Intelligence Feed

3w ago · bleeping-computer

IDC Frontier, a Japanese cloud provider subsidiary of SoftBank Group, suffered a ransomware attack on its IDCF Cloud service in the East Japan Region 1, leading to a system outage and impacting 495 organizations, including government clients. The attackers claimed to have encrypted 225 databases (3.6 PB), accessed 239 hypervisors, sealed 16,000 VM disks, and wiped over 554,000 snapshots. The company has isolated affected systems, disabled customer console access proactively, and is investigating the intrusion vector and full impact.

3w ago · socket-dev

The npm package tensorlake@0.5.144 was compromised in a supply chain attack linked to the ChainDrop/Shai-Hulud campaign, delivering a credential-stealing malware payload via a preinstall hook. The malicious code executes during installation, harvesting secrets from local files, CI environments, Kubernetes, Vault, and AI development tools, then exfiltrates them. The payload also establishes persistence using a 'hostage token' mechanism that triggers destructive actions if stolen tokens are revoked, and it propagates by republishing compromised npm packages under the victim's identity.

3w ago · unit42

The Blinder Tunnel campaign, attributed to an Iranian state-aligned threat actor, targeted Iraqi critical infrastructure in March 2026 using a sophisticated social engineering lure impersonating Dubai Airports' IT department. The attack delivered trojanized Visual Studio projects that exploited .csproj files, AppDomainManager hijacking, and DLL sideloading to deploy custom malware including ShelbyLoader V2 and Blackwood, a Chisel-based tunneling tool. Command-and-control was conducted via GitHub repositories and issues, with fallback mechanisms using encrypted comments, while infrastructure reuse linked this activity to a parallel credential-harvesting campaign targeting Israel.

3w ago · talos

Cisco Talos identified an APT spear-phishing campaign, tracked as UAT-11985, targeting Taiwan-based research organizations using AI-assisted content generation to create highly personalized and credible phishing emails. The campaign leveraged legitimate event themes and impersonated reputable academic institutions, embedding malicious QR codes in posters (quishing) and using deceptive hyperlinks that mimic legitimate Google Forms URLs to redirect victims to phishing pages. The phishing infrastructure employs a real-time adversary-in-the-middle (AitM) framework with a hybrid HTTP and WebSocket architecture to intercept Google credentials and bypass MFA by dynamically mirroring authentication flows. Technical analysis suggests the phishing kit was developed primarily in Simplified Chinese, indicating a developer with mainland Chinese linguistic patterns.

3w ago · hacker-news

The npm package 'tensorlake' was compromised in a supply chain attack delivering a credential-stealing and self-propagating worm named Shai-Hulud. The malicious version 0.5.144 includes a preinstall hook that executes an obfuscated JavaScript loader, which deploys malware to harvest credentials from npm, GitHub, AWS, Kubernetes, Vault, SSH keys, and cryptocurrency wallets. The malware establishes persistence, exfiltrates data via GitHub repositories, uses Ethereum for C2 resolution, and can trigger destructive actions if stolen tokens are revoked. It also modifies project files in AI development environments to re-execute upon project access.

3w ago · hacker-news

Zhang Yu, a Chinese national and director at Shanghai Firetech Information Science and Technology, is wanted by U.S. authorities for his alleged role in state-sponsored cyber espionage activities linked to the HAFNIUM campaign. He is charged in connection with the 2021 Microsoft Exchange Server attacks that exploited zero-day vulnerabilities, including ProxyLogon, to compromise over 12,700 U.S. organizations. The U.S. State Department is offering up to $10 million for information leading to his identification or location. Zhang allegedly coordinated hacking operations on behalf of China's Ministry of State Security, targeting U.S. universities involved in COVID-19 research and an international law firm, alongside co-conspirator Xu Zewei, who was extradited to the U.S. in April 2026.

3w ago · hacker-news

Security researchers identified 16 malicious Firefox extensions designed to impersonate legitimate cryptocurrency wallets, specifically Rabby and OKX Wallets. These extensions intercept and exfiltrate cryptocurrency wallet recovery phrases and private keys by sending them to attacker-controlled Cloudflare Workers domains. The extensions are part of an ongoing campaign that reuses infrastructure and code while rotating names and versions, indicating a persistent threat targeting cryptocurrency users.

3w ago · hacker-news

Wazza is a newly identified phishing kit that targets banking, government, and manufacturing sectors across the US, EU, and Australia. It employs a multi-stage routing infrastructure to filter traffic and evade detection, only delivering the final Adobe-themed Device Code phishing page after validating session tokens and browser telemetry. This layered approach complicates automated analysis and increases investigation time for MSSPs, as the malicious behavior is hidden behind multiple redirects and access controls.

3w ago · bleeping-computer

ASOS confirmed a data breach resulting from a social engineering attack in which an attacker impersonated a trusted contact to steal an employee's login credentials. The compromised credentials were used to access third-party platforms used by ASOS, leading to the exposure of customers' full names, contact details, and certain non-personal account-related information. The threat actor, identifying itself as 'Xuanye Group,' sent malicious in-app notifications to users, but ASOS confirmed that payment card information and account passwords were not accessed.

3w ago · step-security

The npm package tensorlake@0.5.144 has been compromised and functions as a malicious worm that steals credentials, including GitHub and npm tokens, cloud keys, SSH keys, and AI tool configurations. It spreads by modifying victim repositories with malicious .claude and .vscode files and republishing npm packages using stolen tokens. The malware includes a 'hostage token' mechanism: if the stolen GitHub token is revoked, a background monitor triggers deletion of the user's home directory via rm -rf ~/ or equivalent on Windows. The malicious code was pushed directly to the main branch of the tensorlakeai/tensorlake repository under a maintainer's name and published with a valid npm provenance attestation, making it appear legitimate.

3w ago · hacker-news

A critical arbitrary file access vulnerability, CVE-2026-21589, in multiple Atlassian Data Center products is being actively exploited within hours of public disclosure. The flaw allows unauthenticated attackers to retrieve sensitive files from the webroot directory by exploiting path resolution logic in Atlassian's web-resource handling, requiring only knowledge of the target file's exact path. Exploitation attempts have already been observed from multiple IP addresses, with the potential to extract credentials and gain administrative access, particularly in Crowd and Jira instances. Immediate patching is advised as automated scanning via tools like Nuclei is expected to increase exploitation activity.

3w ago · hacker-news

The FBI and USSS have issued a warning about the ongoing FortiBleed campaign, which targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The threat actors exploit reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale. The campaign has collected over 86,644 valid credentials from 194 countries, enabling lateral movement, privilege escalation, and data exfiltration. Attackers create new administrative accounts for persistence and are suspected to be initial access brokers selling access to ransomware groups such as INC and Lynx.

3w ago · hacker-news

A malware family named PoeLLM has infected over 3,400 servers by targeting exposed AI and LLM infrastructure, repurposing them for cryptocurrency mining and botnet expansion. The campaign, dubbed Canto Incognito, uses compromised servers to scan and exploit other vulnerable systems, connecting victims to the Kryptex mining service. The malware retrieves its command-and-control address from a poem hosted in a GitHub repository, with changes to the poem indicating C2 updates. The activity is attributed to an Italian-speaking threat actor with moderate confidence, targeting enterprise services like LiteLLM, Gotenberg, Gitea, and Ivanti Sentry.

3w ago · hacker-news

A supply chain attack dubbed MALFEX has distributed eight malicious npm packages, collectively downloaded over 40,000 times, delivering the Overlord RAT and a Node.js-based information stealer. The threat actor, believed to be Portuguese-speaking, uses postinstall hooks to execute malicious JavaScript payloads that download Windows executables from suspicious domains. Some packages act as loaders for Overlord RAT, while others deploy a stealer targeting Discord, browsers, Telegram, and cryptocurrency wallets, with infrastructure hosted on a Brazilian application platform.

3w ago · bleeping-computer

Advantest Corporation confirmed a ransomware attack that occurred on February 15, 2026, during which a threat actor breached its network and exfiltrated sensitive personally identifiable information (PII). The stolen data includes contact information, dates of birth, Social Security Numbers, national ID numbers, driver’s license numbers, passport numbers, medical information, financial information, and other ID numbers. While the company has not identified the specific threat actor or confirmed data misuse, it has offered affected individuals 18 months of free identity and credit monitoring services through Kroll to mitigate risks of identity theft and fraud.

3w ago · bleeping-computer

The FBI has issued a warning about ongoing FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways, where threat actors use leaked or stolen credentials to gain access and lock out legitimate administrators. Attackers extract authentication data and crack password hashes offline using distributed GPU clusters with tools like Hashcat and Hashtopolis. The compromised access is used as an initial entry point for ransomware affiliates, including INC/Lynx and Payload ransomware groups, who establish persistence, move laterally, and in some cases, sell access. The original FortiBleed leak exposed plaintext credentials for over 86,000 devices, and attackers have been observed creating new admin accounts, deleting existing ones, and preparing compromised access for sale.

3w ago · hacker-news

A critical unpatched vulnerability, CVE-2026-105192, exists in LMCache versions 0.3.9 through 0.5.5 and affects release candidates and the development branch. The flaw resides in the multiprocess mode where the cache server uses ZeroMQ without authentication and deserializes untrusted data using Python's pickle module, allowing unauthenticated remote code execution. Attackers can execute arbitrary code with the privileges of the LMCache process, which runs as root in official container images. JFrog, who discovered the flaw, warns operators to avoid exposing the multiprocess server to routable networks until a fix is available.

3w ago · hacker-news

SonicWall has patched four vulnerabilities in its SMA1000 appliances, the most severe being a pre-authentication server-side request forgery (SSRF) flaw tracked as CVE-2026-102255 with a CVSS score of 10.0. This SSRF vulnerability exists in the WorkPlace portal and could allow unauthenticated attackers to send requests through the appliance to access internal functionality and perform unauthorized operations. The other three flaws require authentication and include an OS command injection, a Zip Slip vulnerability, and a stored cross-site scripting (XSS) issue. SonicWall has not observed exploitation in the wild for these newly patched flaws, but notes this is the third time in 2026 a CVSS 10.0 pre-auth SSRF flaw has been fixed in WorkPlace.

3w ago · bleeping-computer

A critical unauthenticated file-access vulnerability, CVE-2026-21589, affecting multiple self-hosted Atlassian products including Jira, Confluence, and Bitbucket, is being actively exploited in the wild. The flaw allows attackers to perform directory traversal via a shared web-resource library that converts double colons into forward slashes, enabling unauthorized access to sensitive files such as crowd.properties containing plaintext credentials. Exploitation attempts were observed within hours of a public proof-of-concept release by watchTowr, and a Nuclei template has since been published, accelerating automated scanning and exploitation. Affected organizations are urged to patch immediately or apply mitigations such as WAF rules or network access restrictions.

3w ago · bleeping-computer

The PoeLLM malware is a cryptomining campaign targeting exposed AI servers, particularly those running LiteLLM, Ollama, Gotenberg, and Gitea. It uses an ELF file named libgcrypt that retrieves command-and-control (C2) addresses by extracting keywords from a poem hosted on GitHub, which are then mapped to IPv4 addresses via a hardcoded dictionary. The malware enables remote shell access, deploys XMRig and Iron cryptocurrency miners, and turns infected servers into scanners to propagate further, exploiting CVE-2026-42271 and potentially chaining it with CVE-2026-48710 for unauthenticated RCE. Over 3,400 servers have been compromised, primarily in the US and Western Europe, with C2 infrastructure showing signs of Italian origin.

3w ago · bleeping-computer

Hackers breached third-party operators managing country-code top-level domains (ccTLDs) for Ghana (.GH), Sierra Leone (.SL), and American Samoa (.AS), gaining control of authoritative DNS records. This allowed them to hijack domains and obtain unauthorized HTTPS certificates by passing domain ownership validation at Certificate Authorities. The attackers could then impersonate legitimate services and serve malicious content. Google detected the abuse through Certificate Transparency logs, blocked the rogue certificates in Chrome via CRLSets, and notified affected organizations, though it emphasized its own systems were not compromised.

3w ago · hacker-news

Over 100 compromised websites have been injected with malicious JavaScript that displays a fake Cloudflare verification page to deliver LunexStealer, an information-stealing malware. The attack, attributed to threat cluster UAC-0277, uses social engineering via the 'ClickFix' technique to trick users into executing a malicious MSI package. The malware installs a malicious browser extension called LUNARAXE, which steals credentials and browsing data, and deploys an auxiliary component NAIVEMESS for file system access via PowerShell. The campaign uses Ethereum-based smart contracts (EtherHiding) to control script behavior and target Windows users arriving from search engines.

3w ago · bleeping-computer

SonicWall has disclosed a maximum-severity server-side request forgery (SSRF) vulnerability, tracked as CVE-2026-102255, affecting SMA1000 series appliances (6210, 7210, and 8200v models). The flaw exists in the Appliance WorkPlace interface and allows unauthenticated remote attackers to direct the appliance to make internal requests, potentially accessing restricted functionality. While there is no current evidence of exploitation in the wild, the vulnerability poses significant risk due to the strategic positioning of SMA1000 gateways in enterprise networks. SonicWall urges customers to apply released hotfixes immediately to mitigate potential attacks.

3w ago · hacker-news

A new ClickFix attack technique leverages browser cache smuggling to bypass Windows Run dialog character limits and execute malicious payloads. Attackers trick users into pasting commands that retrieve and execute cached scripts, such as VBScript, which then download PowerShell payloads and establish persistence. The attack chain leads to credential theft via .NET assemblies injected into legitimate processes like 'timeout.exe' and connects to malicious domains for further stages. This method has been used by nation-state actors like North Korea's Stardust Chollima and Russia's Sandworm.

3w ago · hacker-news

Unauthorized parties accessed the personal data of approximately 8.8 million individuals in Denmark's Central Person Register (CPR) by exploiting a private company's legitimate access rights. The breach occurred over a 10-day period in September, during which a large volume of automated queries were made to identify valid CPR numbers. The Danish digitalization ministry confirmed the incident, noting that names, addresses, and CPR numbers were exposed, though it remains unclear how attackers gained access to the company's credentials or whether the data was exfiltrated or used. The company's access has since been revoked, and investigations are ongoing by both the data protection authority Datatilsynet and law enforcement.

3w ago · hacker-news

The FBI removed an Accenture contractor following a data breach that exposed personal information of thousands of FBI employees. The breach occurred due to the contractor's failure to apply a critical security patch on Oracle PeopleSoft, which was exploited by the ShinyHunters threat group. ShinyHunters leveraged a URL-encoding bypass technique to exploit CVE-2026-35273 in the PeopleSoft Environment Management Hub (PSEMHUB), circumventing web application firewall protections. The FBI has taken steps to mitigate further risk and is actively investigating with partner agencies, resulting in multiple arrests linked to ShinyHunters.

3w ago · hacker-news

Linux backdoors have been observed targeting telecom and network appliances in South Korea and Taiwan by impersonating legitimate email security tools such as SpamSniper and ShareTech to evade detection. The threat involves a new variant of BPFDoor and a previously undocumented Linux implant named AVERAT, both using process name spoofing and C2 over SMTP on port 25. The BPFDoor variants are linked to the Red Menshen threat group and use BPF-based magic packet triggering wrapped in HTTPS POST requests to bypass deep packet inspection. AVERAT is deployed via a dropper that decrypts payloads using the key 'ShareTech' and supports extensive post-compromise capabilities including shell access, file upload/download, and process manipulation.

3w ago · hacker-news

Cybersecurity researchers have uncovered a human-operated phishing platform impersonating AI chatbot advertising portals such as ChatGPT, Google Gemini, and Anthropic Claude. The fake portals use the browser-in-the-browser (BitB) technique to spoof legitimate login pages and harvest credentials and multi-factor authentication (MFA) codes. The campaign targets agency staff and ad account administrators, aiming to steal and monetize advertising accounts. The infrastructure leverages Next.js and Socket.IO, shares common endpoints, and has exposed source code via misconfigured GitHub repositories.

3w ago · bleeping-computer

A phishing campaign targeting advertising account managers uses fake websites mimicking AI platforms like ChatGPT, Gemini, Claude, and Perplexity to steal login credentials and multi-factor authentication (MFA) codes. The attack employs browser-in-browser (BitB) techniques, where a fake Google login window is rendered inside an iframe, tricking users into submitting their credentials and MFA codes. The operation is part of a larger infrastructure using Next.js, Socket.IO, and Vercel frontends, with backend services on Railway or Render, and includes lures such as fake recruitment and refund pages. Human operators manage the phishing flow in real time, requesting credentials and MFA codes via Socket.IO events.

3w ago · bleeping-computer

UK fashion retailer ASOS confirmed a data breach after hackers sent unauthorized 'ASOS HACKED' push notifications through its mobile app, claiming to have compromised its Snowflake environment and exfiltrated customer data. The attackers directed ASOS to a Telegram channel operated by the 'Xuanye group' and claimed the breach did not affect payment information, though they later stated customer data was stolen. ASOS confirmed unauthorized access to third-party communication platforms and warned customers not to interact with the malicious notification, but has not verified the extent of the compromise or confirmed the attackers' claims.