Intelligence Feed

1mo ago · bleeping-computer

UK authorities have charged five individuals in connection with Russian Coms, a caller ID spoofing platform used by criminals to conduct over 1.8 million scam calls since 2020. The platform enabled scammers to spoof numbers of financial institutions, telecoms, and law enforcement agencies to steal personal data and funds from victims. It was marketed on Telegram, Snapchat, and Instagram, offering encrypted calls, voice-changing, and no-logs services, leading to an estimated £9,400 average loss per victim across more than 107 countries.

1mo ago · bleeping-computer

Varonis Threat Labs created 'Breach at the Beach,' a hands-on Capture the Flag (CTF) training exercise focused on detecting real-world attacks in Microsoft Entra ID environments. The CTF simulates modern identity-based threats, particularly those involving non-human identities and AI-powered workflows, to educate defenders on data exfiltration techniques. It emphasizes detection of legitimate feature abuse rather than misconfigurations and is designed to be resilient to AI-based solving, promoting deep learning through practical experience.

1mo ago · bleeping-computer

Lidl disclosed a data breach affecting customers in Germany, Belgium, and the Netherlands following a cyberattack on a third-party service provider. The attackers accessed a file containing personal information such as names, phone numbers, email addresses, dates of birth, and customer numbers. While the online shop system was not compromised, Lidl cannot rule out exposure of passwords, payment details, and addresses, urging customers to remain vigilant against phishing and identity fraud.

1mo ago · bleeping-computer

Cybersecurity agencies from the US and allied nations have issued a joint advisory warning of Russian state-sponsored hackers, attributed to FSB Center 16, targeting critical infrastructure by exploiting misconfigured routers and known vulnerabilities. The threat actor scans for devices using default SNMP credentials and exploits CVE-2018-0171 in Cisco Smart Install to gain control of network devices. Sectors at risk include energy, healthcare, defense, and government services. The advisory emphasizes mitigation steps such as disabling vulnerable features, upgrading to SNMPv3, and blocking unauthorized protocols at firewalls.

1mo ago · bleeping-computer

The European Union and the United Kingdom have jointly imposed sanctions on Russian individuals and entities linked to state-sponsored cyberattacks. The targeted groups include GRU officers, FSB-affiliated hackers such as the Turla group, and cybercriminals involved in operations like the Lumma Stealer malware. These actors are accused of conducting cyberespionage, targeting critical infrastructure across Europe, and supporting disinformation campaigns. The sanctions follow a series of attacks on energy grids and government institutions, including failed attempts to disrupt Poland's power infrastructure.

1mo ago · bleeping-computer

OpenAI temporarily relaxed usage limits for its GPT-5.6 Sol model due to high demand, removing the five-hour usage restriction for Plus, Pro, and Business plans and resetting usage counters. The change allows users to perform more coding and agentic tasks without hitting previous limits. OpenAI also improved model efficiency, likely by reducing token consumption, to extend available usage.

1mo ago · bleeping-computer

Anthropic has extended access to its Claude Fable 5 model for paid subscribers until July 19, 2026, allowing continued use within weekly subscription limits. The extension applies to Pro, Max, Team, and premium Enterprise plans, with no changes required to activate the benefit. Fable 5 consumes usage limits faster than other models, and once the 50% weekly allowance is exhausted, users must either switch models or use paid credits. This is not a security-related threat event but a product update.

1mo ago · bleeping-computer

The RedHook Android malware has evolved to leverage Wireless ADB for shell-level access without requiring device rooting. By tricking users into enabling Accessibility permissions, the malware enables Developer Options and Wireless Debugging, then pairs with the device's ADB service via loopback to gain elevated privileges. It uses the legitimate Shizuku framework to execute privileged commands, enabling screen streaming, keystroke logging, app manipulation, and persistence through multiple mechanisms, all while evading detection by mimicking legitimate system behavior.

1mo ago · bleeping-computer

The Australian Cyber Security Centre (ACSC) has issued a warning about a global campaign targeting vulnerabilities in content management systems (CMS) and plugins, affecting numerous small- to medium-sized businesses in Australia. Threat actors are actively scanning for exposed CMS platforms and deploying webshells to gain persistent access, enabling credential theft, service disruption, and lateral movement. The campaign exploits known vulnerabilities across multiple CMS platforms including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE, with potential AI assistance to accelerate exploitation.

1mo ago · bleeping-computer

The 'Ghostcommit' attack exploits a review gap in AI code review systems by hiding malicious prompt injection instructions within a PNG image referenced in a pull request. The image contains text instructing the AI agent to read and exfiltrate environment variables (.env) by encoding them as integers in a seemingly benign module constant. Since reviewers and automated tools typically do not inspect image content, the malicious payload bypasses detection and is later executed by AI coding agents, leading to secret exfiltration.

1mo ago · bleeping-computer

Six vulnerabilities in the U-Boot bootloader have been discovered, potentially allowing attackers to execute arbitrary code or crash devices during the boot process. These flaws affect the FIT signature verification functionality and could enable stealthy, persistent firmware-level attacks on embedded systems. Exploitation may not require physical access, especially on systems supporting remote firmware updates like BMCs. The vulnerabilities impact over 50 U-Boot releases and downstream vendor implementations, with older devices potentially remaining unpatched.

1mo ago · bleeping-computer

Rossen G. Iossifov, a Bulgarian national serving prison time for operating a cryptocurrency exchange used to launder funds from online fraud, is accused of orchestrating the theft of $290,000 in government-seized cryptocurrency while incarcerated. He allegedly conspired with others to move the funds through multiple exchanges and mixing services to evade law enforcement. Iossifov previously operated RG Coins, a Bulgaria-based exchange that facilitated money laundering for a fraud ring targeting American victims via fake online listings.

1mo ago · bleeping-computer

Hackers are actively exploiting a critical authentication bypass vulnerability, CVE-2026-20896, in the official Gitea Docker image. The flaw allows unauthenticated attackers to impersonate any user, including administrators, by spoofing the X-WEBAUTH-USER header when reverse proxy settings are misconfigured. The vulnerability affects Gitea Docker images up to version 1.26.2 in default configurations, and exploitation has already been observed in the wild. Singapore’s Cybersecurity Agency (CSA) has issued a warning, urging users to upgrade to patched versions 1.26.3 or 1.26.4.

1mo ago · bleeping-computer

Progress Software has issued an urgent warning to ShareFile customers using on-premises Storage Zone Controllers, advising them to immediately shut down their servers due to a 'credible external security threat.' The threat targets Internet-accessible Storage Zone Controllers used in hybrid deployments, which manage file transfers between ShareFile's cloud and customer-owned storage. While no unauthorized access has been confirmed, Progress has temporarily disabled access as a precaution and is investigating with cybersecurity experts. The situation bears similarities to past attacks on enterprise file transfer platforms like the 2023 MOVEit breach.

1mo ago · bleeping-computer

The Dutch National Police suspect that Dutch hackers were involved in a February 2026 data breach at telecommunications provider Odido. A Dutch-speaking individual impersonated an IT employee in a phone call prior to the attack, enabling the threat actors to conduct phishing and steal personal data of up to 6.2 million customers. The ShinyHunters extortion gang claimed responsibility, publishing an 88GB archive with over 15 million records, continuing their pattern of targeting large organizations through social engineering and SSO compromises.

1mo ago · bleeping-computer

Karen Serobovich Vardanyan, a 34-year-old Armenian national, has pleaded guilty to providing initial access to corporate networks for the Ryuk ransomware operation between November 2019 and April 2020. He facilitated attacks on multiple U.S. organizations, including a Michigan company, a technology firm in Oregon, and a school in Texas, leading to approximately $15 million in ransom payments. Vardanyan was extradited from Kyiv and faces up to 15 years in prison, with sentencing scheduled for September 2026.

1mo ago · bleeping-computer

Zimbra has urged customers to patch a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client, which could allow attackers to execute malicious code via specially crafted emails. The flaw affects Zimbra Collaboration Suite users and could lead to theft of session data, account settings, or mailbox contents. Although no CVE has been assigned yet, the vulnerability was reported by Google's Threat Analysis Group and is suspected to be exploited by state-backed actors, particularly Russian-linked groups.

1mo ago · bleeping-computer

The article discusses how AI agents and machine identities are outpacing traditional identity governance, creating a growing security gap. These non-human identities, such as service accounts and OAuth applications, often inherit excessive permissions and persist long after their original purpose, increasing the attack surface. A notable incident involved threat actor UNC6395 exploiting a trusted OAuth token from Salesloft's Drift integration to pivot across Salesforce, AWS, and Snowflake environments. The core issue is not new vulnerabilities, but the lack of ownership, visibility, and lifecycle management for machine identities.

1mo ago · bleeping-computer

A former ransomware negotiator, Angelo Martino, was sentenced to 70 months in prison for participating in BlackCat (ALPHV) ransomware attacks between April 2023 and April 2025. Alongside accomplices Kevin Tyler Martin and Ryan Clifford Goldberg, Martino targeted at least five U.S. organizations, leveraging insider knowledge of victims' insurance limits to maximize ransom demands. The attackers operated as BlackCat affiliates, paying 20% of ransom proceeds to the core group while extorting tens of millions from victims in financial services, healthcare, and education sectors.

1mo ago · bleeping-computer

The OpenMandriva Linux project faced an internal sabotage attempt allegedly carried out by Davide Beatrici, a developer associated with the Mumble project, following a dispute over project direction and contributor behavior. Beatrici deleted repositories and pushed an empty package to the Cooker repository, targeting the Gnome and Cosmic desktop environments. Although he denied malicious intent, claiming his actions were in response to disagreements over project governance, the OpenMandriva team is restoring affected systems and conducting a security audit. Legal action has been waived by the project despite the severity of the incident.

1mo ago · bleeping-computer

Hackers compromised a contributor's GitHub account for the Injective Labs SDK project and published a malicious version (1.20.21) of the @injectivelabs/sdk-ts npm package. This supply-chain attack targeted developers building cryptocurrency-related applications, stealing wallet private keys and mnemonic seed phrases when SDK functions were used. The stolen data was exfiltrated via HTTP POST to a legitimate Injective Labs endpoint to blend in with normal traffic. The malicious package was downloaded 310 times before being deprecated, and 17 associated packages were also compromised.

1mo ago · bleeping-computer

Microsoft anticipates an increase in Windows security updates due to the use of artificial intelligence in identifying vulnerabilities within its codebase. The company is leveraging its AI-powered system, MDASH, to scan and validate potential security flaws in critical Windows binaries, leading to faster discovery and remediation. While AI accelerates defensive efforts, Microsoft also acknowledges its use by threat actors to exploit zero-day vulnerabilities. As a result, Microsoft is updating its Secure Development Lifecycle to integrate AI earlier in development and counter emerging AI-enabled attack techniques.

1mo ago · bleeping-computer

A new data-extortion group named Helix has emerged, conducting SharePoint data theft attacks using vishing, device code phishing, and MFA abuse. The group targets organizations by impersonating employees or managers to gain account access, then exfiltrates data for extortion or resale. Helix exhibits operational similarities to ShinyHunters and BlackFile, with potential ties based on infrastructure and tactics. The group's consistent use of automated SharePoint enumeration and exfiltration from a specific IP and user-agent provides a strong technical fingerprint.

1mo ago · bleeping-computer

Cybercriminals exploit reduced IT and security staffing during summer months to increase attack success rates, leveraging slower response times and reduced oversight. There is a 40% increase in cyberattacks during holiday periods, with phishing and Business Email Compromise (BEC) campaigns becoming more effective due to AI-driven social engineering. Lean staffing extends attacker dwell time, allowing for lateral movement, data theft, and ransomware deployment before detection.

1mo ago · bleeping-computer

A new phishing-as-a-service (PhaaS) platform named Forg365 targets Microsoft 365 accounts using AI-generated lures, adversary-in-the-middle (AiTM) phishing, and device-code authentication exploits. The platform provides attackers with a comprehensive dashboard for campaign management, token handling, and persistent access via a browser extension called ForgCookie. It leverages legitimate services like Amazon SES and Cloudflare Pages to blend malicious activity with normal traffic, evading detection while enabling post-compromise persistence through OAuth token and cookie theft.

1mo ago · bleeping-computer

Operation First Light 2026, a global law enforcement initiative coordinated by INTERPOL, targeted social engineering fraud and money laundering across 97 countries, resulting in 5,811 arrests and the seizure of $293 million in illicit assets. The operation identified over 142,000 victims and disrupted thousands of financial fraud cases, including business email compromise, romance scams, and investment fraud. This effort is part of a broader series of coordinated actions, including Operation Synergia II and Operation Red Card 2.0, aimed at dismantling transnational cybercrime networks.

1mo ago · bleeping-computer

Microsoft has announced the retirement of the OWA Light client in Exchange Server, citing modern browser capabilities, improved network conditions, and evolving security requirements as reasons. The lightweight web client, introduced two decades ago for older browsers and low-bandwidth environments, will be disabled in an upcoming update expected in August 2026. This move aims to reduce legacy attack surface and streamline engineering efforts toward the modern Outlook on the web experience.

1mo ago · bleeping-computer

Microsoft has patched a zero-day vulnerability in Microsoft Defender, tracked as CVE-2026-50656 and dubbed 'RoguePlanet', which could allow attackers to gain SYSTEM privileges via a race condition exploit. The vulnerability affects fully patched Windows 10 and 11 systems, regardless of real-time protection status. It was disclosed by a researcher known as Nightmare Eclipse, who has previously revealed other Windows zero-day exploits. Microsoft addressed the flaw through an update to the Malware Protection Engine and has warned against malicious exploitation of such vulnerabilities.

1mo ago · bleeping-computer

AssuranceAmerica suffered a data breach in March 2026 after attackers targeted an employee and gained unauthorized access to its IT systems. The attackers exfiltrated sensitive customer data, including names, contact information, driver's license numbers, and insurance policy details of nearly 7 million individuals. The company detected the breach on March 17, 2026, and completed its forensic review by June 15, 2026, after which it began notifying affected individuals. AssuranceAmerica has since reset credentials, isolated affected systems, and enhanced monitoring to prevent further compromise.

1mo ago · bleeping-computer

Mount Royal University (MRU) suffered a cyberattack on June 17, 2026, resulting in data theft and deletion from its H and J drives. The threat actor CMD Organization claimed responsibility, exfiltrated sensitive data including passport scans, and demanded a 30 BTC ransom. The attackers also employ an auction model for stolen data and have published samples online. Recovery efforts are ongoing, with potential long-term disruption to university systems.