57
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates
Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.
On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.
65
57
42
47
42
42
57
42
Chinese AI firms are siphoning capabilities from American models, CISA warns
CISA, NSA and FBI warn Chinese AI firms including DeepSeek and Moonshot AI extracted billions of tokens from US frontier models via distillation campaigns.
A joint CISA, NSA and FBI advisory says China-based firms including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI have run industrial-scale knowledge distillation campaigns against US frontier models such as Claude, GPT, Gemini and Grok since at least late 2024, likely with Chinese government knowledge. The campaigns used gray-market API proxies called transfer stations, premium account pools and traffic routing to bypass restrictions, evade safeguards and exfiltrate billions of tokens used to train models like DeepSeek R1/V3 and Kimi. The agencies challenge DeepSeek's reported $5.6 million training cost and recommend identity verification, usage monitoring, response variation, differential privacy and indicator sharing as defenses.
70
42
42
42
42
57
57
57
57
42
57
42
57
42
57
42
57
42
57
42
Hackers Deploy Agentic AI to Automate Exploitation and Mass Credential Harvesting
Google GTIG documents a financially motivated actor using a multi-agent AI framework to automate credential harvesting, compromising over 23,800 secrets within hours.
Google Threat Intelligence Group (GTIG) documented a financially motivated actor that compromised an unnamed organization's cloud infrastructure and used a multi-agent AI framework to automate vulnerability scanning, credential harvesting, troubleshooting, and IP rotation. The operation went from planning to mass credential compromise in under six hours, harvesting more than 23,800 secrets including cloud and AI-service API keys via an exposed C2 dashboard called 'Recon'. The actor directed specialized agents using an AI coding chatbot and Markdown instruction files such as AGENTS.KNOWLEDGE.md and agentic_vuln_research.md. Google has not observed fully autonomous zero-day exploitation; the shift automates labor-intensive tasks like reconnaissance, account validation, and infrastructure management, sharply shrinking detection windows.
70
42
42
57
57
GitHub Pays $100,000 Bounty for Critical RCE Flaw in Git Push Pipeline
GitHub paid Saif Ghani $100,000 for CVE-2026-3854, a critical unauthenticated RCE in its Git push pipeline allowing command execution on backend infrastructure.
GitHub awarded researcher Saif Ghani $100,000, its largest publicly disclosed bug bounty, for CVE-2026-3854, a critical unauthenticated remote code execution flaw in its Git push processing pipeline. A crafted repository URL could trigger arbitrary command execution on backend infrastructure, threatening source code integrity, repository secrets, and software supply chains. GitHub deployed mitigations and completed a patch rollout through coordinated disclosure before technical details became public.
58
42
42
42
57
Hackers Leverage Claude to Exfiltrate Secrets from 1.8M Android apps
ShinyHunters-linked operators used Claude to scan 1.8M Android apps for hardcoded secrets, fueling intrusions across 40+ tenants.
Anthropic's September 2026 threat intelligence report describes a French-speaking operator (aliases MeowSHA, frkoo, blazespider) tied to ShinyHunters who ran 10 AWS EC2 workers and used Claude to decompile and scan 1.8 million Android APKs for hardcoded secrets with TruffleHog. Verified credentials were sorted into 100+ Telegram channels and paired with GitHub PAT harvesting, providing initial access for confirmed intrusions. In one supply-chain incident the actors extracted data from roughly 200 downstream customer organizations and dumped 2,100+ Azure AD token sets across 40+ corporate tenants in about 34 hours using AI agents. Anthropic banned tied accounts and stressed its own systems were not compromised.
72