CISA Warns of Active Exploitation of Three Linux Kernel Flaws
CISA has issued an alert about active exploitation of three Linux kernel vulnerabilities, including one critical severity flaw affecting Linux systems.
Tag
#Threat Hunting
80 results in the archive.
Contagious Interview Campaign Hits 30K Devices, Steals $10.7M Crypto
North Korean hackers behind the Contagious Interview campaign compromised over 30,000 devices worldwide, targeting crypto specialists and web designers to steal $10.7 million from more than 7,000 cryptocurrency wallets.
Critical Pre-Auth RCE Found and Exploited in Orkes Conductor Platform
A critical unauthenticated remote code execution vulnerability (CVE-2026-58138) in Orkes Conductor affecting versions prior to 3.30.2 is actively exploited and presents severe security risks.
North Korean WaterPlum Hackers Infiltrate 30,000 Devices Worldwide
The North Korean group WaterPlum compromised over 30,000 devices worldwide, stealing more than $10.7 million in cryptocurrency between December 2025 and July 2026.
RatHat Android Malware Exploits ADB to Maintain Shell Access
Researchers identified RatHat, an Android malware using AI and abusing ADB to maintain shell access post-uninstallation, spreading via smishing and malvertising.
Transparent Tribe Deploys New Rust Backdoor Targeting South Asia
The Pakistan-aligned threat group Transparent Tribe (APT36) has launched cyber attacks using new Rust-based backdoors and private GitHub command and control, targeting government and defense sectors in India and Afghanistan.
New RatHat Android Malware Uses AI for Automated Device Control
RatHat is a newly discovered Android malware that incorporates an AI-powered subsystem enabling attackers to remotely control compromised devices, streamlining exploitation actions.
Attacker Hijacks AI Coding Assistant, Spreads Malware Across 100 Repos
An attacker hijacked an AI coding assistant session to distribute the Shai-Hulud worm within approximately 100 internal code repositories at a SaaS provider, resulting in theft of repository secrets and source code.
Critical Issabel Framework Flaw Enables Unauthenticated OS Command Execution
A critical vulnerability in the Issabel Framework allows unauthenticated remote OS command execution, actively exploited and posing a severe security risk.
3BB Attacker Leveraged MeshCentral Backdoor for Root Access
An attacker used a MeshCentral backdoor to gain root access to internal systems at 3BB, a major Thai broadband provider, exposing subscriber credentials and internal tools.
Hackers Target Exposed Vite Servers to Steal AWS and Azure Secrets
A mass-scanning campaign targets internet-exposed Vite development servers to steal cloud credentials linked to AWS and Azure environments.
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Globally
The state-sponsored threat actor Red Heron exploited a remote code execution vulnerability in Gitea to compromise 13 organizations across six countries in a rapid, targeted campaign.
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts
Microsoft disclosed campaigns where attackers exploited third-party email systems for large-scale financial scam phishing and used passkey-themed social engineering techniques to compromise cloud accounts.
China-Linked UNC3569 Exploits Sogou Input Method Flaw for GRAYRABBIT Backdoor
The China-linked threat group UNC3569 exploited a vulnerability in Sogou Input Method on Windows to deploy the GRAYRABBIT backdoor, allowing attackers full control of the affected user's machine.
AI-driven attack exploits PaperCut flaws to breach 395 organizations
A Russian-speaking threat actor used hundreds of AI agents to exploit vulnerabilities in PaperCut NG/MF servers, compromising 395 organizations worldwide and highlighting the operational risks of AI-driven cyberattacks.
CISA Adds Two Actively Exploited MikroTik Vulnerabilities to KEV Catalog
CISA has listed two critical actively exploited MikroTik RouterOS vulnerabilities in its Known Exploited Vulnerabilities Catalog, highlighting the need for prioritized remediation.
Cisco FMC Flaws Exploited by Ransomware and State Hackers
Two patched vulnerabilities in Cisco Secure Firewall Management Center are actively exploited by ransomware gangs and state-sponsored hackers, threatening critical network security infrastructure.
U.S. Agencies Accuse China AI Firms of Distilling Major AI Models
U.S. cybersecurity and intelligence agencies accuse China-based AI firms of industrial-scale distillation attacks on proprietary AI models including Claude, GPT, Gemini, and Grok, raising concerns over AI intellectual property security.
China-Based AI Firms Conduct Industrial-Scale Distillation of US AI Models
NSA, CISA, and FBI warn that China-based AI companies are systematically extracting proprietary functionalities from US AI models at scale using industrial distillation techniques.
Hackers Deploy Linux Rootkit on F5 BIG-IP APM Devices
A Linux rootkit targets F5 BIG-IP APM devices by injecting fileless web shells into memory through PHP file loading interception, complicating detection.
JSCeal Malware Can Bypass Google Auth Using Stolen Session Cookies
JSCeal malware is a sophisticated JavaScript-based threat that bypasses Google authentication by stealing session cookies and uses advanced obfuscation to evade detection.
Attackers Use Invisible Unicode Characters to Bypass Email Filters
Threat actors use invisible Unicode characters in phishing emails to evade detection by security filters, complicating phishing identification.
Critical MikroTik SSH Bypass Exploited - Patch Immediately
MikroTik released a patch for an SSH authentication bypass vulnerability currently exploited to create unauthorized accounts on devices.
REVSTEALER Modules Disable Windows Defender to Run Crypto Miner
Elastic Security Labs identified four REVSTEALER-associated programs that disable Windows Update and Defender to deploy a cryptocurrency miner, persisting even after the main stealer removes itself.
5,400+ hacked sites deliver ClickFix malware via blockchain storage
Over 5,400 small-business websites have been compromised to distribute ClickFix malware payloads stored in smart contracts on the BNB Smart Chain, using blockchain to evade detection.
ASCII Smuggling Technique Evolves from AI Prompt Injection to Phishing Evasion
Attackers are leveraging invisible Unicode characters originally used to evade AI detection as a new method to obfuscate phishing emails and bypass security filters.
Attackers Exploit Two SonicWall SMA 1000 Zero-Days
Two zero-day vulnerabilities in SonicWall SMA 1000 VPN appliances, including a critical pre-authentication SSRF flaw, are being exploited in the wild.
BGP Hijack Delivers Malicious Virtualizor Update with Root Access
Attackers leveraged a BGP hijack to redirect Softaculous update traffic, delivering a malicious Virtualizor update that established persistent root access on five hypervisors.
Iranian Hackers Use Coding Tests to Deliver Cross-Platform RATs
The Iranian group Nimbus Manticore uses recruiter-themed coding tests to distribute Node.js and JavaScript remote access Trojans on Linux and macOS platforms, as reported by Kaspersky.
China-Linked Fire Ant Targets Cisco Routers to Steal Credentials
The China-linked Fire Ant group has compromised Cisco IOS XR routers, TACACS servers, and Linux hosts to steal credentials and disable security logs, targeting critical network infrastructure.
The Coding-Agent Trap: Malicious Use of Free LLM Endpoints Exposed
Attackers repurposed a public LLM inference honeypot to access sensitive coding-agent session information without executing tools, highlighting risks of using untrusted LLM endpoints.
TerminalFix campaign uses reverse tunnel and DLL sideloading in complex intrusion
Microsoft Threat Intelligence analyzes the TerminalFix campaign, which leverages fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel for multistage intrusion.
19 Chrome and Edge Extensions Found Stealing Crypto Wallets
Researchers discovered 19 malicious Chrome and Edge browser extensions that steal cryptocurrency wallet secrets, indicating a coordinated campaign.
Critical ownCloud Flaw Exploited to Steal Nuclear Records in Philippines
A critical ownCloud vulnerability tracked as CVE-2023-49105 has been added to CISA's KEV catalog following exploitation by a Chinese-speaking threat actor targeting a Philippine nuclear research organization.
Critical Vulnerabilities Found in Ebyte NE2-D11 Firmware
Multiple critical vulnerabilities in Ebyte NE2-D11 devices allow unauthorized administrative access, data exposure, and operational disruption, affecting critical infrastructure controls.
Hackers Breached 270+ Zimbra Servers via Critical RCE Vulnerability
Over 270 Zimbra Collaboration Suite servers have been breached through exploitation of a critical remote code execution vulnerability, exposing organizations to significant security risks.
Malicious Webpage Can Poison Local AI Models via NVIDIA NemoClaw
Oasis Security disclosed a vulnerability in NVIDIA NemoClaw that allows attacker-controlled webpages to manipulate local Ollama AI agent models through injection of hidden commands, risking unauthorized AI model poisoning without authentication.
UAT-10147 Uses AI to Scale Server Attacks and Deploys Advanced Linux Rootkit
The Chinese-speaking cybercrime group UAT-10147 leverages AI to launch scaled attacks on Windows and Linux web servers worldwide and deploys advanced tools including the SPECTRE EDR bypass and Linux rootkit.
SynkLoader Malware Spreads via Microsoft Teams Phishing Campaign
SynkLoader malware is delivered through a Microsoft Teams phishing campaign that uses a fake lock screen to steal enterprise user credentials, enabling unauthorized access.
GitLab CVE-2026-19478 Exploited Days After Disclosure
A critical code injection vulnerability in GitLab, CVE-2026-19478, is actively exploited shortly after disclosure, enabling unauthenticated attackers to modify or delete certain publicly accessible projects.
Thousands of Active Leaked AWS Keys Expose Corporate Accounts
Over 9,300 AWS access keys leaked between 2022 and 2026 remain active, exposing corporate accounts to unauthorized access risks.
CISA Warns of Active Exploitation of Critical MLflow Vulnerability
CISA warns that threat actors are actively exploiting a critical vulnerability in the MLflow AI engineering platform, posing risks to federal agencies and beyond.
StopAndProtect Uses 2,000 Hacked WordPress Sites to Spread Malware
The StopAndProtect campaign uses nearly 2,000 compromised WordPress sites worldwide to distribute malware and collect stolen data, impacting web infrastructure security.
AI ‘Mind Viruses’ Can Spread Between Agents Via Persistent Prompt Files
Researchers demonstrated that malicious payloads can spread between AI agents by exploiting editable persistent prompt files in autonomous AI systems.
CISA Flags Actively Exploited Ray Framework Flaw Triggering Browser RCE
CISA has added a critical Ray Framework vulnerability enabling browser remote code execution to its Known Exploited Vulnerabilities catalog, noting ongoing exploitation.
Uncovering MacSync Stealer Infrastructure via Behavioral Pivots
MacSync Stealer evades detection by rapidly rotating domains, but Microsoft identified over 30 related domains by analyzing consistent behavioral patterns to uncover its infrastructure.
Critical Out-of-Bounds Read Vulnerability in Siemens Parasolid
A high-severity out-of-bounds read vulnerability in Siemens Parasolid parsing X_T files allows potential arbitrary code execution, affecting versions prior to V38.0.235 and V38.1.230.
RingCentral Data Breach Exposes 1.6 Million User Accounts
The ShinyHunters group breached RingCentral in July, compromising personal data of 1.6 million user accounts.
Jewelbug Hackers Breach Govt Webmail While Conducting Crypto Fraud
The Jewelbug hacker group has breached government and military webmail accounts while simultaneously conducting cryptocurrency fraud, illustrating a dual-threat approach involving cyber espionage and financial crime.
Microsoft Defender 'ShieldBreak' Zero-Day Grants SYSTEM Privileges
The 'ShieldBreak' zero-day exploit targeting Microsoft Defender enables attackers to obtain SYSTEM-level privileges on affected systems following the August 2026 Patch Tuesday.
Unlimited Technology Systems Breach Affects 3.8 Million People
Healthcare software provider Unlimited Technology Systems disclosed an October 2025 breach impacting over 3.8 million individuals and sensitive healthcare data.
Meta AI Model Hacks Company During Misconfigured Cybersecurity Test
Meta confirmed that one of its AI models inadvertently hacked a company during a misconfigured cybersecurity test, revealing risks in AI security testing.
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The Greatness phishing-as-a-service toolkit now uses device code phishing to exploit OAuth 2.0 Device Authorization Grant, bypassing MFA and hijacking accounts.
How Threat Actors Are Weaponizing Cloud-Based AI: A Data-Driven Review
Talos analyzed prompt logs from various AI applications used by threat actors to understand their evolving tactics, revealing increased sophistication in leveraging cloud-based AI for malicious activities.
Adform's Ad Script Compromised to Steal Cryptocurrency via Clipboard Hijack
Adform's advertising scripts were compromised in a supply-chain attack that hijacks clipboard cryptocurrency addresses to redirect funds to attackers.
Cisco warns of FMC static credential flaw exploited in zero-day attacks
Cisco disclosed a high-severity zero-day vulnerability in its Secure Firewall Management Center involving static credentials, actively exploited to gain unauthorized access.
Coordinated Cyberattack Disrupts 30+ Minnesota Water Systems
A coordinated cyberattack targeted operational technology at over 30 Minnesota community water systems in late July, causing outages and communication disruptions.
Nimbus Manticore Uses NightLedger Backdoor to Target Middle East, Africa, Asia
Iranian state-backed group Nimbus Manticore deploys NightLedger backdoor and custom WebSocket tunnelers in attacks across the Middle East, Africa, and South Asia, enhancing stealth and covert activity.
NVIDIA Forms 37-Member Open Secure AI Alliance, Open-Sources NOOA Framework
NVIDIA and 36 organizations have established the Open Secure AI Alliance to develop collaborative open technologies aimed at securing AI and software environments.
Hermes AI Agent Automates Attack on Thailand's Finance Ministry
An open-source AI agent named Hermes was used to automate post-exploitation processes in an alleged breach of Thailand's Ministry of Finance, demonstrating AI's expanding role in cyberattacks.
SourTrade Malvertising Uses Browser to Assemble Malware Executable
A malvertising campaign named SourTrade targets retail traders by using browsers and a legitimate Bun runtime to assemble Windows malware executables, evading traditional detection methods.
Certighost Exploit Allows Low-Privileged AD Users to Impersonate Domain Controllers
The Certighost exploit enables low-privileged Active Directory users to obtain Domain Controller certificates and authenticate as domain controllers, risking critical Kerberos credential compromise.
Fake Claude app promoted via Bing ads spreads SectopRAT malware
A malvertising campaign on Bing promotes a fake Claude desktop app from a legitimate domain to deliver SectopRAT malware, posing a threat to affected systems.
Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak
The Anubis ransomware group has claimed responsibility for a cyberattack on Coca-Cola's Fairlife brand and threatened to leak stolen data if ransom demands are not met.
Russian Intelligence Hacks IP Cameras to Monitor NATO & Ukraine Military Movements
Russian intelligence services compromise internet-connected security cameras across Europe and Ukraine to gather military logistics intelligence, as reported by the Netherlands' AIVD and MIVD.
Hackers Abuse ViPNet Updates to Target Russian Government Agencies
An advanced threat actor exploits the update mechanism of ViPNet private networking software to attack Russian government agencies, illustrating ongoing espionage.
Abbott Investigates Two Cyber Incidents Amid Extortion Claims
Abbott Laboratories is investigating unauthorized access incidents affecting Exact Sciences legacy systems and its LabCentral portal, with allegations of stolen company data linked to extortion.
North Korean Hackers Use Steganography in Fake Coding Tests to Deliver Malware
North Korean threat actors linked to the Contagious Interview campaign employ steganography within SVG flag images in fake coding challenges to deliver multi-stage OTTERCOOKIE-aligned malware.
New ClickLock macOS Malware Forces Users to Reveal Login Password
ClickLock is a new macOS information-stealing malware that tricks users into revealing their system login password by terminating visible processes.
New OkoBot framework deploys 20 payloads targeting crypto and data theft
The OkoBot malware framework deploys more than 20 payloads aimed at stealing cryptocurrency wallet seed phrases, credentials, and sensitive data, posing a notable threat to individuals and enterprises.
CISA Warns to Patch Actively Exploited SharePoint Vulnerabilities
CISA issued a warning about three actively exploited vulnerabilities in Internet-exposed on-premises SharePoint Server instances that allow remote compromise.
Zoom warns of critical account takeover vulnerability
Zoom has disclosed a critical vulnerability in its Windows desktop client and SDK that enables unauthenticated attackers to hijack user accounts, posing a significant security risk.
Microsoft Patches 622 Flaws Including Two Zero-Days Under Active Attack
Microsoft released its largest Patch Tuesday, addressing 622 security flaws including two actively exploited zero-day vulnerabilities, critical for millions of affected systems.
Nearly 300 Fake GitHub Repos Distribute Infostealer Malware
A threat actor created almost 300 counterfeit GitHub repositories impersonating legitimate software projects to deliver infostealer malware, posing a significant supply chain threat.
Spanish Police Dismantle €140M Cyber Fraud Ring, Arrest Four
Spanish Police arrested four individuals and dismantled a cybercrime network responsible for €140 million in losses through investment fraud and business email compromise attacks.
CISA warns of active RCE flaws in Joomla iCagenda and Balbooa Forms extensions
CISA warns that remote code execution vulnerabilities are actively exploited in Joomla iCagenda and Balbooa Forms extensions through arbitrary file uploads, risking full compromise of affected sites.
Google and Microsoft Remove ModHeader Extension Over Hidden Collector
Google and Microsoft removed the ModHeader browser extension from their stores due to a dormant hidden browsing-history collector found in the official version, with no evidence of active data transmission.
MemGhost Attack Tricks AI Assistants into Storing False Memories via Email
The MemGhost attack allows adversaries to implant persistent false information into AI assistants through a single email, altering AI behavior and posing a risk to AI response integrity.
Compromised jscrambler npm Release Installs Rust Infostealer
The jscrambler npm package version 8.14.0 was compromised to install a Rust-based infostealer via a preinstall hook, impacting Windows, macOS, and Linux environments.
Hackers Exploit Balochistan Police Portal in Multi-Group Espionage
Researchers reveal cyber espionage targeting Pakistani law enforcement by suspected China- and India-aligned groups between 2024 and 2026, compromising police servers with critical data.