Intelligence Feed

3w ago · krebsonsecurity

The Aisuru botnet, initially known for launching massive DDoS attacks exceeding 30 terabits per second, has shifted its operations to support a residential proxy business by leveraging hundreds of thousands of compromised IoT devices. The botnet's operators have updated their malware to allow renting infected devices to proxy services, which are increasingly used for large-scale data scraping to feed AI training models. This shift has caused significant disruption to ISPs and raised concerns about abuse of residential proxies for cybercrime and unauthorized content scraping.

3w ago · lab52

In August 2025, the Lazarus group conducted a targeted campaign using trojanized tools and DLL sideloading techniques as part of their DreamJob operations. The attackers deployed multiple variants of modular loaders, collectively termed 'DreamLoaders', including TSVIPSrv.dll and HideFirstLetter.dll, to execute malicious payloads and extract credentials. These loaders leveraged legitimate system binaries and encrypted resources to evade detection, while communicating with attacker-controlled SharePoint domains. The campaign demonstrates a high degree of code reuse and operational sophistication aimed at compromising organizational administrators.

3w ago · security.com

Russian-linked attackers continue to target Ukrainian organizations with a focus on espionage and persistent access. The intrusions involved the use of webshells, living-off-the-land tactics, and minimal malware deployment to harvest credentials and sensitive data. Techniques included memory dumping, registry exfiltration, and disabling security tools, indicating a highly skilled and stealthy threat actor.

3w ago · bleeping-computer

OnTrac, a U.S.-based parcel delivery company, disclosed a data breach that occurred between March 20 and 22, 2026, where attackers accessed customer data. The breach was detected on March 23, and the company engaged a third-party specialist to investigate. While the exact data compromised is redacted, the company offered credit monitoring services to affected customers. No ransomware group has claimed responsibility, and there is no evidence of data leakage or fraud at this time.

3w ago · bleeping-computer

Hackers are hijacking hotel and conference center Wi-Fi DNS settings to redirect users to fake Microsoft 365 login pages, enabling theft of credentials and bypassing multi-factor authentication via OAuth token authorization. The campaign, active since at least June 2026, targets traveling employees across multiple sectors including finance, healthcare, and legal services. The attack technique resembles previous router-based campaigns linked to the APT28 group. Researchers observed malicious domains and attempted abuse of WPAD for traffic interception.

3w ago · bleeping-computer

A threat actor leveraged the open-source Hermes AI agent in unattended 'YOLO' mode to automate post-exploitation activities during an alleged cyberattack on Thailand's Ministry of Finance. Evidence from exposed web directories indicates deployment of web shells, custom scripts, and a previously undocumented Go-based implant named Hades. The attackers targeted internal systems including Hadoop, Apache Ambari, GlassFish, and mail servers, using AI to perform privilege escalation, enumeration, and file traversal. While the Ministry has not confirmed a breach, artifacts suggest active intrusion and lateral movement within the network.

3w ago · socket-dev

A malicious website at corepack[.]org impersonates the legitimate Corepack Node.js tool to distribute malware, targeting developers searching for the package after its removal from Node.js distributions. The site delivers an infostealer and enrolls victims in a proxyware network through a fake VPN installer, while a secondary path distributes adware and trojanized software. The operation leverages AI-generated content and deceptive infrastructure, indicating a low-effort, high-volume monetization scheme exploiting developer trust.

3w ago · step-security

On July 24, 2026, a compromised PyPI package, mrmustard 0.7.4, was found to contain a credential-stealing payload that activates upon import. The attacker hijacked a maintainer's GitHub account, stole CI secrets to gain PyPI publishing rights, and uploaded the malicious version without modifying the public source repository. The payload exfiltrates SSH keys, cloud credentials (AWS, Kubernetes), and system information, while establishing multiple persistence mechanisms on the infected host.

3w ago · hacker-news

A security researcher from XBOW discovered two critical vulnerabilities in Microsoft's Bing Images service that allowed remote command execution as SYSTEM on Windows and root on Linux servers by exploiting crafted SVG files. The flaws, tracked as CVE-2026-32194 and CVE-2026-32191, stemmed from improper handling of SVG image references that led to command injection via ImageMagick delegates. Microsoft patched the issues server-side before public disclosure, with no evidence of exploitation in the wild.

3w ago · hacker-news

Researchers H0j3n and Aniq Fakhrul disclosed a working exploit named Certighost that enables low-privileged Active Directory users to impersonate a Domain Controller by obtaining a certificate via a vulnerable AD CS enrollment fallback mechanism. The exploit abuses improper validation of the chase target during certificate enrollment, allowing attackers to relay authentication and obtain a certificate for a Domain Controller. This can lead to privilege escalation via DCSync to extract sensitive account secrets such as krbtgt, even without administrator rights.

3w ago · hacker-news

North Korean threat actor BlueNoroff is conducting targeted phishing campaigns using typosquatted Zoom and Microsoft Teams domains to deliver the ClickFix malware. The attackers hijack trusted Telegram accounts in the cryptocurrency space to distribute lures, enabling social engineering attacks that profile victims' cryptocurrency wallets before delivering malware. The phishing kit uses AI-generated headshots and real body movements from prior meetings to create convincing fake calls, and operators selectively target high-value individuals by fingerprinting browser wallets. The campaign demonstrates a self-propagating attack chain leveraging compromised identities and infrastructure for sustained operations.

3w ago · bleeping-computer

Slopsquatting, Phantom Domains, and HalluSquatting represent a class of AI-driven attacks exploiting the predictability of hallucinated identifiers in AI coding agents. Attackers register these predicted names—such as fake package names, domains, or repositories—before they are requested, enabling malicious code delivery without phishing or credential theft. The core vulnerability lies in agents automatically fetching and executing unverified resources, creating scalable attack vectors for botnet-style compromise. This pattern highlights a systemic design flaw in late binding of untrusted AI-generated outputs.

3w ago · bleeping-computer

Chick-fil-A confirmed a data breach affecting over 13,000 customers due to credential stuffing attacks on its website and mobile app between June 17 and June 19, 2026. Attackers used credentials obtained from third-party sources to gain unauthorized access to Chick-fil-A One loyalty accounts. Compromised data includes names, email addresses, membership numbers, partial payment details, and potentially birth dates, phone numbers, and addresses.

3w ago · bleeping-computer

A massive Microsoft 365 and Azure outage occurred on July 23, 2026, beginning at 10:44 AM ET, primarily affecting services in the West US Azure region. The incident was caused by a bug in Microsoft's automated network maintenance system that incorrectly removed IP routes from more devices than intended, disrupting connectivity. Services including SharePoint, OneDrive, Teams, Power BI, and Microsoft Defender were impacted, with traffic rerouting and recovery efforts completed by 2:26 PM ET. Microsoft confirmed resolution of the incident and is conducting a full internal review of its maintenance processes.

3w ago · hacker-news

The Golden Chickens threat actor, tracked as TAG-195, has resurged with four new malware families: TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator. These tools represent an evolution toward modular, operator-driven malware architectures designed for defense evasion and flexible post-compromise operations. The group uses ClickFix-style social engineering to deploy payloads, establishing persistent access and enabling browser theft, surveillance, and remote execution. The malware communicates via WebSockets to C2 servers and leverages shared infrastructure and techniques across families.

3w ago · hacker-news

A threat actor leveraged the open-source Hermes AI agent in YOLO mode to conduct unattended post-exploitation activities within Thailand's Ministry of Finance network. The attacker gained initial access via a web shell and exploited misconfigured Hadoop services with default authentication disabled. The Hermes agent performed automated reconnaissance, including kernel vulnerability scanning and file system crawling, while leaving logs exposed on a public server. The operator used Chinese-language artifacts and infrastructure linked to Hong Kong, suggesting a Chinese-speaking actor, though no specific group was attributed.

3w ago · hacker-news

The article discusses the growing challenge of securing AI agents within enterprise environments, emphasizing that mere visibility into AI agent presence is insufficient. It highlights the risks posed by AI agents' autonomy, dynamic behavior, and access to critical systems, which outpace traditional static access controls. The focus must shift from discovery to active enforcement of least privilege, intent-based policies, and identity-centric governance to mitigate privilege abuse, rogue agents, and other agentic risks.

3w ago · hacker-news

A critical vulnerability named AgentForger in OpenAI's ChatGPT Workspace Agents could allow attackers to deploy rogue AI agents via a phishing link. The flaw, a cross-site request forgery (CSRF), enables automatic creation and execution of malicious agents within an authenticated user's session without further interaction. These agents can persist, execute tasks from emails, access enterprise data, and send phishing messages, effectively becoming autonomous insiders.

3w ago · bleeping-computer

An Illinois man, Kyle Svara, was sentenced to six years in prison for hacking over 750 women's Snapchat accounts using social engineering tactics to steal nude photos, which he traded or sold online. He posed as a Snap Inc representative, used anonymized phone numbers, and phished Snapchat access codes between May 2020 and February 2021. Svara also distributed child sexual abuse material and falsely denied involvement during investigation.

3w ago · bleeping-computer

Europol, in collaboration with law enforcement from nine countries, conducted a multi-week operation targeting 'The Com,' a decentralized network of violent extremist groups. The operation flagged 4,340 URLs for removal, focusing on content promoting self-harm, child sexual abuse, violence, and extremist ideologies. The Com operates through subgroups like Offline Com, Cyber Com, (S)extortion Com, and 764, which recruit and exploit minors via social media and gaming platforms. The network has been linked to ransomware attacks and child exploitation, with prior operations leading to dozens of arrests and victim identifications.

3w ago · step-security

StepSecurity's mid-year report for 2026 highlights a significant increase in software supply chain attacks, driven by the adoption of AI by both developers and attackers. Attackers are shifting left, targeting development pipelines, CI/CD systems, and developer machines with increased efficiency and lower barriers to entry. The report emphasizes the importance of layered security controls across the entire software development lifecycle to proactively prevent and rapidly detect compromise.

3w ago · hacker-news

A Russia-aligned threat cluster known as UAC-0099 is distributing a malicious Notepad++ plugin to deliver MATCHBOIL.V2 malware, a modified version of the C#-based loader MATCHBOIL. The attack begins with a phishing email containing an image that leads to a shortened URL, which redirects to a file-sharing service hosting a malicious ZIP file. The ZIP contains a VBScript that executes a decoy PDF while silently deploying a malicious DLL and additional payloads, including RemoteLibUpdater.exe (BURNYBEAR) and InitTest.dll. The campaign aims to establish persistence and conduct espionage, with no financial motive observed.

3w ago · hacker-news

Redis disclosed and patched multiple memory corruption vulnerabilities in its database software that could lead to authenticated remote code execution (RCE). Two distinct exploit chains were identified: one leveraging a shared-NACK use-after-free in Redis Streams, and another exploiting an out-of-bounds write in the RedisBloom TDigest RDB loader. Both vulnerabilities require the RESTORE command and were exploited in proof-of-concept (PoC) scripts to achieve arbitrary memory access and system command execution. The flaws affect multiple Redis versions, including 6.2.22, 7.4.9, 8.6.4, and 8.8.0, with fixes released on July 23, 2026.

3w ago · hacker-news

NodeBB patched eight high-severity vulnerabilities discovered by AI-powered pentesting tools, affecting all versions prior to 4.14.0. The flaws enable privilege escalation, private message access, unauthorized admin dashboard access, and cross-site scripting via malicious links in forum content. Five of the vulnerabilities are tied to federation functionality with the fediverse, and while no active exploitation has been reported, administrators are urged to upgrade to version 4.14.2 due to the critical nature of the exposures.

3w ago · bleeping-computer

The Clop ransomware gang is conducting a new data theft extortion campaign by exploiting a critical vulnerability, CVE-2026-12569, in Internet-exposed PTC Windchill and FlexPLM instances. The flaw allows unauthenticated remote code execution, enabling attackers to deploy JSP webshells for data exfiltration. Organizations in high-risk sectors such as aerospace, defense, and manufacturing are targeted, with Clop using the email [email protected] for extortion demands.

3w ago · hacker-news

A Russian state-supported espionage group exploited a zero-day vulnerability (CVE-2025-66376) in Zimbra's webmail client to conduct cyber espionage against Western government and commercial organizations. The vulnerability allowed attackers to steal emails, passwords, and 2FA codes through a zero-click exploit triggered by viewing a malicious email. The campaign, active since at least July 2025, used HTML smuggling and DNS-based exfiltration, targeting sectors including government, defense, and finance across NATO, Ukraine, CIS, and Africa.

3w ago · bleeping-computer

The Dolphin X remote access trojan (RAT) is a newly identified malware advertised on cybercrime forums that combines credential theft with an AI-powered 'AI Profiler' to rank infected users by their potential value to attackers. The AI Profiler analyzes application usage, browser domains, installed software, and other data to generate risk scores and daily summaries, enabling threat actors to prioritize high-value targets such as those with access to corporate networks, cloud environments, or cryptocurrency assets. The malware claims to target over 300 applications, including browsers, password managers, crypto wallets, and cloud tools, though its full capabilities remain unverified due to analysis limitations.

3w ago · bleeping-computer

A malvertising campaign leveraging Bing ads promotes a fake Claude desktop application to distribute the SectopRAT remote access trojan. The malicious installer, ClaudeDesktop.exe, sideloads a malicious DLL to deploy the malware, which establishes persistence via a scheduled task under the name DockerDesktop.exe. SectopRAT, also known as ArechClient2, steals credentials, files, and sensitive data from browsers and messaging apps, using Ethereum transactions to retrieve C2 addresses. The campaign, dubbed FakeAgent, has compromised at least 29 organizations and uses anti-analysis techniques to evade detection.

3w ago · bleeping-computer

Australian energy provider Origin Energy confirmed a data breach involving unauthorized access to customer data, including personally identifiable information such as names, addresses, dates of birth, and partial financial details. The breach impacts an unknown number of customers, with threat actors claiming to possess data from 2 million individuals. Origin has launched an investigation, notified relevant authorities, and is contacting affected customers while working to prevent further unauthorized access.

3w ago · talos

Cisco Talos has identified a new Rust-based remote access trojan (RAT) named msaRAT, deployed by the Chaos ransomware group. The malware leverages the Tokio asynchronous runtime and hijacks Chrome or Edge browsers via the Chrome DevTools Protocol (CDP) to establish a covert command-and-control (C2) channel. It is distributed through a deceptive MSI file impersonating a Windows update, enabling in-memory execution and evasion of traditional network detection. The RAT facilitates double-extortion ransomware attacks by enabling persistence and lateral movement.