45
30
50
45
30
30
45
30
45
30
Grand Theft Auto VI hype leads to malware
Fake GTA6 ISO downloads spread via SEO poisoning, torrents, and forums deliver NJRAT, DCRAT, an infostealer, and wiper ransomware.
Huntress analyzed a malicious ISO masquerading as a leaked Grand Theft Auto VI build; there is no official GTA6 demo or leaked playable copy. The fake gta6installer.exe shows a Russian 'license' message asking victims to email the attacker if the crack fails, then drops GTA6-branded files into %TEMP%. It installs multiple repurposed NJRAT copies (2023-era files) connecting to AWS-hosted IPs 35.157.111.131, 3.68.56.232, 3.67.15.169 and an ngrok tunnel, plus DCRAT communicating with a0700877.xsph.ru (141.8.197.42). The bundle also includes an infostealer and ransomware used as a wiper, in what appears to be an opportunistic, everything-at-once campaign.
45
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.
Cisco Talos detailed UAT-10147, a Chinese-speaking cybercrime group conducting SEO fraud and data theft against Windows and Linux web servers in education, media, technology, and gaming sectors, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The actor exploits publicly disclosed vulnerabilities for initial access, including Zimbra (CVE-2022-27925) and Alibaba Nacos (CVE-2021-29441), and abuses Linux LPE flaws like CVE-2022-0847 and CVE-2021-3156 for root. Its toolset includes AI-assisted frameworks DeepAudit and PentestGPT, plus implants such as SPECTRE, BadIIS, Quasar RAT, Gh0stCringe, and Noodle RAT. An exposed directory contained a target list of roughly 170,000 URLs, with the US, India, UK, Germany, and Netherlands as top destinations.
55
50,000 Stripe Secrets Leaked in Public Code
Over 50,000 Stripe merchant API keys leaked via public code and logs; 659 merchant accounts' data offered on trading forum.
Ransomnews researchers identified over 50,000 unique Stripe merchant API keys exposed in public GitHub repositories, GitHub Actions logs, and misconfigured web servers. A dataset on a data-trading forum dated August 18, 2026 contained live keys for 659 merchant accounts plus roughly 35 GB of customer and payment data. Researchers demonstrated a leaked key enabled accessing customer lists, creating fraudulent payment links, and making test charges within 17 hours. Stripe itself was not compromised; over 3,000 misconfigured web servers revealed Stripe-related strings, with about 12% containing working keys.
60
30
45
30
30
Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers
Huntress found fake GTA 6 installer ISOs spreading NJRAT, DCRAT, Mercurial Grabber and a Chaos ransomware wiper that steals credentials.
Huntress analyzed a malicious ISO disguised as a leaked GTA 6 build, distributed via SEO poisoning, torrent sites, and social media, with some images exceeding 100 GB and padded with junk data. The installer stages game-named executables in %TEMP% and deploys NJRAT, DCRAT, and the Mercurial Grabber infostealer, harvesting browser passwords, Discord tokens, Roblox and Minecraft session data, Windows product keys, and cryptocurrency details, with exfiltration via a Discord webhook. A Chaos ransomware variant launched through gta6.exe deletes shadow copies, disables Windows recovery, encrypts files up to 200 MB with AES, and overwrites larger files, effectively acting as a wiper attributed to the 'ASHA Hacker Team'. A Visual Basic script displays a fake 'license not found' error to conceal the already-installed payloads.
47
AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments
Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.
Unit 42's automated BOLA detection tool, built on generative AI, uncovered 15 broken object-level authorization flaws in the open-source scheduling application Easy!Appointments, tracked as CVE-2023-3285 through CVE-2023-3290 and CVE-2023-38047 through CVE-2023-38055. Nine flaws scored CVSS 9.9, letting logged-in customers view or manipulate appointments and accounts of providers and admins, including creating admin users for privilege escalation. The maintainers patched all issues in version 1.5.0. The same tool previously found a BOLA in Grafana (CVE-2024-1313).
48
30
30
30
30
45
30
30
30
30
30
30
30
30
30
30
30
30
45
30
30
30