ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

Google Drive

3 mentions in 7 days · 7 in 30 days · 7 total · first seen · last

Search everything

Timeline

Slack can now vibe-code interactive charts and reports inside chats

Slack launched Slackforce Surfaces, letting Slackbot build interactive dashboards, reports, and microsites directly inside chat channels.

Slackforce Surfaces uses AI to gather context from conversations and connected apps such as Google Drive and Salesforce to generate shareable interactive reports, polls, dashboards, and presentations. Surfaces can be pinned to channels where colleagues can view, interact, and comment. The feature is available to all customers, including free users, with Slackbot enabled, and live data support starts in October.

The Verge · AI · 5d agoAI industry

New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs

ANY.RUN researchers uncovered the N0va phishkit targeting government, technology, consulting, and healthcare organizations across North America and the EU via device code phishing.

The N0va phishkit uses lures imitating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign to draw victims into a device code authentication flow. After the user completes legitimate authentication, N0va captures access and refresh tokens and abuses token-exchange and device-registration mechanisms to establish persistent SSO access to corporate resources. Because the flow relies on real Microsoft authentication, it can evade MFA-focused detections, and token access can outlive takedown of the phishing page. ANY.RUN says it observed the campaign in sandbox sessions, with targeting spanning government, technology, consulting, and healthcare sectors.

Cyber Security Newsupdated · 4d agofirst · 6d agoPhishing & fraud in the wild 13 sources

ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel

Check Point found a ChatGPT flaw letting attackers read victims' Gmail and connected-app data via hidden cross-session instructions; OpenAI patched it.

Check Point Research discovered a covert cross-account command channel in ChatGPT's code execution environment, where containers meant to be isolated shared metadata through an internal service based on JFrog Artifactory. In a proof of concept, a victim's session was tricked into retrieving Gmail email data and relaying it to an attacker-controlled session during an ordinary-looking interaction, with reach extending to any connected apps the session was authorized for, including Google Drive, Microsoft Teams, and GitHub. OpenAI fixed the issue and decommissioned the internal service; the same shared infrastructure was also involved in the separately disclosed Hugging Face compromise, though via different techniques.

CSO Online · 6d agoAI safety & security 2 sources

ChatGPT can now connect to your personal apps to mimic writing style

OpenAI is testing ChatGPT Writing Style, which mimics a user's voice using writing samples from connected Gmail, Slack, and Drive accounts.

OpenAI confirmed it is testing a Writing Style feature for ChatGPT that learns a user's voice from writing samples in connected apps. The onboarding flow references Messaging (Slack), Documents (Google Drive and Notion), and Email (Gmail) as example sources. It resembles Anthropic's Styles personalization feature but draws on existing writing inside connected services rather than uploaded samples. The feature is available to a small group of users with no announced general rollout date.

BleepingComputer · 8d agoAI industry

Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Varonis discloses CoSnitch (CVE-2026-24301), three Microsoft Copilot Personal flaws enabling one-click exfiltration of connected-app data; patched August 18, 2026.

Varonis Threat Labs found that an undocumented autorun=1 parameter, paired with the q parameter, lets an attacker-supplied prompt run automatically on page load in a victim's authenticated Copilot session, then exfiltrate data from connected services such as mail, calendar, Google Drive, chat history and the memory store via Copilot's built-in URL fetch to an attacker webhook. A separate memory-poisoning path through web summarization lets a crafted page persist attacker instructions in the user's memory, surviving password changes, session revocation and device re-enrollment. Microsoft shipped patches on August 18, 2026, tracked as CVE-2026-24301, and Varonis found no evidence of in-the-wild exploitation. The flaws were found via 'meta-hacking', asking Copilot itself to reveal the autorun parameter and its protections.

The Hacker News · 28d agoAI safety & securityCVE-2026-24301CVE-2026-242991

TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks

TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.

Unit 42 identified a TrickBot distribution campaign on November 7-8, 2019, using payroll and annual bonus-themed emails sent from likely compromised .edu addresses through the legitimate SendGrid email delivery service. Emails contained links to Google Docs documents linking to downloader executables hosted on Google Drive, further masked behind SendGrid click-tracking URLs. The downloaders, signed by PERISMOUNT LIMITED and displayed with Microsoft Word icons, show a decoy pop-up and retrieve TrickBot payloads from compromised legitimate domains such as savute[.]in and lindaspryinteriordesign[.]com. The newer TrickBot variant stores its files and configuration under %APPDATA%\cashcore.

Palo Alto Unit 42 · 29d agoPhishing & fraud

UBoatRAT Navigates East Asia

Unit 42 discovers UBoatRAT, a new custom RAT targeting South Korean and video-game industry personnel, delivered via Google Drive with GitHub-based C2 and BITS persistence.

Unit 42 identified UBoatRAT, a new custom remote access trojan first found in May 2017, whose initial version used a public Hong Kong blog service and a compromised Japanese web server for command and control. The latest variants target personnel or organizations related to South Korea or the video games industry, are delivered through Google Drive, and masquerade as Microsoft Word, Excel, or folder icons. The RAT checks for virtualization software and domain join, retrieves its C2 address from a Base64-encoded string in a GitHub-hosted file, uses a custom XOR-encrypted C2 protocol, and maintains persistence via Windows Background Intelligent Transfer Service (BITS) jobs that survive reboots.

Palo Alto Unit 42 · 29d agoMalware in the wild1

Related CVEs

  • CVE-2026-243017.52%
    Command Injection in Microsoft Copilot Allows Information Disclosure
    CVE-2026-24301 is a command injection flaw (CWE-77) in Microsoft Copilot in which special elements are not properly neutralized before being used in a command, allowing an unauthorized attacker to send commands over a network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R), exploitation requires no privileges but does require user interaction, which aligns with the related headline reporting that a single click in the Copilot personal experience could trigger exfiltration of data from connected apps. The vulnerability is rated 8.8 (high), and while the description emphasizes information disclosure, the CVSS base score rates confidentiality, integrity, and availability impacts all high. Affected users are those using Microsoft Copilot; the source data does not specify version ranges, and the headline suggests the personal/consumer Copilot experience is implicated. No exploitation is currently known: there is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS puts 30-day exploitation probability at 2.2% (82nd percentile).
    · Microsoft Copilotmass
  • CVE-2026-242995.3<1%
    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over
    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
    · microsoft 365 copilot—

Appears with

vendor Microsoft 3organization OpenAI 2product Microsoft Teams 2vendor OpenAI 2ai model ChatGPT 2vendor Palo Alto Networks 2product ChatGPT 2product Gmail 2organization Check Point Research 1organization PERISMOUNT LIMITED 1organization Anthropic 1organization Slack 1organization Unit 42 1organization Varonis Threat Labs 1malware UBoatRAT 1organization Palo Alto Networks 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.