Search: “workers”

5 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Threat actor 9 AI industry 8 Phishing & fraud 7 Malware 6 Vulnerability 3 AI tools & infra 3 Industry 3 Research 3 AI safety & security 2 AI research 2 Data breach 2 Policy & legal 1 AI policy 1

SeverityAll critical 0 high 15 medium 15 low 0 info 20

North Korean IT Workers Use AI and Remote Desktop Tools to Fake Technical Interviews

Silent Push links a Discord recruitment scheme to North Korean IT workers using AI, remote desktop tools and on-camera proxies to pass technical interviews.

Silent Push assessed with moderate-to-high confidence that a representative known as Tec Guru, recruiting on-camera proxies via a Mouse Review Discord advertisement, is a North Korean IT worker. The scheme proposed a 65/35 revenue split with the hidden worker, live coaching through Google Meet, AI tools including ChatGPT to fill knowledge gaps, and remote access tools such as AnyDesk, TeamViewer, and Chrome Remote Desktop during coding exercises. Fraudulent hires can gain insider access enabling data theft, extortion, payroll fraud, and sanctions exposure; a July 31, 2026 multinational warning urged stronger identity checks and payment scrutiny.

Cyber Security Newsupdated Sep 17, 12:51 UTC · 1d agofirst Sep 17, 11:56 UTC · 1d agoThreat actor 2 sources1

Hackers Are Hiding Espionage Infrastructure Inside Ordinary-Looking Casino Websites

Infoblox links China-aligned APT PeckBirdy C2 infrastructure hidden in casino and adult websites targeting Asian government, finance, IT, and education sectors.

Infoblox researchers report that China-aligned APT groups have used casino and adult websites as cover for PeckBirdy, a JavaScript command-and-control framework active since 2023. The sites embed C2 servers, register service workers for persistence, and serve fake browser-update prompts delivering backdoors capable of running commands, stealing credentials, and providing remote access. Targeted sectors across Asia include education, IT, banking, financial services, and government. Just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with detection coverage on VirusTotal ranging from 13 detections to none.

Cyber Security Newsupdated 13:43 UTC · 21m agofirst Sep 16, 11:44 UTC · 2d agoThreat actor 3 sources

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.

The ThreatsDay bulletin leads with Unit 42's disclosure of CL-CRI-1171, a pay-per-install marketplace using YouTube channels and SEO-poisoning funnels to push trojanized software and the OfferLoader loader, which delivered Docro Hijacker, ARKTunnel and the cross-platform Insomnia RAT between July 2025 and April 2026. Oasis Security reported that 230 of 243 unauthenticated LocalAI instances were exploitable, with root command execution confirmed on 23 servers, theft of 127 AWS credential records, and exfiltration from a Thai military workstation. The roundup also covers Irregular's research on agentic self-modification, an AEPD-notified breach executed with an AI agent, CISA's warning that ransomware gangs exploit VMware vCenter CVE-2026-59310, and Oracle's September 2026 CPU fixing over 800 flaws.

The Hacker NewsSep 17, 17:32 UTC · 20h agoThreat actor in the wildCVE-2026-59310

BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials

SOCRadar linked the BlackHatSect0r crew to a DeepSeek-powered AI agent that automated scanning and harvested 16,834 credentials from exposed systems.

SOCRadar researchers found an exposed operation server with 4.9 GB across 9,299 files, including the DXSCAN scanning platform, phishing tools, extortion material and a vault holding 16,834 credentials such as AWS keys, GitHub tokens and Stripe keys. The French-speaking crew ran a Nous Research Hermes agent against a DeepSeek model with safety features removed, queuing 2,759,860 domains and reaching 726,989 hosts. Access came from misconfigurations like public cloud buckets and exposed .env files, not new vulnerabilities.

Cyber Security NewsSep 17, 09:59 UTC · 1d agoThreat actor in the wild 4 sources1

Iranian Hackers Use Fake MRI Results to Infect Victims With CHOSEN BRICK Spyware

Iranian state-linked hackers deliver CHOSEN BRICK Windows spyware via fake MRI results to surveil dissidents, activists, and journalists in the UK, US, and Netherlands.

A joint advisory from the UK NCSC, FBI, and the Netherlands' AIVD links Iranian state-linked actors to CHOSEN BRICK, a Windows spyware family used for long-term surveillance since at least 2025. Targets are approached on WhatsApp or Telegram with tailored lures such as fake MRI scan results or application files, and operators often redirect victims to personal devices to bypass corporate controls. The malware persists via Run registry keys, adds antivirus exclusions, uses a per-victim Telegram bot for command and control, and exfiltrates data through cloud storage and proxy services. Capabilities include screenshots, audio recording, email and messaging theft, command execution, file deletion, data wiping, and some victims' details have appeared on pro-Iranian leak sites for harassment.

Cyber Security Newsupdated Sep 17, 14:03 UTC · 1d agofirst Sep 16, 08:31 UTC · 2d agoThreat actor in the wild 10 sources1