ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “static key”

4 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPhishing & fraud 2Threat actor 2Vulnerability 1
SeverityAllcritical 0high 3medium 2low 0info 0

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackers · 21h agoPhishing & fraud in the wild2

BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacks

French-speaking crew BlackHatSect0r disabled AI agent safety controls to automate scanning, credential harvesting, and vishing, exposing 16,834 stolen credentials.

Socradar researchers analyzed the exposed infrastructure of a French-speaking crew called BlackHatSect0r && DXQRTXX, which ran a Nous Research Hermes agent on a DeepSeek model with safety controls removed via HERMES_DISABLE_SAFETY=1. A custom Go-based C2 platform, DXSCAN, was exposed on port 8080 with over 200 secret-detection patterns, a vault of 16,834 harvested credentials, and scanning activity queuing 2.75 million domains and reaching more than 726,000 hosts. The kit also held a database of roughly 450,000 French telecom subscriber records used to prepare vishing lures impersonating Société Générale, plus JWT-forging tooling for a cryptocurrency exchange. Most confirmed compromises relied on exposed secrets and cloud misconfiguration rather than novel exploits; the one cited vulnerability, CVE-2026-42530, is an NGINX HTTP/3 QPACK use-after-free fixed in version 1.31.2.

GBHackersupdated · 43m agofirst · 3h agoThreat actor in the wild 4 sourcesCVE-2026-42530

The skb that wasn't freed - the Fragnesia primitive via Open vSwitch

Doyensec details CVE-2026-90049 in Open vSwitch, enabling deterministic Linux kernel local privilege escalation on default major distribution installs.

Doyensec reports that the Open vSwitch datapath strips the SKBFL_SHARED_FRAG flag from packets it is still forwarding, allowing an in-place decrypt to write attacker-chosen bytes into root-owned page cache — a Dirty COW-class primitive that re-opens the Fragnesia bug family. The issues are tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977, and were reported to the kernel security team with fixes coordinated alongside OVS maintainers. A deterministic local privilege escalation works on default installs of Arch, Fedora, Debian, Amazon Linux, and RHEL where unprivileged user namespaces and openvswitch auto-loading are enabled; the fix landed in mainline and shipped in stable on 09/04/2026. The write technique builds on the earlier Fragnesia and Dirty Frag bugs, including CVE-2026-43284 and CVE-2026-43500.

Lobsters · security · 2h agoVulnerabilityCVE-2026-90049CVE-2026-89487CVE-2026-80977+2 CVEs

Smishing Triad Hackers Use JWR Phishing Kit to Steal Cards, OTPs and Bank Credentials

Group-IB attributes large-scale smishing using the JWR real-time phishing kit to the Smishing Triad's Outsider cluster, harvesting card data, OTPs, and bank credentials.

Group-IB attributes a large-scale SMS phishing campaign to Outsider, an operator sub-cluster within the Smishing Triad phishing-as-a-service ecosystem, using a kit dubbed JWR. The Vue 2-based platform maintains real-time WebSocket communication with operators, enabling them to adapt pages live and harvest roughly 70 PII fields, card data, PINs, OTPs, identity document images, and digital wallet credentials via a dedicated PayPal sub-funnel. Unit 42 previously tied 194,345 malicious domains across 136,933 root domains to the broader operation since January 2024. Defenders can hunt for /api/open/ endpoints, /webSocket/QT/ paths, JWR-prefixed storage artifacts, and a hard-coded WebSocket token.

GBHackersupdated · 21h agofirst · 22h agoPhishing & fraud in the wild 2 sources