on WordPress and PrestaShop, to deliver malicious payloads via the ClickFix exploit. The attack chain uses a technique called EtherHiding, where malicious code is stored in smart contracts on the BNB Smart Chain (BSC) Testnet, making takedown efforts difficult. Victims are lured into executing a PowerShell command through a fake CAPTCHA prompt, leading to payload execution; later variants use a WebRTC-based stager that establishes a covert encrypted channel to receive and execute JavaScript code directly in browser memory.