Intelligence Feed

2w ago · hacker-news

Thermo Fisher Scientific has patched a high-severity vulnerability, CVE-2026-17583, in its Applied Biosystems human identification software that could allow tampering with DNA analysis files (.fsa and .hid) without detection. The flaw affects five supported product lines, enabling unauthorized modification of data files before analysis if laboratory controls are bypassed. Digital signatures have been added in updated versions to verify file integrity, though no exploitation has been reported to date. Three older product lines are end-of-life and will not receive patches.

2w ago · hacker-news

The Police National Legal Database (PNLD) suffered a data breach that exposed personal and contact information of police officers, government personnel, and criminal justice professionals. The compromised data, including names and work email addresses, was published on the dark web by a group calling itself ExfilSquad. The breach may have stemmed from misconfigured Microsoft Power Pages with anonymous access enabled, allowing unauthenticated access to Dataverse tables. While no evidence of password compromise or malware use was found, the exposed data could facilitate targeted phishing attacks.

2w ago · hacker-news

A Chinese threat actor is leveraging a publicly leaked version of the DarkSword exploit kit to target iOS devices running versions 18.4 through 18.7. The campaign uses fake AWS and Apple ID sign-in pages as watering holes to deliver the GHOSTBLADE information-stealing malware, which exfiltrates keychain, iCloud, and Wi-Fi credentials. The attacker infrastructure includes multiple malicious panels such as 'DarkSword Admin,' 'Decode Dashboard,' and 'C2 Control Panel,' with several IP addresses hosting these interfaces and a Telegram contact link recovered from one panel.

2w ago · hacker-news

Three high-severity vulnerabilities in Hugging Face's Diffusers library, collectively named FaceHugger, allow attackers to bypass the trust_remote_code safeguard and execute arbitrary code when loading models from untrusted repositories. The flaws stem from TOCTOU race conditions and improper validation during model loading, enabling malicious model repositories to silently run code during pipeline initialization. These vulnerabilities affect systems that use DiffusionPipeline.from_pretrained with untrusted or remote custom pipelines, posing significant AI supply chain risks.

2w ago · hacker-news

Attackers exploited an authentication bypass vulnerability (CVE-2026-18577) in N-able's N-central remote monitoring and management platform to gain remote administrative access to customer servers. The initial fix for CVE-2026-18556 was incomplete, allowing attackers to exploit an alternate path, later tracked as CVE-2026-18577, affecting N-central builds prior to 2026.3.1.7. After compromising N-central servers, attackers used Take Control for lateral movement and deployed Cloudflare tunnels as persistent services on managed endpoints, enabling remote access without inbound firewall rules. N-able identified six malicious IP addresses used in the attacks, and Huntress observed exploitation at one partner account, leading to access across nine downstream organizations. Post-compromise activity included process enumeration, but no data exfiltration was confirmed. Customers are advised to upgrade to build 2026.3.1.7 and hunt for malicious indicators such as suspicious svchost.exe instances and Cloudflared services.

2w ago · hacker-news

A critical firmware flaw in Coldcard hardware wallets, stemming from a 2021 integration error, led to the theft of approximately $70.2 million in Bitcoin (1,082.65 BTC) from 1,196 addresses within 41 minutes on July 30, 2026. The vulnerability arose because seed generation used a deterministic software pseudorandom number generator (PRNG) instead of the intended hardware RNG, reducing effective entropy to as low as 40 bits. Coinkite released emergency firmware updates, but existing compromised seeds remain vulnerable unless regenerated on patched firmware. The attack exploited predictable BIP-39 seed generation, allowing offline reconstruction of candidate seeds by correlating device UID, timer state, and RNG call history with public blockchain data.

2w ago · hacker-news

A threat actor dubbed Storm-2945, assessed to be a sub-cluster of the Russian state-sponsored group APT29 (aka Cozy Bear), has hijacked hotel Wi-Fi networks to deliver a surveillance-focused remote access trojan named CornFlake. The attack abuses compromised captive portals to redirect users to fake browser or OS update prompts, which lead to the download of malicious payloads. The CornFlake malware, written in Go, establishes persistence via registry run keys and scheduled tasks, captures keystrokes, screenshots, microphone audio, and browser credentials, and can bypass Chrome's App-Bound Encryption. A related in-memory PowerShell stealer, ChocoShell, harvests Microsoft 365, Azure AD, and WAM tokens from the Token Broker cache. Attackers also leveraged Microsoft's device code authentication flow to gain MFA-satisfied access by tricking users into approving malicious sessions.

2w ago · hacker-news

Adobe has patched a critical vulnerability, CVE-2026-48449, in its Campaign Classic (ACC) platform with a CVSS score of 10.0, stemming from incorrect authorization that allows arbitrary code execution without user interaction. Another high-severity flaw, CVE-2026-48448, involving SQL injection leading to arbitrary file reads, was also addressed. The updates apply to ACC v7: 7.4.3 build 9398 for Windows and Linux, with no known in-the-wild exploitation reported.

2w ago · hacker-news

Attackers compromised a JavaScript file, trackpoint-async.js, served by advertising company Adform, using it to conduct a supply chain attack that modified cryptocurrency wallet addresses in real time on affected websites. The malicious script, active at least on July 27, 2026, monitored and altered clipboard content and form inputs to replace legitimate Bitcoin, Ethereum, and Tron wallet addresses with attacker-controlled ones. The script also attempted to exfiltrate the hostname and path of visited pages to a remote server. The attack did not install persistent malware but operated entirely in-browser while the infected page was open, making detection and attribution more difficult.

2w ago · hacker-news

A spear-phishing attack targeting a law firm delivered a multi-stage malware chain involving a Go-based loader framework called HollowFrame and a Rust-based backdoor named Matryoshka. The attack begins with a malicious LNK file disguised as 'Case Documents' that triggers PowerShell to download further payloads. HollowFrame uses DLL side-loading with python.exe and python311.dll to establish persistence via a scheduled task and deploy Matryoshka, which communicates either over HTTP or through a private GitHub repository for command-and-control. Matryoshka variants enable remote command execution, Active Directory reconnaissance, file transfer, and deployment of additional tools, allowing for credential theft and lateral movement.

2w ago · hacker-news

A Chinese-speaking threat actor has been targeting government and public sector organizations in Central Asia since January 2025 using two custom backdoors, OctLurk and SilkLurk, along with a proxy tool called LurkProxy. The malware operates primarily in memory, using obfuscated loaders and victim-specific encoding to evade detection. Post-compromise activities include credential dumping, data exfiltration, remote access via Pandora RC, and lateral movement using tools like Impacket and Fscan.

2w ago · hacker-news

Researchers from Nanyang Technological University identified 84 vulnerabilities, termed implicit trust errors (iTrue), in 4G and 5G core network implementations, including Open5GS, free5GC, and others. These flaws stem from blind trust between core network functions and can enable denial-of-service attacks and session hijacking when exploited. A critical session hijacking flaw allows attackers to redirect a victim's uplink traffic by injecting malicious PFCP Session Modification Requests with duplicate Packet Detection Rule (PDR) IDs. The vulnerabilities affect both open-source and commercial 5G deployments, with one vendor (Dotouch) having patched CVE-2026-8233, while another major vendor remains unpatched.

2w ago · hacker-news

Google patched 1,072 security vulnerabilities in Chrome versions 149 and 150, exceeding the total fixes from the previous 23 updates combined. A critical sandbox escape vulnerability, CVE-2026-3545 (CVSS score: 9.6), was identified in Chrome's Navigation component, allowing potential access to local files. The flaw existed for over 13 years and was discovered using an AI-powered agent leveraging Google's Gemini models. Google is accelerating its release cadence and exploring dynamic patching to counter increasingly rapid, AI-driven vulnerability discovery and exploitation.

2w ago · hacker-news

Bitsight identified a malicious operation dubbed Fuyao, attributed to Zhejiang Fengwo IoT Technology Co., Ltd., involving cheap Android TV boxes that spoof phone hardware identities to commit ad fraud and turn users' broadband into proxy exit nodes. The devices run apps that mimic legitimate smartphones to click ads on operator-controlled websites, while also relaying traffic via SOCKS5 when an HDMI signal is detected. The operation uses machine vision models like YOLOv8s for ad detection and Blockly-based JavaScript automation for fraud campaigns, with command-and-control infrastructure pushing phone profiles to mask underlying hardware. Attribution is based on TLS certificates, email reuse, domain revenue links, and patent records, though the exact supply chain compromise remains unclear.

2w ago · hacker-news

A Chinese-speaking threat actor using the aliases knaithe and KnYuan leveraged the open-source Hermes Agent framework, powered by DeepSeek as the primary reasoning model, to autonomously conduct cyberattacks. The actor issued initial commands via Telegram, after which the agent independently identified internet-facing systems, selected public exploits, and attempted exploitation without further input. The campaign targeted vulnerabilities in Langflow, n8n, Marimo, and Citrix NetScaler systems, with confirmed exploitation of CVE-2026-3055 and CVE-2026-39987, though only three systems were successfully compromised. The operation was exposed due to an unintentional HTTP server exposing configuration files, API keys, exploit scripts, and logs.

2w ago · hacker-news

A macOS malvertising campaign linked to North Korean threat actors has been identified, leveraging fake software update pages to trick users into executing a malicious Terminal command. The attack, part of the Contagious Interview campaign (UNC5342), uses social engineering to induce panic and prompt users to paste a clipboard-staged curl command, leading to malware deployment. The malware employs an EtherHiding technique, retrieving C2 server addresses from Ethereum smart contracts, and delivers a Node.js backdoor and a crypto-stealing payload targeting 157 cryptocurrency wallets and browser data.

2w ago · hacker-news

A critical vulnerability in Azure Cosmos DB, dubbed CosmosEscape by Wiz, allowed attackers to escape the Gremlin query sandbox and achieve remote code execution on a multi-tenant gateway. This enabled access to a platform-wide signing key (Cosmos Master Key) and a regional account directory (Config Store), which could be used to retrieve primary account keys for any Cosmos DB account across tenants and regions. The flaw could have granted full read and write access to databases supporting services like Microsoft Teams and Copilot, though Microsoft confirmed no customer data was accessed. Microsoft patched the vulnerability within 48 hours of disclosure in November 2025, with full remediation completed by July 2026.

2w ago · hacker-news

A Chinese-speaking threat actor operating under the aliases knaithe and KnYuan has launched an AI-powered autonomous hacking campaign leveraging the Hermes Agent framework with DeepSeek as a reasoning engine to exploit seven critical vulnerabilities in Langflow, n8n, Citrix NetScaler, Apache Tomcat, Marimo Notebook, Palo Alto PAN-OS, and Microsoft Windows IKE Extensions. The campaign uses AI models to autonomously conduct vulnerability assessment, target selection, and exploit generation, with command and control coordinated via Telegram. The actor also leverages publicly available AI tools like Claude Code, Codex, and Qwen Code to support operations. When initial exploitation fails, the system automatically searches for new critical CVEs using GitHub PoCs to prioritize attack surfaces.

2w ago · hacker-news

The Chinese cybercrime group SilverFox targeted a Japanese industrial manufacturing organization using a sophisticated attack chain involving a three-driver BYOVD (Bring Your Own Vulnerable Driver) technique for kernel-level access and defense evasion. The attack began with a phishing email containing an invoice-themed lure, leading to DLL side-loading via malicious ZIP archives that deploy ValleyRAT, a Gh0st RAT variant. The malware uses multiple persistence and recovery mechanisms, including NTDLL unhooking, process injection, and a dual watchdog system to maintain remote access and resist removal.

2w ago · hacker-news

A state-sponsored threat actor has conducted a campaign exploiting a zero-day buffer overflow vulnerability in AnySign4PC, a South Korean financial-security software, through compromised legitimate websites used as watering holes. The attack allows remote code execution without user interaction by leveraging malicious WebSocket communication and DLL side-loading, leading to the deployment of SIGNBT or COPPERHEDGE backdoors. These backdoors enable remote command execution, file theft, reconnaissance, and lateral movement using tools like Mimikatz and RDP. The campaign overlaps technically with Gunra ransomware operations in infrastructure and artifacts, though no formal attribution to a specific group like Lazarus is made in the joint advisory.

2w ago · hacker-news

A vulnerability in Microsoft 365 Copilot for Word allows hidden prompts in documents to manipulate content generation, such as altering financial figures and copying malicious instructions into new documents. The attack leverages prompt injection techniques where hidden text, invisible to users but readable by the AI model, influences Copilot's behavior during drafting or editing sessions. Although Microsoft has deployed mitigations, the underlying vulnerability class remains exploitable as of disclosure. The attack requires user interaction and depends on malicious documents entering the model's context via attachments or OneDrive sources.

2w ago · hacker-news

Amazon Threat Intelligence attributes the September 2025 compromise of the npm packages debug and chalk to the North Korean threat actor Sapphire Sleet, also linked to prior attacks on axios and typo-crypto. The attacks began with social engineering of maintainers, followed by malicious updates containing trojanized code. The debug and chalk incident involved a browser-side interceptor that hijacked cryptocurrency transactions by rewriting wallet addresses, while other campaigns used post-install hooks and command-and-control infrastructure. Amazon ties the campaigns together through shared tradecraft, code reuse, and overlapping C2 indicators, though some technical discrepancies exist in the evidence.

2w ago · hacker-news

Russian threat actor TA488, also known as Laundry Bear, has exploited CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA), to conduct cyber espionage against U.S. and European government entities, as well as organizations in the telecommunications, financial, hospitality, and aerospace sectors. The attacks use 'half-click' phishing emails sent from compromised or Proton Mail accounts, which trigger a JavaScript-based payload called OWAReaper upon viewing. This browser-based implant enables persistent access to mailboxes by leveraging server-side persistence mechanisms, surviving credential rotation and device re-imaging. OWAReaper uses GitHub and email for command-and-control, exfiltrates data via encrypted HTTPS or DNS tunneling, and maintains access by stealing OAuth tokens and granting itself Owner-level permissions on mail folders.

2w ago · hacker-news

A zero-day vulnerability, CVE-2026-20316, in Cisco Secure Firewall Management Center (FMC) Software is under active exploitation, allowing unauthenticated remote attackers to log in using static credentials for a low-privileged account and access sensitive data. The vulnerability stems from hardcoded credentials, and while its CVSS score is 5.3, Cisco classifies it as High risk due to potential privilege escalation when chained with other flaws. Indicators of compromise include the presence of '/var/tmp/license.tmp' in system logs. Cisco has released hotfixes for multiple affected versions and urges immediate patching, especially for FCEB agencies by August 1, 2026.

3w ago · hacker-news

A critical vulnerability in Ruby on Rails, tracked as CVE-2026-66066 with a CVSS score of 9.5, allows unauthenticated attackers to read arbitrary files from server environments via crafted image uploads when using libvips for Active Storage processing. The flaw affects Rails versions 6.0 through 8.1.3 under specific configurations and could expose sensitive credentials such as secret_key_base, database passwords, and cloud storage keys, potentially enabling remote code execution or lateral movement. No in-the-wild exploitation has been reported at the time of publication, and researchers have not released a proof-of-concept. The patch requires upgrading Rails and libvips, or applying runtime mitigations using VIPS_BLOCK_UNTRUSTED or Vips.block_untrusted(true).

3w ago · hacker-news

A long-running cybercrime campaign has been active since 2017, involving the creation of fake websites that clone legitimate Russian companies in sectors such as fertilizer, petrochemicals, and logistics. The threat actors use lookalike domains and cloned content in multiple languages to deceive international B2B customers into making advance payments for non-existent goods. Victims are contacted via cold calls and phishing emails, and are provided with forged contracts and invoices containing fraudulent banking details. The operation has been linked to at least 100 counterfeit domains and shows signs of coordination through shared infrastructure and replication of fraud warnings on fake sites.

3w ago · hacker-news

A coordinated cyberattack impacted over 30 Minnesota community water systems on July 26–27, 2026, disrupting operational technology including automated controls and communications infrastructure. Multiple plants reported outages or degraded operations, with Braham's water treatment facility going offline and Maple Plain declaring a local state of emergency. The attack exhibited common tactics across targets, such as access methods and timing, suggesting a coordinated campaign. While no specific vulnerability or malware was confirmed, the activity aligns with known tradecraft of Iranian-affiliated threat group CyberAv3ngers, which has previously targeted industrial control systems using programmable logic controllers and human-machine interfaces.

3w ago · hacker-news

Broadcom has patched multiple critical vulnerabilities in VMware products, including VMware ESX, vCenter, Workstation, and Fusion. The most severe flaws include CVE-2026-59309, an authentication bypass in vCenter that allows unauthorized access, and CVE-2026-59310, a directory traversal flaw enabling remote code execution. Additionally, CVE-2026-47876 is a critical VM escape vulnerability in the VMXNET3 adapter, allowing a malicious actor with local VM privileges to execute code on the host. No evidence of in-the-wild exploitation has been found so far.

3w ago · hacker-news

A high-severity vulnerability in Firefox's JIT compiler, tracked as CVE-2026-10702, allows arbitrary code execution in the browser's renderer process simply by visiting a malicious webpage. This flaw affects Firefox versions 147 through 151.0.2 and also impacts Tor Browser versions based on these Firefox releases. The vulnerability was exploited in a browser-to-kernel chain called IonStack, combining it with a Linux kernel flaw (CVE-2026-43499, GhostLock) to achieve root access on ARM64 Android 17 devices. Mozilla has patched the issue in Firefox 151.0.3, but exploitation remains possible in unpatched systems.

3w ago · hacker-news

The source code for the Flying Eagle Android remote access trojan (RAT) is circulating in criminal Telegram channels, enabling widespread deployment of the malware. Researchers identified infrastructure linked to 170 servers hosting control panels or certificates associated with the RAT, which is used in a fake Chinese Public Security app called '公安一网通办'. The malware can steal payment credentials, record screens, access cameras, and perform phishing attacks on financial and government apps. A second Android RAT, Night Dragon, was introduced by one of the same Telegram groups, though it appears to be a separate build with no shared code with Flying Eagle.