ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Box”

7 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 105Ransomware 77Vulnerability 42Malware 36Data breach 20Threat actor 18Policy & legal 13Phishing & fraud 7Advisory 1AI tools & infra 1Research 1Industry 1AI safety & security 1
SeverityAllcritical 261high 41medium 16low 1info 4

I Hijacked a Real Artist's Spotify with AI Music. It Was Disturbingly Easynew

A journalist used DistroKid's loophole to publish an Udio-generated song on Lathe of Heaven's verified Spotify page, exposing a widespread AI music royalty scam.

A 404 Media reporter generated a punk song with Udio and, via a $3.75-per-month DistroKid account, released it under the name of Brooklyn punk band Lathe of Heaven without any identity verification by the distributor or streaming platforms. The AI-generated track appeared a day later on the band's Spotify, Apple Music, Tidal, Amazon Music and Deezer pages, with royalties flowing to the uploader. Similar abuse has hit deceased musicians such as Blaze Foley, and Spotify says artist profiles that are not actively managed are especially vulnerable.

404 Media · 18m agoPhishing & fraud in the wild

Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT

Cortex XDR threat hunters uncovered a phishing campaign delivering the NetSupport Manager RAT via a fake password-protected NortonLifelock Word document.

Unit 42 identified a January 2020 phishing campaign using a Microsoft Word document disguised as a password-protected NortonLifelock file. Enabling macros triggered an obfuscated command that built alpaca.bat in the temp directory, which used msiexec to download an MSI payload from quickwaysignstx.com, filtered on the Windows Installer user-agent string. The payload installed a PowerShell script and the campaign, which has delivered NetSupport Manager RAT since at least 2018, showed related activity dating back to early November 2019.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild1

A fake ChatGPT billing email is after your OpenAI passwordnew

Cofense reports a fake ChatGPT billing email harvesting OpenAI credentials via a Google redirect to a spoofed login page.

Cofense's Phishing Defense Center traced a fake ChatGPT billing email, sent from support@9527db6e1a[.]nxcli[.]io, claiming a $23.80 overdue balance and a 48-hour deadline before account suspension. The 'Update Payment Information' button routes through a notifications[.]googleapis[.]com redirect to a spoofed OpenAI login page that captures credentials and sends victims to an error page. Cofense published indicators including the Google redirect link plus login.php and key.php paths on the nxcli[.]io host.

Help Net Security · 51m agoPhishing & fraud in the wild

IT Help Desk Impersonation Lets Hackers Bypass MFA

Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.

Arctic Wolf documented a threat cluster tracked as PREY-0058 that impersonates internal IT help desk staff by phone, luring Directors, VPs, and executives to authentication-themed URLs formatted as victim-organization lure domains. Adversary-in-the-middle panels intercept credentials and MFA approvals, and stolen sessions are replayed through residential proxies such as NodeMaven from IPs matching the victim's geo-location and ASN, defeating impossible-travel alerts. Attackers perform discovery against SharePoint and Entra ID, then harvest data from OneDrive, Exchange, and Box before issuing extortion demands. Defenders are advised to require managed devices, use phishing-resistant MFA like FIDO2, enable Continuous Access Evaluation, and monitor sign-ins, SharePoint SearchQueryPerformed, and MailItemsAccessed events.

Security Affairs · 9d agoPhishing & fraud in the wild1