Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.
Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.
RedisRaider cryptojacking campaign compromises thousands of exposed, unauthenticated Linux Redis servers using cron persistence to deploy XMRig Monero miners.
Hunt.io researchers track a large-scale cryptojacking operation named RedisRaider that scans IPv4 ranges for Redis services exposed on TCP port 6379 and targets instances accepting unauthenticated connections. From a master list of 12,966 candidate hosts, 2,342 were confirmed to accept commands without authentication. Attackers abuse Redis commands (CONFIG SET dir/dbfilename, SET, BGSAVE) to write malicious cron entries into /etc/cron.d or /var/spool/cron, launching XMRig-based Monero miners, with branches including SSH authorized-key injection, Lua probing, and WordPress spraying. The article also references CVE-2026-81934, a Redis TLS use-after-free allowing unauthenticated command execution, fixed in releases including 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.
Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.
Check Point Research tracks Gambling Goblin, a Chinese-speaking cluster, installing malicious Apache reverse-proxy modules on compromised Brazilian government and education web servers since mid-2025. The modules divert visitors to gambling and fake app-store pages while stripping the site's security headers, likely for large-scale SEO manipulation. The group's Linux arsenal includes DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcing tools, and it is tied to Trend Micro's Earth Berberoka. Related SEO-fraud campaigns on .gov.br domains were documented by ESET (GhostRedirector), Palo Alto Networks Unit 42, and Hunt.io.
Hunt.io disclosed Operation CameraSwarm, compromising 14,500+ Dahua cameras via credential attacks, auth bypass CVEs, and P2P relay techniques across Ukraine and Russia.
Hunt.io reconstructed a campaign codenamed Operation CameraSwarm that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. Attack paths included credential attacks against 12,324 IPs, exploitation of CVE-2021-33044 and CVE-2021-33045 affecting 1,923 cameras, and P2P relay access to 283 devices behind NAT. The operator, assessed as Russian-speaking, left behind 2,616 files including tooling and campaign logs, with confirmed compromises concentrated in Ukraine and Russia. Dahua advises factory resets and firmware updates; both 2021 CVEs remain in CISA's KEV catalog.
Authentication Bypass in Dahua IP Cameras, NVRs and Video Intercoms
Dahua IP cameras, network recorders and video-intercom devices are affected by a critical identity authentication bypass (CWE-287) in the login process. By constructing malicious data packets sent to a device during the login process, an attacker can bypass device identity authentication entirely, yielding full unauthenticated access with high impact on confidentiality, integrity and availability (CVSS 3.1: 9.8). The flaw spans a broad set of Dahua firmware, including IPC-HUM7xxx/HX3xxx/HX5xxx cameras, NVR-1xxx/2xxx/4xxx/5xxx/6xx and XVR-4x04 recorders, and the VTH-542XH, VTO-65xxx and VTO-75x95x video-intercom units. Public proof-of-concept exploits have been available since October 2021, and CISA added the bug to its Known Exploited Vulnerabilities catalog on 2024-08-21; public reporting describes 14,500+ Dahua devices compromised via credential attacks, auth bypasses and P2P abuse, and EPSS assigns a 99.6% probability of exploitation within 30 days.
· Dahua IPC-HUM7xxx IP camera firmware · Dahua IPC-HX3xxx IP camera firmware KEV PoC ×2mass
Dahua IP cameras and related products contain an authentication bypass flaw (CWE-287, Improper Authentication) that is triggered when the client supplies the NetKeyboard type argument during the authentication process, allowing the device to treat the session as authenticated without valid credentials. An unauthenticated remote attacker who can reach the camera's network interface can exploit this to gain unauthorized access to the device's management functions. Successful exploitation can expose camera video streams and device configuration and can serve as a foothold into the surrounding surveillance or corporate network. Any organization running affected Dahua IP camera firmware, particularly cameras exposed to the internet, is potentially affected. The flaw is confirmed to be exploited in the wild: it was added to the CISA KEV on 2024-08-21, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile), although no public PoC is known.
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload per
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
Use-After-Free in Redis TLS Pending-Data Handling Enables Unauthenticated RCE
Redis contains a use-after-free flaw (CWE-416) in the tlsProcessPendingData() function, which manages the TLS pending-data list, and it affects only deployments that are configured with TLS support. A remote, unauthenticated attacker who can reach the TLS-enabled Redis service can trigger the flaw; the CVSS 4.0 vector scores it as high attack complexity with present attack requirements, suggesting timing- or condition-dependent exploitation. Successful exploitation may allow the attacker to execute arbitrary commands with the privileges of the Redis server process. Any Redis installation running with TLS enabled is in scope, though affected version ranges are not specified in the available data. No public proof-of-concept exists and the flaw is not in CISA KEV (EPSS 0.4%), but related headlines note a massive Redis cryptojacking campaign hijacking thousands of Linux servers, so Redis deployments are actively targeted in the wild even if this specific flaw's exploitation is not yet confirmed.
A vulnerability exists in certain Dahua embedded products.
A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.