ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “AI Security Institute”

2 stories in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 2AI industry 2AI safety & security 2AI policy 1Phishing & fraud 1Threat actor 1
SeverityAllcritical 0high 1medium 2low 0info 6

One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude

Researchers showed a single browser extension could hijack AI agents in Chrome, Edge, Comet, Opera Neon and Claude in Chrome, earning $20,000 in bounties.

Forever Security demonstrated that a browser extension with two common permissions could seize the trusted page controlling built-in AI assistants in five Chromium-based products and drive the agent, read local files, or access the camera. Chrome's flaw was fixed as CVE-2026-0628 (CVSS 8.8) in Chrome 143.0.7499.192, and Microsoft fixed CVE-2026-55945 (CVSS 4.2) in Edge 150.0.4078.48. Perplexity Comet was the worst case: a hijacked agent could read any file, leak browsing history, take screenshots, and act as the user via an unsecured test subdomain. All attacks require a malicious extension already installed; no in-the-wild exploitation or KEV listing was reported as of September 16, 2026.

The Hacker Newsupdated · 8h agofirst · 13h agoAI safety & security 3 sourcesCVE-2026-0628CVE-2026-55945

China-Aligned Hackers Hide PeckBirdy Malware C2 Inside Casino and Adult Websites

Infoblox found China-aligned actors hiding PeckBirdy malware C2 inside fake Chinese-language casino and adult websites, evading security scans via service workers and WebSockets.

Infoblox reported that China-aligned actors behind the PeckBirdy JScript C2 framework conceal command-and-control inside low-quality Chinese-language casino and adult websites, extending Trend Micro's earlier findings that tied the framework to backdoors including MKDOOR and HOLODONUT. One decoy, vip311[.]cc, embedded JavaScript linked to cache-mcp[.]com and registered a service worker connecting to mcp-source[.]online over WebSocket; at publication mcp-source[.]online had zero VirusTotal detections, showing how the layered design evades conventional scanning. The campaign has been active since at least 2023, and just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with education, IT, banking and government among observed sectors.

GBHackersupdated · 15h agofirst · 18h agoThreat actor in the wild 2 sources