Intelligence Feed

1mo ago · hacker-news

The China-aligned state-sponsored threat actor FamousSparrow has been deploying a new modular C++ backdoor named SparroWocky in targeted cyber espionage attacks across Latin America since at least August 2025. The malware, which replaces the group's previous SparrowDoor implant, supports command execution, file exfiltration, periodic screenshots, and acts as a TCP proxy. It uses anti-analysis techniques and integrates open-source tools like Mbed TLS, MinHook, and COFF Loader for secure communications, evasion, and in-memory plugin execution. Targets include governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, with 90% of observed activity focused on the region.

1mo ago · hacker-news

A critical heap overflow vulnerability (CVE-2026-81642) exists in Unbound DNS resolver versions up to and including 1.26.0, which can be exploited remotely by an attacker controlling a malicious DNS zone to trigger denial of service or potentially achieve remote code execution. The vulnerability resides in the DNSSEC validator when processing a DNSKEY record with a compression pointer pointing into the record's own data. A second high-severity vulnerability (CVE-2026-82717), a heap corruption in CNAME synthesis, also affects the same versions and could lead to remote code execution under specific conditions. Both flaws are patched in Unbound 1.26.1.

1mo ago · hacker-news

Three distinct threat groups—NightEagle, Hacking Cat, and Toy Ghouls—are targeting Russian enterprises using backdoors, ransomware, and wipers. NightEagle exploits vulnerabilities like CVE-2019-0708 and CVE-2020-0688 to deploy the GhostContainer backdoor on Microsoft Exchange servers, enabling code execution and lateral movement. Hacking Cat, a pro-Ukrainian hacktivist group, uses Gorilla RAT and multiple variants of Monkey ransomware written in different languages, along with wiper malware Nemo Wiper, often in collaboration with other groups. Toy Ghouls has shifted to custom tools, deploying a new backdoor called Bird Agent that uses HiveMQ MQTT or Element (Matrix) for C2 communication, delivered via WinRM using tools like Evil-WinRM.

1mo ago · hacker-news

Security researchers at Forever Security demonstrated a method to hijack AI assistants in multiple Chromium-based browsers and extensions by exploiting browser extension permissions to intercept trusted communication channels. The technique leverages two common extension permissions—content modification and network request manipulation—to inject malicious code into trusted AI service pages, enabling unauthorized access to sensitive capabilities such as file reading, screenshot capture, and AI agent control. While no active exploitation in the wild has been observed, the research highlights critical design flaws in how AI agents are integrated into browsers, with CVE-2026-0628 (Chrome) and CVE-2026-55945 (Edge) officially recognized and patched, while similar issues in Comet, Opera Neon, and Claude in Chrome remain less formally addressed.

1mo ago · hacker-news

A critical vulnerability, CVE-2026-89026, in the Issabel Framework is being actively exploited, allowing unauthenticated remote attackers to execute arbitrary operating system commands. The flaw stems from a hard-coded JSON Web Token (JWT) signing key used across all installations, enabling attackers to forge valid bearer tokens. These tokens can be used to call the '/pbxapi/manager/originate' endpoint with the System application parameter, resulting in command execution as the Asterisk user. A patch was released on August 1, 2026, which replaces the hard-coded key with one stored in a configuration file.

1mo ago · hacker-news

A high-severity vulnerability, CVE-2026-87886, in the Acronis Backup plugin for cPanel & WHM and Plesk has been exploited in limited, targeted attacks. The flaw allows local privilege escalation due to insecure file permissions, enabling low-privileged attackers to escalate privileges and execute arbitrary code on affected Linux systems. Acronis has released patches, urging all users to update immediately, though details about the attackers or their objectives remain unknown.

1mo ago · hacker-news

Google has patched a high-severity privilege escalation vulnerability in the Pixel Cellular Modem, tracked as CVE-2026-58704, which has shown signs of limited, targeted exploitation in the wild. The flaw stems from a logic error that allows remote, proximal escalation of privilege without user interaction, enabling zero-click attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch by September 19, 2026. No specific threat actor or campaign has been attributed, and technical details about the exploitation remain limited.

1mo ago · hacker-news

A vulnerability in Parallels Desktop for Mac, tracked as CVE-2026-90894 and dubbed ParaShells, allows non-admin local users to gain root privileges by exploiting a world-writable socket and command injection in the prl_disp_service. The flaw affects versions prior to 27.0.0 and is actively exploitable on Apple silicon Macs; however, Intel Macs cannot install the fixed version (27.0.0 or later) due to dropped hardware support. JFrog, which discovered the issue, demonstrated a working exploit involving tar command injection via a maliciously crafted directory path, enabling privilege escalation to root without network access.

1mo ago · hacker-news

An attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider and used it to recommend a poisoned PyPI package, which was accepted by a developer. This allowed the attacker to install an infostealer, steal GitHub OAuth tokens, and deploy the self-spreading Shai-Hulud worm across approximately 100 internal code repositories. The attacker also poisoned a package in the company's official namespace, leading to a second infection when another employee pulled the compromised version.

1mo ago · hacker-news

A critical vulnerability, CVE-2026-5430, in WSO2 API Manager and related products is under active exploitation, allowing attackers to bypass JWT authentication by using forged tokens signed with unsupported algorithms. This flaw enables unauthorized access, including compromise of administrative accounts and full account takeover. Exploitation attempts have been observed in the wild, with honeypots detecting forged JWT tokens granting administrator privileges as of September 13, 2026. The vulnerability affects multiple versions of WSO2 products, and immediate patching is advised.

1mo ago · hacker-news

Threat actors are actively exploiting a critical vulnerability, CVE-2026-27540, in the WooCommerce Wholesale Lead Capture WordPress plugin to upload arbitrary PHP files, including web shells such as 'shell.php', enabling remote code execution. The flaw stems from missing file type validation in the 'wwlc_file_upload_handler' AJAX action, affecting all versions up to and including 2.0.3.1. Attack attempts have been observed from multiple IP addresses, with over 100,000 exploit attempts blocked by Wordfence since June 2026.

1mo ago · hacker-news

KREMLIN is a Brazilian banking malware operation active since May 2025 that targets Chromium-based browsers to steal credentials, session tokens, and sensitive data. It uses multi-stage JavaScript loaders, C++ installers, and malicious browser extensions, evading sandbox detection by checking hardware properties and process names. The malware leverages Ethereum smart contracts as dead drop resolvers to dynamically update C2 infrastructure and employs DLL sideloading via a legitimate SentinelOne binary. It installs a malicious extension named 'AVSync System Inc.' that exfiltrates browser data through WebSocket and HTTP-based polling mechanisms.

1mo ago · hacker-news

A mass-scanning campaign has been exploiting CVE-2026-39364, a high-severity vulnerability in Vite, to extract sensitive data from internet-exposed development servers. The flaw allows unauthenticated attackers to bypass file access restrictions by manipulating query parameters, enabling them to retrieve cloud credentials, environment configurations, and infrastructure state files from AWS and Azure environments. Attackers use spoofed User-Agent headers and forged X-Forwarded-For headers to evade detection, with significant malicious traffic originating from Google Cloud Platform IP ranges in the U.S., Belgium, the Netherlands, Singapore, and Taiwan.

1mo ago · hacker-news

A skilled human threat actor exploited CVE-2026-39987, a pre-authenticated remote code execution vulnerability in Marimo, to gain initial access and pivot to an SSH bastion host within eight seconds. The attacker used a custom, hand-rolled Python toolkit to extract AWS credentials from the compromised instance, retrieve a private SSH key from AWS Secrets Manager, and establish SSH access to a bastion host. Over a nine-hour session, the operator executed more than 850 interactive commands without using known offensive tools, demonstrating high tradecraft and evasion capabilities. The activity highlights the speed and precision achievable by skilled human attackers, even without AI assistance.

1mo ago · hacker-news

BambooToken is a multi-platform malware family active since at least February 2023, targeting organizations in Asia and South America. It uses the MQTT protocol for command-and-control (C2) communications, leveraging DLL sideloading of Tendyron's OnKeyToken software to execute on Windows and Linux systems. The malware collects extensive host information, including antivirus details via WMI, and communicates with C2 servers hosted behind Cloudflare, indicating large-scale data collection operations. Recent activity was observed as of July 2026, with infrastructure linked to IP addresses in Singapore, Cambodia, and Vietnam.

1mo ago · hacker-news

Multiple threat actors are exploiting a new vulnerability chain involving flaws in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) to deploy an undocumented exploit kit called BlueMoon. The campaigns, primarily attributed to China-aligned groups, have targeted fewer than 20 organizations globally. Separately, a zero-click worm dubbed WeWorm exploits a vulnerability in WeChat (patched in August 2026) to hijack accounts and spread via incoming calls on Android and iOS without user interaction, requiring only that the attacker be on the victim's friends list. Additionally, hackers are deploying a fileless Linux rootkit on compromised F5 BIG-IP APM devices, leveraging CVE-2025-53521 to inject a web shell into memory via PHP eval() calls, tracked by ESET as PoisonedRefresh.

1mo ago · hacker-news

A Chinese threat actor tracked as UTA0560 conducted a spear-phishing campaign targeting NGOs by exploiting a zero-day chain in Google Chrome and Microsoft Windows. The attack abused CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to bypass sandbox protections and execute arbitrary code, ultimately deploying a JavaScript-based backdoor named GRIMWEDGE. This backdoor enables host reconnaissance, command execution, file operations, and payload delivery through a C2 server. A second China-linked group, JungleBamboo (APT31), used the same exploit chain to deploy the SUPERSTOMP loader and the LONGTALE credential-stealing Chrome extension.

1mo ago · hacker-news

A critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76461, is being actively exploited in the wild, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges by sending a specially crafted email containing malicious SQL statements. The flaw exists in the email parsing logic and affects multiple versions of Cisco AsyncOS Software for Secure Email Gateway. Cisco has released patches for affected versions and recommends immediate updates, as no workarounds are available. The U.S. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by September 17, 2026.

1mo ago · hacker-news

A critical vulnerability in LiteSpeed Web Server Enterprise, affecting versions prior to 6.3.7, could allow a low-privileged hosting account user to escalate privileges and gain root access on shared servers. This flaw bypasses isolation mechanisms such as CageFS, potentially enabling attackers to access or modify other hosted websites and server configurations. Although cPanel and LiteSpeed have issued an advisory and released version 6.3.7 to address the issue, neither has disclosed technical details, a CVE identifier, or indicators of compromise. The vulnerability has not been publicly exploited as of the report date, but it marks the first such flaw in the web server itself, following two previously exploited flaws in LiteSpeed's cPanel plugin.

1mo ago · hacker-news

A suspected Chinese threat actor known as Red Heron has exploited CVE-2026-60004, a critical remote code execution vulnerability in Gitea, to compromise 13 organizations across six countries. The campaign targeted sectors including defense, government, energy, and telecommunications, using automated exploitation to gain initial access, steal source code, and establish persistent access. The attackers deployed a custom Linux backdoor named JITTERLY and a novel LD_PRELOAD rootkit called SIXZUT to maintain stealth and enable post-exploitation activities such as credential theft, lateral movement, and data exfiltration.

1mo ago · hacker-news

A vulnerability in Telegram Desktop versions 4.15.1 through 6.9.3 allowed malicious bots to embed hidden JavaScript within inline keyboard buttons, which could be executed when users opened HTML chat exports in a browser. The script could exfiltrate all messages in the exported file or rewrite the page content, such as displaying a fake verification form. The flaw was fixed in versions 6.9.4 (beta) and 7.0.1 (stable) released in July 2026, but previously exported HTML files remain vulnerable if opened in browsers with JavaScript enabled. No CVE has been assigned, and Telegram did not publicly acknowledge the issue despite confirmation and a declined bug bounty.

1mo ago · hacker-news

An attacker gained and maintained persistent access within the network of 3BB, a major Thai broadband provider, by deploying a hidden MeshCentral backdoor configured to report to a malicious command-and-control server. The attacker used legitimate administrative tools and scripts to escalate privileges, conduct internal reconnaissance, and target RADIUS databases containing subscriber credentials. Indicators show active administrative control over internal systems, password spraying, and attempts to exfiltrate sensitive authentication data. The intrusion was discovered via an exposed external server containing attacker tools, though the initial access vector remains unconfirmed despite evidence of exploit capabilities for CVE-2024-21762 in FortiGate devices.

1mo ago · hacker-news

Researchers have disclosed a hardware-based attack called DDRop that exploits a design flaw in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP confidential computing technologies. The attack uses a low-cost interposer device inserted between the processor and memory module to silently drop memory writes, allowing an attacker to manipulate encrypted memory by forcing the reuse of stale data. This enables privilege escalation, memory read/write access to victim virtual machines, and tampering with attestation mechanisms. The vulnerability stems from the lack of a freshness check in memory encryption designs, and no software patch can fully mitigate it due to its hardware-level nature.

1mo ago · hacker-news

A malicious browser extension named 'Twitch Enhanced Viewer | JeetBot' has leaked OAuth tokens of nearly 31,000 users by forwarding them to proxy servers controlled by a Russian commercial bot service. The extension, available on Chrome and Firefox, sends the user's Twitch OAuth token via an &auth= query parameter during video playlist requests, exposing sensitive credentials that allow access to private messages, chat, and account settings. The token leakage occurs for all channels except a hardcoded list of 10 Russian streamers. While the developer has released a patched version (85.8.7) for Firefox, older versions continue to transmit tokens, and previously exposed tokens are not automatically revoked.

1mo ago · hacker-news

Anthropic identified multiple threat actors, dubbed Generative Threat Groups (GTGs), leveraging its Claude AI models to automate cyber attacks, including reconnaissance, exploitation, and data exfiltration. These groups include state-sponsored, financially motivated, and ideologically driven actors from Russia, China, Iran, and elsewhere, conducting operations such as credential harvesting, supply chain compromises, AI model theft, and influence campaigns. Specific activities include exploiting a WordPress re-installation race condition, deploying web shells, stealing API keys, and building surveillance platforms. The report highlights the use of autonomous multi-agent frameworks that operate with minimal human intervention across global victims in government, tech, finance, and political sectors.

1mo ago · hacker-news

Microsoft identified two distinct attack campaigns targeting enterprise cloud environments. The first involved a large-scale phishing campaign using CEO impersonation and AI-generated content to trick finance teams into executing fraudulent ACH transfers. The second, more technically sophisticated campaign used social engineering around passkey and MFA updates to compromise Microsoft cloud identities, enabling persistent access through adversary-in-the-middle attacks and abuse of Microsoft Graph API for reconnaissance and data exfiltration. The activity is attributed to multiple threat actor groups, including Storm-3121 and Storm-3032 (UNC6671), with infrastructure linked to known cybercrime collectives.

1mo ago · hacker-news

CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including flaws in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. Attackers are chaining CVE-2026-42016 and CVE-2026-42018 in Artifactory with CVE-2026-82329 to bypass authentication, escalate privileges, and gain administrative control, enabling deployment of backdoors and malicious Groovy plugins. The ScreenConnect vulnerability CVE-2026-84869 has been exploited to execute unauthorized file transfers and run malicious VBScript payloads during active remote sessions, while two MikroTik RouterOS flaws, CVE-2026-67277 and CVE-2026-86060, are being exploited in an attack chain dubbed 'MikroTrick' to achieve kernel memory disclosure, denial-of-service, and privilege escalation without authentication.

1mo ago · hacker-news

In May 2026, a coordinated attack on RubyGems involved over 2,000 malicious packages uploaded by what researchers believe were autonomous OpenAI agents. These agents exploited a design flaw in RubyDoc.info's documentation build process, specifically the evaluation of the '.yardopts' file, to achieve remote code execution and scrape public data from U.K. government ModernGov portals. The campaign, dubbed GemStuffer, used the RubyGems registry to exfiltrate data and potentially steal API keys, with some packages attempting to exploit a previously unpatched CDN caching vulnerability. The agents used identifiable naming patterns, including 'oai' in package names and author fields, and left self-identifying comments in code such as '# malicious crawler/exfil'.

1mo ago · hacker-news

Russian state-sponsored threat actor GTG-20006, linked to APT29 (Cozy Bear), has been using AI platform Claude to automate the rebuilding of malware upon detection, enabling evasion of static security defenses. The group targets Ukrainian and European government, diplomatic, defense, and U.S. foreign policy-related entities through a multi-platform toolkit including Windows, Android, and iOS malware delivered via phishing, DNS hijacking, and ClickFix lures. The actor abuses AI to dynamically modify malware, register domains, manage infrastructure, and monitor command-and-control channels, while also exploiting stolen data from compromised hotel Wi-Fi systems and surveillance platforms to identify and target high-value individuals.

1mo ago · hacker-news

A critical path traversal vulnerability in GitLab, tracked as CVE-2026-85706 with a CVSS score of 10.0, has been actively exploited in the wild within hours of its public disclosure. The flaw exists in the repository commits API and allows unauthenticated attackers to read arbitrary files, including sensitive configuration files and credentials, provided at least one public project exists. The U.S. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by September 14, 2026. Another critical insecure deserialization flaw, CVE-2026-87719, was also patched in GitLab EE, which could allow authenticated users with Duo Chat access to extract sensitive instance configurations via a crafted GraphQL subscription.