Product

Firefox

0 mentions in 7 days · 6 in 30 days · 7 total · first seen Aug 11, 2026 · last 7d ago

Timeline7 articles

HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.

ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.

ANY.RUNSep 8, 10:24 UTC · 7d agoMalware in the wild

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.

Recorded FutureSep 3, 00:00 UTC · 13d agoThreat actor in the wild1

Firefox helps iPhone users bypass ads on web sites while making money showing its own ads

Mozilla rolls out built-in ad blocking for Firefox on iOS using Apple WebKit Content Blockers; the feature is off by default and iOS-only.

Mozilla began gradually enabling native ad blocking in Firefox for iOS, built on Apple's WebKit Content Blockers with an EasyList-derived filter, because iOS requires all browsers to use WebKit. The feature blocks ad trackers, third-party network ads, and popups, but not sponsored content, search ads, or Mozilla's own new tab promotions, and is off by default. Mozilla says it has no plans to extend built-in ad blocking to desktop or Android, preserving the extension ecosystem.

The Register · SecuritySep 1, 20:17 UTC · 14d agoOther

Mozilla security advisory (AV26-868)

Canada's Cyber Centre reports Mozilla vulnerabilities fixed in Firefox 155 and Firefox ESR 115.40, 140.15, and 153.2.

Canadian Centre for Cyber Security advisory AV26-868, dated September 1, 2026, notes vulnerabilities in Firefox (versions prior to 155) and Firefox ESR (prior to 115.40, 140.15, and 153.2). The bulletin links to Mozilla's security advisories and urges users and administrators to update. No CVE identifiers or exploitation details are provided.

Canadian Centre for Cyber SecuritySep 1, 18:14 UTC · 14d agoAdvisory

Bring the Fire: Play Games on GeForce NOW With New Firefox Browser Support

NVIDIA's GeForce NOW cloud gaming service adds Firefox browser support, letting users play supported PC games without a dedicated app.

NVIDIA announced Firefox browser support for GeForce NOW, its cloud gaming platform. Users on school laptops or everyday PCs can now stream supported PC games directly from the browser without installing the dedicated app.

NVIDIA BlogAug 20, 13:00 UTC · 26d agoOther

Hacking Public Wi-Fi DNS to Steal Credentials

Attackers can hijack public Wi-Fi DNS to redirect users to credential-stealing fake login pages; commenters debate HTTPS limits and mitigations like encrypted DNS.

The discussion examines how an attacker controlling DNS on shared or public Wi-Fi networks can redirect requests for legitimate services to attacker-controlled servers to steal credentials. Commenters analyze whether HTTPS and certificates mitigate the attack, noting attackers often rely on HTTP or browser trust quirks. Suggested defenses include encrypted DNS (DoH), DNSSEC, and travel routers running OpenWRT. No specific campaign, victims, or indicators are provided.

Schneier on SecurityAug 17, 11:18 UTC · 29d agoResearch1

Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo

Mozilla revoked the Firefox and Thunderbird Linux RPM signing subkey after an unencrypted copy landed in a private repo; no unauthorized access found.

Mozilla revoked the OpenPGP signing subkey (fingerprint 09BE ED63 F346 2A2D FFAB 3B87 5ECB 6497 C1A2 0256) used for Firefox and Thunderbird Linux downloads after an unencrypted copy was committed to one of its private repositories, citing reason code 2, 'key material has been compromised.' Audit records showed no sign of unauthorized access, and a replacement subkey (827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3) valid until August 5, 2028 was published. Users who verify signatures manually or install from Mozilla RPM packages may need to import the new key and remove the old one. The rotation came roughly seven months ahead of Mozilla's usual two-year subkey cycle.

The Hacker NewsAug 11, 12:04 UTC · Aug 11, 2026Data breach

Appears with

vendor Mozilla 6 malware AsyncRAT 1 organization Recorded Future 1 malware HVNC backdoor 1 malware NFCShare 1 malware NGate 1 malware REMCOS 1 malware Stealc 1 malware XWorm 1 ai model Claude Mythos Preview 1 ai model Claude Opus 4.6 1 organization Canadian Centre for Cyber Security 1 organization HackerOne 1 organization Insikt Group 1 malware Cobalt Strike 1 threat actor Winos4.0 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.