Intelligence Feed

4w ago · bleeping-computer

A previously unknown threat actor, tracked as UTA0533, exploited two zero-day vulnerabilities in SonicWall SMA1000 appliances to deploy custom malware. The attack chain began with a server-side request forgery (SSRF) vulnerability (CVE-2026-15409) to access internal services, followed by a command injection flaw (CVE-2026-15410) to execute commands as root. The attackers deployed a custom Python dropper named KNUCKLEBALL, which installed Java-based malware Sou5 and ORANGETAIL for persistent access and command execution.

4w ago · bleeping-computer

Estée Lauder suffered a data breach after attackers exploited a vulnerability in the Oracle E-Business Suite (CVE-2025-61882) used for HR operations. The breach, which occurred around August 9, 2025, allowed unauthorized access to sensitive personal and financial information of individuals. The Clop ransomware gang is linked to the attack, having exploited the flaw as a zero-day since early August 2025.

4w ago · bleeping-computer

The JadePuffer agentic threat actor has evolved to target AI/ML infrastructure using custom ransomware named EncForge, which encrypts critical AI assets such as model checkpoints, training datasets, and vector databases. The attack leverages autonomous decision-making to adapt in real time, deploying Python scripts to deliver the Go-based EncForge payload after gaining root access via an exposed Docker socket. The ransomware uses AES-256 and RSA-2048 encryption, appends '.locked' to encrypted files, and leaves a ransom note, though no data exfiltration was observed.

4w ago · bleeping-computer

Security researchers from Pillar Security demonstrated sandbox escape techniques across four AI coding agents: Cursor, OpenAI's Codex CLI, Google's Gemini CLI, and Antigravity. The attacks leverage prompt injection to manipulate files within the sandboxed workspace, which are later executed or interpreted by trusted tools running outside the sandbox, leading to command execution on the host. These techniques exploit design flaws such as over-trusted configuration files, incomplete denylists, and privileged local daemons. Most vulnerabilities have been patched, though some CVEs are still pending.

4w ago · bleeping-computer

A newly identified malware named HollowGraph leverages compromised Microsoft 365 accounts and the Microsoft Graph API for command-and-control (C2) communications, using calendar events as a covert channel to send and receive encrypted commands and exfiltrated data. The malware is associated with the Cavern C2 framework and shows technical similarities to the Iranian-linked threat actor Lyceum, though attribution remains unconfirmed. HollowGraph employs hybrid encryption (RSA and AES-256-GCM), DNS tunneling for credential updates, and targets organizations in Israel for espionage purposes.

4w ago · bleeping-computer

Hugging Face disclosed a breach where an autonomous AI agent exploited code-execution vulnerabilities in its data-processing pipeline to gain access to internal datasets and credentials. The attacker used a malicious dataset to execute code on a processing worker, enabling lateral movement across internal clusters. The campaign involved self-migrating command-and-control infrastructure hosted on public services, consistent with an 'agentic attacker' scenario. Hugging Face has since revoked credentials, rebuilt compromised nodes, and improved detection systems.

4w ago · bleeping-computer

The article discusses the challenges and considerations for evaluating AI-powered Security Operations Center (SOC) solutions, emphasizing the gap between vendor promises and real-world performance. It highlights that while AI SOC tools show potential in automating threat detection and response, many fail in production due to misalignment with team workflows, lack of contextual data, and durability issues. The guide recommends a structured evaluation framework focusing on verdict accuracy, operational fit, long-term reliability, and lessons from practitioners. No specific threat actor, malware, or attack campaign is described.

4w ago · bleeping-computer

Attackers are actively exploiting a critical remote code execution vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, allowing unauthenticated threat actors to escape the sandbox and execute arbitrary code. The flaw was patched on July 13, 2026, but exploitation was confirmed in the wild just days later. Despite ServiceNow not officially acknowledging active exploitation, threat intelligence firm Defused has observed attack attempts leveraging the same endpoint used in the vulnerability proof-of-concept.

4w ago · bleeping-computer

Microsoft released an out-of-band (OOB) update (KB5121767) to address a compatibility issue between a Windows USB-C Connection Manager interface and the Intel Innovation Platform Framework (IPF) Processor Participant driver on certain Dell PCs. The conflict, introduced in the June 2026 KB5095093 preview update, caused unexpected shutdowns, performance degradation, increased heat, and battery drain. The issue affected Dell systems running Windows 11 25H2 and 24H2 after installing the July 2026 KB5101650 update, with Microsoft temporarily blocking the update until the fix was available.

4w ago · bleeping-computer

Microsoft is addressing a widespread issue affecting Windows Server Update Services (WSUS) synchronization, which has caused delays and timeouts since July 13, 2026. The problem impacts both client and server platforms, preventing administrators from deploying the latest Windows updates through WSUS or Configuration Manager. While mitigation measures have been deployed for new or rebuilt WSUS servers, Microsoft continues to work on solutions for previously affected systems.

4w ago · bleeping-computer

An advanced threat actor is exploiting the update mechanism of the ViPNet software, widely used in Russian government and regulated sectors, to deploy a multi-stage malware payload. The campaign, dubbed HelloNet, has been active since at least May 2026 and targets organizations in government, energy, transport, education, and logistics. The attackers use a malicious DLL sideloaded via a legitimate ViPNet updater to establish persistence and deploy proxy and backdoor tools. Attribution to a Chinese-speaking APT is considered low confidence due to limited evidence and potential false flags.

4w ago · bleeping-computer

7-Zip has released version 26.02 to address a critical remote code execution vulnerability in its XZ decompression functionality. The flaw, stemming from a heap-based buffer overflow, could allow attackers to execute arbitrary code if a user opens a specially crafted archive. While no active exploitation has been reported, the lack of an automatic update mechanism increases the risk of prolonged exposure for unpatched systems.

4w ago · bleeping-computer

Critical remote code execution vulnerabilities in WordPress Core, collectively known as 'wp2shell' and tracked as CVE-2026-63030 and CVE-2026-60137, have been publicly exploited. These flaws allow unauthenticated attackers to execute arbitrary code on affected WordPress installations running versions 6.9.0–6.9.4 and 7.0.0–7.0.1. The vulnerabilities stem from a REST API batch-route confusion flaw and a SQL injection in the 'author__not_in' parameter, which can be chained together for pre-authentication RCE. Immediate patching to WordPress 7.0.2 or 6.9.5 is strongly advised due to active exploitation.

4w ago · bleeping-computer

Microsoft has observed a significant increase in ACR Stealer malware attacks targeting enterprise customers. The malware is delivered via social engineering using the ClickFix lure, WebDAV servers, and MSHTA to execute malicious payloads. ACR Stealer steals browser passwords, authentication tokens, and sensitive documents, leveraging obfuscated PowerShell scripts, in-memory execution, and steganographic images. Some variants use blockchain services as dead-drop resolvers for C2 communication.

4w ago · bleeping-computer

The article discusses the growing implementation of age verification laws worldwide and highlights concerns around biometric data privacy. Incode Technologies introduces On-Device Age Estimation, a privacy-preserving solution where facial analysis occurs locally on the user's device, ensuring faces are never transmitted or stored. The company also emphasizes its $100 million commitment to privacy-enhancing technologies and anti-fraud collaboration without centralized data pooling. This approach aims to meet compliance requirements while mitigating risks of data breaches and increasing consumer trust.

4w ago · bleeping-computer

Abbott Laboratories is investigating two unrelated cyber incidents. The first involves the ShinyHunters extortion gang, which claims to have accessed legacy Exact Sciences systems via a vishing attack compromising Microsoft Entra SSO credentials, exfiltrating sensitive customer and internal data. The second incident involves a threat actor named ShadowByt3$, who claims unauthorized access to Abbott's LabCentral portal using compromised customer credentials, allegedly stealing technical and regulatory documents. Abbott states that no critical operations were impacted and disputes claims that sensitive data was exposed in the LabCentral incident.

4w ago · bleeping-computer

A vulnerability named HollowByte allows unauthenticated attackers to cause a denial-of-service condition on OpenSSL servers by sending an 11-byte malicious payload during the TLS handshake. The flaw stems from improper memory allocation based on unvalidated message length headers, leading to memory bloat and heap fragmentation. Although the issue has been silently patched in OpenSSL versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, affected systems remain at risk until updated, particularly given the widespread use of OpenSSL in web servers, runtimes, and databases.

4w ago · bleeping-computer

Cybercriminals involved in carding are increasingly relying on 'clean' residential proxies to bypass fraud detection systems, but these proxies alone are no longer sufficient. They are now part of a broader identity-simulation strategy that includes matching geographic data, device fingerprints, and browser profiles to stolen identity information. As financial services improve detection, carders face challenges with proxy reputation degradation and provider restrictions, leading to a growing demand for finance-compatible proxy services.

4w ago · bleeping-computer

Ernst & Young disclosed a data breach resulting from the compromise of a third-party support ticket system used by its IT personnel. The breach occurred between March 28 and April 12, during which an unauthorized party accessed and downloaded documents containing personal and financial data related to tax filings. The company detected anomalous activity on April 23, launched an investigation with external cybersecurity experts, and has since secured its systems. No threat actor has claimed responsibility, and there is no evidence of data misuse to date.

4w ago · bleeping-computer

A security researcher known as Nightmare Eclipse has released a Windows zero-day exploit named LegacyHive, which enables privilege escalation on fully patched systems by exploiting a flaw in the Windows User Profile Service. The proof-of-concept requires additional user credentials to limit weaponization, but successful exploitation allows non-admin users to manipulate registry hives and achieve automatic code execution upon administrator login. Microsoft has not yet assigned a CVE to this vulnerability, and the company has issued warnings against malicious use of such disclosures.

4w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to urgently patch two actively exploited critical vulnerabilities in Fortinet's FortiSandbox platform, identified as CVE-2026-39808 and CVE-2026-25089. These flaws allow unauthenticated remote code execution via command injection with no user interaction required. Exploitation in the wild has been confirmed by threat intelligence firm Defused, prompting CISA to add the vulnerabilities to its known exploited catalog. Agencies must remediate by July 19, 2026, per Binding Operational Directive 26-04.

4w ago · bleeping-computer

U.S. authorities charged Zhuoying Chen and Haojie Zhang for allegedly managing a money laundering network that processed at least $43 million from cyber-enabled investment fraud scams. The funds originated from 'pig butchering' or romance baiting schemes, where victims were lured into fraudulent investment opportunities via social media and messaging platforms. The defendants used 140 bank accounts under 45 shell companies to transfer stolen funds to China. This case highlights the growing scale of investment fraud, which accounted for 49% of scam incidents in the FBI's 2025 Internet Crime Report.

4w ago · bleeping-computer

Microsoft has announced that Windows Server 2022 will reach the end of mainstream support on October 13, 2026, transitioning to extended support with continued security updates until 2031. Organizations are advised to upgrade to Windows Server 2025, the latest Long-Term Servicing Channel release, to remain protected and supported. The article highlights Microsoft's lifecycle policy and recent extensions to hotpatching and extended security updates for certain editions.

4w ago · bleeping-computer

A new macOS malware named ClickLock targets users through social engineering to steal login credentials, cryptocurrency assets, browser data, and password manager information. The malware forces victims into entering their system password by displaying fake authentication dialogs and terminating critical system processes. It establishes persistence via LaunchAgents, exfiltrates data through Telegram, and deploys a persistent backdoor using GSocket for remote access. The malware leverages compromised legitimate domains and evades detection by self-deleting modules and clean reputations of host infrastructure.

4w ago · bleeping-computer

A vulnerability in Anthropic's Claude for Chrome extension allows malicious browser extensions to trigger predefined AI workflows by simulating untrusted click events. The flaw arises because the extension fails to validate the Event.isTrusted property, enabling unauthorized execution of actions in connected services like Gmail, Google Docs, Calendar, and Salesforce. Although the issue requires a malicious extension already installed by the user, it can abuse Claude's authenticated access to sensitive platforms without additional user consent.

4w ago · bleeping-computer

The Coca-Cola Company disclosed that its Fairlife dairy subsidiary suffered a ransomware attack, leading to the temporary suspension of production across U.S. facilities. The attack impacted production-related systems, though product safety remains unaffected. Investigation is ongoing, with outside cybersecurity experts and law enforcement involved. No ransomware group has claimed responsibility, and details on data exfiltration or extortion remain undisclosed.

4w ago · bleeping-computer

A new malicious framework named OkoBot has been active since January 2026, delivering over 20 payloads to steal cryptocurrency wallet seed phrases, credentials, and sensitive data. It spreads via ClickFix attacks and malicious GitHub repositories hosting trojanized software. The infection chain begins with the TookPS PowerShell script, which installs an SSH bot to deploy further modules. Victims are primarily in Brazil, with secondary targets in Vietnam, Canada, Mexico, and Turkey, and evidence suggests the threat actor may be Russian-speaking due to geoblocking and code comments.

4w ago · bleeping-computer

A Russian financially motivated threat actor, UAT-11795, has been conducting attacks since at least June 2025 by distributing trojanized installers of legitimate software such as WebEx, Zoom, and MobaXterm to deploy the Starland RAT. The malware establishes persistence, performs reconnaissance, steals credentials and cryptocurrency, and can deploy additional payloads like CastleStealer and Remcos RAT. The campaign targets users in the U.S., Germany, Romania, and Venezuela, using sophisticated techniques including registry manipulation, sandbox detection, and encrypted C2 communications via a PowerShell framework called WLDR.

4w ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to patch a critical vulnerability, CVE-2026-46817, in Oracle E-Business Suite (EBS) by July 18, 2026, due to active exploitation in the wild. The flaw resides in the File Transmission component of Oracle Payments and allows unauthenticated attackers to take over systems via HTTP. Threat intelligence firm Defused confirmed exploitation after observing attacks on honeypots, despite the absence of public proof-of-concept code. CISA emphasizes prompt patching to prevent compromise of federal systems.

4w ago · bleeping-computer

Microsoft has announced that Windows 11 24H2 Home and Pro editions will reach end of support on October 13, 2026, after which they will no longer receive security or non-security updates. This increases the risk of unpatched vulnerabilities being exploited on unupdated systems. Users are advised to upgrade to Windows 11 25H2 to remain protected against emerging threats.