Intelligence Feed

3w ago · bleeping-computer

Over 24,000 internet-exposed server Baseboard Management Controllers (BMCs) are vulnerable to a 20-year-old flaw (CVE-2013-4786) in IPMI 2.0, allowing attackers to extract password-derived authentication material for offline cracking. Researchers found that many of these systems use weak or default credentials, with Supermicro and HPE systems among the most commonly exposed. Successful compromise of a BMC can enable attackers to control physical servers, pivot to other management interfaces, and disrupt multi-tenant environments, especially in AI infrastructure. Evidence of active exploitation includes an exposed HPE iLO 4 interface displaying a ransom note demanding 0.3 BTC.

3w ago · bleeping-computer

The article discusses the risks associated with single sign-on (SSO) systems, highlighting the 2025 University of Pennsylvania breach where attackers compromised a PennKey SSO account and accessed internal systems such as VPN, Salesforce, Qlik, SAP, and SharePoint, leading to the theft of data on 1.2 million individuals. It emphasizes that while SSO improves user experience and centralized access management, it must be properly secured with strong passwords and multi-factor authentication (MFA) to prevent credential-based attacks. The article recommends using phishing-resistant MFA, securing identity provider (IdP) administrator accounts, and protecting signing certificates, OAuth secrets, and delegated permissions to reduce the identity attack surface.

3w ago · bleeping-computer

The PEAR ransomware group claimed responsibility for a data breach at Medical Computer Business Services (MCBS), a Georgia-based medical billing firm, which exposed sensitive personal and health information of 1.26 million individuals. The breach occurred between September 22 and 26, 2025, with threat actors exfiltrating 3.3 terabytes of data, including Social Security numbers, medical histories, and insurance details. The stolen data has been fully leaked online, and MCBS has notified affected individuals to take protective measures such as placing fraud alerts on their credit files.

3w ago · bleeping-computer

Hackers are actively exploiting a zero-day remote code execution vulnerability, CVE-2026-16723, in the FastJson Java library to target U.S.-based organizations across multiple sectors including financial services, healthcare, and retail. The vulnerability exists in FastJson versions 1.2.68 through 1.2.83 and is exploited without requiring user interaction or elevated privileges, primarily affecting Spring Boot fat-JAR deployments. Alibaba has confirmed the issue but no patch is available, and FastJson 1.x is no longer maintained, leaving affected systems exposed.

3w ago · bleeping-computer

Arista has patched a critical command injection vulnerability, CVE-2026-16812, in on-premises VeloCloud Orchestrator (VCO) deployments that is being actively exploited. The flaw allows unauthenticated remote attackers to execute privileged OS commands, compromising the confidentiality, integrity, and availability of the orchestrator and managed data. Exploitation requires only network access to the VCO web interface, with no credentials needed, and the U.S. CISA has mandated federal agencies to mitigate the issue by July 30, 2026.

3w ago · bleeping-computer

A proof-of-concept exploit for the 'Certighost' vulnerability (CVE-2026-54121) in Windows Active Directory Certificate Services has been released, enabling authenticated attackers to hijack Windows domains. The vulnerability allows a low-privileged domain user to manipulate machine account attributes and obtain a certificate that authenticates as a domain controller via PKINIT. This can lead to full domain compromise through DCSync attacks and theft of critical account credentials such as krbtgt.

3w ago · bleeping-computer

The Dysphoria DDoS botnet has infected approximately 200,000 devices worldwide by exploiting weak credentials and known vulnerabilities in IoT devices. It evolved from 'jackskid' and 'fbot' malware, incorporating a blockchain-based command-and-control mechanism using Ethereum ENS and Solana SNS domains for resilience. The botnet conducts DDoS attacks and can transform infected devices into network proxies, leveraging UPnP to expose internal services. Its operators claim a maximum attack capacity of 4 Tbps, promoting the service on a clearnet website as a stress-testing tool.

3w ago · bleeping-computer

The ShinyHunters extortion gang has claimed responsibility for the recent data breach at Ernst & Young (EY), asserting they obtained EY credentials through a supply-chain attack. The attackers allegedly accessed EY's Jira, GitHub, and Azure environments and exfiltrated documents containing client tax, personal, and financial information. EY detected suspicious activity between March 28 and April 12, 2026, and confirmed unauthorized access to a third-party support ticket system, though it has not verified ShinyHunters' involvement. The gang is threatening to release stolen data unless contacted by July 31, 2026.

3w ago · bleeping-computer

The Coca-Cola Company confirmed a ransomware attack on its subsidiary Fairlife, which resulted in the theft of approximately one terabyte of data. The Anubis ransomware gang claimed responsibility, stating they encrypted Nutanix systems and exfiltrated data, threatening to leak it unless a ransom was paid. Coca-Cola reported the incident to authorities and did not engage in negotiations, with most U.S. production operations since resumed.

3w ago · bleeping-computer

Apple is being sued by three individuals who lost approximately $1.8 million in Bitcoin after downloading a fraudulent Sparrow Wallet app from the App Store. The fake application impersonated the legitimate desktop-only Sparrow Wallet software and tricked users into disclosing their seed phrases, enabling theft of cryptocurrency. Plaintiffs allege Apple failed to monitor app submissions despite prior warnings, and promoted the malicious app through curated collections. The legitimate Sparrow Wallet developer had previously warned Apple about impersonation attempts and attempted to submit a placeholder app to prevent further fraud.

3w ago · bleeping-computer

Shadow AI agents are being created across various platforms like Salesforce Agentforce, Microsoft Copilot Studio, and Zapier without IT or security oversight, leading to persistent access to corporate systems and data. These agents can autonomously perform actions, increasing the risk of unauthorized or destructive activity. With only 21% of organizations having mature governance programs, there is a significant gap in visibility and control over these agents.

3w ago · bleeping-computer

GitHub and PyPI have implemented new time-based defenses to mitigate supply chain attacks. GitHub's Dependabot now enforces a default 72-hour cooldown period before updating dependencies, reducing the risk of automatic adoption of malicious packages. PyPI has introduced a 14-day cutoff, blocking the addition of new files to older package releases to prevent release poisoning. These measures aim to limit the impact of compromised tokens or malicious actors in the software supply chain.

3w ago · bleeping-computer

Threat actors are exploiting Steam discussion forums in a social engineering campaign known as ClickFix, where they pose as helpful users offering technical fixes. They trick victims into running malicious PowerShell commands that download and execute an XMRig cryptominer. The script masquerades as a Windows optimization tool, performs fake maintenance tasks, and establishes persistence via scheduled tasks and Defender exclusions, ultimately leading to cryptocurrency mining on compromised systems.

3w ago · bleeping-computer

A large-scale malvertising campaign dubbed SourTrade has been active since late 2024, targeting retail traders and cryptocurrency investors through fake Solana, Luno, and TradingView webpages. The attack uses malicious JavaScript to assemble malware directly in browser memory, leveraging service workers and shared workers to build payloads locally with unique hashes per session to evade detection. The payload is believed to enable network traffic interception, credential theft, keylogging, screenshot capture, and cryptocurrency wallet theft, delivered without transmitting a complete file over the network.

3w ago · bleeping-computer

Threat actors are leveraging email addresses and company breach data leaked by the ShinyHunters extortion group to conduct a sextortion email campaign. The emails falsely claim that recipients' devices were compromised and threaten to release intimate videos unless $2,000 in Bitcoin is paid. The campaign uses legitimate breach details to appear credible, but there is no evidence of actual device compromise. ShinyHunters has denied involvement in the scam.

3w ago · bleeping-computer

Threat actors have exploited a recently patched SNMP vulnerability (CVE-2025-20352) in Cisco IOS and IOS XE devices to deploy a rootkit on vulnerable switches, enabling them to bypass access controls, manipulate logs, and move laterally across VLANs. The attacks, tracked as 'Operation Zero Disco' by Trend Micro, target older Linux systems lacking endpoint detection and response solutions. The rootkit includes fileless components that persist across reboots via IOSd hooks, and attackers also attempted to exploit the older CVE-2017-3881 vulnerability. Cisco confirmed the exploitation of CVE-2025-20352 as a zero day, with no reliable detection tool currently available.

3w ago · bleeping-computer

OpenAI has confirmed a worldwide outage affecting ChatGPT, with users across the U.S., Europe, India, Japan, Australia, and other regions reporting connectivity issues. The company is actively investigating the cause of the disruption, which began within the last 30 minutes. No evidence of a cyber attack or compromise has been provided in the article; the nature of the incident appears to be service degradation rather than malicious activity.

3w ago · bleeping-computer

OnTrac, a U.S.-based parcel delivery company, disclosed a data breach that occurred between March 20 and 22, 2026, where attackers accessed customer data. The breach was detected on March 23, and the company engaged a third-party specialist to investigate. While the exact data compromised is redacted, the company offered credit monitoring services to affected customers. No ransomware group has claimed responsibility, and there is no evidence of data leakage or fraud at this time.

3w ago · bleeping-computer

Hackers are hijacking hotel and conference center Wi-Fi DNS settings to redirect users to fake Microsoft 365 login pages, enabling theft of credentials and bypassing multi-factor authentication via OAuth token authorization. The campaign, active since at least June 2026, targets traveling employees across multiple sectors including finance, healthcare, and legal services. The attack technique resembles previous router-based campaigns linked to the APT28 group. Researchers observed malicious domains and attempted abuse of WPAD for traffic interception.

3w ago · bleeping-computer

A threat actor leveraged the open-source Hermes AI agent in unattended 'YOLO' mode to automate post-exploitation activities during an alleged cyberattack on Thailand's Ministry of Finance. Evidence from exposed web directories indicates deployment of web shells, custom scripts, and a previously undocumented Go-based implant named Hades. The attackers targeted internal systems including Hadoop, Apache Ambari, GlassFish, and mail servers, using AI to perform privilege escalation, enumeration, and file traversal. While the Ministry has not confirmed a breach, artifacts suggest active intrusion and lateral movement within the network.

3w ago · bleeping-computer

Slopsquatting, Phantom Domains, and HalluSquatting represent a class of AI-driven attacks exploiting the predictability of hallucinated identifiers in AI coding agents. Attackers register these predicted names—such as fake package names, domains, or repositories—before they are requested, enabling malicious code delivery without phishing or credential theft. The core vulnerability lies in agents automatically fetching and executing unverified resources, creating scalable attack vectors for botnet-style compromise. This pattern highlights a systemic design flaw in late binding of untrusted AI-generated outputs.

3w ago · bleeping-computer

Chick-fil-A confirmed a data breach affecting over 13,000 customers due to credential stuffing attacks on its website and mobile app between June 17 and June 19, 2026. Attackers used credentials obtained from third-party sources to gain unauthorized access to Chick-fil-A One loyalty accounts. Compromised data includes names, email addresses, membership numbers, partial payment details, and potentially birth dates, phone numbers, and addresses.

3w ago · bleeping-computer

A massive Microsoft 365 and Azure outage occurred on July 23, 2026, beginning at 10:44 AM ET, primarily affecting services in the West US Azure region. The incident was caused by a bug in Microsoft's automated network maintenance system that incorrectly removed IP routes from more devices than intended, disrupting connectivity. Services including SharePoint, OneDrive, Teams, Power BI, and Microsoft Defender were impacted, with traffic rerouting and recovery efforts completed by 2:26 PM ET. Microsoft confirmed resolution of the incident and is conducting a full internal review of its maintenance processes.

3w ago · bleeping-computer

An Illinois man, Kyle Svara, was sentenced to six years in prison for hacking over 750 women's Snapchat accounts using social engineering tactics to steal nude photos, which he traded or sold online. He posed as a Snap Inc representative, used anonymized phone numbers, and phished Snapchat access codes between May 2020 and February 2021. Svara also distributed child sexual abuse material and falsely denied involvement during investigation.

3w ago · bleeping-computer

Europol, in collaboration with law enforcement from nine countries, conducted a multi-week operation targeting 'The Com,' a decentralized network of violent extremist groups. The operation flagged 4,340 URLs for removal, focusing on content promoting self-harm, child sexual abuse, violence, and extremist ideologies. The Com operates through subgroups like Offline Com, Cyber Com, (S)extortion Com, and 764, which recruit and exploit minors via social media and gaming platforms. The network has been linked to ransomware attacks and child exploitation, with prior operations leading to dozens of arrests and victim identifications.

3w ago · bleeping-computer

The Clop ransomware gang is conducting a new data theft extortion campaign by exploiting a critical vulnerability, CVE-2026-12569, in Internet-exposed PTC Windchill and FlexPLM instances. The flaw allows unauthenticated remote code execution, enabling attackers to deploy JSP webshells for data exfiltration. Organizations in high-risk sectors such as aerospace, defense, and manufacturing are targeted, with Clop using the email [email protected] for extortion demands.

3w ago · bleeping-computer

The Dolphin X remote access trojan (RAT) is a newly identified malware advertised on cybercrime forums that combines credential theft with an AI-powered 'AI Profiler' to rank infected users by their potential value to attackers. The AI Profiler analyzes application usage, browser domains, installed software, and other data to generate risk scores and daily summaries, enabling threat actors to prioritize high-value targets such as those with access to corporate networks, cloud environments, or cryptocurrency assets. The malware claims to target over 300 applications, including browsers, password managers, crypto wallets, and cloud tools, though its full capabilities remain unverified due to analysis limitations.

3w ago · bleeping-computer

A malvertising campaign leveraging Bing ads promotes a fake Claude desktop application to distribute the SectopRAT remote access trojan. The malicious installer, ClaudeDesktop.exe, sideloads a malicious DLL to deploy the malware, which establishes persistence via a scheduled task under the name DockerDesktop.exe. SectopRAT, also known as ArechClient2, steals credentials, files, and sensitive data from browsers and messaging apps, using Ethereum transactions to retrieve C2 addresses. The campaign, dubbed FakeAgent, has compromised at least 29 organizations and uses anti-analysis techniques to evade detection.

3w ago · bleeping-computer

Australian energy provider Origin Energy confirmed a data breach involving unauthorized access to customer data, including personally identifiable information such as names, addresses, dates of birth, and partial financial details. The breach impacts an unknown number of customers, with threat actors claiming to possess data from 2 million individuals. Origin has launched an investigation, notified relevant authorities, and is contacting affected customers while working to prevent further unauthorized access.

3w ago · bleeping-computer

A widespread outage affecting Microsoft 365 services, including Teams, SharePoint, OneDrive, and the Admin Center, began on July 23, 2026, at 10:44 a.m. ET, primarily impacting users in North America. The issue has caused degraded functionality such as failed page loads, missing images in Teams, and inaccessible admin tools. Microsoft is investigating the incident, identified as MO1437424, and has initiated traffic rerouting to mitigate the impact, with partial recovery observed for some users.