ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Google Password Manager”

4 stories in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 2Malware 2Threat actor 1
SeverityAllcritical 0high 0medium 3low 0info 2

I don't like passkeys

A security blogger argues passkeys suit enterprises but expose individuals to lockout, ban, and recovery risks that outweigh their phishing protection.

The author contends that passkeys are a strong fit for corporate environments but a poor fit for personal security due to permanent lockout, automated account bans, and device loss risks. Hardware keys cap discoverable credentials at 25-300 accounts, and synced passkey ecosystems tied to Apple or Google accounts remain immature and fragmented. The post recommends password managers with independent TOTP apps for individuals.

Lobsters · security · 1h agoIndustry

New RatHat Android malware uses AI to automate device control

Zimperium discovered RatHat, an AI-assisted Android banking trojan linked to Chinese actors, stealing credentials via overlays and intercepting SMS one-time passwords.

Zimperium zLabs identified RatHat, a new Android banking malware whose AI subsystem serializes the live Accessibility tree to XML and queries a popular AI assistant for navigation instructions such as SCROLL_DOWN. It is distributed via malvertising, SMS, and phishing sites pushing sideloaded APKs, then abuses Accessibility permissions to enable Wireless Debugging and gain ADB shell privileges without a PC, similar to ToxicPanda and RedHook. A Go-based agent (liblocal-service.so) maintains mutual persistence with the malware, while libmedia_codec.so acts as an FRP reverse-proxy tunnel; HTML overlays capture banking and crypto credentials, SMS OTPs, and lock-screen PINs. Zimperium links it to Chinese-speaking operators based on Chinese-language LLM prompts and notes anti-analysis tricks including a 61MB manifest and invalid DEX pseudo instructions.

BleepingComputerupdated · 4h agofirst · 16h agoMalware in the wild 6 sources

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.

The ThreatsDay bulletin leads with Unit 42's disclosure of CL-CRI-1171, a pay-per-install marketplace using YouTube channels and SEO-poisoning funnels to push trojanized software and the OfferLoader loader, which delivered Docro Hijacker, ARKTunnel and the cross-platform Insomnia RAT between July 2025 and April 2026. Oasis Security reported that 230 of 243 unauthenticated LocalAI instances were exploitable, with root command execution confirmed on 23 servers, theft of 127 AWS credential records, and exfiltration from a Thai military workstation. The roundup also covers Irregular's research on agentic self-modification, an AEPD-notified breach executed with an AI agent, CISA's warning that ransomware gangs exploit VMware vCenter CVE-2026-59310, and Oracle's September 2026 CPU fixing over 800 flaws.

The Hacker News · 20h agoThreat actor in the wildCVE-2026-59310

How Pentest Companies Adapt In The Era of AI

Opinion piece urges pentest firms to adopt self-hosted AI like Qwen3-Coder via Ollama, warning client findings pasted into cloud models breach confidentiality.

The article argues penetration testers are already using AI tools, and pasting client findings, scope documents, or credentials into cloud models like ChatGPT or Claude risks NDA breaches and GDPR/HIPAA compliance violations. It recommends self-hosted models on firm-controlled infrastructure instead of banning AI. The piece promotes PentestPad, a pentest reporting platform offering managed, self-hosted, and air-gapped deployment, an MCP server exposing fourteen typed tools, and a writing assistant that can target a local LLM. PentestPad's own team reportedly runs Qwen3-Coder through Ollama with OpenCode or Claude Code as the agent harness.

GBHackers · 9h agoIndustry