Search: “Beacon”

28 stories in the last 30d

Trend Micro found 14 trojanized npm calendar utilities delivering RedC2 4.0, an AI-powered cross-platform backdoor sold for $99.99.

Trend Micro's TrendAI identified 14 functional but trojanized npm packages (streak-*, kit-map-vim, map-streak-kit) that load a bundled Linux implant, the RedShell beacon of RedC2 4.0, without requiring install hooks. RedC2 4.0, sold by Red Offsec for $99.99 and advertised on Hack Forums by actor MarlboroMan in June 2026, offers shell access, credential theft, SOCKS5 proxying, in-memory execution, and an LLM-driven component called Red Agent for natural-language post-exploitation. The framework has evolved from version 2.0 in August 2025 through 4.0, with the Linux beacon introduced in the latest release.

The Hacker NewsAug 24, 17:23 UTC · 23d agoMalware in the wild

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.

Recorded FutureSep 3, 00:00 UTC · 14d agoThreat actor in the wild1

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

VulnCheck discloses two factory implants, SPEAKINGSTONE and DARKLANTERN, in ZBT router firmware granting unauthenticated remote attackers root command execution.

VulnCheck found two previously undocumented implants in firmware from Shenzhen Zhibotong Electronics (ZBT), tracked as CVE-2026-74232 (SPEAKINGSTONE) and CVE-2026-74233 (DARKLANTERN), each rated 9.8 on CVSS 3.1. SPEAKINGSTONE (yunmgrd) beacons to a hardcoded C2 over UDP port 10000 and supports root command execution, PPPoE credential exfiltration, DNS hijacking, and reverse SSH tunnels; DARKLANTERN (infosrvd) listens on UDP port 9992 with weak hardcoded authentication. Scanning found 203 internet-facing DARKLANTERN instances across 22 countries, and 392 devices reported to the SPEAKINGSTONE backup C2, nearly all in China on China Mobile. No fixed firmware release is named, and ZBT's white-labeling means model number rather than brand is the reliable detection check.

The Hacker NewsSep 8, 15:59 UTC · 8d agoVulnerability in the wildCVE-2026-74232 CVE-2026-74233 CVE-2026-66747

StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack

Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.

Sansec is investigating StyleSmuggler, an actively exploited unauthenticated remote code execution chain in Magento Open Source and Adobe Commerce, now tracked as CVE-2026-75650 with CVSS 10.0. Adobe released hotfix VULN-39341 via APSB26-146 (priority 1) on September 7 for versions 2.4.4 through 2.4.9, but stores were being exploited for roughly three days before the fix existed. The implant is a Rust backdoor that disguises itself as kworker, fc-cache, or chronyd processes and exfiltrates host data in MessagePack records sent as fake NTP replies over UDP port 123. Adobe advises rotating the encryption key and every credential it protected, and Sansec stresses patching does not clean already-compromised stores.

Sansec (Magento / e-commerce security)Sep 5, 00:00 UTC · 12d agoExploit / PoC in the wildCVE-2026-756501

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 BlogSep 4, 12:00 UTC · 13d agoThreat actor in the wild1

Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

Seqrite Labs details Operation QUICSILVER, a China-nexus espionage campaign targeting Myanmar government and IT with graduation-invite lures deploying QUICAgent backdoor.

Seqrite Labs reported Operation QUICSILVER, a cyber espionage campaign against Myanmar's government and IT sectors attributed with moderate confidence to a China-nexus actor. Since April 2026, attacks used fake Belgian-Myanmar holiday and Burmese graduation ceremony invitation lures delivered via VHD/LNK files that abuse ftp.exe (LOLBAS) to assemble and launch QUICAgent, a Go backdoor communicating over QUIC on UDP 443 with five commands and Startup-folder persistence. Separately, China-linked Mustang Panda was observed using an updated COOLCLIENT backdoor with a signed kernel-mode driver across Myanmar, Mongolia, Pakistan, and Russia.

The Hacker NewsAug 24, 11:51 UTC · 24d agoThreat actor in the wild1

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.

Zscaler ThreatLabz documents Operation RapidRust, a campaign by Pakistan-aligned APT36 deploying four new tools: RUSTYSHADE, a 64-bit Rust Windows backdoor that uses attacker-controlled private GitHub repositories with a hardcoded PAT and AES-256-GCM-encrypted messages for C2; RUSTYMOVE; PSNATCH, a PowerShell file stealer that scans Office documents, archives, media, and databases modified in the last 120 days and exfiltrates up to 5 GB per run to per-machine GitHub repositories; and BASHNATCH. The backdoor was dropped via PowerShell from attacker-controlled Backblaze B2 storage and supports screenshots, webcam capture, file listing, downloads, and shell command execution.

Zscaler ThreatLabzupdated 10:17 UTC · 2h agofirst Sep 16, 15:13 UTC · 21h agoThreat actor in the wild 3 sources

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.

Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.

The Hacker NewsSep 4, 14:51 UTC · 12d agoThreat actor in the wild

Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.

Symantec's Threat Hunter Team (Broadcom) reports that since February 2026 attackers have used the legitimate signed node.exe binary and interpreted scripts to deliver implants while evading signature-based detection, hitting government departments, technology companies, and hotels. One intrusion at an Asian technology firm (March 23–July 25, 2026) used ClickFix social engineering, the official Node.js installer, and EtherHiding to fetch commands via the Ethereum blockchain after AdaptixC2 and Cobalt Strike attempts were blocked. Related chains involve KongTuke (Woodgnat) using ModeloRAT, Mistic, NexShield, and GateKeeper, plus C2Looper, AsukaStealer, and EtherRAT; GuidePoint Security separately linked a fake-CAPTCHA ClickFix campaign to at least 31 compromised organizations using the Polygon blockchain as a dynamic C2 address book.

The Hacker NewsSep 3, 10:43 UTC · 14d agoThreat actor in the wild1

APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).

Recorded Future's Insikt Group identified campaigns deploying the previously undocumented HOOKEDGE backdoor against government and diplomatic organizations in Romania, Spain and Türkiye from late September 2025 to early April 2026. The lightweight Windows batch backdoor is delivered via macro-enabled Word documents and attributed with moderate confidence to APT28 (Fancy Bear, tracked as BlueDelta), described as the evolutionary successor to HEADLACE, using webhook.site for C2, payload staging and exfiltration. HOOKEDGE fetches .cmd payloads and returns output through headless Microsoft Edge HTTP requests, maintains a 30-minute scheduled task, and a second-stage implant gives high-value targets five-minute beaconing for interactive operator tasking.

The Hacker NewsAug 28, 08:20 UTC · 20d agoThreat actor in the wild

FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor

ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.

ESET's Welivesecurity team reports FamousSparrow gained initial access by exploiting publicly reachable Microsoft Exchange servers, with roughly 90 percent of targets since mid-2025 in Latin America, including governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The group's new modular C-language backdoor SparroWocky replaces SparrowDoor and uses a three-part loader: a legitimate executable, a malicious DLL side-loaded in memory, and an encrypted payload. It persists via Windows services or Registry Run keys, supports screenshots, file operations, TCP proxying, Beacon Object Files, TLS/RC4-encrypted C2, and anti-forensics such as call-stack spoofing. IOCs including loader SHA-1 hashes and C2 IP addresses were published.

Cyber Security News11:20 UTC · 1h agoThreat actor in the wild 3 sources

One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire

Two China-linked APT groups reused identical Chrome/Windows zero-day chain against NGOs, deploying GRIMWIDGE backdoor and LONGTALE credential-stealing extension.

Volexity reports that China-linked actors UTA0560 and JungleBamboo (APT31/TA412) ran byte-identical Chrome/Windows exploit chains against NGOs starting September 1, 2026, combining Chrome type confusion CVE-2026-85046, WebAssembly sandbox escape CVE-2026-87491, and Windows kernel flaw CVE-2026-85880. The Chrome bug was fixed in Chromium source but not yet shipped to Chrome users, making it an effective zero-day with an unusual patch gap. UTA0560 delivered the in-memory GRIMWEDGE JScript backdoor, while JungleBamboo deployed the SUPERSTOMP loader installing LONGTALE, a malicious Chrome extension disguised as Google Gemini that steals cookies, session tokens, and keystrokes. Volexity assesses with low confidence the exploit chain was sold or shared among different Chinese end-users.

Security AffairsSep 15, 10:17 UTC · 2d agoThreat actor in the wild 8 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-858804

Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning

Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.

Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.

Cyber Security NewsSep 14, 13:33 UTC · 2d agoMalware in the wild

Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities

Sophos uncovers a 64-bit Cyclops Blink variant on hacked Cisco FMC appliances, adding internal network scanning and selective packet capture; linked to Sandworm.

Sophos CTU analyzed a new 64-bit x86-64 Cyclops Blink implant (timezone_check) deployed on Cisco Secure Firewall Management Center appliances compromised via CVE-2026-20079 authentication bypass and CVE-2026-20316 low-privileged login. The activity is assessed with high confidence as Russian-nexus, with a moderate-confidence link to Sandworm (IRON VIKING, also tracked as Seashell Blizzard). The implant runs a parent controller plus five worker modules, masquerades as [kworker/0:1], persists via SysV init scripts at /lib/tz/timezone_check, and beacons to hard-coded C2 89.34.96.56 over a custom TLS protocol on ports 43856 and 49172. New module 0x11 scans internal IPv4 networks for SSH, SMB, LDAP, VMware, HTTP/HTTPS and VPN services, while module 0x12 performs filtered packet capture that can expose cleartext credentials, cookies and tokens.

GBHackersSep 14, 09:27 UTC · 3d agoMalware in the wild 7 sources CVE-2026-20079 CVE-2026-20316

China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor

China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.

Gen Threat Labs discovered UNC3569 exploiting CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows that chains an insecure sgbiz: protocol handler with an unsandboxed Chromium 80 CEF webview. The chain weaponizes CVE-2021-38003 (V8 type confusion) to run shellcode that DLL-sideloads via 7z.exe/7z.dll and deploys the GRAYRABBIT backdoor, which beacons over RC4-encrypted raw TCP 443 to mail.uaiubifas[.]top. Tencent patched the issue in version 16.3.0.3498, released via automatic updates on April 21, 2026. UNC3569 is a PRC-nexus espionage actor targeting government, education, technology, and financial sectors across East and Southeast Asia.

GBHackersupdated Sep 14, 13:01 UTC · 2d agofirst Sep 14, 08:09 UTC · 3d agoThreat actor in the wild 3 sources CVE-2026-51990 CVE-2021-380031

ClickFix attacks infecting PCs and Macs are going viral

ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.

BlueVoyant reports the Lorem Ipsum malware operation pivoted to ClickFix in late May 2026, dropping code-signing infrastructure and broadening its victim pool from Microsoft Teams searchers to anyone browsing a compromised website. Jamf and independent researchers documented macOS ClickFix variants that bypass Gatekeeper protections. Cisco Talos observed attackers abusing published Google Sheets for control traffic, while Netskope counted 5,400 sites beaconing to one campaign; Sandworm has separately hosted control infrastructure in blockchain smart contracts.

Ars Technica · SecuritySep 11, 11:30 UTC · 6d agoPhishing & fraud in the wild1

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.

SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.

The Hacker NewsSep 7, 18:12 UTC · 9d agoMalware in the wild1

Magento StyleSmuggler zero-day exploited to deploy Linux backdoor

StyleSmuggler zero-day in Magento and Adobe Commerce is actively exploited in the wild to deploy a Rust-based Linux backdoor; fix not yet released.

A zero-day dubbed StyleSmuggler affecting all versions of Magento and Adobe Commerce is being actively exploited, with the first observed incident on September 4 on a fully patched site. The exploit injects PHP code via Magento's template system through a fake 'failed-payment' email to achieve code execution, installing a Rust-based backdoor disguised as kworker/u:8:0 or fc-cache with a 30-minute cron job for persistence. The backdoor communicates via TLS/WebSockets or UDP port 123 masquerading as NTP traffic, checks TracerPid to detect tracing, and can receive remote commands. Adobe confirmed it is working on a fix with no timeline; Sansec recommends disabling GraphQL as mitigation and monitoring for suspicious cron entries and kworker or fc-cache processes. Magento is installed on more than 160,000 websites, including 14,000 of the top 1 million sites.

BleepingComputerSep 7, 16:50 UTC · 9d agoExploit / PoC in the wild

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs

Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Sansec found attackers exploiting an Adobe Commerce/Magento zero-day (StyleSmuggler) since September 4 to deploy Rust backdoors on online stores.

Threat actors are actively exploiting a zero-day RCE in Adobe Commerce and Magento 2.4.7-2.4.9, injecting PHP code via generated failure reports and executing it through Magento's payment-failure email, with no user interaction required. Exploitation began September 4 and succeeds even against stores running the July and August 2026 patches; the Rust backdoor disguises itself as kworker/u:8:0 or fc-cache and hides C&C communication inside fake NTP replies. Adobe's September 8 Patch Tuesday updates may not include a StyleSmuggler fix.

SecurityWeekSep 7, 11:58 UTC · 10d agoExploit / PoC in the wild

AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks

Researchers found 120 corporate llms.txt files pointing to unregistered packages, demonstrating AI coding agents install and execute attacker-controlled code on Fortune 500 networks.

Researchers at an Israeli stealth startup scanned 6,214 live domains belonging to defense contractors, Fortune 500 and Big Tech companies, finding 120 llms.txt files that pointed to unregistered code packages or domain names. After registering a handful of the unclaimed names, they received a phone-home beacon within an hour from a Fortune 500 company and dozens more over time. Parent-process chains showed coding agents including Claude, OpenAI's Codex and Nous Research's Hermes executed the installed packages. The researchers warn agents treating vendor docs as ground truth creates a SolarWinds-style supply-chain surface as agent adoption spreads across SaaS, cloud and endpoints.

Schneier on SecuritySep 4, 10:35 UTC · 13d agoAI safety & security in the wild1

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.

Microsoft warned of a human-operated campaign abusing Teams external collaboration to impersonate IT help desk staff, deploy malicious MSI packages staging Node.js runtimes and obfuscated JavaScript implants, then pivot to domain controllers over WinRM. Unit 42 documented the Spring Ring vishing operation targeting over 150 employees across at least 10 companies using 26 attacker identities, including an NTLM relay variant against domain controllers. Sophos reported The Gentlemen ransomware (Gold Sherwood) reached 683 total victims by end of July 2026, adding 169 in July, with a playbook using BYOVD-based EDR killers and backup tampering. Group-IB found the Outsider phishing-as-a-service platform created 700+ new phishing pages within a month despite law enforcement takedowns.

The Hacker NewsSep 3, 18:02 UTC · 13d agoThreat actor in the wild1

Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads

US and European authorities with CrowdStrike dismantled the two-decade-old Sality P2P botnet using peer-list manipulation, blocking payload delivery to infected hosts.

The US Department of Justice announced a coordinated takedown of the Sality peer-to-peer botnet, executed August 31, 2026 by authorities from the US, Bulgaria, Hungary, and Romania with CrowdStrike and the Shadowserver Foundation. Sality, active since 2003, infects Windows executables and delivers payloads including the EggJagger crypto clipper, which stole at least $150,000, and was used for DDoS campaigns. The operation abused the botnet's peer-list maintenance cycle to insert sinkhole nodes and isolate both super peers and NAT-hidden infections, cutting off URL and payload distribution to more than 15,000 infected machines across two P2P networks.

The Hacker NewsSep 2, 10:20 UTC · 15d agoMalware

13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.

Socket researchers found 13 malicious Composer theme packages across five vendor namespaces (including vsmov, vsphim, and ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. On iPhones running iOS 18.4-18.6.x, the injected code fires a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529, pivoting through the GPU process and the AppleM2ScalerCSCDriver IOKit user client to gain kernel read/write. Since around August 12, 2026 the payload also steals cryptocurrency wallet seeds and mnemonics from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, alongside keychain databases, Wi-Fi passwords, SMS, photos, cookies, and location history, uploaded via HTTPS to rotating C2 domains. The group is believed to be Vietnamese-operated, hosts exploits on Funnull infrastructure, and Apple patched the kernel escape flaw in iOS and macOS 26.1.

The Hacker NewsSep 2, 06:24 UTC · 15d agoExploit / PoC in the wildCVE-2025-31277 CVE-2025-43529 CVE-2025-43398+2 CVEs

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.

Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.

Microsoft Security BlogSep 1, 22:48 UTC · 15d agoThreat actor in the wild1

Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations

Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.

Recorded Future's Insikt Group documented a BlueDelta (APT28/Fancy Bear/Forest Blizzard) espionage campaign from late September 2025 through early April 2026 targeting government and diplomatic organizations in Romania, Spain and Türkiye. The group delivered HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents with diplomatic lures, including one impersonating Spain's Ministry of the Presidency after a Spanish-Moldovan meeting. HOOKEDGE uses webhook.site as C2, a scheduled task every 30 minutes that downloads commands through Microsoft Edge, and canary pixels like docopened.jpg to track phishing funnel progress. A second tier with 5-minute check-ins served high-value victims, and beaconing intervals were stretched to 61 minutes to evade sandboxes; code overlap ties HOOKEDGE to BlueDelta's earlier HEADLACE backdoor.

Security AffairsAug 28, 11:26 UTC · 20d agoThreat actor in the wild1

Risky Bulletin: Two TeamPCP members arrested in Australia

Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.

The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.

Risky Business NewsAug 28, 04:40 UTC · 20d agoPolicy & legal in the wild1

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

Compromised maintainer account published malicious versions of popular Rust crates with 245M downloads, delivering a build-time payload via typosquatted proc-macro1 dependency.

The Rust Project deleted malicious releases of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 from crates.io after a compromised maintainer account added a typosquatted dependency, proc-macro1, whose build script downloaded and executed a remote payload during compilation. Each malicious version was online for 86 to 107 minutes on August 20, 2026, before deletion. The build script disabled TLS validation and deployed OS-specific implants on Unix, macOS, and Windows, with builds alone sufficient to trigger execution. Wiz Research confirmed active exploitation, noting the impacted packages appear in 35% of cloud and code environments and over 75% of Rust-using environments; arrayref alone has 245 million all-time downloads and 403 dependent crates.

The Hacker NewsAug 25, 16:13 UTC · 22d agoMalware in the wild1