ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “PAYONE”

31 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllRansomware 4Data breach 2Phishing & fraud 2Malware 1Threat actor 1Vulnerability 1
SeverityAllcritical 2high 5medium 2low 2info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

The 12 Best Managed Detection & Response (MDR) Services, Compared and Priced

Buyer's guide compares 12 MDR services, naming Huntress best value, CrowdStrike Falcon Complete for response authority and Expel for transparency.

The article compares 12 managed detection and response providers across response authority, tool bundling and pricing, highlighting Huntress for published SMB pricing and CrowdStrike Falcon Complete for unilateral containment. It stresses the consolidation landscape: Sophos completed its acquisition of Secureworks in February 2025 for approximately $859 million, and Arctic Wolf closed its purchase of BlackBerry's Cylance endpoint assets the same month. It also warns that only full-response contract tiers isolate hosts and kill processes, while lower tiers only triage or guide.

GBHackersupdated · 8d agofirst · 8d agoIndustry 3 sources1

Rhysida Ransomware Group Targets Berlin Government Ahead of Vote

Rhysida ransomware hit Berlin's state government weeks before the September 20 election, claiming 5.79 TB stolen; officials refused the ransom.

Berlin's government confirmed an August cyberattack on its administrative network, with data exfiltrated between August 7 and August 12 and departments isolated on August 17. The Rhysida group claimed responsibility on August 28, alleging theft of 5.79 TB and 1.44 million files including personal data on 12,076 individuals, payroll files, plaintext credentials, and vulnerability analyses of Berlin's water supply. Officials said election systems were not affected and refused to pay; Rhysida has claimed roughly 280 victims since 2023, entering via VPNs without MFA, Zerologon, or phishing.

Security Affairs · 19d agoRansomware in the wild

Employee benefits platform Paylogix says hackers stole financial and health

Akira ransomware gang stole financial, health, and passport data on tens of thousands of people from benefits administrator Paylogix in November.

Hackers stole files from Paylogix's network between November 13 and 18, exposing Social Security numbers, financial accounts, health insurance information, medical data, passport numbers, and taxpayer IDs. State breach notices report at least 67,789 affected people, including 64,383 in South Carolina. Paylogix did not name the attackers but appeared on the Akira ransomware gang's leak site in January. The company notified federal law enforcement, is cooperating with an investigation, and faces organizing class action lawsuits.

The Record · 22d agoData breach in the wild

Berlin Ransomware Leak Exposes State Secrets

Rhysida ransomware leaked 5.79 TB of Berlin state government data on the dark web after the city refused a 30 Bitcoin ransom.

The Rhysida ransomware group published 5.79 TB (about 1.44 million files) of Berlin state administration data on its leak site on August 28, 2026, after the city-state refused a 30 Bitcoin ransom. The claimed dataset includes personal data on 12,076 individuals, over 5,000 personnel files, payroll records, plaintext credentials for systems like PAYONE and Z_ADMIN, Bundesrat committee protocols, and documents allegedly containing state secrets. Leaked material reportedly covers national defense emergency plans, federal secret communication channels, a CBRN threat planning folder, and vulnerability analyses of Berlin's water supply. Berlin's government has activated a central crisis unit to review the leaked data and notify affected citizens and businesses.

Security Affairs · 10d agoRansomware

The 12 Best Endpoint Detection & Response (EDR) Solutions, Compared and Priced

An editorial scorecard ranks 12 EDR platforms, with CrowdStrike and SentinelOne tied at 8.6/10 and telemetry retention identified as the hidden cost driver.

An editorial comparison scores twelve EDR platforms on detection, response, analyst burden, pricing transparency, and coverage. CrowdStrike and SentinelOne tie at 8.6/10, with Microsoft Defender for Endpoint close behind at 8.5 and described as effectively free in Microsoft 365 E5 estates. The guide argues that telemetry retention, not per-endpoint price, drives real cost, with fully-priced quotes frequently diverging 2-3x from headline rates. Managed detection offerings, including Cynet's bundled 24/7 SOC, factor into the buyer-fit rankings.

GBHackers · 8d agoIndustry 2 sources

Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS

New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.

Panzer, a ransomware-as-a-service operation that surfaced August 5, listed a kitchen manufacturer in Treviso (Doimo Cucine) and a telecommunications engineering firm in Catanzaro (NTE Italia) among alleged victims, claiming 30 GB and 16 GB of stolen data respectively. The group advertises encryptors for Windows, Linux, FreeBSD, and VMware ESXi, a Tox-based affiliate recruitment process with screening, an affiliate dashboard, and an 80/20 revenue split. Neither victim had publicly confirmed the incidents when researcher Andrea Fortuna's report was published, and the group's first access method and payload have not been independently analyzed. Panzer posted victims across 11 countries as claimed Italian ransomware incidents reached 212 by September 6, already above 2025's full-year total of 169.

Cyber Security News · 9d agoRansomware in the wild

Suno launches v6 music models built with Warner, BMG, and Believe

Suno launches v6, v6-wild, and free v6-mini music models co-developed with Warner Music Group, BMG, and Believe, retiring all older models.

Suno's flagship v6 serves Pro and Premier subscribers, v6-wild targets experimentation, and v6-mini is free; all three understand vocals, instrumentation, structure, mood, and multimodal inputs, with text-based editing of individual song sections. The models were built with Warner Music Group, BMG, and Believe following Warner's November 2025 licensing settlement, while Universal and Sony continue litigating and a Munich court found v3.5 and v4 infringed six works. Suno reports more than 100 million users, over two million paying subscribers, and $300 million ARR after raising $400 million at a $5.4 billion valuation in June.

The Decoder · 7d agoModel release

Retail Cybersecurity in ANZ: Five Decisions That Keep Trading

Huntress outlines five key cybersecurity decisions for ANZ retail businesses to secure identities and maintain trading continuity against ransomware.

Huntress published guidance aimed at retailers in Australia and New Zealand, describing five decisions that help retail businesses stay trading through cyber incidents. The piece covers identity security, dependency management, and ransomware resilience. It is guidance content rather than a report of a specific incident.

Huntress · 21d agoIndustry

FST Pay: Deterministic Safety-Gated Architecture for Youth Digital Payments

FST Pay proposes a deterministic safety-gated architecture for teen digital payments, pairing invariant authorization checks with decoupled post-settlement AI explanations.

Researchers propose FST Pay, a formal architecture for adolescent digital payments on rails like UPI that applies six deterministic invariant checks (spending limits, guardian co-sign policies, amount thresholds, merchant category codes, temporal intervals, hardware integrity) to classify transactions as ALLOW, REVIEW, or BLOCK. High-risk transactions trigger an asynchronous guardian co-sign workflow. Generative AI is restricted to post-settlement natural-language insights and holds no mutation privileges over the ledger, avoiding non-determinism on the real-time authorization path.

arXiv cs.CR · 7d agoResearch

A $25 template helped scammers build hundreds of phantom bank domains

Allure Security researchers found 838 live phantom bank sites sharing a $25 template, built to lend credibility to investment and romance scams.

Allure Security researchers discovered roughly 2,200 domains presenting invented banks, of which 1,095 returned working pages and 838 contained a shared phrase. 97% of those retained parts of the $25 Cuex front-end template and 94% ran Laravel, with a misspelled 'Curreny Charts' heading on 90% of sites. The sites presented login pages, session cookies, and anti-forgery tokens consistent with a fraud model where scam contacts direct victims to fake financial portals. A leftover 'Remedy bank' title and form submission to remedycodes[.]site linked some sites to already-flagged fraud infrastructure.

Help Net Security · 27d agoPhishing & fraud

12 Best Ransomware Protection Solutions Compared (2026): Features & Pricing

GBHackers compares 12 ransomware protection solutions for 2026, recommending layered stacks of EDR prevention, managed detection, containment, and guaranteed recovery.

The editorial comparison argues no single product stops ransomware, recommending a layered strategy across prevention, early detection, blast-radius containment, and clean recovery. CrowdStrike and SentinelOne are named best-in-class EDR, Huntress and Sophos MDR for managed 24/7 coverage, ColorTokens for microsegmentation containment, and Rubrik and Acronis for guaranteed recovery. The guide notes ransomware is now professionalized with double extortion and encryption sprints measured in minutes.

GBHackersupdated · 1d agofirst · 6d agoIndustry 8 sources1

Securing Your Business: The Vital Role of Cyber Insurance | Huntress

Huntress explains cyber insurance coverage types, insurer security requirements, and the shift toward documented evidence of controls.

Huntress outlines first-party and third-party cyber insurance coverage, including business interruption, data recovery, extortion, privacy liability, and regulatory fines. Insurers now commonly require EDR, MFA, security awareness training, patching, tested backups, least-privilege access, and incident response plans. With ransomware accounting for 91% of insurance losses in H1 2025 and average US breach costs at $10.22 million, underwriters increasingly demand evidence packs rather than self-attestation.

Huntress · 15d agoIndustry

What Is Account Takeover Fraud? A Comprehensive Guide | Huntress

Huntress published an educational guide explaining account takeover (ATO) fraud, how attackers steal credentials, and steps to detect and prevent it.

Huntress released a comprehensive guide on account takeover fraud, which occurs when attackers steal login credentials to gain access to victim accounts. The article is educational rather than incident reporting, covering detection signals and prevention measures such as credential protection. No specific breach, actor, or vulnerability is described.

Huntress · 26d agoPhishing & fraud

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.

Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.

Cloudflare Blog · 17h agoMalware in the wild

Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting

DoJ seized domains of Chinese espionage botnet platforms QScan and QTRouter, run by private firm QTFY for MSS and PLA targeting.

The US Department of Justice disrupted QScan, a distributed vulnerability scanning system with nearly a decade of internet scanning data, and QTRouter, a covert communications platform routing traffic through compromised IoT devices, operated by QTFY under Chinese company Nanjing Xinjiuwei Network Technology. FBI and NSA advisories say QTFY customers include China's Ministry of State Security and the People's Liberation Army, targeting federal agencies, the US Senate, hospitals, telecoms and financial institutions. This is the third Chinese state-backed botnet disrupted since December 2023, following the KV botnet (Volt Typhoon) and Raptor Train (Flax Typhoon), and a sister network, JDY, has more than doubled since the KV disruption. Separately, the Qilin ransomware group claimed a breach of the ATF's CALEA system, briefly publishing 6.3 GB of case folders and forensic data.

Risky Business News · 14d agoThreat actor1

Signing the Transaction but Not the Decision: Whisper Attacks and a Binding Defense for AP2

Research shows AP2 agent-payment signatures can be manipulated into valid but wrong carts; proposed A-VIP defense binds signed intent to purchases.

A study demonstrates Whisper attacks on the AP2 agent payment protocol, where ordinary product-description text steers shopping agents into carts that pass every cryptographic check but no longer match user intent. Using Gemini Flash-Lite models specified by AP2's default sample agents, three attacks succeeded at 90%, 56%, and 73.3%, with the vulnerability spanning seventeen Google models, three agent frameworks, cross-vendor anchors, and Google's consumer assistant. The proposed A-VIP defense treats signed intent as a capability grant, binding credential lookups to sessions and cart lines to seen listings, blocking the first two attacks with zero false positives while surfacing unauthorized spending. The authors release A-VIP code, machine-checked invariants, and AP2-WhisperBench with 1,544 evaluation scenarios.

arXiv cs.CRupdated · 6d agofirst · 6d agoAI safety & security 2 sources1· 1 read

The State of Ransomware Q2 2026

Check Point's Q2 2026 ransomware report finds dominant RaaS operations still leading while the previously concentrated ransomware landscape starts to shift.

Check Point Research published its State of Ransomware Q2 2026 report, examining the ransomware threat landscape. Over the past year the ecosystem was defined by concentration, with a handful of dominant Ransomware-as-a-Service operations causing most damage while the pool of active groups shrank. The new report indicates this picture is beginning to change, although the leading operations are still winning the majority of activity.

Check Point Research · Aug 13, 2026Ransomware

Healthcare cyberattacks hit pacemakers and millions of patient records

McKesson confirms a data breach as ShinyHunters demands $55.2M amid healthcare cyberattacks affecting millions of patient records and pacemaker devices.

McKesson, one of the largest US healthcare distribution companies, has admitted a data breach. The ShinyHunters group is demanding a $55.2M extortion payment. The Register reports broader healthcare cyberattacks tied to the story, affecting millions of patient records and involving medical devices such as pacemakers. Details on the exact number of compromised records have not been confirmed.

The Register · Security · 16d agoData breach in the wild

Third-Party Script Security: How Tags, Pixels, and Embeds Can Put Websites at Risk

Sucuri details how third-party tags, pixels, and embeds expand website attack surface, letting compromised vendors read data and alter pages.

The article explains that third-party scripts used for analytics, ads, chat, payments, and video can read page content, collect visitor data, and change what users see. A compromise of the vendor, account, or integration configuration can affect every page loading the script. It recommends inventorying scripts, understanding their purpose and ownership, and detecting unexpected changes rather than removing useful integrations.

Sucuri Blog · 23d agoResearch

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog · 13d agoThreat actor in the wild1

Daisy-Chaining Trust: Investigating Faronics Deploy Abuse

Actors abuse Faronics Deploy in phishing campaigns to run PowerShell and deploy ScreenConnect while evading detection with trusted tools.

Huntress investigated attacks in which threat actors abuse Faronics Deploy, a legitimate remote management tool, as part of phishing-driven intrusions. The chain uses the trusted deployment tool to launch PowerShell commands and deploy ScreenConnect for remote access. Leveraging signed, legitimate software helps the actors blend in and evade detection.

Huntress · 16d agoThreat actor in the wild

Hackers Frequently Target Healthcare and Finance Orgs

A new Huntress survey indicates threat actors frequently target healthcare organizations and banks because of the highly personal data they hold.

Huntress published survey findings indicating that healthcare organizations and banks are frequent targets for threat actors. The piece attributes this to the highly personal information these sectors handle. The article is framed around cyberattack readiness rather than a specific incident.

Huntress · 15d agoIndustry

Operational Resilience: IT Security Risks with Reduced Staffing | Huntress

Huntress blog advises security teams on managing change, risk, and incident response during reduced-staffing holiday periods.

The article discusses how holiday-period staffing reductions change organizational risk profiles around change management, monitoring, and incident response capability. It argues against blanket change freezes when critical vulnerabilities with high exploitation probability demand patching, and stresses retaining decision-making authority, escalation paths, and recovery knowledge. It concludes by promoting Huntress Managed Response, which lets the Huntress SOC take predefined containment actions on confirmed threats without customer intervention.

Huntress · 1d agoIndustry

Fideo Lens reveals connections across identities, accounts and devices

Fideo Intelligence launched Fideo Lens, an investigative platform mapping relationships across identities, accounts, devices and behaviors for fraud and AML teams.

Fideo Intelligence introduced Fideo Lens, an investigative intelligence platform that helps fraud, financial crime, and AML teams discover hidden relationships among identities, accounts, devices, and behaviors. The tool draws on the company's Identity Fraud Intelligence Network (iFIN) and offers interactive relationship mapping, entity resolution, explainable reason codes, and continuously refreshed data. It is designed to complement existing fraud, AML, and case management systems rather than replace them.

Help Net Security · 23d agoTools

Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.

Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.

Huntress · 15d agoPhishing & fraud in the wild1

Medusa ransomware gang has hit over 500 organizations, CISA warns

FBI, CISA, and HHS warn Medusa ransomware has hit over 500 organizations across critical infrastructure since June 2021, using phishing and unpatched flaws.

An updated joint advisory from CISA, FBI, and HHS states Medusa ransomware has affected more than 500 organizations, spanning healthcare, defense, manufacturing, government, IT, financial services, education, insurance, and legal sectors. Since early 2023 Medusa has operated a ransomware-as-a-service affiliate model and buys access from initial access brokers for $100 to $1 million. Affiliates gain entry via phishing and unpatched internet-facing software, exploiting newly disclosed flaws in ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust within 24 hours. The group runs double extortion, giving victims 48 hours before leak-site publication, with $10,000 in cryptocurrency buying a one-day delay.

Help Net Security · 29d agoRansomware in the wild

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.

Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.

The Hacker News · 12d agoThreat actor in the wild

Android car head units infected with proxy botnet malware through built-in software updaters

Kaspersky found malware delivered via car head unit updaters, attributed to the MoYu Group's BADBOX operation, recruiting devices into a proxy botnet.

Kaspersky discovered malware delivered through the built-in TWCore system updater in Android-based car head units running DoFun infotainment firmware, turning devices into ad-fraud tools and nodes in a proxy botnet. The three-stage infection chain (JarService dropper, loader, and final payload supporting nine commands) installs the zhima reverse-proxy module, which Nokia's Deepfield team independently found on TV set-top boxes. Kaspersky attributes the operation with high confidence to the MoYu Group, linked to the BADBOX supply-chain botnet first identified by HUMAN Security in 2023. DoFun closed the gap after Kaspersky's responsible disclosure.

Help Net Security · 24d agoMalware in the wild

Pharmaceutical giant McKesson warns of 'service degradation' following cyberattack

Pharmaceutical giant McKesson disclosed a cyberattack on a third-party application that exfiltrated customer data, claimed by ShinyHunters.

McKesson reported a cybersecurity incident involving an unnamed third-party application, with attackers exfiltrating data tied to its oncology and surgical business units. The company filed with the SEC, offered credit monitoring, and said it had received reasonable assurance the attackers were no longer inside its systems. The ShinyHunters group claimed responsibility and threatened leaks; McKesson reported $106 billion in revenue last quarter and distributes about one-third of North American prescriptions.

The Record · 17d agoRansomware in the wild

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.

Microsoft warned of a human-operated campaign abusing Teams external collaboration to impersonate IT help desk staff, deploy malicious MSI packages staging Node.js runtimes and obfuscated JavaScript implants, then pivot to domain controllers over WinRM. Unit 42 documented the Spring Ring vishing operation targeting over 150 employees across at least 10 companies using 26 attacker identities, including an NTLM relay variant against domain controllers. Sophos reported The Gentlemen ransomware (Gold Sherwood) reached 683 total victims by end of July 2026, adding 169 in July, with a playbook using BYOVD-based EDR killers and backup tampering. Group-IB found the Outsider phishing-as-a-service platform created 700+ new phishing pages within a month despite law enforcement takedowns.

The Hacker News · 13d agoThreat actor in the wild1

Guide to Cybersecurity Budget Planning: How Much + How To | Huntress

Huntress publishes guidance on planning cybersecurity budgets and getting more value from security spend.

Huntress released a guide aimed at helping businesses plan their cybersecurity budgets without overspending. The content is promotional guidance on prioritizing security spend rather than incident reporting. No vulnerabilities, incidents, or threat activity are described.

Huntress · Aug 12, 2026Industry