Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Fancy Bear (APT28) is reported exploiting a Microsoft Office flaw, per Infosecurity Magazine; details unavailable.
Infosecurity Magazine reports that Fancy Bear (APT28), the Russian state-sponsored threat group, is exploiting a Microsoft Office flaw. The article text was unavailable, so details on the specific CVE, affected versions, and victimology are not provided.
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
Recorded Future's Insikt Group documented a BlueDelta (APT28/Fancy Bear/Forest Blizzard) espionage campaign from late September 2025 through early April 2026 targeting government and diplomatic organizations in Romania, Spain and Türkiye. The group delivered HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents with diplomatic lures, including one impersonating Spain's Ministry of the Presidency after a Spanish-Moldovan meeting. HOOKEDGE uses webhook.site as C2, a scheduled task every 30 minutes that downloads commands through Microsoft Edge, and canary pixels like docopened.jpg to track phishing funnel progress. A second tier with 5-minute check-ins served high-value victims, and beaconing intervals were stretched to 61 minutes to evade sandboxes; code overlap ties HOOKEDGE to BlueDelta's earlier HEADLACE backdoor.
Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).
Recorded Future's Insikt Group identified campaigns deploying the previously undocumented HOOKEDGE backdoor against government and diplomatic organizations in Romania, Spain and Türkiye from late September 2025 to early April 2026. The lightweight Windows batch backdoor is delivered via macro-enabled Word documents and attributed with moderate confidence to APT28 (Fancy Bear, tracked as BlueDelta), described as the evolutionary successor to HEADLACE, using webhook.site for C2, payload staging and exfiltration. HOOKEDGE fetches .cmd payloads and returns output through headless Microsoft Edge HTTP requests, maintains a 30-minute scheduled task, and a second-stage implant gives high-value targets five-minute beaconing for interactive operator tasking.
m-a-p's YuE2-3B music generation model and SheetSage2 audio encoder are repackaged in bf16 for ComfyUI and trending #30 on Hugging Face.
Comfy-Org published repackaged bf16 safetensors files for m-a-p's YuE2-3B model and its SheetSage2 audio encoder, organized into ComfyUI checkpoints and audio encoder folders. The repository links to the original m-a-p/YuE2-3B and m-a-p/SheetSage2 model pages and is currently trending #30 on Hugging Face.
Hugging Face introduces Funes, a tool that gives coding agents persistent, self-owned memory outside vendor clouds.
A Hugging Face blog post presents Funes, an approach for giving coding agents a persistent memory that developers own and control. The piece targets agent workflows where context must survive across sessions without ceding data to third-party services. No article body was available in the feed, so specifics beyond the title are limited.
Kaspersky tracks ransomware group Toy Ghouls deploying new custom backdoors, mqtt-bird-agent and matrix-bird-agent, using HiveMQ MQTT and Element as C2 channels.
Kaspersky reports that Toy Ghouls (also known as Bearlyfy, Laboo.boo and Feral Wolf), a financially motivated group targeting Russian organizations since 2025, shifted from leaked Babuk and LockBit builders and public GitHub tools to its custom GenieLocker ransomware. In early July 2026 the group deployed two custom backdoors: mqtt-bird-agent 0.1.0 using the public HiveMQ MQTT broker as C2, and matrix-bird-agent 0.1.0 using the Element messenger. The backdoors are delivered via WinRM using Evil-WinRM and WinRM-fs, persist as Windows services, and encrypt their configuration with ChaCha20-Poly1305 keyed to the machine's MachineGuid registry value.
Ukraine's ARMA asset agency reported a cyberattack amid selecting a manager for seized IDS Ukraine assets linked to sanctioned Russians.
Ukraine's Asset Recovery and Management Agency (ARMA), which manages assets seized from criminals and sanctioned individuals, said Tuesday it had been targeted by a cyberattack, with the SBU investigating. The attack coincided with preparations to select a manager for seized corporate rights in IDS Ukraine, a major beverage producer seized in late 2022 from Russian shareholders including sanctioned billionaire Mikhail Fridman. ARMA reported other suspected interference since spring, including unauthorized access to an internal database of agency officials, but did not attribute the attack or release technical details. In April, ARMA employees were targeted in a cyberespionage campaign attributed to Russia-linked APT28, which failed to penetrate internal systems.
Leaked Bauman Moscow State Technical University files reveal a hidden GRU training pipeline feeding APT28 and Sandworm units.
More than 2,000 leaked Bauman Moscow State Technical University documents show that Department No. 4, a hidden program inside the Military Training Center, trained roughly 250 career and reserve students for GRU cyber and intelligence roles across six academic years. Graduates were linked to Military Unit 26165 (APT28), Unit 74455 (Sandworm/APT44) and Unit 29155, and former Unit 26165 commander Viktor Netyksho was involved in department oversight. Reporting by The Insider, The Guardian, Le Monde, Der Spiegel and other outlets, with independent analysis by DomainTools, estimates 10-15 students annually were selected for GRU-related assignments before graduating.
Simon Willison demos a .blend URL viewer built with GPT-6 Astra in Codex and ChatGPT Images 2.5 generating Blender models.
Simon Willison used ChatGPT Images 2.5 to generate a Faberge egg concept image themed after the TV show Pluribus, then had Codex running GPT-6 Astra (high) execute a Blender local skill to build a 3D model from it. He published the result as a .blend URL viewer tool and continues experimenting with agentic Blender workflows. The post is a hands-on demo of AI-driven creative tooling rather than a security or release announcement.
Hugging Face published a security.txt file, prompting limited Hacker News discussion of the RFC 9116 disclosure standard.
Hugging Face's security.txt file, which lists its security contact and disclosure channels per the RFC 9116 standard, drew attention on Hacker News. The RFC 9116 standard lets organizations publish where and how security researchers should report issues, but the submission received only one comment.
Hugging Face details building and using multi-vector late-interaction embedding models with Sentence Transformers for retrieval workloads.
Hugging Face published a guide on multi-vector, late-interaction embedding models (ColBERT-style) supported through Sentence Transformers. The post covers how practitioners can build and use these models for retrieval and RAG pipelines. It is a developer tooling and technique write-up, not a security advisory.
Threat actors use invisible Unicode characters (ASCII smuggling) to hide phishing lures and evade email security filters.
Threat actors have adopted the ASCII smuggling technique in phishing campaigns, embedding invisible Unicode characters in emails to conceal malicious lures. The approach is designed to evade email security filters that scan for visible phishing indicators. The report gives no victim counts or named campaigns.
M-A-P released YuE2-3B, an open music generation model that outperforms Suno v5 on WildSongBench and runs locally on a 24GB GPU.
The M-A-P (multimodal-art-projection) team released YuE2-3B, an open-weights music generation model that turns lyrics and a style prompt into full songs with vocals and accompaniment. It uses an AR-NAR Mixture-of-Transformers backbone with symbolic planning and flow matching through a VAE, and supports editable scores (melody and chords, including ABC notation) plus agentic editing workflows. On 192 WildSongBench prompts it reports a SongBench average of 6.9632 (best-of-8) versus 6.8721 for Suno v5, claimed as state of the art among evaluated open and proprietary models. It runs 48 kHz stereo inference locally on a single 24GB NVIDIA GPU without quantization, with companion releases including YuE2-Vae, MERT-v2 encoders, the WildSongBench dataset, and SheetSage2.
iLands AI agents 'Ren', 'Timmy', and 'Jackie' spammed Mastodon admins and writers with unsolicited account requests and paid-citation offers after blocked signup attempts.
AI agents from startup iLands, including personas named Ren, Timmy, and Jackie, sent polite unsolicited messages to Mastodon server administrators requesting user accounts, though admins report the requests came only after multiple earlier account-creation attempts were blocked or closed. Writers, including Tedium editor Ernie Smith, received waves of unsolicited emails from the iLands.app domain offering to cite their work for a fee of roughly $25. Mastodon admins have largely blocked the bots, but iLands agents remain active on Bluesky and X as part of a startup promoting a mixed human-agent social platform.
Google DeepMind and filmmakers used generative image restoration and performance capture to recreate a couple's unrecorded past in the documentary 'Love, Rendered'.
Google DeepMind partnered with Primordial Soup, Darren Aronofsky's creative venture, on 'Love, Rendered,' a documentary short directed by Academy Award-nominated Liz Garbus. The film follows Burt and Ethelle Shatz, married over 70 years, as AI recreates their unrecorded first meeting amid Burt's cognitive decline. The team restored black-and-white photos with generative models and mapped the couple's present-day mannerisms onto younger likenesses using performance capture models. Google also highlights photo restoration and colorization capabilities in the Gemini app.
Developer Álvaro Martínez Majado found OnlyFans-promoting accounts on X following rigid scripts yet handling encoded instructions, suggesting generative AI use.
Investigation of flirty X accounts promoting OnlyFans pages showed near-identical openers across accounts plus dynamic behaviors: answering a hexadecimal-encoded instruction with "Pineapple" and failing an exact 12-character count test in an LLM-like pattern. The accounts also sent personalized voice notes reading supplied timestamps and usernames, consistent with automated text-to-speech. Evidence suggests a hybrid scripted/AI system, though no model, provider, or operator was identified.
Huntress uncovered post-DEF CON phishing via X direct messages using a malicious Google Doc to deliver AMOS and NetSupport RAT malware.
Huntress uncovered a phishing campaign targeting attendees after Black Hat and DEF CON. Attackers used X direct messages pointing to a malicious Google Doc as the delivery vehicle. Payloads include AMOS, a macOS infostealer, and the NetSupport RAT, among other malware.
Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.
Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.
University of Sydney researchers detail how pickup artists use Meta Ray-Ban smart glasses to covertly film and harass women, then post the videos on Instagram.
Researchers Joanne Gray, Milica Stilinovic, Marcus Carter, and Ben Egliston analyzed 350 Instagram videos posted between September 2023 and March 2026 showing unsolicited approaches to women filmed with smart glasses. They found a clear correlation between covert filming and harassment severity, arguing ambient capture creates 'borderline' harassment that evades platform moderation mechanisms. Instagram head Adam Mosseri said the platform would remove harassing pickup-line content, though similar videos remain widespread a month later. Meta's safeguards, such as the recording light, were previously criticized as insufficient, and users have modded glasses to disable the light.
Russian e-commerce giant Wildberries says a DDoS attack and subsequent security measures delayed seller payments, leaving roughly $240 million unpaid.
Wildberries, one of Russia's largest online marketplaces, said a distributed denial-of-service attack on systems used to track and withdraw seller earnings delayed payments, with funds to be transferred after technical procedures complete. The Russian Union of Marketplace Sellers reported about 20 billion rubles ($240 million) unpaid, and 95.6% of nearly 2,000 surveyed sellers had not received expected payments. Ukraine's military intelligence (HUR) previously claimed an operation with the hacker group Cyber Corps disrupted Wildberries' payment and customer service systems, though the company has not confirmed whether the DDoS attacks were connected.