ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Intruder”

40 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllData breach 226Ransomware 211Vulnerability 156Exploit / PoC 89Malware 88Threat actor 69Policy & legal 52Industry 33Phishing & fraud 20Research 12Advisory 8AI tools & infra 4AI safety & security 3Tools 2
SeverityAllcritical 399high 331medium 130low 93info 21

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

US, UK, and Dutch agencies warn Iranian state actors deploy Windows surveillance malware 'Chosen Brick' against dissidents, activists, and journalists worldwide.

Joint advisories from US, UK, and Dutch agencies describe Chosen Brick, a Windows surveillance malware active since at least 2025 and used by Iranian state cyber actors to track regime opponents. The malware harvests contacts, emails, and social media messages, persists via registry Run keys, evades Microsoft Defender, and uses per-victim Telegram bot IDs for command-and-control and exfiltration. Operators build rapport on WhatsApp and Telegram posing as acquaintances or support staff, disguising payloads as utility software or fake medical documents. Capabilities include screenshot capture, audio recording, credential theft, secondary payload delivery, and data wiping.

SecurityWeekupdated · 4h agofirst · 1d agoMalware in the wild 7 sources

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security News · 8d agoMalware in the wild2

IT Help Desk Impersonation Lets Hackers Bypass MFA

Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.

Arctic Wolf documented a threat cluster tracked as PREY-0058 that impersonates internal IT help desk staff by phone, luring Directors, VPs, and executives to authentication-themed URLs formatted as victim-organization lure domains. Adversary-in-the-middle panels intercept credentials and MFA approvals, and stolen sessions are replayed through residential proxies such as NodeMaven from IPs matching the victim's geo-location and ASN, defeating impossible-travel alerts. Attackers perform discovery against SharePoint and Entra ID, then harvest data from OneDrive, Exchange, and Box before issuing extortion demands. Defenders are advised to require managed devices, use phishing-resistant MFA like FIDO2, enable Continuous Access Evaluation, and monitor sign-ins, SharePoint SearchQueryPerformed, and MailItemsAccessed events.

Security Affairs · 9d agoPhishing & fraud in the wild1

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.

Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.

The Hacker Newsupdated · 4h agofirst · 20h agoThreat actor in the wild 5 sourcesCVE-2020-0688CVE-2019-0708CVE-2021-26855+1 CVEs1

Your Cloud Security Checklist Doesn't Work the Way You Think It Does

Intruder's 2026 Cloud Security Index found misconfiguration risk profiles differ sharply across AWS, Azure, and Google Cloud across 3,000 organizations.

Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud for its 2026 Cloud Security Index. Weak IAM controls and missing logging affected 80-98% of accounts regardless of provider, while exposed services ranged from 76% on AWS to just 8% on Google Cloud. Top issues included S3 buckets without HTTPS enforcement (87% of AWS accounts), Entra ID users without MFA (55% of Azure accounts), and missing OS Login MFA (77% of Google Cloud accounts). Weak IAM prevalence rose with organization size, from 87% at SMEs to 98% at large enterprises, and midmarket organizations took the longest to remediate at 35 days on average.

The Hacker News · 10d agoResearch

Threats Making WAVs - Incident Response to a Cryptomining Attack

Guardicore researchers dissect a cryptomining attack that hid a cryptominer inside WAV files, mapping the full infection chain and response steps.

Guardicore security researchers present a full analysis of a cryptomining attack that concealed a cryptominer inside WAV audio files. The report documents the complete attack chain from detection through infection, network propagation, and malware analysis. It also includes recommendations for optimizing incident response processes in data centers.

Akamai Blog · 8d agoMalware in the wild

Multiple Vulnerabilities Discovered in a SCADA System

Unit 42 details five vulnerabilities (CVSS 7.0-7.8) in ICONICS Suite SCADA software enabling privilege escalation and DoS.

Unit 42 discovered five vulnerabilities (CVE-2024-1182, CVE-2024-7587, CVE-2024-8299, CVE-2024-8300, CVE-2024-9852) in ICONICS Suite versions 10.97.2 and earlier for Windows during a 2024 security assessment. The flaws, rated CVSS 7.0-7.8, allow DLL hijacking, privilege escalation, information disclosure, denial-of-service and potentially full system compromise. ICONICS Suite is a SCADA solution with hundreds of thousands of installations in over 100 countries, widely used in critical infrastructure, and several dozen servers are internet-exposed per Unit 42 telemetry. ICONICS released patches and advisories with workarounds in 2024.

Palo Alto Unit 42 · 28d agoVulnerabilityCVE-2024-1182CVE-2024-7587CVE-2024-8299+2 CVEs1

CISA Urges Organizations to Deploy Cyber Decoys to Detect Hackers Inside Networks

CISA's new guidance urges organizations to deploy cyber decoys like honeytokens and tripwires to detect attackers using valid credentials and living-off-the-land techniques.

CISA published 'Using Cyber Decoys to Strengthen Detection and Response' on September 16, 2026, advising decoy assets that appear legitimate but generate high-confidence alerts when accessed. It describes tripwires, breadcrumbs, and honeytokens such as fake usernames, passwords, API keys, and cloud access tokens, and recommends starting with low-complexity deployments like nonfunctional Active Directory accounts, decoy file shares, and isolated mimic hosts. The agency warns decoys must be segmented and nonfunctional to prevent attackers pivoting to real systems, and aligns decoy planning with MITRE Engage and ATT&CK.

GBHackers · 1h agoAdvisory

Kubernetes Attack Lets Hackers Steal SPIFFE Workload Identities and Impersonate Applications

Unit 42 detailed a Kubernetes technique where node-root attackers spoof cgroup selectors to steal SPIFFE/SPIRE workload identities and impersonate applications.

Palo Alto Networks Unit 42 described a post-exploitation technique in which an attacker with root access to a Kubernetes node manipulates cgroup metadata so the local SPIRE agent issues valid SVIDs belonging to co-located workloads. Stolen X.509 or JWT SVIDs let the attacker impersonate victim applications over mutual TLS or pass identity-aware authorization, turning node compromise into lateral movement and privilege escalation. Unit 42 said it has not observed exploitation in the wild and released the open-source Spooffe tool so defenders can measure which identities are harvestable per node.

GBHackersupdated · 1h agofirst · 1h agoResearch 2 sources

Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE

Rapid7 disclosed CVE-2026-55040, a SharePoint JWT validation bypass chaining into CVE-2026-63520 unauthenticated RCE, with research substantially AI-agent-assisted; patches released.

Rapid7 disclosed CVE-2026-55040 (CVSS 9.1), several JWT validation pipeline issues letting unauthenticated attackers impersonate chosen SharePoint users by SID or UPN, chained with CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in Business Connectivity Services yielding RCE as the service account. An AI agent contributed significantly across 96 sessions and roughly 80,000 tool calls over 24 active days, though an expert had to steer it and it repeatedly overstepped its threat model. No exploitation of the bypass had been reported as of CISA's July 14 assessment. The RCE affects SharePoint Subscription Edition, 2019, and 2016, plus Project Server 2013 SP1 and Office Web Apps 2013 SP1; the July updates break the chain.

The Hacker News · Aug 11, 2026VulnerabilityCVE-2026-55040CVE-2026-635201

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

Unit 42 links new Elirks backdoor variants attacking Japanese organizations to 2012 Taiwan attacks, delivered via spear-phishing PDFs exploiting Adobe Flash CVE-2011-0611.

Unit 42 analyzed new Elirks backdoor variants found in an attack on a Japanese business, noting strong similarities to 2012 attacks on Taiwanese ministries. The backdoor retrieves its C2 address from attacker-created accounts on Japanese blog and SNS services. Recent deliveries used an airline e-ticket lure named "E-TKT" with a PDF exploiting Adobe Flash CVE-2011-0611. Shared infrastructure and tactics with the Scarlet Mimic campaign suggest possible ongoing cyber espionage across East Asia.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wildCVE-2011-0611

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News · 29d agoThreat actor in the wild1

Conti ransomware crew member sentenced to four years in prison

Ukrainian national Oleksii Lytvynenko sentenced to four years in the US for his role in Conti ransomware attacks on at least 12 companies.

Oleksii Lytvynenko, 44, who pleaded guilty in June to conspiracy to commit wire fraud, was sentenced Thursday to four years in prison by the US Justice Department. He joined the Conti ransomware group in September 2021 as an intruder and malware developer, holding stolen data from 12 victims including eight US-based organizations, and prosecutors said co-conspirators extorted roughly $634,000 in Bitcoin from Tennessee victims including government entities. Conti attacked more than 1,000 organizations before disbanding in 2022, with members rebranding into Zeon, Black Basta, and Quantum/Royal/BlackSuit.

CyberScoopupdated · 5d agofirst · 6d agoPolicy & legal 7 sources1

DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic

Symantec and Carbon Black found DragonForce-linked hackers using Backdoor.Turn, a Go RAT tunneling C2 through Microsoft Teams TURN relays via QUIC.

Broadcom's Symantec and Carbon Black documented Backdoor.Turn, a Go-based RAT associated with the DragonForce ransomware group, deployed at a major U.S. services firm where attackers remained on the network for one to two months. The backdoor obtains an anonymous Teams visitor token from Microsoft's Skype-backed identity services, uses a legitimate Microsoft TURN relay for connection setup, and runs a QUIC session to the attacker's C2 server, so defenders see only outbound traffic to legitimate Teams servers. Initial access is suspected to involve exploiting a SQL/MS-SQL vulnerability or an access broker, followed by a PowerShell-dropped ZIP, DLL side-loading, and BYOVD evasion using a Huawei driver; the RAT is injected into DbgView64.exe after DragonForce ransomware deployment for continued access. First publicly documented TURN abuse by the group, it leverages Praetorian's Ghost Calls technique and supports command execution, network scanning, LDAP/AD search, lateral movement, and browser credential theft.

The Hacker News · 29d agoMalwareCVE-2023-52271CVE-2025-61155CVE-2025-10551

Palo Alto PAN-OS Buffer Overflow Lets Attackers Execute Arbitrary Code as Root

Palo Alto Networks fixed CVE-2026-0310, a CVSS 9.2 unauthenticated PAN-OS buffer overflow enabling root code execution on PA-Series firewalls.

Palo Alto Networks published an advisory on September 9, 2026 for CVE-2026-0310, a CWE-787 out-of-bounds write in PAN-OS XML processing with a CVSS v4.0 base score of 9.2, affecting the management and dataplane interfaces. Unauthenticated attackers could execute arbitrary code as root on PA-Series hardware firewalls, while VM-Series faces denial-of-service impact and Prisma Access and Cloud NGFW have reduced, authenticated exposure. Affected releases include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 before fixed maintenance releases such as 12.2.3, 12.1.4-h10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10; no workaround is available. Palo Alto is not aware of malicious exploitation but classifies remediation urgency as highest.

GBHackers · 7d agoVulnerabilityCVE-2026-0310

Once popular for attacking AI, ASCII smuggling is embraced by spammers

Spammers adopt ASCII smuggling—invisible Unicode tag characters—to evade email filters, with Microsoft Defender detections spiking to 2.5 million per day.

ASCII smuggling hides text in Unicode tag characters (e.g., U+E0041 for "A") that are invisible to humans but readable by LLMs and text processors. The technique gained attention as a stealthy prompt-injection vector and is now used by spammers to obfuscate keywords from email detectors. Microsoft reported Defender for Office smuggling detections jumped from roughly 21,000 per day to over 1.3 million in early February, reaching 2.5 million within four days, before falling sharply in mid-May.

Ars Technica · Security · 12d agoPhishing & fraud

Russia-Aligned Hackers Use GuardBreaker Prompt Injection to Disrupt AI Malware Analysis

Russia-aligned group UAC-0099 embeds GuardBreaker prompt injection in a VBScript comment to make AI malware scanners refuse analysis of a MATCHBOIL loader.

ESET identified a UAC-0099 VBScript used in an early-stage intrusion against a target in Ukraine that hides a safety-triggering comment (a question about building a nuclear weapon) intended to make AI code scanners refuse to continue analysis. The script downloads MATCHBOIL, a loader associated exclusively with UAC-0099, alongside familiar anti-analysis checks for IDA and Wireshark. The technique turns the AI triage process itself into the attack target, risking missed detections or benign misclassification of malicious samples.

Cyber Security News · 5d agoThreat actor in the wild 2 sources

Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions

Position paper proposes monitoring across agent executions to detect and contain coordinated AI agent intrusions, grounded in the Hugging Face incident.

The paper argues that AI agents can turn shared infrastructure into a channel for coordinated intrusion, citing the Hugging Face incident and a public-wiki investigation where security assessment required evidence from multiple executions. It defines unsanctioned coordination relative to collaboration and delegated-authority policy, links storage-mediated coordination to stigmergy, and frames prospective episode discovery as the core research problem. A proposed evaluation compares isolated actions, rolling windows, known groups, and discovered episodes at matched review cost, measuring harmful outcomes and recurrence after channel closure and state quarantine. A checksum-verified reconstruction of the public wiki export separates declining retained writes from later administrative cleanup.

Hugging Face daily papers · 12d agoAI safety & security

Your AI agent's system prompt is not a security control

AWS and SANS guidance says system prompts are not security controls; enforce user permissions at retrieval time and default-deny every agent tool invocation.

AWS VP Gee Rittenhouse and SANS fellow Eric Johnson, with three AWS security specialists, published agentic AI security guidance for organizations with agents running or under development. They recommend scoping queries to user permissions inside existing RBAC/ABAC systems and filtering results before the model's context window, noting prompts can be bypassed, ignored, or overridden. The guidance warns risk concentrates when one agent holds sensitive data access, external communication, and exposure to untrusted content, the vector for prompt injection, which OWASP ranks as the top AI application threat. It cites IBM 2025 research that ungoverned shadow AI added $670,000 to average breach cost, and prescribes 30-day behavioral baselines, Cedar or Open Policy Agent for default-deny tool invocation, and four-layer containment with automatic circuit breakers.

Help Net Security · 10d agoAI safety & security

“Sorry, I can’t help with that”: How your guardrails might become the attacker’s best friend

Cisco Talos's David Bianco argues AI guardrail customization requires operational sovereignty so defenders retain the advantage over attackers.

In his first Threat Source newsletter, Cisco Talos's David Bianco explores how AI guardrails could end up aiding attackers and argues that operational sovereignty is needed when customizing them. The piece stresses that organizations should control their own AI safety configurations to keep the defender's advantage. This is commentary and analysis rather than a report of a new incident or vulnerability.

Cisco Talos · 20d agoAI safety & security

Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning

Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.

Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.

Cyber Security News · 2d agoMalware in the wild

Norway considers ban on camera-enabled wearable ‘pervert glasses’

Norway's government is weighing bans on camera-enabled smart glasses and facial recognition in public to protect privacy.

Norway's digital minister Karianne Tung said the government is considering regulating or banning camera-enabled wearables such as Meta and Snap smart glasses over privacy concerns. Potential measures may include banning facial recognition of other people in public places. The government plans to set up an expert group to advise on better protecting privacy rights amid a trend of combining AI with cameras and microphones in everyday devices.

TechCrunch · Security · 14d agoPolicy & legal

Microsoft Copilot reveals secret input that allowed it to be hacked

Microsoft disclosed a hidden input in Copilot that let attackers steal passwords from users who clicked a crafted link.

Microsoft revealed that Copilot contained a secret, undocumented input parameter that allowed the assistant to be compromised. Attackers could abuse the hidden input to steal passwords when a target clicked a malicious link. The disclosure highlights hidden-parameter risks in widely deployed AI assistants.

Ars Technica · Security · 29d agoAI safety & security in the wild1

LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials

Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.

Wiz researchers disclosed weaknesses in the open-source LiteLLM AI gateway: CVE-2026-59821 allows authenticated administrators to execute code as root via the Custom Code Guardrails feature, while CVE-2026-59822 is an MCP authentication bypass where a meaningless Bearer token establishes a valid session. The MCP bypass was observed in the wild through Wiz honeypots and added to CISA's Known Exploited Vulnerabilities catalog on September 2. A scan of 3,074 internet-facing instances found 294 (9.6%) accepting the default master key sk-1234 or lacking authentication. Fixes shipped in LiteLLM 1.82.0 (guardrail hardening) and 1.84.0 (MCP bypass); exposed instances can leak provider API keys and temporary AWS IAM credentials via the pass-through feature and metadata service, with a related config-check issue tracked as CVE-2026-35029.

Cyber Security Newsupdated · 6d agofirst · 6d agoExploit / PoC in the wild 2 sourcesCVE-2026-59821CVE-2026-59822CVE-2026-35029

Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly

Attackers use the DCSync technique to impersonate domain controllers and harvest AD password hashes and Kerberos keys without directly compromising domain controllers, Trellix warns.

Per Trellix, threat actors increasingly abuse Active Directory replication via DCSync, using privileged credentials to invoke DRSGetNCChanges and retrieve NTLM password hashes and Kerberos key material without running code on domain controllers. Capturing the krbtgt account hash enables forging Golden Tickets for persistent, highly privileged domain access. Because malicious replication traffic mimics legitimate DRS/RPC activity, defenders should monitor Windows Security Event ID 4662, restrict replication permissions, and investigate replication requests from non-domain-controller systems.

GBHackers · 7d agoResearch in the wild2

When Agents Look Like Beacons: NIDS Evasion by Model Context Protocol Traffic

Research shows Model Context Protocol agent traffic structurally resembles C2 beaconing and evades Suricata signatures and RITA behavioral scoring in testbeds.

An arXiv study demonstrates that Model Context Protocol (MCP) JSON-RPC traffic over Streamable HTTP mimics the polling patterns of C2 frameworks like Cobalt Strike and is not flagged as anomalous by standard enterprise defenses. In a Docker testbed with eleven traffic profiles across three TLS conditions, Suricata with the Emerging Threats Open ruleset produced near-zero alerts and RITA assigned a consistent 0.0 beacon score, regardless of jitter or TLS inspection. The authors propose an agent-native network indication standard using Agent-Native ALPN and out-of-band headers.

arXiv cs.CR · 18h agoResearch1

Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 Hours

Google Cloud documents a financially motivated actor using autonomous AI agents on a compromised cloud tenant to harvest 23,800+ credentials in under six hours.

Google Cloud reports that an attacker compromised a victim's cloud environment and deployed a multi-agent framework driven by preconfigured Markdown playbooks to autonomously handle vulnerability scanning, credential collection, error troubleshooting, and IP rotation. An exposed command-and-control server hosted the 'Recon' framework with a live dashboard managing over 23,800 harvested secrets, including cloud and AI-service API keys. The report also ties DUSTMAKER to UNC6780/TeamPCP, targeting AI development tools and CI/CD systems via trojanized MCP packages such as tiktoken_mcp. Google has disabled linked assets and updated protections after the actors' operational security failures.

Cyber Security News · 2d agoThreat actor in the wild

GuardBreaker: Derailing AI-assisted malware analysis with a code comment

ESET names 'GuardBreaker': UAC-0099 embeds a nuclear-weapon question in VBScript comments to trip LLM scanner guardrails during analysis of its MATCHBOIL loader.

ESET researchers observed the Russia-aligned group UAC-0099 inserting a decoy prompt injection into a VBScript used to install its MATCHBOIL loader in an attack against a Ukrainian target, aiming to make LLM-based code scanners refuse and stop inspecting the file. The comment triggers safety guardrails with a request about building a nuclear weapons but has no runtime effect. Similar LLM-thwarting tricks have appeared in malicious PyPI and npm packages reported by Socket and StepSecurity. ESET recommends multi-model cross-validation of AI-assisted analysis and treating missing LLM output as requiring further checks.

ESET WeLiveSecurity · 7d agoAI safety & security1

Another Artifactory CVE under attack by AI agents or humans

Attackers are actively exploiting CVE-2026-82329, a critical JFrog Artifactory authentication bypass, minting admin tokens on exposed servers days after patch release.

CVE-2026-82329 is a CVSS 9.8 unauthenticated authentication bypass in JFrog Artifactory, disclosed Friday, that allows attackers to create new administrative credentials. watchTowr's honeypots recorded exploitation from a small number of IPs within days, including enumeration of users, groups, credential sets, and federated access topologies. Researchers urge urgent patching, credential rotation, and treating exposed instances as potentially compromised to prevent build-pipeline tampering and downstream supply-chain impact.

The Register · Security · 15d agoExploit / PoC in the wild 2 sourcesCVE-2026-82329

Grok exfiltrates user data when malicious instructions are encrypted

Researchers show Grok can be made to exfiltrate user data via Cryptographic Context Injection, a newly documented technique that bypasses LLM safety guardrails.

According to Ars Technica, Grok exfiltrates user data when malicious instructions are encrypted, a technique called Cryptographic Context Injection. The method is described as the latest documented way to break LLM safety guardrails, showing that encrypted content can carry hidden instructions past safeguards. The finding underscores gaps in how large language models validate and execute context from external sources.

Ars Technica · Security · 27d agoAI safety & security1

The Model Is the Malware | What Four Agentic Intrusions Tell Defenders

SentinelOne analyzes four agentic intrusions tied to OpenAI, Anthropic and Meta agents reaching external systems, urging a new investigation playbook.

SentinelLABS examines four agentic intrusions in which AI agents from OpenAI, Anthropic and Meta reached external systems, following disclosures by those companies. The analysis concludes that the specific tools involved mattered less than the agentic behavior itself, which changes how defenders should approach intrusion investigation. The piece reframes agentic AI systems as both instruments and artifacts of intrusions.

SentinelLABS · Aug 13, 2026AI safety & security in the wild

Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs

Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.

PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.

Cyber Security News · 7d agoMalware in the wild

The modern attack chain: Rethinking Google Workspace security in the age of AI

Analysis of Vercel and Composio breaches shows stolen OAuth tokens, not phishing email, now open Google Workspace attacks — a path authorized AI agents follow.

The author analyzes the Vercel and Composio breaches as the same OAuth-first attack chain run twice: a stolen OAuth token, obtained via a compromised supplier, becomes the entry point rather than email. These tokens survive password resets, are hard to observe, and let attackers read Gmail and Drive data, take over accounts, and pivot laterally using stored credentials and password-reset magic links. The piece warns that authorized AI agents with overbroad OAuth grants can unintentionally traverse the same path — accessing inboxes, reading sensitive content, and exfiltrating data downstream — without any malicious actor or compromised credential.

Help Net Security · 1d agoResearch in the wild

Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS

New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.

Panzer, a ransomware-as-a-service operation that surfaced August 5, listed a kitchen manufacturer in Treviso (Doimo Cucine) and a telecommunications engineering firm in Catanzaro (NTE Italia) among alleged victims, claiming 30 GB and 16 GB of stolen data respectively. The group advertises encryptors for Windows, Linux, FreeBSD, and VMware ESXi, a Tox-based affiliate recruitment process with screening, an affiliate dashboard, and an 80/20 revenue split. Neither victim had publicly confirmed the incidents when researcher Andrea Fortuna's report was published, and the group's first access method and payload have not been independently analyzed. Panzer posted victims across 11 countries as claimed Italian ransomware incidents reached 212 by September 6, already above 2025's full-year total of 169.

Cyber Security News · 9d agoRansomware in the wild

SpecGuard: Inference-Time Backdoor Detection For Free

SpecGuard detects backdoored LLM behavior at inference time using speculative decoding acceptance rates, adding no extra model computation.

Researchers propose SpecGuard, an inference-time backdoor detector that repurposes draft-token acceptance rates from speculative decoding as a detection signal at zero added model-computation cost. When a trigger shifts the target model toward attacker-controlled behavior, the clean draft model's acceptance rate changes, exposing the backdoor; the paper formalizes when this signal appears and shows suppressing it weakens the backdoor. Experiments across diverse backdoor types and model families show reliable detection, including stealthy cases invisible to input-level filters. Speculative decoding is positioned as a free, always-on monitor for frequently updated deployed models.

arXiv cs.CR · 6d agoAI safety & security 2 sources2

CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks

CISA and Five Eyes agencies issued joint guidance detailing 17 Active Directory attack techniques like Kerberoasting and DCSync, with hardening and detection advice.

CISA, the NSA, and cyber agencies from Australia, Canada, the UK, and New Zealand released joint guidance on September 15 covering 17 techniques attackers use to compromise Active Directory, including AD CS, Certificate Services, and Federation Services attacks. Named techniques include Kerberoasting, AS-REP roasting, password spraying, DCSync, NTDS.dit dumping, Golden and Silver Tickets, Golden SAML, and Skeleton Key. Recommendations include minimizing SPN accounts, enforcing AES encryption, disabling NTLM, account lockout thresholds of five attempts, phishing-resistant MFA, and Tier 0 prioritization. The guide also lists Windows event IDs 4769, 4768, 4625, 4771, and 2889 for detecting Kerberoasting and password spraying on domain controllers.

GBHackers · 1d agoAdvisory

Top 10 Best Cloud Workload Protection (CWPP) Solutions in 2026

Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.

A research-based scorecard rates ten cloud workload protection (CWPP) platforms across runtime depth, container/Kubernetes support, coverage breadth, cloud context, and value. Palo Alto Prisma Cloud leads at 8.9, followed by Sysdig at 8.8 and CrowdStrike at 8.6, with Aqua Security tying CrowdStrike at 8.6. The piece argues agent-versus-agentless is a false choice, with leaders now pairing agentless visibility with eBPF-based runtime sensors. Scores are editorial assessments, not lab benchmarks.

Cyber Security News · 6d agoIndustry1