Intelligence Feed

1mo ago · unit42

In April 2026, a financially motivated campaign distributed the Vidar stealer and XMRig cryptocurrency miner via malvertising, targeting users searching for cracked software. The attackers used password-protected archives with fake code signing certificates to evade detection and deliver payloads. The malware employed file inflation, DLL sideloading, and AMSI bypass techniques to avoid sandbox analysis and security controls. Victims were primarily located in the U.S. and EU, with data exfiltrated to C2 servers and Monero mining initiated through a configured pool.

1mo ago · hacker-news

A critical vulnerability dubbed 'Rogue Agent' in Google Dialogflow CX allowed attackers with edit permissions to compromise other agents within the same Google Cloud project. The flaw stemmed from a shared, writable runtime environment where a malicious Code Block could overwrite a critical execution file, enabling data theft, phishing, and message manipulation across all agents. Although Google has patched the issue and no exploitation was observed, the attack could bypass logging and security perimeters due to insufficient isolation and excessive network access.

1mo ago · bleeping-computer

Accenture confirmed a security breach after a threat actor named '888' claimed responsibility for stealing over 35 GB of data, including source code, authentication keys, and configuration files. The actor posted a screenshot showing access to an Azure DevOps repository hosted under a redacted accenture.com subdomain and offered the data for sale on a cybercrime forum. Accenture stated the issue was isolated and remediated with no impact on operations, but did not confirm the scope or method of the breach.

1mo ago · socket-dev

A coordinated campaign across npm and PyPI registries has been identified, distributing 17 malicious packages that typosquat popular payment SDKs such as PaySafe, Skrill, and Neteller. The packages mimic legitimate SDKs to harvest environment variables containing sensitive data like API keys, tokens, and credentials. The stolen data is exfiltrated to an AWS-hosted C2 server using ngrok infrastructure, with anti-sandboxing and obfuscation techniques employed to evade detection.

1mo ago · hacker-news

RedWing is a new Android malware-as-a-service (MaaS) operation rented via Telegram, enabling low-skilled attackers to conduct bank fraud. It delivers ready-made payloads that bypass security tools and use phishing links to trick users into installing malicious apps from unofficial sources. The malware abuses Android Accessibility services to steal banking credentials, intercept one-time codes, and enable real-time remote control of infected devices. It primarily targets Russian financial institutions and operates through custom-built droppers with dynamically configurable overlay attacks.

1mo ago · bleeping-computer

A hidden authentication backdoor in multiple Tenda router firmware versions allows attackers to gain full administrative access to the device's web interface by using an undocumented password comparison mechanism. The vulnerability, tracked as CVE-2026-11405, is located in the '/bin/httpd' binary and remains unpatched as the vendor could not be reached. Successful exploitation enables attackers to reconfigure the device, alter network settings, and disable security features, posing significant risk to the local network.

1mo ago · bleeping-computer

Chinese threat actor UAT-7810 is expanding its Operational Relay Box (ORB) network by deploying updated and new malware variants, including LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST. These tools are used to compromise internet-facing networking devices, primarily unpatched Ruckus and ASUS routers, leveraging known vulnerabilities. The ORB infrastructure enables other China-aligned APTs to proxy traffic through compromised regional devices to evade detection and hinder attribution.

1mo ago · hacker-news

A critical session isolation vulnerability in Writer, an enterprise AI platform, dubbed WriteOut, allowed attackers to hijack user accounts across tenants by exploiting the live preview feature. By tricking a logged-in user into clicking a malicious preview link, attackers could steal session cookies and gain full access to the victim's account, including sensitive data and administrative privileges. The vulnerability bypassed input filters by fetching and executing remote malicious scripts within a sandboxed environment.

1mo ago · hacker-news

U.S. prosecutors have linked 19-year-old Peter Stokes, allegedly part of the Scattered Spider hacking group, to a May 2025 breach of a luxury jewelry retailer. The attackers used social engineering to manipulate the IT help desk into resetting passwords and bypassing multifactor authentication, then deployed tunneling tools like ngrok and Teleport to exfiltrate over 77 GB of data. Despite ransomware deployment being blocked, the attackers demanded $8 million in cryptocurrency. The FBI traced Stokes via a persistent Windows device ID tied to Microsoft account activity and correlated IP addresses from his online accounts.

1mo ago · hacker-news

Researchers at Noma Security discovered a technique called GitLost that exploits indirect prompt injection to manipulate GitHub Agentic Workflows into leaking private repository data. The attack involves a malicious public GitHub issue that tricks an AI agent with read access into pulling and publicly commenting sensitive contents from private repositories. This highlights an architectural risk in AI agents that combine access to private data, untrusted input, and public output channels, creating a data exfiltration path without requiring stolen credentials or direct access.

1mo ago · hacker-news

A phishing campaign leveraging Microsoft's device-code flow has been observed targeting Microsoft 365 accounts using collaboration-themed lures. The attack abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass MFA, tricking users into authorizing an attacker-controlled session. The campaign, linked to reusable tooling called DEBULL, shares tactics with Storm-2372 and is part of a growing trend in phishing-as-a-service (PhaaS) platforms like EvilTokens and ARToken that enable account takeover and business email compromise.

1mo ago · bleeping-computer

In June 2026, researchers at Novee Security identified a critical CI/CD vulnerability pattern named Cordyceps affecting widely used open-source projects, including those from Microsoft, Google, and Apache. The issue stems from the composition of GitHub Actions workflows that misuse privileged triggers like pull_request_target and workflow_run, enabling attackers to execute code in trusted contexts via pull requests. Despite passing all standard security checks, these pipelines allowed potential theft of long-lived credentials and persistent access to critical systems, highlighting a systemic gap in supply chain governance.

1mo ago · bleeping-computer

Spanish authorities have arrested a man suspected of being an active member of the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest. He allegedly provided logistical and operational support to a Ukrainian hacker within CARR and facilitated escape routes to Russia. The groups have been linked to attacks on critical infrastructure in the U.S. and Europe, including SCADA systems, and are loosely associated with the Russian state-backed APT44 (Sandworm). The suspect also participated in operations attributed to the hacktivist group NoName057(16), which promotes pro-Russian and anti-Western narratives.

1mo ago · talos

UAT-7810, a China-nexus advanced persistent threat (APT) actor, continues to expand its Operational Relay Box (ORB) networks by deploying new malware variants including LONGLEASH, DOGLEASH, and JARLEASH. The group exploits known vulnerabilities in Ruckus and ASUS routers to compromise devices and establish backdoors. These backdoors enable remote command execution, file management, and network tunneling, supporting further exploitation by secondary threat actors. Cisco Talos has identified new infrastructure and malware samples associated with ongoing campaigns.

1mo ago · hacker-news

The integration of AI into software development pipelines has significantly expanded the software supply chain attack surface. AI coding assistants, autonomous agents, and model context protocols (MCP) introduce new risks, such as malicious dependency suggestions, poisoned tool descriptions, and prompt injection attacks. Traditional security scanning is insufficient as threats now originate from models, agents, and their configurations, not just code artifacts.

1mo ago · bleeping-computer

A critical 16-year-old Linux kernel vulnerability named Januscape (CVE-2026-53359) enables guest-to-host virtual machine escape on both Intel and AMD architectures, posing significant risks to multi-tenant cloud environments. The flaw resides in KVM/x86's shadow MMU emulation and can be exploited by attackers with root access inside a guest VM to execute arbitrary code on the host or cause a denial-of-service by crashing the host kernel. It was used as a zero-day in Google's kvmCTF program, and when combined with the Dirty Frag privilege escalation, even unprivileged attackers could achieve full compromise. Administrators are urged to apply patch commit 81ccda30b4e8 to mitigate exposure.

1mo ago · bleeping-computer

Modern email attacks increasingly exploit trusted identities, legitimate services, and normal communication patterns to bypass traditional security controls. Techniques such as Device Code phishing, business email compromise (BEC), and account takeovers (ATO) are commonly used, allowing attackers to evade detection by avoiding malware and suspicious attachments. These attacks result in alert fatigue and manual investigation overhead for security teams. The article highlights the need for behavioral AI to automate detection and response in the evolving email threat landscape.

1mo ago · hacker-news

BeyondTrust has patched multiple critical vulnerabilities in its Remote Support (RS) and Privileged Remote Access (PRA) products. The most severe flaws, CVE-2026-40138 and CVE-2026-40139, allow unauthenticated attackers to bypass authentication and gain unauthorized access to appliances, including elevated privilege accounts, under specific configurations. Additional vulnerabilities could lead to denial-of-service conditions and unauthorized data access. While no active exploitation has been reported, past flaws in these products have been actively exploited to deploy web shells and backdoors, underscoring the urgency of patching.

1mo ago · hacker-news

CERT/CC has warned of a hidden administrative backdoor in multiple Tenda router firmware versions, tracked as CVE-2026-11405. The backdoor resides in the '/bin/httpd' binary and allows full administrative access by bypassing normal authentication using an undocumented 'rzadmin' password check. The vulnerability enables attackers to gain elevated privileges without valid credentials, leading to potential device takeover. No patch is currently available, and users are advised to disable remote management and change default LAN IP settings.

1mo ago · bleeping-computer

Microsoft is testing a new Cloud Rebuild feature for Windows 11, designed to remotely reinstall the operating system on devices that are non-bootable or experiencing critical issues. This feature, part of the Windows Resiliency Initiative, allows for a full OS recovery without the need for physical media or a functioning OS. It is being rolled out to Windows Insider Experimental channel users as part of ongoing efforts to improve system recovery and resilience.

1mo ago · bleeping-computer

BeyondTrust has disclosed two critical vulnerabilities, CVE-2026-40138 and CVE-2026-40139, in its Remote Support (RS) and Privileged Remote Access (PRA) software that allow unauthenticated attackers to bypass authentication and gain unauthorized access to affected systems. Exploitation requires specific configurations, though details were not disclosed. The vendor has patched cloud instances and urges self-hosted customers to update to version 25.3.3 or later. Previous vulnerabilities in the same software have been actively exploited in the wild by threat actors, including the Chinese state-backed group Silk Typhoon.

1mo ago · bleeping-computer

Microsoft is enabling the Windows settings backup and restore tool by default for enterprise devices joining or hybrid-joining Microsoft Entra, starting with Windows 11 version 26H2. This feature, previously opt-in, aims to streamline user settings backup during device resets, replacements, or upgrades. The default enablement applies only to eligible non-EU DMA-regulated devices where administrators have not explicitly configured backup policies. IT admins retain control via MDM solutions like Microsoft Intune or Group Policy to override defaults.

1mo ago · hacker-news

A critical 16-year-old use-after-free vulnerability in Linux's KVM hypervisor, dubbed 'Januscape' and tracked as CVE-2026-53359, allows guest virtual machines to escape to the host on both Intel and AMD x86 systems. The flaw resides in the shadow MMU code and can lead to host kernel corruption or full host code execution when exploited. The vulnerability affects any x86 environment hosting untrusted guests with nested virtualization enabled, posing a high risk to multi-tenant cloud environments.

1mo ago · hacker-news

An Iranian hacking group linked to the Ministry of Intelligence and Security (MOIS), tracked as Cavern Manticore, has been using a new modular command-and-control (C2) framework named Cavern to target Israeli organizations, particularly in the IT and government sectors. The attack leverages DLL side-loading via SysAid's software update mechanism, deploying a trojanized DLL (uxtheme.dll) that communicates with a C2 server and downloads additional malicious modules. These modules enable reconnaissance, data theft, lateral movement, and tunneling, with a sophisticated .NET-based architecture using mixed compilation formats to hinder analysis. The group exploits trusted relationships in the software supply chain and has shifted from broad reconnaissance to targeted data exfiltration across Middle Eastern sectors.

1mo ago · bleeping-computer

Vietnamese authorities have arrested seven suspects linked to the operation of HiAnime, a major anime piracy service that attracted hundreds of millions of visitors monthly. The group allegedly created over 100 websites to distribute more than 26,000 pirated anime titles, generating $12.85 million in illicit advertising revenue between 2020 and April 2026. The service was previously rebranded from Zoro.to to Aniwatch.to and later to HiAnime.to, appearing on both the European Commission's and USTR's notorious markets lists. The Alliance for Creativity and Entertainment (ACE) commended the takedown, which resulted from a multi-year investigation supported by U.S. law enforcement.

1mo ago · bleeping-computer

Threat actors are conducting fake IT support calls via Microsoft Teams to trick employees into installing the EtherRAT malware. The attack begins with a phishing email containing a malicious PDF, followed by a voice call from an external Teams account impersonating system administrators. Attackers use legitimate remote access tools like HopToDesk and AnyDesk, then deploy EtherRAT via a malicious MSI installer, enabling full system control and data theft. EtherRAT uses Ethereum smart contracts for C2 resilience, and the campaign is actively evolving with multiple malware versions observed.

1mo ago · bleeping-computer

A phishing campaign impersonates over 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, to target marketing professionals with fake job interviews. The attackers abuse legitimate platforms like PeopleForce and Salesforce Marketing Cloud to increase credibility, using nested redirects to deliver a malicious landing page. Victims are prompted to sign into their Google accounts via a fake 'Continue with Google' page that uses browser-in-the-browser (BitB) technique to mimic legitimate authentication, enabling credential theft.

1mo ago · hacker-news

Threat actors are actively probing and attempting to exploit CVE-2026-20896, a critical vulnerability in Gitea Docker images that allows unauthenticated remote users to gain elevated access by spoofing the 'X-WEBAUTH-USER' HTTP header. The flaw arises from the default configuration trusting all IP addresses due to a wildcard in the 'REVERSE_PROXY_TRUSTED_PROXIES' setting. Exploitation attempts were detected just 13 days after public disclosure, with initial activity observed from a ProtonVPN IP address. Although no full exploitation has been confirmed yet, the risk remains high for unpatched internet-facing instances.

1mo ago · hacker-news

A suspected China-nexus threat actor is conducting a targeted cyber espionage campaign against Indian taxpayers, tax professionals, and corporate finance teams using spear-phishing emails impersonating the Indian Income Tax Department. The campaign, dubbed Operation DragonReturn, delivers DcRAT via a malicious fake tax filing utility to steal sensitive data and establish persistent access. The attackers use social engineering, DLL side-loading, image-based payload concealment, and Windows service persistence to maintain long-term access to compromised systems.

1mo ago · hacker-news

The article discusses how to evaluate AI-powered Security Operations Center (SOC) platforms in 2026, emphasizing the importance of real-time data correlation, full-lifecycle automation, and measurable outcomes. It contrasts true AI SOC platforms with 'bolt-on' AI solutions that offer limited automation. The focus is on architectural capabilities rather than marketing terms, with Exaforce's Exabots highlighted as an example of an agentic AI SOC platform performing detection, triage, investigation, and response. No specific malicious threat activity, threat actor, or compromise indicators are described.