GOLD OGRE used Cursor agents to reach domain admin for Aur0ra
Sophos says three networks where agents gained domain management later appeared on the Aur0ra leak site.
76
Organization
CloudSEK
- Mentions · 7d4
- Mentions · 30d10
- All mentions23
- First seenAug 12, 2026
- Last mentioned10h ago
Timeline
23 articles · newest firstGOLD OGRE automated Aur0ra intrusions with Cursor and Claude
Agents moved from stolen VPN access to domain management, and three of those victims later hit the leak site.
74
MR ROBOT Android MaaS rents bank trojans aimed at Indian customers
CloudSEK says one affiliate’s data held 5,407 texts from 153 devices, with call forwarding on 58 percent.
64
Downloads-folder instruction file tried to make a coding agent install malware
Forever stopped the agent before code ran; Codex followed the planted file in more than 90% of isolated tests.
66
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Malicious npm package imgdecode, tied to MALFEX, loads a DLL that downloads and injects shellcode.
74
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Eight malicious npm packages, downloaded 40,767 times, installed Overlord RAT and a Node.js stealer.
73
Ransomware Hacker Uses AI Coding Assistant as Attack Channel Against Enterprise Networks
Ransomware affiliate Azazel used an AI coding assistant's MCP tools to attack more than two dozen organizations.
82
Gentlemen Ransomware Affiliate Uses MCP as C2 Channel in Live Cyberattacks
Gentlemen ransomware affiliate Azazel used Model Context Protocol as live command-and-control across victims in six countries.
78
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
CloudSEK exposes Gentlemen RaaS affiliate 'Azazel' who diverted extortion proceeds via his own Leakned leak site after compromising 25+ victims across six countries.
65
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
Microsoft says ClickFix attacks now smuggle VBScript through the browser cache to bypass Windows Run limits.
64
SilverFox Built Fake Software Sites That Know When Researchers Are Watching
Silver Fox operators delivered a Windows loader via WhatsApp while hiding payloads from security researchers.
61
Which Platforms to Use for Enterprise Threat Intelligence
A CloudSEK-focused guide says enterprise threat intelligence must filter noise and correlate exposure.
16
GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package
GHAPPIER supply chain campaign compromised 65 GitHub repositories and pushed a malicious four-stage npm loader via compromised maintainer trusted publishing.
55
Hackers Compromise 65 GitHub Repositories and Poison npm Package With Hidden Backdoor
CloudSEK details GHAPPIER campaign compromising 65 GitHub repos to backdoor the @dforge-core/dforge-mcp npm package with cryptographically verified provenance.
65
Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign
Attackers abused npm trusted publishing to ship the GHAPPIER loader via a legitimate package in the North Korea-linked PolinRider campaign.
72
BigBear phishing crew nets thousands of Microsoft 365 credentials
CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
60
BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
The BigBear 2.0 phishing-as-a-service framework bypassed MFA to steal 5,000+ Microsoft 365 credentials across 258 organizations, CloudSEK researchers found.
52
BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
CloudSEK found the BigBear 2.0 phishing-as-a-service platform bypassed MFA at 258 organizations and captured over 5,000 Microsoft 365 credentials.
72
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.
72
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
Australian Federal Police charges two men with 14 offences over TeamPCP supply chain backdoors in Trivy, Checkmarx KICS, and LiteLLM affecting 1,000+ organizations.
72
U.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited CVE-2026-21962, a CVSS 10.0 unauthenticated flaw in Oracle HTTP Server and WebLogic Proxy Plug-in, to KEV with an August 27 deadline.
85
153GB of stolen credentials surface after LiteLLM supply chain attack
153GB archive from the LiteLLM supply chain attack exposes secrets from about 2,500 companies, including AWS, Samsung, Cisco and Salesforce.
90
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.
78
Related CVEs
by mentions- CVE-2026-2196273%10.0Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in
- CVE-2020-14882100%9.8Remote Code Execution in Oracle WebLogic Server
- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2020-255193%9.8Unauthenticated Remote Code Execution in Oracle WebLogic Server via IIOP
- CVE-2026-3363460%9.4Embedded Malicious Code in Aquasecurity Trivy, trivy-action, and setup-trivy Releases
- CVE-2017-10271100%7.5Unauthenticated Remote Code Execution in Oracle WebLogic Server
- CVE-2020-1488398%7.2High-Privilege Console Flaw in Oracle WebLogic Server Enables Full Takeover
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
Appears with
- CloudSEKvendor · 6
- Microsoftvendor · 5
- GitHuborganization · 4
- Anthropicvendor · 3
- TeamPCPthreat actor · 3
- Microsoft 365product · 3
- Checkmarxorganization · 3
- npmorganization · 3
- npmproduct · 3
- Cobalt Strikemalware · 2
- Azazelthreat actor · 2
- FBIorganization · 2
- Aur0ramalware · 2
- MALFEXmalware · 2
- Claude 4.5-Sonnetai model · 2
- LiteLLMproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.