Search: “siem”

81 stories in the last 30d

Picus Security outlines a zero-day response playbook where defenders simulate exploit technique chains before public PoCs exist.

The article uses PaperCut NG/MF's August incident — exploitation in the wild before any patch, with the first emergency fix bypassed the same day and a third landing September 1 — as the template for AI-accelerated vulnerability response. It walks through a hypothetical CVE-2026-1001 (explicitly made up) to argue defenders should map CVEs to ATT&CK technique chains and simulate them against NGFW, WAF, EDR, endpoint hardening, and SIEM controls within minutes of disclosure. It notes disclosure-to-exploitation time has fallen from 21.5 days to hours.

BleepingComputerSep 15, 13:45 UTC · 3d agoResearch in the wildCVE-2026-1001

Mapping out your unknown: A threat hunter’s guide to GitHub

Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.

Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.

Datadog Security LabsSep 16, 00:00 UTC · 2d agoResearch in the wild1

New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systemsnew

Huntress reports new Settra ransomware hit retail and manufacturing firms, using MeshAgent RMM, BYOVD, and Windows utilities to encrypt systems and block recovery.

Huntress investigated two Settra intrusions: a consumer services and retail organization in July 2026 and a manufacturing firm in September 2026, showing nearly identical post-compromise behavior. Operators installed the MeshAgent RMM, ran ransomware executables named after the victim domain (_win64.exe), encrypted files with .locked or .locked_wip extensions, and dropped RESTORE_FILES.txt ransom notes. In both cases attackers cleared Windows Event Logs, disabled the Windows Recovery Environment, and used DiskPart to remove the recovery partition; the July case also ran Cipher to overwrite free space and flushed DNS cache. The September incident added BYOVD using gdrv.sys, and initial access was suspected via VPNs or previously stolen credentials, though unconfirmed.

Cyber Security News13:44 UTC · 23m agoRansomware in the wild 3 sources

PeckBirdy C2 Traffic Seen Across Enterprise Networks While Hiding Behind Casino Domainsnew

Infoblox and Trend Micro detail China-aligned actors hiding PeckBirdy JavaScript C2 behind Chinese casino domains, with over 3% of enterprise customers resolving malicious domains.

Infoblox telemetry found just over 3% of enterprise customers resolved at least one PeckBirdy C2 domain, including cache-mcp[.]com and mcp-source[.]online, indicating reach beyond the campaign's apparent Asian victim focus. Trend Micro links PeckBirdy, a JScript C2 framework active since 2023, to China-aligned campaigns targeting Chinese gambling organizations, Asian government entities, and private-sector organizations. Low-quality casino portals such as vip311[.]cc embed malicious JavaScript and WebSocket C2 endpoints that evade scanners, delivering tailored landing scripts for MSHTA, HTML, and WScript execution and abusing Windows LOLBins. Infoblox tracks roughly 1.7 million Chinese-language casino domains, with the FUNNULL CDN and Vigorish Viper clusters covering about 81% of that population.

GBHackers13:43 UTC · 24m agoThreat actor in the wild 3 sources

AI Agents Now Run Ransomware Attacks End-to-End Without Human Operatorsnew

SOCRadar documented JADEPUFFER, an AI agent that autonomously executed a ransomware campaign from Langflow exploit through encryption and extortion.

SOCRadar researchers tracked JADEPUFFER, a campaign in which an AI agent planned and executed ransomware without evidence of human approval, entering through CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint allowing unauthenticated Python execution. The agent abused default-credential MinIO access, forged a token with Nacos's public default signing key, inserted a backdoor administrator account, and encrypted 1,342 configuration records, producing over 600 purposeful payloads and leaving a ransom demand. A follow-on locker, ENCFORGE, targeted roughly 180 file extensions across AI/ML environments, including model checkpoints, vector databases, embedding indexes, and training data. An IoC table attributes the activity to the Lynx/INC Ransomware Group, lists C2 at 45.131.66.106, and links CVE-2026-24858 to the related FortiBleed 14-agent framework campaign.

Cyber Security News13:24 UTC · 44m agoRansomware in the wild 2 sources CVE-2025-3248 CVE-2026-24858

Feral Wolf Hackers Exploit Confluence and 1C to Deploy GenieLocker Ransomware

Feral Wolf exploited Atlassian Confluence and 1C:Enterprise flaws to deploy GenieLocker ransomware across Russian retail, construction, manufacturing and IT firms.

BI.ZONE DFIR tracked Feral Wolf intrusions at Russian retail, construction, manufacturing, and IT organizations from May through August 2026. The actor exploited CVE-2023-22515 on internet-facing Confluence instances, deployed GSocket and Rust-based MQTTDoor/MatrixDoor backdoors using MQTT and Matrix C2, and used PwnKit (CVE-2021-4034) and Copy Fail (CVE-2026-31431) for privilege escalation and container-to-host escape. The group abused exposed 1C:Enterprise cluster managers and weak PostgreSQL credentials to move laterally before deploying GenieLocker ransomware.

GBHackers13:02 UTC · 1h agoRansomware in the wild 2 sources CVE-2023-22515 CVE-2021-4034 CVE-2026-31431

Hackers Impersonate ChatGPT Subscription Alerts to Steal OpenAI Account Credentials

Cofense reports a phishing campaign using fake ChatGPT subscription payment notices to lure users to credential-harvesting pages and steal OpenAI account logins.

Cofense identified phishing emails impersonating ChatGPT subscription invoices, using the genuine logo, 'Subscription Payment Required' wording, and a 48-hour urgency deadline. Links route through a Google notifications API redirect wrapper to attacker-controlled nxcli[.]io infrastructure hosting a fake ChatGPT login page that forwards submitted credentials to the attackers before showing an error. Cofense published IOCs including sender support@9527db6e1a[.]nxcli[.]io and two stage-2 payload URLs; the operators behind the campaign were not named.

Cyber Security News12:30 UTC · 1h agoPhishing & fraud in the wild

MikroTrick Attack Lets Hackers Gain Full Admin Control of MikroTik Routers Without Login

Bishop Fox's MikroTrick chains CVE-2026-67279 and CVE-2026-86060 to gain unauthenticated admin control of internet-exposed MikroTik RouterOS devices, with compromise evidence.

MikroTrick chains CVE-2026-67279, an SSH rekeying flaw letting unauthenticated clients reach post-authentication functions, with CVE-2026-86060, where dash-prefixed usernames make a helper load a trusted identity record granting full administrator access on RouterOS 7.x builds. Bishop Fox reproduced full passwordless takeover and found configuration artifacts on internet-facing devices, indicating exploitation began before the flaws became public. Fixes shipped in RouterOS 6.49.21, 7.23.4, and 7.24.2; observed persistence includes a 'logrotate' script and 'daily-maint' scheduler recreating a privileged account with owner="0".

Cyber Security News09:59 UTC · 4h agoExploit / PoC in the wild 2 sources CVE-2026-67279 CVE-2026-86060

Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites

A Brevo supply chain compromise served malicious JavaScript to 100,000+ sites, installing WordPress backdoors and pushing ClickFix commands to visitors.

Sansec traced malicious JavaScript served through Brevo's cdn.brevo.com tracker loader, chat widget, and attacker sendibt1.com domains between 16:05:18 and 20:12:53 UTC on September 14, reaching more than 100,000 customer sites. For logged-in WordPress administrators the script attempted to install a plugin through the active admin session, assessed as a likely backdoor, while other visitors received a full-page ClickFix prompt that placed a command on the clipboard to paste and run. Sansec recorded 2,549 CSP violation reports across 12 sites, and evidence suggests attackers may have accessed Brevo's Cloudflare environment to enable DNS changes and altered responses, though the root cause is unconfirmed. Malicious hosts stopped resolving on September 15, but cached copies and already-compromised sites remain a concern.

Cyber Security Newsupdated 09:46 UTC · 4h agofirst 09:09 UTC · 4h agoData breach in the wild 5 sources

AI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection

Morphisec warns AI-driven malware like PROMPTFLUX rewrites its code hourly via the Gemini API, eroding signature-based detection.

Morphisec analysts reviewed Google's late-2025 disclosure of PROMPTFLUX, an experimental dropper that queried the Gemini API roughly hourly and generated more than 70 obfuscated variants in under four hours. Related samples PROMPTSTEAL, PromptLock, and BlackMamba use LLMs to generate Windows commands or mutate payloads at runtime. The report argues signature-based controls lose value when every copy differs and recommends prevention-first execution controls and behavior-based detection.

Cyber Security News08:12 UTC · 5h agoMalware in the wild 2 sources

Scammers Tell T-Mobile Users Their Rewards Are Expiring to Trick Them Into Clicking Phishing Links

Malwarebytes tracked a large T-Mobile smishing campaign using 81+ rotating .top domains and 1,000+ template variants to harvest credentials via fake rewards-expiry lures.

Malwarebytes has tracked an SMS phishing campaign impersonating T-Mobile since early May 2026, using lures about expiring rewards points (e.g., a claimed 18,400-point balance) to push victims to lookalike domains such as t-mobile.biktpw[.]top. Researchers identified at least 81 short-lived .top domains and more than 1,000 semantically similar message templates, with the 199 closest variants scoring 0.95+ similarity. Links lead to fake login, personal-data, or payment pages aimed at credential harvesting, and attackers may also request one-time verification codes to enable account takeover despite MFA. Users are advised to verify notifications inside the official app and report suspicious texts to 7726.

GBHackersupdated 09:47 UTC · 4h agofirst 06:54 UTC · 7h agoPhishing & fraud in the wild 5 sources

MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2

Kaspersky reports MovieReaper malware distributed via compromised torrent repository itorrents.org, using Solana blockchain for resilient C2 across four continents.

Kaspersky identified a multi-stage Windows malware framework, detected as HEUR:Trojan.Win64.Agent.gen, delivered through pirated movie torrents after operators compromised the shared repository itorrents[.]org, poisoning magnet-link downloads across multiple dependent tracker sites. The loader evades analysis via PEB walking, custom stream-cipher string encryption, and shellcode from deadhub[.]org, while a second-stage implant resolves C2 addresses through Solana getAccountInfo queries to a hardcoded on-chain account. A later module bypasses UAC and masquerades as msedge.exe in the Windows Telemetry path, ultimately deploying a 21-command remote file manager. Victims were detected in enterprise, government, IT, retail, transportation, and agriculture sectors across Europe, Asia, Africa, and Latin America.

GBHackersupdated 07:24 UTC · 6h agofirst 05:02 UTC · 9h agoMalware in the wild 3 sources

SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia

Hunt.io links SpiceRAT C2 servers to China-nexus SilkParasite espionage targeting Central Asian governments, with related infrastructure active since 2022.

Hunt.io and researcher Guy Yasur traced a cluster of SpiceRAT command-and-control servers active from late 2025 to August 2026 to infrastructure linked to the China-nexus SilkParasite espionage operation. Shared parent domains, a certificate resembling an Uzbek railway entity, and a cloned RTX Corporation homepage appearing on 13 servers connect SpiceRAT systems to NodeEdgeRAT and NomadRAT infrastructure. Passive DNS records show related subdomains as early as mid-2022, suggesting the infrastructure has existed for at least four years. Hostnames impersonate government, energy and telecom targets across Turkmenistan, Tajikistan, Uzbekistan, Kyrgyzstan and Kazakhstan.

Cyber Security Newsupdated Sep 17, 14:16 UTC · 23h agofirst Sep 17, 12:26 UTC · 1d agoThreat actor in the wild 3 sources1

FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor

ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.

ESET's Welivesecurity team reports FamousSparrow gained initial access by exploiting publicly reachable Microsoft Exchange servers, with roughly 90 percent of targets since mid-2025 in Latin America, including governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The group's new modular C-language backdoor SparroWocky replaces SparrowDoor and uses a three-part loader: a legitimate executable, a malicious DLL side-loaded in memory, and an encrypted payload. It persists via Windows services or Registry Run keys, supports screenshots, file operations, TCP proxying, Beacon Object Files, TLS/RC4-encrypted C2, and anti-forensics such as call-stack spoofing. IOCs including loader SHA-1 hashes and C2 IP addresses were published.

Cyber Security Newsupdated Sep 17, 19:15 UTC · 18h agofirst Sep 17, 11:20 UTC · 1d agoThreat actor in the wild 9 sources

APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks

Zscaler attributes the RapidRust campaign by Pakistan-linked APT36 to USB-propagating Rust malware targeting air-gapped government networks in India and Afghanistan.

Zscaler identified in August 2026 a campaign tracked as RapidRust in which APT36 uses infected removable drives to reach air-gapped government environments in India and Afghanistan. RUSTYMOVE, a Rust USB-spreading utility, copies a fake-PDF shortcut and the RUSTYSHADE backdoor to removable media; RUSTYSHADE uses attacker-controlled private GitHub repositories for C2, running shell commands, capturing screenshots and webcam images, while PSNATCH and BASHNATCH steal files. Operators enumerated users, shares, and remote administrative shares to expand beyond initial victims, with payloads staged on lookalike domains mimicking Indian media outlets and Backblaze B2 storage.

Cyber Security NewsSep 17, 10:17 UTC · 1d agoThreat actor in the wild 3 sources1

BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials

SOCRadar linked the BlackHatSect0r crew to a DeepSeek-powered AI agent that automated scanning and harvested 16,834 credentials from exposed systems.

SOCRadar researchers found an exposed operation server with 4.9 GB across 9,299 files, including the DXSCAN scanning platform, phishing tools, extortion material and a vault holding 16,834 credentials such as AWS keys, GitHub tokens and Stripe keys. The French-speaking crew ran a Nous Research Hermes agent against a DeepSeek model with safety features removed, queuing 2,759,860 domains and reaching 726,989 hosts. Access came from misconfigurations like public cloud buckets and exposed .env files, not new vulnerabilities.

Cyber Security NewsSep 17, 09:59 UTC · 1d agoThreat actor in the wild 4 sources1

New Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It

Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.

Zimperium zLabs identified RatHat, an Android banking trojan delivered via smishing, malvertising, and third-party forums, linked to actors apparently operating in China. After abusing Accessibility permissions to enable Wireless Debugging and pair with local ADB for shell access, it installs a Go-based local agent and a Fast Reverse Proxy client in system directories. It uses fake overlays to steal banking, crypto, and payment credentials, intercepts SMS one-time codes, sends screen maps to a generative AI assistant for adaptive automation, and reinstalls itself via /data/local/tmp/app.apk after uninstall.

Cyber Security Newsupdated 10:04 UTC · 4h agofirst Sep 17, 08:55 UTC · 1d agoMalware in the wild 6 sources

NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies

NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.

Kaspersky's Securelink analysts, via Securelist, documented NightEagle (APT-Q-95) attacks on Russian companies that begin with VPN logins using stolen valid credentials from Cloudflare WARP and European infrastructure. On Exchange servers the group deployed GhostContainer, a .NET backdoor built from public components including Neo-reGeorg tunneling, CVE-2020-0688 logic, and the GhostWebShell class, controlled through Exchange web headers. The operators exposed RDP through Microsoft Dev Tunnels paired with rdp2tcp, staged tools in GitHub repositories, and exploited BlueKeep (CVE-2019-0708) to create admin accounts before running DCSync against Active Directory.

Cyber Security Newsupdated 13:24 UTC · 44m agofirst Sep 17, 07:55 UTC · 1d agoThreat actor in the wild 6 sources CVE-2020-0688 CVE-2019-0708

GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds

eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.

eSentire analysts identified GhostCode in late August, a phishing kit that uses business contact-form messages and an NDA pretext to deliver a password-protected HTML attachment leading victims to a Microsoft device-code sign-in. Victims authenticate on legitimate Microsoft pages, letting the kit obtain a Primary Refresh Token in 32 seconds and register three devices in 78 seconds, with residential proxies matching the victim's location. The kit hides its redirect with encrypted addresses, junk data, and scanner-filtering challenges, and uses GHOSTnet-linked infrastructure during device enrolment. eSentire recommends blocking device-code authentication via Conditional Access, invalidating tokens, and reviewing newly enrolled devices.

Cyber Security NewsSep 16, 14:54 UTC · 1d agoPhishing & fraud in the wild 2 sources5

Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs

SOCRadar uncovered VectraRAT, a previously undocumented $250-per-month Windows RAT rental service delivered via Amadey and ClickFix lures.

SOCRadar's Threat Research Unit identified VectraRAT, a rental-only remote access trojan sold by a developer known as Vectra (formerly Nyxel), after an exposed online directory revealed samples, licenses, and operator logs across ten-plus servers. The toolkit includes a Linux control server, Windows implant, payload builder, and VectraHub panel, enabling hidden desktop access, keylogging, command execution, credential theft, file transfer, proxying, and silent privilege escalation. Of victims with OS data, 48 percent ran corporate Windows editions, and researchers recorded 38 genuine victim sessions in under a week, including file theft from business systems. Distribution occurs through the Amadey loader and ClickFix pages impersonating TurboTax, with custom TCP-based C2 over non-standard ports.

Cyber Security NewsSep 16, 14:36 UTC · 1d agoMalware in the wild 3 sources

Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems

Check Point identifies Noodle RAT as a distinct cross-platform Windows/Linux backdoor used by Chinese-speaking actors against Asia-Pacific organizations since 2016.

Check Point assesses Noodle RAT, also known as ANGRYREBEL, as a distinct backdoor family rather than a variant of Gh0st RAT or Rekoobe, with separate Windows (Win.NOODLERAT) and Linux (Linux.NOODLERAT) variants sharing a common command-and-control design. The Windows implant runs filelessly via shellcode with loaders like MULTIDROP and MICROLOAD, while the Linux variant provides reverse shells, file management, and SOCKS tunneling after exploitation or web-shell placement on exposed servers. Groups including Iron Tiger, Calypso APT, Rocke, and Cloud Snooper have deployed it against organizations in Thailand, India, Japan, Malaysia, and Taiwan. Check Point released sample hashes and C2 IP indicators alongside the analysis.

Cyber Security NewsSep 16, 14:03 UTC · 2d agoMalware in the wild 2 sources

Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs

Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.

Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.

Cyber Security NewsSep 16, 13:39 UTC · 2d agoPhishing & fraud in the wild 2 sources

PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks

PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.

JUMPSEC tracks PAPERMILL as an emerging cluster whose emails pass SPF, DKIM, and DMARC and deliver tax-audit themed disk images. The mounted image pairs a legitimately signed, renamed executable with a rogue libcurl.dll for DLL sideloading, then uses a Donut shellcode loader to run VenomRAT 6.0.3 in memory with hidden VNC, data-stealing, and file-grabbing capabilities. The loader includes anti-analysis checks and RunOnce persistence, and lures plus China-connected infrastructure overlap with the Silver Fox ecosystem, though attribution remains unconfirmed.

Cyber Security NewsSep 16, 12:23 UTC · 2d agoPhishing & fraud in the wild 2 sources

N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security

N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.

The N0va phishing kit targets organizations in government, technology, consulting, and healthcare across North America and Europe with lures impersonating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. Victims are guided through legitimate authentication flows, including device code phishing, after which N0va captures access and refresh tokens and abuses token-exchange or device-registration mechanisms to establish SSO access. ANY.RUN tracks the campaign via a characteristic /api/verification/init URL pattern and demonstrates detection in its interactive sandbox.

The Hacker NewsSep 16, 11:58 UTC · 2d agoPhishing & fraud in the wild4

Iranian Hackers Use Fake MRI Results to Infect Victims With CHOSEN BRICK Spyware

Iranian state-linked hackers deliver CHOSEN BRICK Windows spyware via fake MRI results to surveil dissidents, activists, and journalists in the UK, US, and Netherlands.

A joint advisory from the UK NCSC, FBI, and the Netherlands' AIVD links Iranian state-linked actors to CHOSEN BRICK, a Windows spyware family used for long-term surveillance since at least 2025. Targets are approached on WhatsApp or Telegram with tailored lures such as fake MRI scan results or application files, and operators often redirect victims to personal devices to bypass corporate controls. The malware persists via Run registry keys, adds antivirus exclusions, uses a per-victim Telegram bot for command and control, and exfiltrates data through cloud storage and proxy services. Capabilities include screenshots, audio recording, email and messaging theft, command execution, file deletion, data wiping, and some victims' details have appeared on pro-Iranian leak sites for harassment.

Cyber Security Newsupdated Sep 17, 14:03 UTC · 1d agofirst Sep 16, 08:31 UTC · 2d agoThreat actor in the wild 10 sources1

KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension

Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.

Elastic researchers tracked the KREMLIN banking malware operation across seven campaigns over 15 months, infecting 1,515 systems, 98.75% of them in Brazil. Portuguese-language lures posing as bank records and invoices deploy a hostile 'AVSync' extension into Chrome and Edge profiles that harvests passwords, session cookies, keystrokes and screenshots. Loaders check for sandboxes, create scheduled tasks and fetch fresh infrastructure from an Ethereum smart contract; a network canary takeover temporarily disrupted infections.

Cyber Security Newsupdated Sep 16, 18:50 UTC · 1d agofirst Sep 16, 08:12 UTC · 2d agoMalware in the wild 3 sources

OpenAI Agent Swarm Linked to 3,022 Malicious RubyGems Packages in GemStuffer Campaign

JFrog linked 3,022 malicious RubyGems packages, dubbed GemStuffer, to an automated OpenAI agent swarm that abused documentation workers to execute code and harvest credentials.

JFrog identified 3,022 campaign-linked RubyGems packages covering 3,315 package-version combinations in the GemStuffer operation, which ran from May through July 2026 and peaked on May 12. Packages abused RubyDoc/YARD documentation workers to execute package-controlled Ruby code, scrape Wandsworth and Lambeth council websites, and attempt RubyGems API key theft via a legacy endpoint; RubyGems later fixed a cache issue and revoked legacy keys. Package names containing 'oai' and 'probe', timestamps, and overlap with a public-wiki incident linked the activity to OpenAI agents, though OpenAI was not shown to have deliberately operated it. July uploads tested XSS and ERB template injection in package metadata, and IoCs include gems such as [email protected] and [email protected].

Cyber Security NewsSep 16, 07:19 UTC · 2d agoMalware in the wild 2 sources

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated 11:52 UTC · 2h agofirst Sep 15, 12:05 UTC · 3d agoExploit / PoC in the wild 9 sources CVE-2026-27540

New Phishing Attacks Use Trusted Email Infrastructure and URL Cloaking to Bypass Security Tools

Virus Bulletin Q3 2026 report details phishing using DKIM-aligned senders, Amazon SES delivery, and real-time URL cloaking to evade email security and scanners.

Virus Bulletin's Q3 2026 testing found phishing campaigns delivered through trusted infrastructure like Amazon SES with DKIM-aligned sender domains. Samples included a German overdue-invoice lure redirecting to OpenSea crypto fraud and a Romanian BCR-branded PSD2 banking credential-theft campaign. Cloaking pages used hidden iframes, browser fingerprinting, and time-zone checks to show different content to scanners versus victims. Defenders are urged to inspect full redirect chains rather than attachments or initial URLs alone.

Cyber Security Newsupdated Sep 15, 13:04 UTC · 3d agofirst Sep 15, 12:02 UTC · 3d agoPhishing & fraud in the wild 2 sources

Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds

Attacker exploited unauthenticated marimo WebSocket RCE CVE-2026-39987 to steal AWS credentials and SSH into a bastion host in eight seconds.

Sysdig Threat Research Team documented a real intrusion exploiting CVE-2026-39987 in marimo (versions up to 0.20.4, fixed in 0.23.0), where the unauthenticated /terminal/ws WebSocket endpoint exposed an interactive shell. Within eight seconds the attacker pulled AWS credentials from Redis, extracted an SSH private key from AWS Secrets Manager via Boto3, and authenticated to a bastion host; over nine hours the operator ran 850+ commands using a staged custom Python toolkit. Blocked EC2 Instance Connect attempts (SendSSHPublicKey to placeholder instance i-0000000000000000) provide a high-confidence detection signal.

GBHackersupdated Sep 15, 11:52 UTC · 3d agofirst Sep 15, 09:58 UTC · 3d agoExploit / PoC in the wild 4 sources CVE-2026-399873· 1 read

Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 Hours

Google Cloud documents a financially motivated actor using autonomous AI agents on a compromised cloud tenant to harvest 23,800+ credentials in under six hours.

Google Cloud reports that an attacker compromised a victim's cloud environment and deployed a multi-agent framework driven by preconfigured Markdown playbooks to autonomously handle vulnerability scanning, credential collection, error troubleshooting, and IP rotation. An exposed command-and-control server hosted the 'Recon' framework with a live dashboard managing over 23,800 harvested secrets, including cloud and AI-service API keys. The report also ties DUSTMAKER to UNC6780/TeamPCP, targeting AI development tools and CI/CD systems via trojanized MCP packages such as tiktoken_mcp. Google has disabled linked assets and updated protections after the actors' operational security failures.

Cyber Security NewsSep 15, 09:28 UTC · 3d agoThreat actor in the wild

Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies

Huntress details intruders using PsExec and VSSAdmin on domain controllers to steal NTDS.dit credentials and delete shadow copies before ransomware.

Huntress analysts identified attackers launching SYSTEM-level command shells via PsExec on a domain controller, then running 'vssadmin create shadow' to snapshot and copy the NTDS.dit Active Directory database. Shadow copies were later deleted to destroy local recovery options ahead of a likely ransomware stage. Huntress recommends correlating VSS creation/deletion events with remote execution, DNS enumeration, and lateral movement rather than alerting on any single VSS event.

Cyber Security NewsSep 15, 08:29 UTC · 3d agoThreat actor in the wild

Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads

Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.

HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.

Cyber Security Newsupdated Sep 15, 11:51 UTC · 3d agofirst Sep 15, 06:56 UTC · 3d agoMalware in the wild 7 sources

Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor

Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.

Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.

GBHackersupdated Sep 17, 09:33 UTC · 1d agofirst Sep 15, 05:20 UTC · 3d agoExploit / PoC in the wild 4 sources CVE-2024-21762 CVE-2020-1938

Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users

Malicious 'Twitch Enhanced Viewer | JeetBot' browser extension stole live OAuth session tokens from roughly 31,000 Chrome and Firefox users.

Socket.dev found the cross-store extension 'Twitch Enhanced Viewer | JeetBot' rerouted Twitch playlist requests through operator-controlled proxies, attaching the victim's account-level OAuth token as a URL parameter where it could be logged in cleartext. About 30,000 Chrome and 552 Firefox installs were exposed, with tokens forwarded for nearly every watched channel to infrastructure tied to a Russian commercial bot service. The stolen bearer token enables chat, whisper, account-setting access and channel-point spending without the password or 2FA.

Cyber Security Newsupdated Sep 14, 15:00 UTC · 3d agofirst Sep 14, 13:50 UTC · 4d agoMalware in the wild 2 sources

Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning

Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.

Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.

Cyber Security NewsSep 14, 13:33 UTC · 4d agoMalware in the wild

Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities

Sophos uncovers a 64-bit Cyclops Blink variant on hacked Cisco FMC appliances, adding internal network scanning and selective packet capture; linked to Sandworm.

Sophos CTU analyzed a new 64-bit x86-64 Cyclops Blink implant (timezone_check) deployed on Cisco Secure Firewall Management Center appliances compromised via CVE-2026-20079 authentication bypass and CVE-2026-20316 low-privileged login. The activity is assessed with high confidence as Russian-nexus, with a moderate-confidence link to Sandworm (IRON VIKING, also tracked as Seashell Blizzard). The implant runs a parent controller plus five worker modules, masquerades as [kworker/0:1], persists via SysV init scripts at /lib/tz/timezone_check, and beacons to hard-coded C2 89.34.96.56 over a custom TLS protocol on ports 43856 and 49172. New module 0x11 scans internal IPv4 networks for SSH, SMB, LDAP, VMware, HTTP/HTTPS and VPN services, while module 0x12 performs filtered packet capture that can expose cleartext credentials, cookies and tokens.

GBHackersSep 14, 09:27 UTC · 4d agoMalware in the wildCVE-2026-20079 CVE-2026-203161

Hackers Deploy Casbaneiro Banking Trojan That Activates When Victims Open Bank Websites

Fortinet details Casbaneiro banking Trojan campaign hitting Latin American bank customers via invoice-themed PDF phishing, with AutoIt loading, RegSvcs.exe injection, and bank-site-triggered activation.

Fortinet identified an August 2026 Casbaneiro banking Trojan campaign targeting users in Argentina, Peru, Colombia, and Mexico through phishing PDFs styled as urgent invoices or legal notices. The staged chain uses IP-based geo-filtering, a Base64-encoded ZIP, an HTA file, and a legitimate AutoIt interpreter before injecting into RegSvcs.exe or mobsync.exe and persisting via a Startup shortcut. The Trojan exfiltrates address book and Outlook data unencrypted, stays dormant until victims visit targeted bank sites, then accepts commands for keyboard control, clipboard pasting, file execution, and command execution. It uses an expected HTTP 403 response from a second server and malformed HTTP requests to complicate network analysis.

Cyber Security NewsSep 14, 08:42 UTC · 4d agoMalware in the wild

China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor

China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.

Gen Threat Labs discovered UNC3569 exploiting CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows that chains an insecure sgbiz: protocol handler with an unsandboxed Chromium 80 CEF webview. The chain weaponizes CVE-2021-38003 (V8 type confusion) to run shellcode that DLL-sideloads via 7z.exe/7z.dll and deploys the GRAYRABBIT backdoor, which beacons over RC4-encrypted raw TCP 443 to mail.uaiubifas[.]top. Tencent patched the issue in version 16.3.0.3498, released via automatic updates on April 21, 2026. UNC3569 is a PRC-nexus espionage actor targeting government, education, technology, and financial sectors across East and Southeast Asia.

GBHackersupdated Sep 14, 13:01 UTC · 4d agofirst Sep 14, 08:09 UTC · 4d agoThreat actor in the wild 4 sources CVE-2026-51990 CVE-2021-380031

Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker

Unit 42 exposed CL-CRI-1171, a pay-per-install operation using YouTube gaming channels and SEO poisoning to deliver RATs and a Chrome hijacker.

Palo Alto Networks Unit 42 identified over 10,000 OfferLoader samples and 11 YouTube channels pushing trojanized installers via gaming lures and SEO-poisoned searches for tools like WinDirStat and Bluetooth drivers. Trojanized Inno Setup installers spawn three payload branches: Insomnia RAT (dual Node.js/Python backdoor that disables Microsoft Defender), ARKTunnel (undocumented RAT hiding its payload in a bitmap image and tunneling TCP/UDP), and Docro Hijacker (alters Chrome protected preferences to hijack search and affiliate links). The pay-per-install model sells each infection to multiple buyers, reaching gamers as well as corporate and government endpoints.

Cyber Security NewsSep 14, 08:01 UTC · 4d agoMalware in the wild1