Intelligence Feed

1mo ago · bleeping-computer

A China-linked threat cluster tracked as UNK_MassTraction has been exploiting vulnerabilities in Roundcube webmail servers at academic institutions in the U.S. and Canada since May 2026. The attackers target physics and engineering departments, deploying malware to steal credentials and establish persistent access. Exploitation involves CVE-2024-42009 and CVE-2025-49113 to deploy backdoors such as IceCube, SquareShell, and VShell. Proofpoint attributes the activity to a likely China-aligned espionage group based on infrastructure overlap and linguistic artifacts, though confidence is moderate.

1mo ago · bleeping-computer

A threat actor has published 17 malicious packages on npm and PyPI that impersonate legitimate Paysafe, Skrill, and Neteller SDKs to steal credentials and access tokens. These packages mimic real software development kits but instead exfiltrate sensitive data such as API keys, tokens, and system metadata to an AWS-hosted command-and-control server. The malware includes basic anti-analysis techniques and targets developers integrating payment functionality, with different activation triggers between npm and PyPI versions.

1mo ago · bleeping-computer

A threat actor tracked as O-UNC-066, associated with the Pink extortion gang, is conducting vishing attacks to trick Microsoft 365 users into enrolling Entra passkeys under the attacker's control. The campaign uses voice phishing and phishing kits that mimic legitimate Microsoft enrollment pages, enabling real-time credential and MFA interception. The attacker exploits a new Microsoft passkey registration feature and uses fake BIP-39 recovery phrases to distract victims while stealing credentials. Post-compromise, the actor exfiltrates data from SharePoint and OneDrive to support extortion efforts.

1mo ago · bleeping-computer

Japanese telecommunications company KDDI disclosed a data breach affecting over 12 million users, resulting from an attack on May 16 that exploited a zero-day vulnerability in third-party software used by multiple ISPs. The breach exposed email addresses and passwords, with some credentials stored in hashed or encrypted form. KDDI detected and blocked the attackers on June 17, implemented EDR solutions, and is enforcing password resets for affected accounts.

1mo ago · bleeping-computer

DuckDuckGo has introduced a new feature in its browser that blocks YouTube video ads by leveraging community-maintained filter lists from uBlock Origin and its own compatibility rules. The feature is enabled by default on iOS, Mac, and Windows, while Android users can enable it manually. This functionality enhances user experience by reducing ad interruptions without requiring third-party extensions, aligning DuckDuckGo with browsers like Brave and Opera.

1mo ago · bleeping-computer

AI is increasingly being leveraged by threat actors to enhance service desk attacks through more convincing impersonation, accelerated reconnaissance, and scalable social engineering. These attacks exploit the urgency and trust inherent in service desk operations, particularly during employee onboarding, to gain unauthorized access. Attackers use AI to generate realistic communication, personalize phishing attempts, and bypass traditional identity verification methods, making detection more difficult for security teams.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to patch a critical vulnerability, CVE-2026-48282, in Adobe ColdFusion by a strict deadline due to active exploitation in the wild. The flaw allows unauthenticated remote attackers to achieve code execution on unpatched systems with low attack complexity. Adobe released patches one week prior and warned of high exploitation risk, with evidence of attacks emerging within hours of disclosure.

1mo ago · bleeping-computer

Ubiquiti has disclosed and patched seven critical vulnerabilities in its UniFi OS platform, including a maximum-severity command injection flaw tracked as CVE-2026-50746 in the UniFi Connect Application. The vulnerabilities, affecting various UniFi products such as UniFi Talk, Access, and Protect, allow for low-complexity attacks without user interaction and could enable remote command execution. Internet-exposed UniFi OS instances remain a concern, with over 100,000 instances detected online, making them attractive targets for state-sponsored and cybercriminal groups. Previous incidents have shown exploitation of similar flaws to build botnets for cyberespionage and malicious traffic proxying.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to urgently patch CVE-2026-55255, an authentication bypass vulnerability in the Langflow AI development platform. This flaw allows authenticated attackers to access other users' workflows by manipulating the /api/v1/responses endpoint with a victim's flow_id, enabling data theft and resource abuse. Exploitation in the wild has been observed since June 25, with attackers pursuing financial gain through compute resource hijacking and credential theft. CISA has also added related Langflow vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2025-3248 and CVE-2026-33017, exploited by ransomware actors.

1mo ago · bleeping-computer

Accenture confirmed a security breach after a threat actor named '888' claimed responsibility for stealing over 35 GB of data, including source code, authentication keys, and configuration files. The actor posted a screenshot showing access to an Azure DevOps repository hosted under a redacted accenture.com subdomain and offered the data for sale on a cybercrime forum. Accenture stated the issue was isolated and remediated with no impact on operations, but did not confirm the scope or method of the breach.

1mo ago · bleeping-computer

A hidden authentication backdoor in multiple Tenda router firmware versions allows attackers to gain full administrative access to the device's web interface by using an undocumented password comparison mechanism. The vulnerability, tracked as CVE-2026-11405, is located in the '/bin/httpd' binary and remains unpatched as the vendor could not be reached. Successful exploitation enables attackers to reconfigure the device, alter network settings, and disable security features, posing significant risk to the local network.

1mo ago · bleeping-computer

Chinese threat actor UAT-7810 is expanding its Operational Relay Box (ORB) network by deploying updated and new malware variants, including LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST. These tools are used to compromise internet-facing networking devices, primarily unpatched Ruckus and ASUS routers, leveraging known vulnerabilities. The ORB infrastructure enables other China-aligned APTs to proxy traffic through compromised regional devices to evade detection and hinder attribution.

1mo ago · bleeping-computer

In June 2026, researchers at Novee Security identified a critical CI/CD vulnerability pattern named Cordyceps affecting widely used open-source projects, including those from Microsoft, Google, and Apache. The issue stems from the composition of GitHub Actions workflows that misuse privileged triggers like pull_request_target and workflow_run, enabling attackers to execute code in trusted contexts via pull requests. Despite passing all standard security checks, these pipelines allowed potential theft of long-lived credentials and persistent access to critical systems, highlighting a systemic gap in supply chain governance.

1mo ago · bleeping-computer

Spanish authorities have arrested a man suspected of being an active member of the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest. He allegedly provided logistical and operational support to a Ukrainian hacker within CARR and facilitated escape routes to Russia. The groups have been linked to attacks on critical infrastructure in the U.S. and Europe, including SCADA systems, and are loosely associated with the Russian state-backed APT44 (Sandworm). The suspect also participated in operations attributed to the hacktivist group NoName057(16), which promotes pro-Russian and anti-Western narratives.

1mo ago · bleeping-computer

A critical 16-year-old Linux kernel vulnerability named Januscape (CVE-2026-53359) enables guest-to-host virtual machine escape on both Intel and AMD architectures, posing significant risks to multi-tenant cloud environments. The flaw resides in KVM/x86's shadow MMU emulation and can be exploited by attackers with root access inside a guest VM to execute arbitrary code on the host or cause a denial-of-service by crashing the host kernel. It was used as a zero-day in Google's kvmCTF program, and when combined with the Dirty Frag privilege escalation, even unprivileged attackers could achieve full compromise. Administrators are urged to apply patch commit 81ccda30b4e8 to mitigate exposure.

1mo ago · bleeping-computer

Modern email attacks increasingly exploit trusted identities, legitimate services, and normal communication patterns to bypass traditional security controls. Techniques such as Device Code phishing, business email compromise (BEC), and account takeovers (ATO) are commonly used, allowing attackers to evade detection by avoiding malware and suspicious attachments. These attacks result in alert fatigue and manual investigation overhead for security teams. The article highlights the need for behavioral AI to automate detection and response in the evolving email threat landscape.

1mo ago · bleeping-computer

Microsoft is testing a new Cloud Rebuild feature for Windows 11, designed to remotely reinstall the operating system on devices that are non-bootable or experiencing critical issues. This feature, part of the Windows Resiliency Initiative, allows for a full OS recovery without the need for physical media or a functioning OS. It is being rolled out to Windows Insider Experimental channel users as part of ongoing efforts to improve system recovery and resilience.

1mo ago · bleeping-computer

BeyondTrust has disclosed two critical vulnerabilities, CVE-2026-40138 and CVE-2026-40139, in its Remote Support (RS) and Privileged Remote Access (PRA) software that allow unauthenticated attackers to bypass authentication and gain unauthorized access to affected systems. Exploitation requires specific configurations, though details were not disclosed. The vendor has patched cloud instances and urges self-hosted customers to update to version 25.3.3 or later. Previous vulnerabilities in the same software have been actively exploited in the wild by threat actors, including the Chinese state-backed group Silk Typhoon.

1mo ago · bleeping-computer

Microsoft is enabling the Windows settings backup and restore tool by default for enterprise devices joining or hybrid-joining Microsoft Entra, starting with Windows 11 version 26H2. This feature, previously opt-in, aims to streamline user settings backup during device resets, replacements, or upgrades. The default enablement applies only to eligible non-EU DMA-regulated devices where administrators have not explicitly configured backup policies. IT admins retain control via MDM solutions like Microsoft Intune or Group Policy to override defaults.

1mo ago · bleeping-computer

Vietnamese authorities have arrested seven suspects linked to the operation of HiAnime, a major anime piracy service that attracted hundreds of millions of visitors monthly. The group allegedly created over 100 websites to distribute more than 26,000 pirated anime titles, generating $12.85 million in illicit advertising revenue between 2020 and April 2026. The service was previously rebranded from Zoro.to to Aniwatch.to and later to HiAnime.to, appearing on both the European Commission's and USTR's notorious markets lists. The Alliance for Creativity and Entertainment (ACE) commended the takedown, which resulted from a multi-year investigation supported by U.S. law enforcement.

1mo ago · bleeping-computer

Threat actors are conducting fake IT support calls via Microsoft Teams to trick employees into installing the EtherRAT malware. The attack begins with a phishing email containing a malicious PDF, followed by a voice call from an external Teams account impersonating system administrators. Attackers use legitimate remote access tools like HopToDesk and AnyDesk, then deploy EtherRAT via a malicious MSI installer, enabling full system control and data theft. EtherRAT uses Ethereum smart contracts for C2 resilience, and the campaign is actively evolving with multiple malware versions observed.

1mo ago · bleeping-computer

A phishing campaign impersonates over 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, to target marketing professionals with fake job interviews. The attackers abuse legitimate platforms like PeopleForce and Salesforce Marketing Cloud to increase credibility, using nested redirects to deliver a malicious landing page. Victims are prompted to sign into their Google accounts via a fake 'Continue with Google' page that uses browser-in-the-browser (BitB) technique to mimic legitimate authentication, enabling credential theft.

1mo ago · bleeping-computer

Threat actors are actively exploiting a maximum-severity vulnerability in Adobe ColdFusion, tracked as CVE-2026-48282, to achieve remote code execution on unpatched systems. The flaw affects ColdFusion versions 2025.9, 2023.20, and earlier. Exploitation began within two hours of public disclosure, prompting urgent warnings from KEVIntel and the Canadian Center for Cyber Security. Adobe urges administrators to apply patches immediately to mitigate risk.

1mo ago · bleeping-computer

The article discusses the evolution of software development from Waterfall to Agile, DevOps, and now 'Vibe Coding,' where generative AI enables rapid application creation through natural language prompts. This acceleration introduces significant security risks, as AI-generated code may contain vulnerabilities, architectural flaws, or compliance issues despite appearing functional. Traditional secure development practices like threat modeling, code review, and least privilege remain critical to mitigate these risks. The article warns that without proper governance, Vibe Coding could become a modern form of shadow IT—innovative but potentially dangerous.

1mo ago · bleeping-computer

JadePuffer ransomware represents the first documented case of a ransomware operation fully automated by a large language model (LLM) agent. The AI-driven attack exploited CVE-2025-3248 in Langflow to gain initial access, then performed reconnaissance, credential theft, lateral movement, and encryption autonomously. The agent adapted to failures in real time, demonstrating human-like operational resilience and rapid iteration. It encrypted 1,342 Nacos configuration items and left a ransom note with a Proton Mail contact and a Bitcoin address, though the encryption likely used AES-128-ECB rather than AES-256 as claimed.

1mo ago · bleeping-computer

Flipper Devices has announced a shift in its firmware development strategy for the Flipper Zero, transitioning to a community-driven model with a reduced internal team. While official firmware maintenance will continue, full-time feature development has ended, and future updates will depend on community contributions reviewed by the core team. The company aims to focus on new hardware like the Flipper One and Busy Bar, while leveraging community input to sustain the Flipper Zero platform. This change follows user backlash over perceived abandonment of firmware development.

1mo ago · bleeping-computer

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that a high-severity remote code execution vulnerability in Microsoft SharePoint, tracked as CVE-2026-45659, is now under active exploitation. The flaw allows authenticated attackers with low privileges to execute arbitrary code remotely on unpatched SharePoint servers without user interaction. Microsoft addressed the vulnerability in May 2026 updates, but over 10,000 exposed servers remain at risk. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by a strict deadline.

1mo ago · bleeping-computer

Cisco has confirmed active exploitation of a critical vulnerability (CVE-2026-20230) in its Unified Communications Manager (Unified CM) software. The flaw allows unauthenticated attackers to perform server-side request forgery (SSRF) attacks via crafted HTTP requests. Cisco urges customers to apply patches immediately or disable the vulnerable WebDialer service as a mitigation. The vulnerability follows a trend of repeated security issues in Cisco Unified CM devices.

1mo ago · bleeping-computer

Microsoft resolved a bug that caused Copilot buttons to disappear in Classic Outlook for Windows users with the Copilot Chat (Basic) license. The issue was fixed via a service update on June 29, 2026, and users are advised to restart Outlook or update to the latest build. Microsoft is also investigating Outlook crashes linked to Kaspersky Antivirus's Kaspersky Mail Checker (mcou.dll).

1mo ago · bleeping-computer

ConsentFix and ClickFix are social engineering attacks that hijack Microsoft 365 accounts by exploiting user trust in routine workflows. ClickFix tricks users into executing malicious commands via fake verification prompts, while ConsentFix abuses OAuth consent flows by luring victims into dragging a localhost callback link, surrendering OAuth tokens. These attacks bypass traditional security measures by mimicking legitimate processes, requiring no malware or credential theft. Attackers leverage publicly shared blueprints and common platforms like Dropbox to distribute lures.