Search: “Gemini app”

8 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 44 Vulnerability 32 Malware 25 AI industry 22 Data breach 17 Policy & legal 16 Phishing & fraud 15 Ransomware 15 Model release 13 AI safety & security 12 Industry 8 Threat actor 8 AI tools & infra 3 Research 2

SeverityAll critical 84 high 30 medium 52 low 22 info 49

Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers

Security researchers hired three suspected North Korean IT workers at a fake DeFi startup, documenting forged IDs, AI-edited images and post-hire system access.

Researchers from BCA LTD, NorthScan and ANY.RUN built a fake DeFi protocol called Ballena Azul and hired three suspected Famous Chollima operatives through a real recruiting pipeline. The hires submitted inconsistent or AI-processed identity documents, including a driver's license whose metadata showed Google Gemini processing and a SynthID watermark. On day one the workers profiled their assigned VMs, checked their egress country, and one installed Chrome Remote Desktop and logged into GitHub. The findings were presented at DEF CON 34 and align with a July 31 joint government alert on DPRK IT worker schemes.

The Hacker NewsAug 11, 12:48 UTC · Aug 11, 2026Threat actor

OpenAI: Threat actors use us to be efficient, not make new tools

CyberScoopOct 7, 19:56 UTC · Oct 7, 2025Threat actor

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.

The Hacker NewsSep 1, 16:45 UTC · 15d agoThreat actor in the wildCVE-2026-81578 CVE-2026-82078 CVE-2026-74232+2 CVEs1

Google researchers uncover criminal zero-day exploit likely built with AI

Google links a likely LLM-built criminal zero-day for an open-source admin tool to planned mass exploitation and maps AI-assisted threats.

Google Threat Intelligence Group linked a zero-day exploit for a popular open-source web-based administration tool, enabling 2FA bypass with valid credentials via a semantic logic error, to a criminal group, citing educational docstrings, a hallucinated CVSS score, and textbook Python as signs of LLM authorship; the vendor was notified before a planned mass exploitation campaign. The report also details Russia-nexus malware families CANFAIL and LONGSTREAM using AI-generated decoy code, the PROMPTSPY Android backdoor driving the UI through the Gemini API, APT27 using Gemini to build relay tooling, and the TeamPCP (UNC6780) supply chain compromise of LiteLLM and Trivy repositories that planted the SANDCLOCK credential stealer.

Help Net SecurityAug 24, 04:21 UTC · 24d agoThreat actor

Personal LLM Accounts Drive Shadow AI Data Leak Risks

Infosecurity MagazineJan 7, 13:10 UTC · Jan 7, 2026Threat actor

OpenAI Codex Authentication Tokens Stolen in codexui

The Hacker NewsJun 1, 09:31 UTC · Jun 1, 2026Threat actor1

Chinese espionage groups swarm to exploit triple-link chain of zero-days

Four China-aligned espionage groups, starting with TA412/APT31, chained zero-days CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 to spy on targets since late August.

TA412 (Violet Typhoon/APT31) began exploiting the BlueMoon chain on Aug. 28, followed by UNK_LateNight (US aerospace, Sept. 2), UNK_DoubleCheck (Vietnamese manufacturing via a compromised Southeast Asian government account) and UNK_QuietRacket (Indonesia and Singapore government, consulting and finance, Sept. 3). The chain pairs Chromium JavaScript engine RCE flaws CVE-2026-85046 and CVE-2026-87491 with the Windows ALPC privilege-escalation zero-day CVE-2026-85880, enabling sandbox escape and system privileges. Delivery used phishing links installing a fake Google Gemini browser extension that surveilled browser activity and stole credentials; Proofpoint directly observed fewer than 20 organizations but expects wider proliferation as the kit spreads.

Proofpoint Threat InsightSep 9, 21:17 UTC · 7d agoThreat actor in the wild 3 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-858804

Hacking campaign compromised at least 16 Chrome browser extensions

Security AffairsDec 31, 15:40 UTC · Dec 31, 2024Threat actor