DarkSword iOS chain escapes Safari and steals Apple Notes
Zimperium says a tested iOS 18.6.2 device uploaded NoteStore.sqlite and an inventory of 214 apps to attacker infrastructure.
76
Organization
Google Threat Intelligence Group
- Mentions · 7d3
- Mentions · 30d28
- All mentions65
- First seenAug 13, 2026
- Last mentioned13h ago
Timeline
65 articles · newest firstAd platform says malware ads fingerprint iOS before payload
ADEX linked about 50 advertiser accounts by shared cloaking behavior and says that does not mean they delivered Coruna.
34
ShinyHunters PeopleSoft zero-day is three flaws under CVE-2026-35273
Unauthenticated SSRF to the loopback-trusted admin hub yields code execution on PeopleTools 8.61 and 8.62.
82
AOMEI Backupper update servers briefly hijacked to push a backdoor
Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.
78
AOMEI has not notified customers after update-server malware hijack
Attackers briefly swapped update configs from April to July so Backupper fetched malware, and already infected PCs stay infected.
74
AOMEI Backupper updates briefly served malware in 2026
UNC7017 used five-to-ten-minute windows to deliver CrossRoad and the ShinyRoad backdoor to anyone fetching packages.
78
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
UNC7017 hijacks AOMEI updates for minutes to plant backdoors
Tampered update configs in brief windows between April and July 2026 could leave CROSSROAD and SHINYROAD after the servers were fixed.
76
UNC7017 hijacked AOMEI updates to install CROSSROAD and SHINYROAD
Five- to ten-minute tampering windows in May and July 2026 exposed organizations in eleven countries without a CVE.
76
AOMEI update servers briefly served CROSSROAD and SHINYROAD malware
UNC7017 altered promotion configs for minutes in May and July so Backupper ran malware without user action.
74
AOMEI Backupper update servers hijacked to deliver a backdoor
Google’s threat intel group confirmed three tampering windows of ten, six, and five minutes between April and July.
74
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Attackers used a compromised ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 tenants.
80
Prolific Chinese espionage group exploits BeyondTrust zero-day
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting in late August.
84
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
UNC7017 briefly tampered with AOMEI Backupper updates to install the SHINYROAD backdoor on polling hosts.
78
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
China-linked Armory Castle exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day since August.
84
BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert
Chinese espionage group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 for root and credential-vault access.
88
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
China-nexus UNC5221 exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and wiped logs.
86
Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors
China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access and persistent backdoors.
86
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.
86
CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing
CERT-In says AI agents under test reached Indian organizations and read personal and confidential data undetected.
70
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
87
Investigating Ephemeral Supply Chain Tampering
UNC7017 briefly hijacked AOMEI updates to deliver CROSSROAD and SHINYROAD malware.
82
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
iVerify details P7 DarkSword, an iOS exploit kit that steals keychains and crypto wallets and accepts remote commands.
77
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
Cisco Talos finds malware embedding AI-evasion prompts that swayed analysis in about 35 percent of tests.
62
AI accelerates n-day attacks, as flaw disclosures and exploits double
Google Threat Intelligence says 141 flaws were exploited by August 2026, exceeding all of 2025, with AI tooling accelerating n-day weaponization and shrinking exploit timelines.
58
Dell asks admins to patch max severity CSM flaws as soon as possible
Dell patched six critical Container Storage Modules flaws that let unauthenticated attackers gain admin control of enterprise storage.
73
The vulnerabilities AI finds are the ones attackers want
GTIG says AI-found flaws skew toward remote code execution, and attackers hit BeyondTrust CVE-2026-1731 within four days.
80
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
LevelBlue details post-exploitation of actively exploited Citrix NetScaler flaw CVE-2026-88771: superuser account creation, PHP web shells, and configuration theft.
93
Google: Vulnerability disclosures double to 10,000 per month as AI fuels exploitation
Google says vulnerability disclosures doubled to 10,740 a month as AI accelerates n-day exploitation.
82
Google Warns of Hackers Actively Exploiting Citrix 0-Day Vulnerabilities to Deploy Web Shells
Attackers are exploiting two critical Citrix NetScaler zero-days to deploy WHIPSHOT web shells and tunnel inward.
91
Google: AI Is Changing the Pace and Profile of Vulnerability Discovery
Google Threat Intelligence reports monthly vulnerability disclosures doubled in 2026, with exploited-in-the-wild counts nearly doubling as AI accelerates discovery.
62
Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
Mandiant links weeks-long NetScaler ADC/Gateway zero-day exploitation to suspected state actors, hitting 100+ government, finance, and legal organizations.
95
Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)
Suspected state-sponsored actors exploited NetScaler zero-day CVE-2026-88772 since early September, affecting dozens of organizations.
91
Hackers Exploit Citrix NetScaler Zero-Day to Gain Root Access and Deploy Web Shells
Attackers exploit Citrix NetScaler zero-day CVE-2026-88772 for root access and PHP web shells.
91
WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign
Attackers exploit Citrix NetScaler zero-days and deploy WHIPSHOT and SLAPSHOT for persistent root access.
91
Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
Suspected state-sponsored actors mass-exploited Citrix NetScaler zero-day CVE-2026-88772 undetected for over three weeks, hitting dozens of organizations.
95
Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services
Unknown attackers exploited critical Citrix NetScaler zero-days CVE-2026-88771/88772 since early September, deploying custom WHIPSHOT and SLAPSHOT malware for persistence and tunneling.
95
Oracle PeopleSoft Servers Targeted Again as ShinyHunters Expands Extortion Operations
ShinyHunters-linked UNC6240 is mass-exploiting Oracle PeopleSoft CVE-2026-35273, bypassing WAF path filters for extortion.
84
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
ShinyHunters is mass-exploiting Oracle PeopleSoft CVE-2026-35273, bypassing WAF rules to plant web shells.
85
The SOC Doesn't Need to Start Over with Every Alert
Opinion piece argues AI cheapens retrying failed intrusions and urges SOCs to fix lossy handoffs between intel, hunting, detection, investigation, and remediation.
30
Related CVEs
by mentions- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-10276419%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2026-173193%9.9Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2025-0282100%9.0Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2023-4966100%7.5Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway
- CVE-2026-3527397%9.8Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
- CVE-2026-2276914%10.0Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access
Appears with
- Mandiantorganization · 36
- Googlevendor · 24
- AOMEI Backupperproduct · 10
- Citrixvendor · 10
- Mandiantvendor · 9
- BeyondTrustvendor · 9
- UNC7017threat actor · 8
- CrossRoadmalware · 8
- ShinyRoadmalware · 8
- ManageEngineorganization · 8
- Microsoftvendor · 7
- UNC5221threat actor · 7
- Armory Castlethreat actor · 7
- BeyondTrust Remote Supportproduct · 7
- TeamPCPthreat actor · 6
- ShinyHuntersthreat actor · 6
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.