Intelligence Feed

2d ago · bleeping-computer

Pokémon Center disclosed a data breach affecting customers in the United Kingdom and Germany due to a cyberattack on its third-party logistics provider, CEVA Logistics, which was compromised between July 29 and August 1, 2026. The breach exposed customer personal information including full names, mailing addresses, phone numbers, email addresses, and order details. Although payment card data was not accessed, the incident led to order cancellations and shipping delays. CEVA Logistics, a subsidiary of CMA CGM Group, confirmed the breach impacted multiple European retailers, including Valve, which also reported stolen customer data.

1d ago · bleeping-computer

A threat actor using the alias 'TheHatman' is selling alleged employee databases stolen from the Microsoft Azure environments of multiple Fortune 500 companies, including McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels, Wyndham Hotels, Hexaware, and Kyndryl. The actor claims to have obtained the data using compromised credentials, potentially via password spray and MFA fatigue attacks. The datasets reportedly include employee names, email addresses, job titles, phone numbers, addresses, service accounts, and tenant-specific Azure structures. While some companies like Tata and Gap have stated there is no evidence of a breach and that the data may be outdated, cybersecurity firm Hudson Rock has analyzed samples and confirmed the data contains authentic corporate directory attributes and could be used for social engineering or spearphishing.

2d ago · bleeping-computer

Certighost, tracked as CVE-2026-54121, is a critical vulnerability in Active Directory Certificate Services (AD CS) that allows a low-privileged domain user to coerce an Enterprise Certification Authority (CA) into issuing a valid authentication certificate for a Domain Controller. This is achieved by exploiting a 'chase' functionality flaw where the CA follows attacker-supplied routing information without validating the target endpoint, enabling the attacker to forge identity data and obtain a certificate impersonating a Domain Controller. The attacker can then use PKINIT to obtain a Ticket Granting Ticket, perform DCSync to extract credentials including the krbtgt hash, and achieve full domain compromise. The vulnerability was patched by Microsoft on July 14, 2026, but the underlying risk stems from standing privileges like default MachineAccountQuota settings that allow unprivileged users to create machine accounts.

2d ago · bleeping-computer

The Clop ransomware gang is conducting data theft attacks against organizations using PTC Windchill and PTC FlexPLM platforms, exploiting a critical vulnerability, CVE-2026-12569, that allows improper input validation. Companies including Philips, General Electric (GE), and Shell have confirmed they are investigating or have confirmed breaches. The attackers deploy JSP webshells to exfiltrate sensitive data such as project plans, blueprints, and internal backups. The U.S. CISA and Germany's BSI have issued urgent warnings, mandating immediate patching due to active exploitation in the wild.

2d ago · bleeping-computer

Microsoft is actively working on a security patch for a newly disclosed zero-day vulnerability in Microsoft Defender named 'ShieldBreak', tracked as CVE-2026-69414. The vulnerability, disclosed by security researcher Nightmare Eclipse, allows local attackers with limited privileges to escalate to SYSTEM-level access on fully patched Windows 10, Windows 11, and Windows Server systems. The exploit acts as a bypass for the previously patched RoguePlanet vulnerability (CVE-2026-50656), indicating an incomplete fix. Microsoft has acknowledged the issue but has not yet released a patch, while the researcher has publicly released a proof-of-concept exploit due to an ongoing dispute over disclosure practices.

2d ago · bleeping-computer

The French Ministry of the Economy and Finance disclosed a data breach affecting 678,000 individuals after a threat actor using the handle 'ZeroBytes' claimed responsibility and listed a stolen database for sale on the PwnForums hacking forum on August 12, 2026. The attacker accessed the General Directorate of Public Finances (DGFiP) systems, extracting sensitive tax and cadastral data, including reference tax income, family quotient, withholding tax rate, company names, SIREN numbers, and property records. Access to sensitive systems was shut down, and the incident is under investigation with support from ANSSI, though user credentials were not compromised.

2d ago · bleeping-computer

Cryptocurrency hardware wallet provider SafePal suffered a data breach affecting approximately 39,798 customers due to an authorization flaw in an order-tracking plugin, which allowed unauthorized access to customer order information. The exposed data includes names, email addresses, shipping addresses, phone numbers, and purchase details, but not wallet seed phrases, private keys, or payment information. A threat actor is now claiming to sell the stolen data on a cybercrime forum, and customers have reported receiving phishing emails and phone calls impersonating SafePal, warning of a firmware vulnerability in the X1 device to trick users into compromising their wallets.

3d ago · bleeping-computer

Threema, a secure messaging service, was disrupted by large-scale distributed denial-of-service (DDoS) attacks that targeted both its infrastructure and its colocation partner, Nine. The attacks caused intermittent outages and service degradation for users in Switzerland, India, and China, despite internal status pages showing normal operations. The threat actor continuously changed attack patterns, making mitigation difficult, and an unrelated technical issue prevented timely status updates. Threema has since implemented specialized upstream DDoS protection to reduce future impact.

3d ago · bleeping-computer

AmnesiaStealer is a macOS-targeting information-stealing malware distributed via ClickFix campaigns using fake GitHub download pages. It steals browser profiles, passwords, cryptocurrency wallets, Apple Notes, keychain data, and documents. A key capability is its 'stream_module' component, which enables remote operators to control a headless browser instance loaded with the victim's cloned Chromium profile, allowing interactive access to authenticated web sessions via WebSocket-based remote control. This provides attackers with live screencast access and full input control (keyboard, mouse) over the victim's active sessions.

4d ago · bleeping-computer

Evooo1Bot is a new Mirai-based modular Linux botnet targeting internet-facing routers and gateway devices to turn them into SOCKS5 traffic relay nodes. It exploits known vulnerabilities in devices from vendors including Alcatel, NETGEAR, Tenda, and D-Link, and includes capabilities such as SSH brute-forcing, credential sniffing, DDoS attacks, and encrypted C2 communications over port 443. The malware performs anti-analysis checks, establishes persistence via multiple methods, and supports file transfer and interactive shell access for remote control by attackers.

5d ago · bleeping-computer

The Netherlands' National Cyber Security Centre (NCSC) has issued a warning that attackers are actively exploiting a macOS Screen Sharing vulnerability, CVE-2026-65400, to gain unauthorized access to systems with exposed port 5900. The flaw allows network-based attackers to bypass authentication and obtain root access without valid credentials. In confirmed attacks, the threat actors have deployed Monero cryptocurrency miners on compromised systems. Apple has patched the vulnerability in recent macOS updates, including Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.

5d ago · bleeping-computer

A critical remote code execution vulnerability, CVE-2026-58231, in SAP Commerce Cloud is being actively exploited in the wild just three days after the patch was released. The flaw, which has a CVSS score of 10.0, stems from improper authorization in the Data Hub Adapter extension, allowing unauthenticated attackers to execute arbitrary code by exploiting a default authentication client. Threat intelligence firm Defused confirmed exploitation attempts are already occurring, as observed through honeypot traffic, despite the absence of a public proof-of-concept. The vulnerability affects internet-exposed SAP Commerce Cloud instances, with over 4,200 such systems identified globally, primarily in Europe and North America.

5d ago · bleeping-computer

The Clop ransomware gang claimed responsibility for stealing 89GB of data from energy giant Shell, allegedly exploiting a critical vulnerability, CVE-2026-12569, in Internet-exposed PTC Windchill and FlexPLM instances. The same vulnerability was actively exploited to target other major companies, including General Electric and Philips, with attackers deploying JSP webshells to exfiltrate sensitive data such as engineering drawings, project plans, and facility reports. U.S. CISA and German BSI issued urgent advisories urging immediate patching, and the flaw has been added to CISA's Known Exploited Vulnerabilities catalog.

5d ago · bleeping-computer

In July 2026, the ShinyHunters extortion group breached RingCentral through a sophisticated social engineering campaign, exfiltrating personal information from 1.6 million customer accounts. The stolen data included names, email addresses, phone numbers, and physical addresses. After RingCentral refused to pay a ransom, ShinyHunters leaked a 280GB compressed archive of the stolen data on their dark web leak site. The breach did not impact RingCentral's core platform, and no further unauthorized activity has been observed since remediation efforts were implemented.

5d ago · bleeping-computer

An Akira ransomware affiliate gained initial access via an exposed SonicWall VPN without MFA, then used RDP to move laterally and exfiltrate data. The attacker rebooted the compromised host into Safe Mode with Networking to disable EDR and AV solutions, including the Huntress agent and Microsoft Defender. Data was stolen using s5cmd and uploaded to an attacker-controlled S3 bucket, while AnyDesk was installed and configured to persist in Safe Mode. The ransomware payload (akira.exe) failed to execute due to low virtual memory, preventing encryption. Despite the failure, the actor exfiltrated sensitive data within five hours.

6d ago · bleeping-computer

Microsoft has patched a Windows zero-day vulnerability known as 'LegacyHive' (CVE-2026-62832), which affects the Windows User Profile Service and allows authenticated local attackers to gain administrator privileges by exploiting improper link resolution during registry hive loading. The vulnerability was publicly disclosed and demonstrated by security researcher Nightmare Eclipse, who criticized Microsoft's disclosure practices. Exploitation does not require user interaction and enables privilege escalation by modifying another user's registry hive when they log in.

6d ago · bleeping-computer

The China-based threat actor Jewelbug (also known as Earth Alux and REF7707) has been conducting espionage operations against government and military organizations in the Middle East, Southeast Asia, and South Asia, while simultaneously running a large-scale cryptocurrency fraud operation. The group compromised a shared webmail platform used by multiple government tenants, injecting a malicious script into login and mailbox pages to steal cookies and credentials. Successful compromises led to the deployment of the Antino backdoor via fake Adobe Flash installers, enabling further payload delivery, including a malicious browser extension called 'PDF Viewer' that steals credentials and injects JavaScript. Symantec uncovered the group's infrastructure, revealing over one million implant check-ins, more than 580,000 stolen browser cookies, and extensive cryptocurrency fraud operations using AI-generated content and lookalike domains impersonating Binance and OKX.

6d ago · bleeping-computer

Trezor disclosed a data breach affecting nearly 14,000 customers due to a compromise of its shipping provider, ShipMonk, which was breached via a zero-day SQL injection vulnerability in the analytics platform Metabase. The attackers accessed customer order data including names, email addresses, phone numbers, and shipping addresses. ShipMonk confirmed the breach stemmed from exploitation of a critical vulnerability in Metabase, which was also used to attack other companies like Framework and Tally. Trezor emphasized that its own systems were not compromised and device security remains intact, but warned affected users of increased phishing risks. The ShinyHunters extortion group has claimed responsibility, sending extortion emails to ShipMonk.

6d ago · bleeping-computer

A critical directory traversal vulnerability in VMware vCenter Syslog Server (CVE-2026-59310) is being actively exploited to gain remote code execution. Attackers are deploying the open-source reverse_ssh framework to establish reverse SSH connections for persistence and remote access. Compromised systems have been observed connecting to attacker infrastructure starting August 3, with 361 victim IPs identified across 47 countries by August 7. The campaign is suspected to be conducted by an advanced persistent threat (APT) actor, though attribution remains unconfirmed.

6d ago · bleeping-computer

A new Android malware campaign combines WindRelay, an NFC relay tool, with the SpyNote remote administration trojan to enable real-time financial fraud. Attackers socially engineer victims by impersonating bank employees, tricking them into sideloading a malicious APK that grants Accessibility Services, enabling remote device control. The attackers then install WindRelay to capture NFC payment card data and PINs during live phone calls, allowing them to conduct fraudulent transactions or take out loans in the victim's name. The attack chain was executed entirely over a 13-minute call, highlighting a shift toward real-time, voice-mediated social engineering without requiring persistent malware access.

6d ago · bleeping-computer

The City-Forum data theft campaign targets misconfigured Salesforce Experience Cloud and ServiceNow portals by exploiting overly permissive guest user access. Attackers use a single server at IP 158.220.87.79 to enumerate and steal data exposed to unauthenticated users via custom techniques on both legacy Aura and newer Lightning Web Runtime (LWR) frameworks in Salesforce, as well as the ServiceNow Service Portal search API. The campaign has been active since at least March 2025, with increasing activity across multiple sectors including finance, telecom, and public-sector organizations. No vulnerability is exploited; instead, the theft relies on misconfigurations that allow public access to sensitive records.

6d ago · bleeping-computer

Hackers are actively exploiting a critical vulnerability, CVE-2026-71362, in Adobe Commerce and Magento platforms to hijack customer accounts without authentication or user interaction. The flaw stems from improper handling of customer identity in account sessions, allowing attackers to switch between customer accounts. Security firm Sansec has observed exploitation attempts in the wild and confirms that the vulnerability enables unauthorized access to private customer data. Adobe released patches as isolated updates, urging administrators to apply them immediately to mitigate risk.

1w ago · bleeping-computer

Researchers Alejandro Hernando and Borja Martínez disclosed 'Plug and Pwn' attack techniques that exploit Windows Plug and Play to gain SYSTEM privileges by emulating malicious USB devices. The attacks abuse signed vendor software installed automatically by Windows during device enumeration, leveraging vulnerabilities in co-installers, services, or insecure update mechanisms. One variant, 'NoPlug & Pwn', abuses RDP USB redirection to perform the attack remotely without physical access. A demonstrated chain uses emulated Sierra Wireless and Sony FeliCa devices to manipulate DNS and hijack unencrypted downloads, ultimately achieving code execution as SYSTEM. Another RDP-based variant emulates an Intel RealSense camera to exploit DLL hijacking in a co-installer for privilege escalation.

1w ago · bleeping-computer

Attackers are actively exploiting CVE-2026-55040, a critical authentication bypass vulnerability in Microsoft SharePoint's JWT token validation pipeline, to perform unauthorized actions as SharePoint users or administrators. A proof-of-concept exploit was published by Rapid7 and has already been weaponized, with attacks observed targeting SharePoint honeypots. Microsoft patched the vulnerability in its July 2026 updates, but over 8,500 SharePoint servers remain exposed online. CISA has issued warnings urging organizations to secure internet-facing SharePoint servers and apply security hardening measures.

1w ago · bleeping-computer

A new zero-day vulnerability dubbed 'ShieldBreak' has been disclosed by security researcher Nightmare Eclipse, exploiting a bypass in Microsoft Defender that allows privilege escalation to SYSTEM level on fully patched Windows 10, 11, and Server systems. The flaw effectively circumvents the patch for CVE-2026-50656 (RoguePlanet), which Microsoft had previously addressed. The exploit has been successfully tested on Windows 11 25H2 (Canary) and Windows Server 2025 with a 100% success rate. Microsoft Defender must be enabled for the exploit to work, and the vulnerability remains unpatched at the time of publication.

1w ago · bleeping-computer

The Russian threat group Sandworm, operating as UAC-0145, has been targeting IT professionals and system administrators since at least May 2026 through a social engineering campaign involving fake job offers. The attackers pose as legitimate IT companies, such as Sopra Steria, and lure victims into downloading a trojanized WireGuard-based client called 'SopraVPN' from SourceForge. The malicious client contains a custom Base64 decoder and executes PowerShell code that establishes persistence via scheduled tasks on Windows or downloads additional payloads on Linux through attacker-controlled infrastructure.

1w ago · bleeping-computer

The DeadLock ransomware operation, active since mid-2025, employs double-extortion tactics by stealing and encrypting data to extort ransom payments. It uses blockchain infrastructure, specifically the Polygon blockchain, to store configuration data and leak site content, making takedown efforts more difficult. The ransomware communicates with victims via a decentralized Session network and hosts stolen data on Wasabi cloud, while using XChaCha20 encryption with Curve25519 key exchange to lock files, appending the '.dlock' extension and dropping ransom notes. Microsoft observed deployment by multiple threat groups, including affiliates linked to Lynx and INC ransomware ecosystems.

1w ago · bleeping-computer

Cisco has warned of active exploitation of a high-severity denial-of-service vulnerability, CVE-2026-20349, in its Secure Firewall ASA and Threat Defense (FTD) software. The flaw stems from insufficient error checking when processing HTTP requests, allowing an unauthenticated remote attacker to crash affected devices by sending a crafted HTTP request to the SSL VPN service. Exploitation leads to a reload of the device, causing a DoS condition, and no workarounds exist—only patching with fixed software releases mitigates the issue.

1w ago · bleeping-computer

Microsoft's August 2026 Patch Tuesday addresses 400 vulnerabilities, including three zero-days. One of these, CVE-2026-68820, was actively exploited in the wild by the North Korean threat actor Lazarus Group to elevate privileges and deploy a kernel-mode rootkit called FudModule. The other two zero-days, CVE-2026-62832 and CVE-2026-72971, were publicly disclosed but not confirmed as exploited. Check Point linked the exploitation of CVE-2026-68820 to Lazarus, highlighting ongoing targeting using local privilege escalation in Windows drivers.

1w ago · bleeping-computer

Delta Air Lines investigated a Wi-Fi deauthentication attack that occurred on Flight 591 from Las Vegas to Atlanta, carrying attendees of the DEF CON 34 hacker conference. Passengers allegedly performed a deauth attack to disconnect others from the in-flight network and broadcast a rogue Wi-Fi access point named 'Delta WiFi Fast' to phish credentials. The cabin crew deactivated Wi-Fi for about 30 minutes, and upon landing, federal authorities boarded the aircraft to question suspects and seize hardware. The rogue network reportedly displayed a phishing page harvesting personal and Google login credentials.