GTG-1002 (Threat actor): news timeline & CVEs

Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws

Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.

Google released Chrome 154 to the Stable channel, fixing 108 security vulnerabilities including 11 critical flaws. The critical bugs involve memory-safety issues in the ANGLE, GPU, and WebGL components, which could allow code execution or sandbox escapes. Organizations should prioritize deployment as exploit details may remain restricted until patches are widely adopted.

GBHackersSep 23, 09:02 UTC · 4d agoVulnerability CVE-2026-95350 CVE-2026-95357 CVE-2026-95339+8 CVEs

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

WordPress 7.1.2 fixes a critical unauthenticated path traversal flaw (CVE-2026-87902) that could allow remote code execution.

WordPress released version 7.1.2 to address a critical unauthenticated path traversal vulnerability (CVE-2026-87902). The flaw allows an attacker to load and execute arbitrary PHP files from outside the site's active theme folders, potentially leading to remote code execution. All WordPress versions from 4.7.0 through 7.1.1 are affected, and users should update immediately.

Help Net Securityupdated Sep 26, 07:42 UTC · 1d agofirst Sep 23, 09:01 UTC · 4d agoVulnerability 16 sources CVE-2026-87902

AI-Driven Cyberattacks Enter New Phase With Autonomous Fraud and Digital Trust Abuse

AI-driven cyberattacks are automating fraud and intrusions, with the GTG-1002 campaign using AI agents for most operational tasks.

AI-driven cyberattacks are evolving, with the China-linked GTG-1002 campaign using AI agents to handle most operational tasks. The report highlights 'PromptSpy', an Android malware that uses AI to read screen content and request instructions for interaction, and 'LunaLock', which uses AI to find sensitive data for extortion. These attacks exploit trust in familiar actions, such as video calls and payment approvals, leading to financial fraud and data theft.

Cyber Security NewsSep 23, 08:59 UTC · 4d agoMalware in the wild 2 sources

AI-Powered Threats Exploit Digital Trust Through Autonomous Breach Techniques

A PRC-linked group used Claude Code as an autonomous operator for espionage, while researchers identified the first Android malware leveraging generative AI.

Anthropic disclosed a PRC-linked campaign (GTG-1002) where the threat actor used its Claude Code model as an autonomous operator, integrating it with offensive tools via Model Context Protocol servers. This marks a shift from AI as a coding assistant to an autonomous breach operator. Separately, researchers identified PromptSpy, the first Android malware to use generative AI (Google Gemini) for device-specific reconnaissance and execution, and Trellix noted AI agents are automating the full kill chain from credential harvesting to lateral movement.

GBHackersupdated Sep 23, 08:59 UTC · 4d agofirst Sep 23, 07:31 UTC · 4d agoThreat actor in the wild 2 sources

GTG-1002

Timeline4 articles

Related CVEsby mentions

Appears with

Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

AI-Driven Cyberattacks Enter New Phase With Autonomous Fraud and Digital Trust Abuse

AI-Powered Threats Exploit Digital Trust Through Autonomous Breach Techniques