Search: “App Store Connect”

11 stories in the last 24h

Anthropic exposed a network of roughly 28 AI-driven dating apps using autonomous personas and gig workers to defraud paying users.

Anthropic threat intelligence uncovered a fraud network of around 28 dating apps after a prepaid account sent over 100,000 Claude API requests daily, with most chats run by autonomous AI personas and no human agent. Researchers Matthew Gore-Kormanik and Anthropic's Chris Cronbaugh documented apps including Dora, Romi, and Doni, which monetize conversations via coins; gig workers were hired only to pass liveness checks and select pregenerated replies. An operations manual written in Chinese was found inside the Doni app, and Anthropic published findings in its September 2026 AI misuse report.

The Verge · AI14:45 UTC · 1h agoPhishing & fraud in the wild

Reimagining advertising with AI

OpenAI launches ChatGPT advertising features including Sponsored Agents, AI ad creation in Ads Manager, and integrations with HubSpot and Shopify.

OpenAI is testing Sponsored Agents in the United States, letting users converse with clearly labeled business-sponsored agents after clicking ads in ChatGPT. Advertisers can create, update, and analyze campaigns via natural-language prompts in ChatGPT with an Ads Manager plugin, plus AI-suggested copy and imagery in Ads Manager. HubSpot becomes the first CRM partner and Shopify the first ecommerce partner, with the Shopify app expanding internationally on September 23.

OpenAI News13:00 UTC · 3h agoAI industry

The modern attack chain: Rethinking Google Workspace security in the age of AI

Analysis of Vercel and Composio breaches shows stolen OAuth tokens, not phishing email, now open Google Workspace attacks — a path authorized AI agents follow.

The author analyzes the Vercel and Composio breaches as the same OAuth-first attack chain run twice: a stolen OAuth token, obtained via a compromised supplier, becomes the entry point rather than email. These tokens survive password resets, are hard to observe, and let attackers read Gmail and Drive data, take over accounts, and pivot laterally using stored credentials and password-reset magic links. The piece warns that authorized AI agents with overbroad OAuth grants can unintentionally traverse the same path — accessing inboxes, reading sensitive content, and exfiltrating data downstream — without any malicious actor or compromised credential.

Help Net Security05:00 UTC · 11h agoResearch in the wild

Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

FBI, NCSC, and AIVD detail Iran MOIS spyware CHOSEN BRICK/HEAVYGRAM, Telegram-controlled Windows malware spying on dissidents since 2023.

A September 15 joint advisory from the FBI, UK NCSC, and Dutch AIVD attributes the Windows spyware HEAVYGRAM (NCSC name CHOSEN BRICK) to Iran's Ministry of Intelligence and Security, with the campaign dating to autumn 2023 and targeting dissidents, journalists, and activists in the UK, US, Netherlands, and worldwide. Delivered via messages impersonating known contacts or tech support, the malware assigns each victim a dedicated Telegram bot for command-and-control and exfiltration, and can take screenshots, record microphone audio, steal Telegram/WhatsApp data, saved passwords, and emails, download more malware, and wipe the computer. Persistence uses a registry Run key (SMQDService or winappx) plus Microsoft Defender exclusions, with stolen data exiting via Telegram and cloud storage services like Vultr and Storj. The US Justice Department seized four pro-Iranian leak sites in March that had published stolen victim data.

The Hacker NewsSep 15, 16:29 UTC · 23h agoMalware in the wild1

Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results

NCSC, FBI, and AIVD warn Iranian state-linked actors deliver CHOSEN BRICK Windows spyware via fake AI apps, antivirus installers, and MRI-result lures.

A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK (FBI tracking name: HEAVYGRAM), Iranian state-linked Windows spyware targeting dissidents, activists, and journalists worldwide since at least 2025. Lures impersonate Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass, and operators pivot conversations from corporate to personal devices to bypass enterprise controls. The spyware persists via Registry Run keys, adds Microsoft Defender exclusions, uses per-victim Telegram bots for command-and-control, and exfiltrates screenshots, audio, email, and chat data via Telegram and cloud services, with some victim data appearing on pro-Iranian leak sites.

GBHackersupdated 12:00 UTC · 4h agofirst 06:57 UTC · 9h agoMalware in the wild 5 sources

KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension

Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.

Elastic researchers tracked the KREMLIN banking malware operation across seven campaigns over 15 months, infecting 1,515 systems, 98.75% of them in Brazil. Portuguese-language lures posing as bank records and invoices deploy a hostile 'AVSync' extension into Chrome and Edge profiles that harvests passwords, session cookies, keystrokes and screenshots. Loaders check for sandboxes, create scheduled tasks and fetch fresh infrastructure from an Ethereum smart contract; a network canary takeover temporarily disrupted infections.

Cyber Security News08:12 UTC · 8h agoMalware in the wild

NightEagle targets Russian companies

Kaspersky links NightEagle (APT-Q-95) attacks on Russian firms to compromised VPN credentials, a GhostContainer Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync.

Kaspersky's Global Emergency Response Team investigated NightEagle (APT-Q-95) incidents over the past year, finding the group—active since at least 2023 and formerly focused on Asia—now targeting Russian businesses. Attackers used compromised VPN credentials and deployed the GhostContainer .NET backdoor on Microsoft Exchange servers, built from Neo-reGeorg, a CVE-2020-0688 exploit, and ysoserial's GhostWebShell, injected in memory via VIEWSTATE manipulation with AMSI bypass. For lateral movement they combined Microsoft dev tunnels with rdp2tcp over RDP, exploited BlueKeep (CVE-2019-0708) to create local admin accounts, and performed DCSync replication against Active Directory.

Kaspersky Securelist10:00 UTC · 6h agoThreat actor in the wildCVE-2020-0688 CVE-2019-0708

Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix

JFrog disclosed CVE-2026-90894, a 7.8-rated local privilege escalation in Parallels Desktop for Mac, patched only in version 27, which Intel Macs cannot install.

JFrog researcher Yuval Moravchick disclosed CVE-2026-90894 (dubbed ParaShells, CVSS 7.8), a local privilege escalation in Parallels Desktop for Mac that lets non-admin users run code as root. The root-level prl_disp_service listens on a world-writable socket, and argument injection into a tar command via QProcess::splitCommand and the --use-compress-program option yields code execution as root, demonstrated on Parallels Desktop 26.4.0 build 57513 on Apple silicon. The fix appears in version 27.0.0, but Parallels Desktop 27 requires Apple silicon, leaving Intel Macs on the 26.x line with no build JFrog describes as fixed. No exploitation in the wild has been reported and Parallels has not published a statement.

The Hacker News13:14 UTC · 3h agoVulnerability 4 sources CVE-2026-90894

TP-Link Cameras 0-Day Vulnerabilities Allow Attackers to Spy on Users

Two zero-day flaws in TP-Link Tapo C200 cameras allowed authentication bypass and denial-of-service; fixed in firmware V5_1.4.6.

OPSWAT researchers Khoi Tran and Thai Do found CVE-2026-15315, an authentication bypass in the Tapo C200's local HTTPS interface that lets network-adjacent attackers replay an authentication value to gain administrator access, and CVE-2026-15316, an unauthenticated denial-of-service in the Wi-Fi onboarding process that crashes the camera's HTTPS service. TP-Link was notified on April 16, 2026, confirmed the flaws on July 10, and released patches on August 18, 2026 in firmware V5_1.4.6. Exploitation requires local network access but no valid account, existing session, or user interaction, exposing live feeds and stored recordings to surveillance risk.

Cyber Security News13:27 UTC · 3h agoVulnerability 3 sources CVE-2026-15315 CVE-2026-15316

KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions

Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.

Elastic Security Labs tracks the KREMLIN banking malware operation as REF9334, active since at least May 2025 across seven campaigns primarily targeting 12 Brazilian banks. The malware is installed by a victim-run JavaScript loader, achieves scheduled-task persistence, and side-loads a malicious DLL via SentinelOne's SentinelMemoryScanner.exe. It modifies Chrome and Edge Secure Preferences files, enables developer mode, and regenerates Chromium MAC values to silently install extensions, while extracting browser encryption material including the newer App-Bound OSCrypt key. An Ethereum smart contract serves as a dead-drop resolver for C2 config; Elastic disrupted over 1,500 infections via a canary domain.

GBHackers05:33 UTC · 10h agoMalware in the wild 2 sources

Mapping out your unknown: A threat hunter’s guide to GitHub

Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.

Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.

Datadog Security Labs00:00 UTC · 16h agoResearch in the wild