Intelligence Feed

1mo ago · bleeping-computer

Two new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts using techniques that bypass multi-factor authentication (MFA). Jalisco leverages device-code phishing via OAuth 2.0 Device Authorization Grant, tricking users into authorizing attacker-controlled devices. OmegaLord uses a fake PDF reader login page to harvest credentials and phone numbers, aiding in MFA bypass. Both kits enable rapid data exfiltration from SaaS platforms like SharePoint, often within minutes of compromise.

1mo ago · bleeping-computer

Microsoft is transitioning to passkeys as the default authentication method for Entra ID starting September 2026, retiring SMS and voice authentication by February 2027. This shift aims to reduce reliance on phishable methods and improve security against credential theft and identity attacks. Threat actors, including the ShinyHunters group, have been targeting Entra ID SSO accounts using stolen credentials, with AI-enhanced phishing campaigns achieving high click-through rates. Organizations are urged to adopt phishing-resistant authentication methods to prevent sign-in disruptions and strengthen account protection.

1mo ago · bleeping-computer

The article discusses the shrinking window between vulnerability disclosure and exploitation, driven by the increasing volume of CVEs and the rapid weaponization of flaws using AI. It highlights the case of 'Nightmare-Eclipse,' a set of Windows zero-day exploits developed by a disgruntled security researcher, which enables local privilege escalation, credential theft, and evasion of Windows Defender. The article advocates for breach and attack simulation (BAS) techniques that validate exploitability without executing real exploits, allowing defenders to prioritize patching based on actual risk.

1mo ago · socket-dev

A supply chain attack has compromised three npm packages in the @asyncapi namespace, including @asyncapi/generator-helpers, @asyncapi/generator-components, and @asyncapi/generator. These packages deliver a multi-stage botnet loader known as Miasma, which downloads its second-stage payload from IPFS and establishes persistence on the victim's system. The malware supports command execution, credential harvesting, and evasion techniques, posing significant risk to development and CI environments.

1mo ago · step-security

A coordinated supply chain attack compromised two AsyncAPI GitHub repositories on July 14, 2026, by injecting malicious code into the CI/CD pipelines. The attacker gained push access to the 'next' and 'master' branches, leveraging legitimate GitHub Actions workflows to publish four malicious npm packages without stealing tokens. These packages delivered an obfuscated dropper that downloads and executes the Miasma RAT, a sophisticated payload with multi-channel C2 capabilities, credential harvesting, AI tool poisoning, and worm-like propagation features. The attack bypassed trust mechanisms like SLSA provenance by abusing authorized pipelines, highlighting risks in CI/CD security.

1mo ago · talos

Threat actors are increasingly targeting Python developers through malicious packages and supply chain attacks, leveraging trusted ecosystems like PyPI to distribute payloads. These attacks exploit native Python features such as setup.py, .pth files, and site hooks to execute arbitrary code during installation or runtime, achieving persistence or conditional execution. Techniques include build hook abuses and package content manipulation, enabling adversaries to hijack legitimate binaries, override functions, or exfiltrate data. The blog highlights defensive strategies including dependency auditing, version pinning, and isolated build environments to mitigate these risks.

1mo ago · hacker-news

Microsoft has identified three attack paths used by threat actors associated with ShinyHunters to compromise Salesforce environments over a year-long campaign from mid-2025 to mid-2026. The attackers exploited trusted OAuth integrations through vishing attacks, stole OAuth tokens from compromised third-party vendors like Drift, Gainsight, and Klue, and abused misconfigured guest access in Salesforce Experience Cloud sites. These methods allowed persistent access to CRM data without exploiting platform vulnerabilities, blending malicious activity with legitimate traffic. The campaigns targeted organizations across retail, education, and manufacturing sectors, leveraging social engineering, supply chain compromises, and poor identity governance.

1mo ago · hacker-news

A cyber threat campaign distributed 148 malicious npm packages disguised as student web proxies, which when accessed via browser turned devices into a DDoS botnet. The packages hosted a proxy application named 'Lucide' that appeared legitimate but silently loaded remote code and executed WebSocket-based attacks. The malicious infrastructure leveraged GitHub repositories and CDNs to deliver payloads, targeting a nursing school's domain and Wisp proxy servers. The operators maintained persistent control through mutable branches and could re-enable DDoS capabilities at any time.

1mo ago · hacker-news

The U.S. Treasury has sanctioned a Ukrainian individual and a Belarusian national for supporting ransomware operations through a malicious VPN service and cryptor sales. Dmytro Rashevskyi operated First VPN Service (1VPNS), which enabled ransomware groups to conceal their activities by providing anonymous access to infrastructure. Yegeniy Silayev sold cryptors to help cybercriminals obfuscate malware, contributing to attacks on U.S. businesses, hospitals, and government entities. The activity is linked to significant financial losses and exploitation of known vulnerabilities in network devices.

1mo ago · hacker-news

xAI's Grok Build coding CLI was found uploading entire Git repositories, including full commit history, to a Google Cloud Storage bucket without user consent. The data included tracked files and credentials, even when the 'Improve the model' setting was disabled. Although xAI later disabled the upload feature server-side, the incident exposed sensitive source code and secrets by design, raising serious data privacy and security concerns for developers using the tool.

1mo ago · bleeping-computer

The U.S. Treasury Department sanctioned two individuals and one entity for supporting ransomware operations by providing infrastructure and tools to conceal malicious activity. First VPN Service (1VPNS), a no-logs VPN provider used by ransomware groups, and its administrator Dmytro Rashevskyi were designated for enabling attackers to hide their identities. Additionally, Belarusian national Yegeniy Vladimirovich Silayev was sanctioned for selling crypters that help malware evade detection. These actions are part of a broader international effort to dismantle enablers of cybercrime, following the takedown of 1VPNS in Operation Saffron with European law enforcement.

1mo ago · bleeping-computer

A new macOS information-stealing malware named CrashStealer impersonates Apple's crash reporting tool to evade detection and steal sensitive data. It uses a signed and notarized installer to bypass macOS Gatekeeper, tricks users with a fake password prompt to access Keychain data, and targets browser credentials, crypto wallets, and password managers. The malware encrypts stolen data with AES-256-GCM before exfiltration, indicating a sophisticated and stealthy operation.

1mo ago · bleeping-computer

Hackers compromised the npm publishing credentials of Jscrambler and published malicious versions of its npm package (8.14, 8.16, 8.17, 8.20), which were downloaded nearly 1,500 times. The backdoored package executed an infostealer during the 'preinstall' hook, targeting source code, credentials, cloud secrets, cryptocurrency wallets, and browser data. The malware used ChaCha20-Poly1305 encryption for obfuscation, and Jscrambler has since deprecated the affected versions and enhanced its publishing pipeline security.

1mo ago · bleeping-computer

Japan's largest taxi operator, Nihon Kotsu, suffered a cyberattack involving unauthorized access and suspected malware infection, leading to the shutdown of critical systems including taxi dispatch, web booking, and reservation management. The company has disconnected affected systems to prevent further damage and is working with external cybersecurity experts to investigate potential data leaks. No ransomware group has claimed responsibility, and customers are warned against opening suspicious communications.

1mo ago · hacker-news

Researchers have identified a new attack technique called 'stealth memory injection,' dubbed MemGhost, that enables attackers to plant persistent false memories in AI agents through a single malicious email. The attack manipulates AI assistants that read emails and maintain persistent memory files, allowing an adversary to silently alter the agent's behavior in future sessions without detection. The technique was successfully tested against OpenClaw and Claude-based agents, with high success rates in background execution modes, highlighting a critical risk in AI systems that combine untrusted input processing with autonomous memory updates.

1mo ago · hacker-news

Multiple threat actors are leveraging compromised software supply chains, AI-driven attacks, and unpatched vulnerabilities to deploy malware, steal credentials, and conduct ransomware operations. Notable activities include the exploitation of Citrix Bleed 2 (CVE-2025-5777) for DragonForce ransomware deployment, a compromised npm package distributing a Rust-based stealer, and the emergence of HalluSquatting attacks targeting AI coding assistants. Additionally, new backdoors like GigaWiper and RedHook are being used for persistent access and data exfiltration across Windows and Android platforms.

1mo ago · hacker-news

Google and Microsoft removed the ModHeader browser extension, which had approximately 1.6 million installs, after researchers discovered a dormant browsing-history collector embedded in its code. The collector, capable of gathering and exfiltrating encrypted browsing data, was inactive due to an empty allow-list but could be activated remotely via a routine update. The extension had been pinging tracking domains and logging request metadata, raising concerns about supply chain integrity and the stealthy potential of signed, popular extensions to harvest user data.

1mo ago · hacker-news

CrashStealer is a newly identified macOS information stealer written in native C++ that evades Gatekeeper by using a signed and Apple-notarized dropper. It harvests credentials from browsers, cryptocurrency wallets, password managers, and keychain data, encrypts the stolen data using AES-GCM, and exfiltrates it to an attacker-controlled server. The malware employs analysis resistance techniques such as control-flow flattening and anti-debugging, and uses a multi-stage delivery chain involving a GitHub-hosted payload.

1mo ago · bleeping-computer

CISA has issued a warning about actively exploited remote code execution (RCE) vulnerabilities in two Joomla extensions, iCagenda and Balbooa Forms. The vulnerabilities, CVE-2026-48939 and CVE-2026-56291, allow attackers to upload arbitrary files, including malicious PHP scripts, leading to full website compromise. These flaws were exploited in automated attacks before patches were released, with exploitation occurring just days prior to vendor fixes.

1mo ago · wiz

The article discusses the importance of Infrastructure-as-Code (IaC) coverage as a security metric for cloud environments. It emphasizes that IaC coverage enables traceability, resilience, and compliance by ensuring cloud resources are defined and governed in code. The article introduces a funnel model—supportable, tracked, and mapped—to measure how well cloud infrastructure is governed through IaC, highlighting that higher coverage enables machine-speed remediation and better security posture.

1mo ago · hacker-news

An unknown threat actor leveraged a suspected AI-generated PowerShell script to perform aggressive Active Directory enumeration following initial access via RDP with compromised credentials. The script conducted reconnaissance by mapping users, computers, domains, and other AD components, then exported data into CSV and HTML files. The attacker later deployed legitimate tools like s5cmd and SharpShares for further data discovery and exfiltration. This incident highlights how AI is being used as a force multiplier to accelerate traditional attack chains, lowering the barrier for less-skilled attackers to conduct damaging campaigns rapidly.

1mo ago · hacker-news

The article discusses the application of Daniel Kahneman's dual-process theory of human cognition to security operations centers (SOCs), advocating for a two-tiered AI architecture that mirrors 'System 1' (fast, automatic processing) and 'System 2' (slow, deliberate thinking). It highlights that 98% of security alerts can be autonomously resolved using fast, forensic-grade AI, while only 2% require human judgment and deeper analysis. The core argument is that misapplying human or AI resources to inappropriate tasks leads to missed threats and analyst burnout. The recommended model integrates autonomous investigation for scale and AI copilots for human-augmented decision-making, creating a feedback loop that improves over time.

1mo ago · hacker-news

Meta has filed a patent for an AI system capable of continuously monitoring a user's voice, biometrics, and device usage to infer emotional states throughout the day. The system could run on smart glasses, phones, or smart home devices, logging emotional data with timestamps, location, and activity context. While not currently implemented in any product, the technology raises significant privacy concerns due to its extensive data collection, including voice tone, pupil size, blink rate, and app usage. The EU AI Act has already restricted emotion-inference technologies in workplaces and schools, and similar consumer-facing systems may face regulatory scrutiny.

1mo ago · hacker-news

A phishing-as-a-service (PhaaS) platform named Forg365 is targeting Microsoft 365 users through sophisticated attack chains involving device code phishing, adversary-in-the-middle (AitM) session theft, and AI-generated lures. The service is offered via Telegram for $400/month and leverages legitimate email services like Amazon SES and SendGrid to evade detection. It enables low-skilled attackers to conduct large-scale phishing operations with post-compromise capabilities such as token vaulting, cookie injection, and AI-assisted email drafting.

1mo ago · bleeping-computer

UK authorities have charged five individuals in connection with Russian Coms, a caller ID spoofing platform used by criminals to conduct over 1.8 million scam calls since 2020. The platform enabled scammers to spoof numbers of financial institutions, telecoms, and law enforcement agencies to steal personal data and funds from victims. It was marketed on Telegram, Snapchat, and Instagram, offering encrypted calls, voice-changing, and no-logs services, leading to an estimated £9,400 average loss per victim across more than 107 countries.

1mo ago · bleeping-computer

Varonis Threat Labs created 'Breach at the Beach,' a hands-on Capture the Flag (CTF) training exercise focused on detecting real-world attacks in Microsoft Entra ID environments. The CTF simulates modern identity-based threats, particularly those involving non-human identities and AI-powered workflows, to educate defenders on data exfiltration techniques. It emphasizes detection of legitimate feature abuse rather than misconfigurations and is designed to be resilient to AI-based solving, promoting deep learning through practical experience.

1mo ago · bleeping-computer

Lidl disclosed a data breach affecting customers in Germany, Belgium, and the Netherlands following a cyberattack on a third-party service provider. The attackers accessed a file containing personal information such as names, phone numbers, email addresses, dates of birth, and customer numbers. While the online shop system was not compromised, Lidl cannot rule out exposure of passwords, payment details, and addresses, urging customers to remain vigilant against phishing and identity fraud.

1mo ago · hacker-news

A misconfigured server exposed three active Evilginx phishing operations targeting Microsoft 365 users, enabling attackers to bypass MFA through proxy-based login interception and abuse of Microsoft's legitimate device code flow. The operations, attributed to threat actors codemado, mail-argenta, and saroula01, leveraged custom forks of open-source Evilginx hosted on public GitHub repositories. One campaign used AI-assisted development, and all three harvested corporate credentials, with sessions maintained via long-lived cookies and token refresh mechanisms. The incident highlights the growing accessibility of phishing-as-a-service and the need for robust Conditional Access policies.

1mo ago · bleeping-computer

Cybersecurity agencies from the US and allied nations have issued a joint advisory warning of Russian state-sponsored hackers, attributed to FSB Center 16, targeting critical infrastructure by exploiting misconfigured routers and known vulnerabilities. The threat actor scans for devices using default SNMP credentials and exploits CVE-2018-0171 in Cisco Smart Install to gain control of network devices. Sectors at risk include energy, healthcare, defense, and government services. The advisory emphasizes mitigation steps such as disabling vulnerable features, upgrading to SNMPv3, and blocking unauthorized protocols at firewalls.

1mo ago · bleeping-computer

The European Union and the United Kingdom have jointly imposed sanctions on Russian individuals and entities linked to state-sponsored cyberattacks. The targeted groups include GRU officers, FSB-affiliated hackers such as the Turla group, and cybercriminals involved in operations like the Lumma Stealer malware. These actors are accused of conducting cyberespionage, targeting critical infrastructure across Europe, and supporting disinformation campaigns. The sanctions follow a series of attacks on energy grids and government institutions, including failed attempts to disrupt Poland's power infrastructure.