Search: “volexity”

35 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 82 Vulnerability 53 Malware 52 Threat actor 36 Data breach 30 Ransomware 14 Phishing & fraud 7 Advisory 3 Policy & legal 2 Industry 2 AI safety & security 1

SeverityAll critical 179 high 74 medium 25 low 4 info 0

One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire

Two China-linked APT groups reused identical Chrome/Windows zero-day chain against NGOs, deploying GRIMWIDGE backdoor and LONGTALE credential-stealing extension.

Volexity reports that China-linked actors UTA0560 and JungleBamboo (APT31/TA412) ran byte-identical Chrome/Windows exploit chains against NGOs starting September 1, 2026, combining Chrome type confusion CVE-2026-85046, WebAssembly sandbox escape CVE-2026-87491, and Windows kernel flaw CVE-2026-85880. The Chrome bug was fixed in Chromium source but not yet shipped to Chrome users, making it an effective zero-day with an unusual patch gap. UTA0560 delivered the in-memory GRIMWEDGE JScript backdoor, while JungleBamboo deployed the SUPERSTOMP loader installing LONGTALE, a malicious Chrome extension disguised as Google Gemini that steals cookies, session tokens, and keystrokes. Volexity assesses with low confidence the exploit chain was sold or shared among different Chinese end-users.

Security AffairsSep 15, 10:17 UTC · 2d agoThreat actor in the wild 8 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-858804

Threat actors are using legitimate Microsoft feature to compromise M365 accounts

Help Net SecurityFeb 14, 00:00 UTC · Feb 14, 2025Threat actor

Cozy Bear revisits one of its greatest hits, researchers say: election skulduggery

CyberScoopMay 27, 20:21 UTC · May 27, 2021Threat actor in the wild

Vietnamese APT32 group is one of the most advanced APTs in the threat landscape

Security AffairsNov 7, 13:36 UTC · Nov 7, 2017Threat actor

Russian Hackers Target Microsoft 365 Accounts with Device Code Attacks

Infosecurity MagazineFeb 14, 14:30 UTC · Feb 14, 2025Threat actor1

China-linked APT group Salt Typhoon compromised some US ISPs

Security AffairsSep 26, 14:04 UTC · Sep 26, 2024Threat actor in the wildCVE-2024-20399 CVE-2021-30869

Russian Threat Actors Target NGOs with New OAuth Phishing Tactics

Infosecurity MagazineJul 22, 17:15 UTC · Jul 22, 2025Threat actor1

APT Group StormBamboo Attacks ISP Customers Via DNS Poisoning

Infosecurity MagazineAug 5, 09:40 UTC · Aug 5, 2024Threat actor

Russian Hackers Exploit Microsoft OAuth to Target Ukraine Allies via Signal and WhatsApp

The Hacker NewsApr 30, 09:51 UTC · Apr 30, 2025Threat actor1

Nation-State Actors Weaponize Ivanti VPN Zero

The Hacker NewsJan 17, 01:56 UTC · Jan 17, 2024Threat actor in the wildCVE-2023-46805 CVE-2024-218871

How the Russian hacking group Cozy Bear, suspected in the SolarWinds breach, plays the long game

CyberScoopDec 18, 21:04 UTC · Dec 18, 2020Threat actor

Cozy Bear targets NGOs and Think Tanks in post

Security AffairsNov 12, 09:26 UTC · Nov 12, 2016Threat actor

SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse

Recorded FutureAug 22, 00:00 UTC · Aug 22, 2025Threat actor1

AI-Powered Fake News Campaign Targets Western Support for Ukraine and U.S. Elections

The Hacker NewsNov 30, 07:05 UTC · Nov 30, 2024Threat actor

Facebook disrupts Beijing's Uyghur hacking campaign

The RecordNov 17, 00:00 UTC · Nov 17, 2022Threat actor

US Seizes Domains Used by SolarWinds Hackers in Cyber Espionage Attacks

The Hacker NewsJun 3, 05:55 UTC · Jun 3, 2021Threat actor

Microsoft warns of state-sponsored Chinese hackers exploiting multiple zero

CyberScoopMar 2, 21:28 UTC · Mar 2, 2021Threat actor

Phishing campaigns target US gov exploiting flaw CVE-2015

Security AffairsJul 28, 20:51 UTC · Jul 28, 2018Threat actor CVE-2015-5119

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.

Google Threat Intelligence Group detailed three suspected Russian espionage clusters, UNC6293, UNC7005 (Storm-2945), and UNC5976, targeting academia, aerospace, defense, governments, and think tanks in Europe, the US, Ukraine, and Armenia. UNC6293, assessed as a sub-cluster of APT29/Ice Relic, conducted OAuth and application-specific password phishing while impersonating State Department officials. UNC5976 registered file-sharing-themed domains hosting fake OAuth login pages and deployed a malicious Excel plugin codenamed HEADRUSH, while UNC7005 abused WhatsApp device linking to hijack accounts and record victims' audio and video.

The Hacker NewsAug 21, 14:54 UTC · 26d agoThreat actor in the wild

Search: “volexity”

One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire

Threat actors are using legitimate Microsoft feature to compromise M365 accounts

Cozy Bear revisits one of its greatest hits, researchers say: election skulduggery

Vietnamese APT32 group is one of the most advanced APTs in the threat landscape

China-Aligned UTA0388 Uses AI Tools in Global Phishing Campaigns

Threat actors exploited Palo Alto Pan

Threat actors hacked hundreds of servers by exploiting Zimbra CVE-2022

Russian Hackers Target Microsoft 365 Accounts with Device Code Attacks

China-linked APT group Salt Typhoon compromised some US ISPs

Russian Threat Actors Target NGOs with New OAuth Phishing Tactics

APT Group StormBamboo Attacks ISP Customers Via DNS Poisoning

Russian Hackers Exploit Microsoft OAuth to Target Ukraine Allies via Signal and WhatsApp

Nation-State Actors Weaponize Ivanti VPN Zero

How the Russian hacking group Cozy Bear, suspected in the SolarWinds breach, plays the long game

Cozy Bear targets NGOs and Think Tanks in post

SOLARDEFLECTION C2 Infrastructure Used by NOBELIUM in Company Brand Misuse

AI-Powered Fake News Campaign Targets Western Support for Ukraine and U.S. Elections

Facebook disrupts Beijing's Uyghur hacking campaign

US Seizes Domains Used by SolarWinds Hackers in Cyber Espionage Attacks

Microsoft warns of state-sponsored Chinese hackers exploiting multiple zero

Phishing campaigns target US gov exploiting flaw CVE-2015

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

APT42 Hackers Pose as Journalists to Harvest Credentials and Access Cloud Data

Amazon Disrupts APT29 Watering Hole Campaign Abusing Microsoft Device Code Authentication

Chinese State-Sponsored Group TA413 Adopts New Capabilities in Pursuit of Tibetan Targets

U.S. agency cautions employees to limit phone use due to Salt Typhoon hack of telco providers

Volt Typhoon targeted emergency management services, per report

US seizes two domains used by the SVR in recent hacking campaign

Threat actors sell access to tens of vulnerable networks compromised by exploiting Atlassian 0day

Threat actors exploit recently disclosed Atlassian Confluence flaw in cryptomining campaign

SolarWinds hackers are behind a widespread phishing campaign impersonating USAID, Microsoft says

Facebook Tracks APT32 OceanLotus Hackers to IT Company in Vietnam

Force 47 - The Vietnamese brigade tasked with fighting "wrongful views" spreading online

Watering hole attacks on Polish Banks Linked to Lazarus Group

Operation Blockbuster revealed the Lazarus Group Activities