Intelligence Feed

1mo ago · hacker-news

Multiple active threats were reported this week, including a Chrome zero-day under active exploitation (CVE-2026-85046), which allows remote code execution via a crafted HTML page. MikroTik RouterOS devices are being targeted using an exploit chain called MikroTrick, combining CVE-2026-67276 and CVE-2026-86060 to achieve unauthenticated remote code execution. Unpatched Magento and Adobe Commerce stores are being compromised via a zero-day named StyleSmuggler, leading to backdoor installation. A supply chain attack on Coder's infrastructure delivered malicious Terraform modules that steal credentials. Additionally, the RevStealer information stealer is spreading via fake game cheats and a counterfeit Claude desktop app, using blockchain-based dead drops for resilience.

1mo ago · hacker-news

A threat cluster tracked as PREY-0058 by Arctic Wolf is conducting data theft and extortion attacks targeting Microsoft 365 users, primarily executives, through vishing (voice phishing) and adversary-in-the-middle (AitM) attacks. Attackers impersonate IT help desk personnel and direct victims to malicious authentication pages using domains that mimic legitimate services, such as 'mfaregister[.]com', to steal credentials and MFA tokens. These tokens are then replayed via residential proxy infrastructure to access Microsoft 365 services, enabling large-scale data exfiltration from SharePoint, OneDrive, Exchange, and Box without deploying malware or moving laterally within networks.

1mo ago · hacker-news

JSCeal is a compiled V8 JavaScript malware designed to steal browser credentials, cookies, and OAuth tokens, enabling attackers to bypass Google authentication via session replay attacks. It is distributed through malvertising campaigns, particularly the SourTrade operation, which impersonates legitimate cryptocurrency trading platforms like TradingView, Solana, and Luno. The malware uses heavy obfuscation techniques and in-memory assembly to avoid detection, and includes modules for keystroke logging, screenshot capture, and traffic interception via a local proxy targeting financial and cryptocurrency services.

1mo ago · hacker-news

N-able has released Hotfix 4 (build 2026.3.1.14) for its N-central RMM platform to address CVE-2026-86218, a critical unauthenticated remote code execution vulnerability with a CVSS score of 10.0. The flaw affects all on-premises builds prior to 2026.3.1.14, including those recently updated to Hotfix 3. N-able's incident notice states the vulnerability has been exploited in the wild, though the company's release notes claim no confirmed exploitation. Huntress observed a compromise of a fully patched N-central environment and reproduced a PoC exploit chain, but could not confirm whether CVE-2026-86218 was the exploited vector due to log rotation.

1mo ago · hacker-news

Elastic Security Labs identified four malicious modules—ProManager, WinUpdate, SoftManager, and LockAppHost—linked to the REVSTEALER information stealer. These modules persist on infected systems after the main stealer deletes itself and perform various malicious activities, including cryptocurrency wallet theft, clipboard manipulation, reverse proxy setup, and cryptocurrency mining. LockAppHost disables Windows Update and Microsoft Defender to run a miner with elevated privileges, weakening system defenses. The modules share code and infrastructure with REVSTEALER, including use of Polygon blockchain for C2 resiliency and common packer techniques.

1mo ago · hacker-news

Attackers are exploiting a vulnerability chain in MikroTik RouterOS, dubbed 'MikroTrick' by CERT Polska, to gain full administrative control of internet-exposed routers via SSH without authentication. The attacks, observed since at least September 2, 2026, target unpatched devices across multiple RouterOS versions. CERT recommends immediate updates to fixed firmware versions, as temporary mitigations include disabling exposed management services and avoiding use of built-in clients from unpatched systems. Evidence of compromise includes unexpected privileged accounts and specific SSH login logs.

1mo ago · hacker-news

A zero-day vulnerability in Magento Open Source and Adobe Commerce, dubbed StyleSmuggler, is being actively exploited to achieve unauthenticated remote code execution and install persistent backdoors on e-commerce platforms. The attack chain leverages malicious input in log files and abuse of Magento's internal classes to execute a PHP dropper, which downloads and runs a malicious Rust-based implant. The backdoor runs under a disguised process name and establishes persistence via cron, with capabilities to read session data from Redis. No data exfiltration or lateral movement has been observed so far, but the threat is ongoing. Adobe has not yet released a patch or official advisory.

1mo ago · hacker-news

Trezor disclosed that a breach at its shipping provider ShipMonk exposed personal data of 67,000 U.S. customers, including names, email addresses, phone numbers, shipping addresses, and order numbers from November 2019 to August 2021. The breach resulted from a zero-day SQL injection vulnerability, CVE-2026-72898, in Metabase that was exploited by the ShinyHunters extortion gang. Although Trezor had received assurances from ShipMonk that customer data was deleted, it remained in ShipMonk's systems and was accessed during the incident. Trezor warned users about potential social engineering and phishing attacks leveraging the stolen data.

1mo ago · hacker-news

Broadcom has patched two security vulnerabilities in VMware Workstation and Fusion, including a critical integer-overflow flaw (CVE-2026-59346) that could allow a local attacker with administrative privileges on a virtual machine to execute arbitrary code on the host. The second vulnerability is a stack-based buffer overflow in HGFS (CVE-2026-59347) that can also be exploited by a local admin to run code in the context of the VMX process on the host. Both vulnerabilities require local admin access within the VM, but could be leveraged after initial compromise via phishing or misconfigurations. The updates apply to versions 25H2 and 26H1, with fixes included in 26H1u1 releases. While no known in-the-wild exploitation of these specific flaws has been observed, recent VMware vCenter vulnerabilities have been actively exploited, including by a China-nexus APT actor.

1mo ago · hacker-news

In August 2026, unidentified threat actors exploited a critical vulnerability, CVE-2026-63077, in JetBrains' TeamCity server to breach the Cadence cloud service environment. The attackers gained access to a 2024 backup of the Cadence server, extracting sensitive data including personal information, source code, and AWS IAM credentials belonging to JetBrains employees and users. JetBrains confirmed unauthorized access between August 8 and 24, 2026, and urged all Cadence users to immediately rotate credentials and treat all executions as potentially compromised due to exposure of secrets and configurations.

1mo ago · hacker-news

PostgreSQL has patched a 12-year-old vulnerability, CVE-2026-6471, affecting versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The flaw allows an authenticated replication user to execute arbitrary code as the database OS user by exploiting unvalidated plugin paths in logical decoding. Attackers can leverage path traversal in the CREATE_REPLICATION_SLOT command to load malicious libraries from remote SMB or NFS shares, or local disk, achieving privilege escalation and persistence. The fix introduces a whitelist parameter, output_plugin_libraries, to restrict allowed decoding plugins, but gaps remain, such as in pg_createsubscriber behavior.

1mo ago · hacker-news

Threat actors are actively exploiting two vulnerabilities in PaperCut software, identified as CVE-2026-81578 and CVE-2026-82078, to conduct unauthorized access and credential theft targeting educational institutions in the U.S. and Europe. The attackers chain an authentication bypass with remote code execution to create privileged accounts, execute commands, and deploy credential-harvesting tools such as lsa_collect.exe and save_hives.exe. Post-exploitation activities include collecting Windows registry hives, searching configuration files for secrets, and exfiltrating data to attacker-controlled IP addresses.

1mo ago · hacker-news

A previously undocumented Linux backdoor named 'ted' has been discovered embedded within trojanized HAProxy binaries deployed at two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, enables command-and-control (C2) communication by mimicking legitimate HTTP responses, and allows attackers to execute shell commands, upload/download files, and modify configurations. Rapid7 Labs attributes the activity with medium confidence to North Korean state-sponsored actors, potentially linked to APT37, Lazarus, and Kimsuky clusters, based on infrastructure overlaps and operational patterns. The backdoor evades logging by manipulating HAProxy's internal connection counters and uses trojanized system binaries such as crond, sshd, agetty, atd, and polkitd to maintain persistence and exfiltrate credentials.

1mo ago · hacker-news

A high-volume phishing campaign has been leveraging invisible Unicode tag characters, specifically from the Unicode Tags block (U+E0000 to U+E007F), to obfuscate financial lure words such as 'funding' and evade email security filters. The technique, known as ASCII Smuggling, splits keywords with non-rendering characters (e.g., 'fun⟨U+E0020⟩ding') to bypass literal string detection while appearing normal to human recipients. The campaign has sent millions of emails daily, primarily targeting Small Business Administration (SBA) loan applicants, using the ActiveCampaign platform to distribute AI-generated phishing emails and dynamically generated, convincing phishing websites. The operation uses disposable finance-themed domains and leverages ActiveCampaign's infrastructure for link tracking, complicating reputation-based filtering.

1mo ago · hacker-news

BraZetsu is a sophisticated Python-based Windows malware framework used by the threat actor Exilware to compromise systems and monetize access via the 'Infected Marketplace' (aka 'Banco de Infects'). The malware conducts deep reconnaissance, steals financial data including CNAB-format remittance files, captures screenshots, and enables remote command execution. It leverages generative AI for target triage and prioritization, and maintains persistent communication via WebSocket. BraZetsu shares infrastructure and code with AgenteV2, indicating they are part of the same malware framework. The campaign primarily targets Iberian and Latin American organizations in e-commerce, finance, and critical infrastructure sectors.

1mo ago · hacker-news

Cisco disclosed a critical vulnerability, CVE-2026-20212, in 10 Silicon One-based Nexus 9000 switches that allows unauthenticated remote attackers to execute code with root privileges by exploiting exposed TCP ports 43210 and 43211. The flaw stems from binding to an unrestricted IP address, enabling direct access to a privileged service. Cisco has released patches and recommends immediate upgrades, while also providing temporary mitigations such as infrastructure ACLs and a Live Protect shield. Separately, a hardening release for IOS XR addresses 7 CVEs, including two rated 9.8, and ongoing exploitation of similar infrastructure is linked to the China-nexus threat actor Fire Ant, which has deployed stealthy implants on IOS XR routers to manipulate traffic and exfiltrate data.

1mo ago · hacker-news

Multiple threat campaigns are leveraging social engineering, phishing-as-a-service (PhaaS), and abuse of trusted software to gain unauthorized access to corporate and personal accounts. Microsoft Teams is being abused in vishing attacks to trick users into granting remote access via RMM tools, while PhaaS platforms like Outsider and BlueKit enable credential theft through browser-in-the-middle attacks. Malicious actors are also exploiting misconfigurations in AI instruction files (llms.txt) to deliver malicious packages, and trojanized Electron apps are distributing the RevStealer information stealer. Additionally, attackers are abusing legitimate tools like Faronics Deploy and ScreenConnect to establish persistent remote access, and ransomware operations such as The Gentlemen and CRPx0 continue to target organizations with sophisticated, multi-stage attack chains.

1mo ago · hacker-news

Google has released a security update for Chrome to address CVE-2026-85046, a high-severity type confusion vulnerability in the V8 JavaScript and WebAssembly engine that is actively exploited in the wild. The flaw allows a remote attacker to execute arbitrary code within the sandbox by using a crafted HTML page. Security researcher Salvatore Gulizia discovered and reported the vulnerability, which stems from incorrect handling of JavaScript array maps leading to arbitrary read/write capabilities on the JavaScript heap. Users are urged to update to Chrome version 152.0.7977.82 or later to mitigate the risk.

1mo ago · hacker-news

Plex has urged users to immediately update their Plex Media Server and Desktop applications to version 1.43.3 and 1.115.0, respectively, to address multiple undisclosed security vulnerabilities for which CVE identifiers have been requested. While specific details about the newly patched flaws were not disclosed, historical vulnerabilities in Plex Media Server have enabled serious attacks, including infrastructure enumeration and unauthorized access. The article highlights past exploited flaws such as CVE-2025-34158, which allowed lower-privileged users to access administrative tokens and discover linked servers, and CVE-2020-5741, which was used in the 2022 LastPass breach to deploy keyloggers on an employee's machine.

1mo ago · hacker-news

Threat actors are actively exploiting two critical remote code execution (RCE) vulnerabilities in WordPress plugins Super Forms and Elementor Pro. CVE-2026-14894 and CVE-2026-32475 allow unauthenticated attackers to upload arbitrary PHP files, enabling remote code execution via web shells. Exploitation attempts have exceeded 440,000, with attacks observed since July 14, 2026, peaking in August. Attackers upload PHP web shells such as 'Mushr00w_upl.php' and leverage them to execute commands, exfiltrate data, or take control of WordPress sites.

1mo ago · hacker-news

Threat actors are leveraging the legitimate Node.js runtime (node.exe) to deliver malware in targeted attacks against government departments, technology firms, and hotels since February 2026. By using signed, trusted binaries and executing malicious JavaScript scripts, attackers evade signature-based detection. The attacks involve tools such as AdaptixC2, Cobalt Strike, ModeloRAT, Mistic (MLTBackdoor), GateKeeper, and C2Looper, with initial access often gained via the ClickFix social engineering technique. Attackers also abuse EtherHiding and blockchain-based C2 infrastructure for resilience, making blocking efforts difficult.

1mo ago · hacker-news

Thomson Reuters disclosed a data breach affecting its C-Track court case management platform, which exposed sensitive personal information including Social Security numbers, driver's license numbers, and sealed or redacted court data. The unauthorized access occurred from March 1 to June 29, 2026, impacting court systems in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. The breach originated within Thomson Reuters' cloud environment, with backup data accessed without evidence of fraud or misuse to date. Investigations are ongoing, and affected individuals are being offered identity monitoring services.

1mo ago · hacker-news

Security researcher Chaotic Eclipse (aka INFINITE NIGHTMARE) disclosed a zero-day privilege escalation vulnerability in CrowdStrike Falcon Sensor dubbed FalconFlank, which exploits the product's handling of malicious Office macros. A proof-of-concept (PoC) has been released and reportedly works on fully updated Windows 11 25H2 and Windows Server 2025 systems with Falcon installed. The researcher also previously disclosed similar zero-days in Kaspersky's endpoint product (HardBreacher) and Microsoft Defender (ShieldBreak, CVE-2026-69414), the latter of which remains unpatched. The researcher claims Microsoft has not responded to their reports, prompting public disclosure.

1mo ago · hacker-news

A widespread RMM phishing campaign has targeted 46 countries, with the United States now the top target, accounting for 45% of observed activity. Attackers use social engineering lures tailored to specific regions, including tax forms, shipping notices, and Adobe PDFs, to trick victims into installing legitimate remote monitoring and management (RMM) software for malicious purposes. The campaign leverages rapidly rotating infrastructure hosted on Vercel, GitHub Pages, Netlify, and other platforms, with 94% of domains active for only one day, complicating detection. Persistent artifacts such as shared resources (e.g., font1.woff2, icons8-microsoft-word-94.png) and a consistent delivery pattern (secure.html → project/*.zip) link disparate infrastructure to the same operation, indicating a coordinated and adaptive threat.

1mo ago · hacker-news

CISA has added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in SonicWall SMA 1000, Sangoma Switchvox, JFrog Artifactory, Kludex Starlette, Kestra OSS, and Berri LiteLLM. Threat actors are exploiting these vulnerabilities to deploy reverse shells, execute arbitrary code, steal credentials, and deploy cryptocurrency miners. Exploitation of CVE-2026-83548 and CVE-2026-83549 in SonicWall devices has been confirmed, while CVE-2026-9586 and CVE-2026-82329 are being used to gain administrative access and conduct post-exploitation activities. Microsoft and Wiz report active exploitation of CVE-2026-42271 and CVE-2026-48710 in LiteLLM deployments, with attackers achieving remote code execution and stealing API keys, and CVE-2026-49869 in Kestra being used to establish reverse shells and deploy miners.

1mo ago · hacker-news

A member of Serbia's student protest movement had their iPhone infected with NSO Group's Pegasus spyware via an iMessage zero-click exploit between December 2025 and January 2026. The exploit has since been patched in iOS 18.4.1. At least 14 individuals in Serbia, including activists and opposition figures, have been targeted with advanced spyware in 2026, coinciding with local elections. A new variant of NoviSpy Android spyware was also identified, suggesting ongoing surveillance operations by Serbian authorities or affiliated actors.

1mo ago · hacker-news

A malware campaign attributed to the Chinese threat cluster Silver Fox (aka Yinhu) is distributing malicious fake software installers through spoofed vendor websites, primarily targeting Chinese-speaking users and multinational organizations in China. The installers deploy Gh0st RAT and ValleyRAT, which disable Windows Update services, weaken Microsoft Defender, and establish command-and-control communication via non-standard ports. The payloads use DLL sideloading and masquerade as legitimate installers to bypass security controls, enabling keystroke logging, clipboard theft, and remote system control.

2mo ago · hacker-news

SonicWall has identified and patched two zero-day vulnerabilities in its SMA 1000 series VPN appliances that are being actively exploited. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained together to enable remote unauthenticated attackers to gain unauthorized access and execute arbitrary commands on affected systems. The attack impacts specific versions of the SMA 1000 models 6210, 7210, and 8200v, and SonicWall advises customers to upgrade immediately, check for indicators of compromise, and reset credentials and TOTP if compromised.

2mo ago · hacker-news

A malvertising campaign on Meta platforms targeted Spanish-speaking users with ads promoting a fake TV streaming app that delivers the StreamRat Android banking trojan. The malware, once installed, requests Accessibility and other permissions to enable remote device control, keystroke logging, and overlay attacks. The dropper first installs a non-functional VPN to disrupt analysis, then downloads and installs the final payload. The campaign ran from June 11 to July 3, 2026, and was also promoted via TikTok, though attribution remains unconfirmed.

2mo ago · hacker-news

A Chinese-speaking cybercrime group dubbed Gambling Goblin has been compromising Brazilian government and educational web servers since mid-2025, installing malicious Apache modules to redirect traffic to online gambling and sports betting pages. The attack infrastructure uses compromised high-reputation .gov.br and .jus.br domains to manipulate search engine rankings through SEO fraud. The group deploys tools including DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and an SSH brute-forcer. Check Point links the group to Earth Berberoka, previously documented by Trend Micro, and notes the use of reverse-proxy techniques to serve malicious content while preserving the appearance of legitimate traffic.