ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “go”

25 stories in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPolicy & legal 6Industry 6Malware 6Phishing & fraud 3Threat actor 3Vulnerability 2Exploit / PoC 1Research 1Data breach 1Advisory 1
SeverityAllcritical 0high 6medium 9low 3info 12

NightmareStresser Goes Offline in Global DDoS-for-Hire Crackdown

The DOJ seized NightmareStresser domains, a DDoS-for-hire service behind hundreds of thousands of attacks since 2022, as part of Operation PowerOFF.

The US Department of Justice announced the court-authorized seizure of internet domains behind NightmareStresser, a booter service allegedly used to launch hundreds of thousands of actual or attempted DDoS attacks worldwide since 2022. The action, announced from the District of Alaska with FBI Anchorage and Royal Canadian Mounted Police support, is part of Operation PowerOFF, which previously took down 53 domains across 21 countries in April and 27 booter sites in December 2024. Over the past eight years, prosecutors have charged twelve defendants and seized more than 100 domains tied to DDoS-for-hire services.

Security Affairs · 1h agoPolicy & legal 3 sources

12 Best DSPM Tools Compared (2026): Features & Pricing

A 2026 buyer's guide compares 12 DSPM vendors' features and pricing, warning per-TB data-volume billing inflates long-term cloud security costs.

The article compares 12 data security posture management (DSPM) tools, including Palo Alto Networks (Dig), BigID, Wiz, Symmetry Systems, Varonis, CrowdStrike (Flow Security), Cyera, and Tenable (Eureka), focusing on billing models such as per-TB scanning, per-data-store, per-identity, and pay-as-you-go. It highlights vendor consolidation through acquisitions and advises negotiating scan-volume caps and clarifying whether shadow copies and dev clones count as billable data.

GBHackers · 2h agoIndustry 7 sources

RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs

New Android banking trojan RatHat abuses Wireless Debugging to gain shell access and steals banking PINs and OTPs via raw touch capture.

Zimperium and zLabs analyzed RatHat, an Android banking malware linked to China-based actors that chains Accessibility abuse and Wireless Debugging to obtain a local ADB shell without a host computer. Masqueraded Go binaries in /data/local/tmp provide persistence and an FRP reverse tunnel, while a getevent-based collector maps touch coordinates to PIN pads and pattern locks using locateValues.json layouts. It targets banking, crypto, WeChat and Alipay apps through smishing, malicious ads, and HTML overlays, and serializes the accessibility tree for a generative AI assistant to automate on-screen actions. Layered anti-analysis includes malformed DEX, a padded manifest, and debugger, Frida, and emulator checks.

GBHackersupdated · 18m agofirst · 5h agoMalware in the wild 3 sources

The sexy AI-powered dating app scams are here

Anthropic exposed a network of roughly 28 AI-driven dating apps using autonomous personas and gig workers to defraud paying users.

Anthropic threat intelligence uncovered a fraud network of around 28 dating apps after a prepaid account sent over 100,000 Claude API requests daily, with most chats run by autonomous AI personas and no human agent. Researchers Matthew Gore-Kormanik and Anthropic's Chris Cronbaugh documented apps including Dora, Romi, and Doni, which monetize conversations via coins; gig workers were hired only to pass liveness checks and select pregenerated replies. An operations manual written in Chinese was found inside the Doni app, and Anthropic published findings in its September 2026 AI misuse report.

The Verge · AI · 22h agoPhishing & fraud in the wild

Ofcom discovers issuing Online Safety Act fines is easier than collecting them

Ofcom says most Online Safety Act fines totaling over £7 million remain unpaid as platforms structure businesses to evade collection.

Ofcom director of enforcement Suzanne Cater told the House of Lords that the majority of fines issued under the UK Online Safety Act remain uncollected despite over £7 million in penalties on 11 providers. The regulator's largest fine was £1.4 million against 8579 LLC in February. Ofcom is running six enforcement programs and 40 formal investigations covering more than 100 services, including Telegram, TikTok and X, and is working with the UK government to strengthen its enforcement powers.

The Register · Security · 3h agoPolicy & legal

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.

Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.

Cloudflare Blog · 17h agoMalware in the wild

LinkedIn fights for the right to tell customers when the feds want their data

Microsoft's chief legal officer argues federal subpoenas for LinkedIn user data should carry narrower scope and that secrecy orders must become the exception.

Microsoft chief legal officer Jon Palmer said federal courts and Congress must curb overly broad US government subpoenas for LinkedIn user data that arrive with secrecy orders preventing customer notification. The company is asking courts to enforce meaningful limits on demand scope and secrecy, invoking Fourth and First Amendment arguments. Palmer cited House legislation passed August 31 to rein in secret surveillance, while LinkedIn simultaneously faces user privacy lawsuits, one dismissed with leave to amend by Judge Vince Chhabria.

CSO Online · 17h agoPolicy & legal

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · security · 23h agoResearch

A fake ChatGPT billing email is after your OpenAI passwordnew

Cofense reports a fake ChatGPT billing email harvesting OpenAI credentials via a Google redirect to a spoofed login page.

Cofense's Phishing Defense Center traced a fake ChatGPT billing email, sent from support@9527db6e1a[.]nxcli[.]io, claiming a $23.80 overdue balance and a 48-hour deadline before account suspension. The 'Update Payment Information' button routes through a notifications[.]googleapis[.]com redirect to a spoofed OpenAI login page that captures credentials and sends victims to an error page. Cofense published indicators including the Google redirect link plus login.php and key.php paths on the nxcli[.]io host.

Help Net Security · 16m agoPhishing & fraud in the wild

Comp AI Raises $34 Million for AI-Native Compliance and Securitynew

Comp AI raised a $34 million Series A to expand its AI-native GRC platform into continuous cybersecurity monitoring.

Comp AI, a Florida-based startup founded in January 2025, announced a $34 million Series A led by Roo Capital and Grand Ventures, bringing total funding to over $36 million. The company automates governance, risk and compliance tasks such as onboarding, evidence gathering, policy generation, control monitoring and assessment, and plans to expand into continuous cybersecurity with real-time monitoring and control validation across applications and infrastructure.

SecurityWeek · 18m agoIndustry

T-Mobile rewards points expiry texts are a phishing scam

Malwarebytes tracks an SMS phishing campaign, active since May 2026, impersonating T-Mobile rewards expiry with 1,000+ templates and 81 rotating domains to lure victims.

Malwarebytes Labs has monitored a large smishing campaign since early May 2026 that falsely claims recipients' T-Mobile Rewards points are expiring, using invented balances like 18,400 points and imminent deadlines to create urgency. Researchers identified more than 1,000 semantically similar message templates (199 scoring at least 0.95 similarity) that vary only in salutation, headline, expiry date, and point balance. The links resolve to rotating domains such as t-mobile.biktpw[.]top, with at least 81 short-lived domains observed over four months, pushing victims to fake redemption pages where they may enter credentials or payment details. Activity peaked in two large spikes and has since declined, though messages are still circulating.

Malwarebytes Labs · 2h agoPhishing & fraud in the wild

Why APAC Enterprises Need Real-Time Threat Intelligence as Singapore, Malaysia, and Thailand Tighten Cyber Compliance in 2026

Singapore, Malaysia, and Thailand all tightened cyber compliance in 2026, mandating continuous monitoring and rapid incident reporting for critical infrastructure.

Singapore's CSA issued the Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026, adding board cyber-resilience duties, annual training, and controls on Interconnected Systems, with most obligations effective by 29 July 2027. Malaysia's Cyber Security Act 2024 requires NACSA-licensed providers, audits, and fast incident notification, with fines up to RM500,000 and up to ten years' imprisonment. Thailand's NCSA cloud security standard has been enforced since 10 September 2026, with a Website Security Standard effective 16 September 2026. The vendor article argues detection speed has become a compliance metric driving demand for real-time threat intelligence.

Cyble · 3h agoPolicy & legal

The skb that wasn't freed - the Fragnesia primitive via Open vSwitch

Doyensec details CVE-2026-90049 in Open vSwitch, enabling deterministic Linux kernel local privilege escalation on default major distribution installs.

Doyensec reports that the Open vSwitch datapath strips the SKBFL_SHARED_FRAG flag from packets it is still forwarding, allowing an in-place decrypt to write attacker-chosen bytes into root-owned page cache — a Dirty COW-class primitive that re-opens the Fragnesia bug family. The issues are tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977, and were reported to the kernel security team with fixes coordinated alongside OVS maintainers. A deterministic local privilege escalation works on default installs of Arch, Fedora, Debian, Amazon Linux, and RHEL where unprivileged user namespaces and openvswitch auto-loading are enabled; the fix landed in mainline and shipped in stable on 09/04/2026. The write technique builds on the earlier Fragnesia and Dirty Frag bugs, including CVE-2026-43284 and CVE-2026-43500.

Lobsters · security · 4h agoVulnerabilityCVE-2026-90049CVE-2026-89487CVE-2026-80977+2 CVEs

Top 10 Best Microsoft Azure Security Tools in 2026

An editorial roundup of the ten best Azure security tools in 2026 names Defender for Cloud the native floor, with Wiz, Orca, and Prisma Cloud leading third-party options.

The brief reviews ten Azure security tools, positioning Microsoft Defender for Cloud's free foundational tier and published per-resource plans as the rational starting point for every Azure estate. Wiz and Orca are shortlisted for agentless attack-path correlation, Prisma Cloud for multicloud breadth, CrowdStrike for runtime protection, and Tenable for CIEM depth with Entra permission analytics. The piece emphasizes Azure's tight identity-infrastructure coupling via Entra ID as both an operational advantage and its most critical risk surface. Scoring is editorial, not lab-tested, with pricing compared by model only.

Cyber Security News · 4h agoIndustry

Adversary simulation: what you need to know

UK NCSC publishes guidance on adversary simulation, comparing full spectrum and assumed breach approaches across prerequisites, testing, and reporting phases.

NCSC guidance describes two adversary simulation approaches: full spectrum, starting outside the network with an end-to-end attack, and assumed breach, starting from an internal foothold. The preferred methodology spans three phases - prerequisites (scoping, passive reconnaissance, preparation), testing (active reconnaissance, initial access, internal phase, cleanup), and reporting. The document distinguishes adversary simulation from penetration testing and stresses customer-defined objectives and minimal information sharing.

NCSC UKupdated · 4h agofirst · 4h agoAdvisory 2 sources

CCC invites all model citizens to 40C3new

The Chaos Computer Club opened its Call for Participation for 40C3, running 27-30 December 2026 in Hamburg under the motto 'Model Citizens'.

The Chaos Computer Club will hold the 40th Chaos Communication Congress from 27 to 30 December 2026 at the Hamburg exhibition halls, its second year at the new venue. The Call for Participation opened for talks, art, punk performances, and music, alongside calls for volunteers and helpers. The congress is billed as Europe's largest non-commercial hacker conference, organized by volunteers and drawing over 16,000 participants.

Hacker News · security · 5h agoIndustryHN 42↑ · 1 comments

Chosen Brick, Iran’s Surveillance Malware

UK, US, and Dutch agencies warn Iranian CHOSEN BRICK malware targets dissidents and journalists via Telegram, harvesting contacts, emails, and messages since 2025.

The UK NCSC, FBI, and Dutch AIVD jointly attributed the CHOSEN BRICK Windows malware family to Iranian intelligence services, used since at least 2025 against dissidents, journalists, and activists worldwide, including in the UK, US, and Netherlands. Operators build rapport over WhatsApp or Telegram, impersonating known contacts or platform support, then deliver lures disguised as installers for Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, or KeePass, or fake MRI results. The malware persists via registry Run keys, adds Microsoft Defender exclusions, and uses per-victim Telegram bot IDs for C2, with newer versions adding HTTPS or SOCKS5 proxies. Some victims' data appeared on pro-Iranian leak sites, raising harassment and physical-safety risks.

Security Affairsupdated · 25m agofirst · 5h agoMalware in the wild 8 sources

BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacks

French-speaking crew BlackHatSect0r disabled AI agent safety controls to automate scanning, credential harvesting, and vishing, exposing 16,834 stolen credentials.

Socradar researchers analyzed the exposed infrastructure of a French-speaking crew called BlackHatSect0r && DXQRTXX, which ran a Nous Research Hermes agent on a DeepSeek model with safety controls removed via HERMES_DISABLE_SAFETY=1. A custom Go-based C2 platform, DXSCAN, was exposed on port 8080 with over 200 secret-detection patterns, a vault of 16,834 harvested credentials, and scanning activity queuing 2.75 million domains and reaching more than 726,000 hosts. The kit also held a database of roughly 450,000 French telecom subscriber records used to prepare vishing lures impersonating Société Générale, plus JWT-forging tooling for a cryptocurrency exchange. Most confirmed compromises relied on exposed secrets and cloud misconfiguration rather than novel exploits; the one cited vulnerability, CVE-2026-42530, is an NGINX HTTP/3 QPACK use-after-free fixed in version 1.31.2.

GBHackersupdated · 3h agofirst · 6h agoThreat actor in the wild 4 sourcesCVE-2026-42530

The AI security question leaders should be asking instead

Gremlin security officer Frederic Bull argues AI has eroded the attacker-defender skill asymmetry while least-privilege controls remain essential for securing AI agents.

In a Help Net Security interview, Gremlin Security Officer Frederic Bull says AI has narrowed the expertise gap between attackers and defenders, enabling faster exploit discovery even by less-skilled actors. His team processed roughly nine times more vulnerabilities in the past year with unchanged staffing using LLM-based tooling, cutting time-to-remediate by about 5%. He argues least privilege, session-based RBAC via OIDC/OBO, and human-in-the-loop oversight remain the bedrock defenses for AI agents, and that hiring should favor engineers able to catch confidently wrong AI output.

Help Net Security · 7h agoIndustry

Flock cameras are riddled with security vulnerabilities and hardcoded creds

Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.

DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.

Hacker News · securityupdated · 3h agofirst · 14h agoVulnerability 4 sourcesHN 35↑ · 3 commentsCVE-2021-1905CVE-2018-9568

CISA decides weekly vulnerability bulletin isn't necessary anymore

CISA will discontinue its weekly vulnerability bulletin on September 28, pushing users toward KEV, alerts, and CVE data under risk-based prioritization.

CISA announced its weekly vulnerability bulletin will stop on Monday, September 28, as part of a shift from static CVSS severity scores to a modern, risk-based approach detailed in a June Binding Operational Directive. The directive prioritizes federal remediation based on exposure, exploitation evidence, control granted by exploitation, and whether exploitation can be automated. CISA directs bulletin subscribers to rely instead on its Known Exploited Vulnerabilities catalog, cybersecurity alerts and advisories, and the CVE catalog, requiring users to enable those subscriptions in GovDelivery or Granicus to avoid missing critical notices.

The Register · Security · 16h agoPolicy & legal

BambooToken: The Malware That Speaks MQTT to Stay Under the Radar

Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.

Lumen Black Lotus Labs identified BambooToken, a multiplatform malware family that exchanges commands through MQTT brokers so infected hosts never contact the C2 server directly, active from at least February 2023 through July 2026. The Windows variant sideloads via Tendyron's OnKey hardware-token software used in Chinese banking and government, or impersonates Kingsoft Office, without either vendor's signing certificate being compromised; a Linux build appeared by December 2025 with shell, file transfer, and system information commands. Victims include MikroTik and DrayTek routers in Singapore, Cambodia, and Vietnam reached after internet-wide SNMP scanning, and Lumen cannot attribute the family to any known actor.

Security Affairs · 16h agoMalware in the wild1

Scans Targeting Hospitality Applications, (Wed, Sep 16th)

Scans from a bulletproof-hosting IP target the abandoned PIAF-HMS hospitality application, which contains numerous unpatched SQL injection flaws.

SANS ISC observed requests for /PIAF-HMS/ using the unusual user-agent Farez-Sorter/1.0, along with paths like /admin/, /ucp/, /hms/, and /hotel/, starting September 15 from the single source IP 94.102.49.125 (IP Volume, AS202425, a bulletproof hoster). PIAF-HMS, a PBX in a Flash Hospitality Management System, was last updated 10 years ago and a SQL injection vulnerability was reported recently; the code shows many injection flaws and lacks authentication and access control. The handler notes hotels are soft targets for personal data theft and guest MitM attacks, and asks for community insight on the campaign.

SANS Internet Storm Center · 18h agoExploit / PoC

Data Broker Radaris Loses Domains in Privacy Fight

A New Jersey court ordered people-search broker Radaris to transfer radaris.com and a dozen related domains to Atlas Data Privacy over Daniel's Law violations.

On August 26, a New Jersey judge found Radaris failed to defend claims that it violated Daniel's Law, which protects law enforcement officials' personal data and imposes $1,000 fines per ignored removal request. The court ordered radaris.com and more than a dozen related broker domains transferred to plaintiff Atlas Data Privacy Corp. Radaris had delayed litigation using offshore shell entities and previously used a fictitious CEO named 'Gary Norden' in investor-facing press releases.

Krebs on Security · 19h agoPolicy & legal

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.

Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.

The Hacker Newsupdated · 5h agofirst · 21h agoThreat actor in the wild 5 sourcesCVE-2020-0688CVE-2019-0708CVE-2021-26855+1 CVEs2