60
60
60
60
60
60
60
60
60
60
Multiple Chinese hacking groups seen using identical Chrome zero-day exploit
Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.
Proofpoint identified at least four Chinese-aligned espionage groups (TA412/RedBravo, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) using an identical Chrome zero-day exploit kit dubbed BlueMoon in late August through this week. Targets include US defense contractors, NGOs, mining companies, and Southeast Asian government agencies. The exploit chains a Chromium patch-gap vulnerability with a Windows flaw, delivering malware such as ShadowPad and a fake Gemini browser extension backdoor, with possible AI-assisted exploit development.
85
Operation Triangulation: The last (hardware) mystery
60
60
60
60
60
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk
QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.
German incident response firm QUIRSOS assessed with moderate confidence that a suspected China-nexus actor, likely operating in UTC+08:00 hours, exploited VMware vCenter flaw CVE-2026-59310 (CVSS 9.8 directory traversal) beginning five days after Broadcom's July 29 patch. The campaign compromised 361 unique victim IPs across 47 countries, most in Germany, the US, Turkey, Iran, and France. The actor abused cron jobs, a XOR-obfuscated 'linuxFile' WebSocket backdoor with systemd/cron persistence, a JSP web shell, SSH authorized-keys manipulation, and a reverse SSH tool, with one Babuk deployment reported. A separate vCenter 'vcenter_admin' account creation consistent with CVE-2026-59309 exploitation was also observed from August 1.
78
60
60
U.S. Cybersecurity Agency Warns of Actively Exploited Ivanti EPMM Vulnerability
60
60
60
60
Week in review: PostgreSQL databases under attack, new Chrome zero-day actively exploited
60
New Ivanti Vulnerability Observed as Widespread Security Concerns Grow
60
60
60
60
60
Update Your Chrome Browser to Patch 2 New In-the-Wild 0
60
Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.
Google Threat Intelligence Group says attackers are targeting proprietary AI models across healthcare, government, and media, exfiltrating API credentials, and co-opting victim cloud environments to run unauthorized AI workloads. TeamPCP (Altered Spider/UNC6780) is conducting supply chain compromises of PyPI, npm, and Docker Hub, deploying the SANDCLOCK and DUSTMAKER credential stealers, with DUSTMAKER using AI workspace poisoning and prompt injection for defense evasion. One financially motivated actor used an autonomous multi-agent framework to compromise thousands of third-party credentials in under six hours without human intervention. China-nexus groups UNC6508 and Basin Castle (Mustang Panda) used local open-weight LLMs and commercial LLMs like Gemini, Claude, and Codex for espionage tasks and evading provider monitoring.
72
60
60
Most Sophisticated iPhone Hack Ever Exploited Apple's Hidden Hardware Feature
60
60
60
60
Chinese espionage groups swarm to exploit triple-link chain of zero-days
At least four China-aligned espionage groups chained three zero-days in Chromium browsers and Windows ALPC for espionage since late August.
Proofpoint observed at least four state-aligned threat groups, starting with TA412/Violet Typhoon/APT31 on August 28, chaining three zero-days in the 'BlueMoon' exploit chain targeting Chrome, Chromium-based browsers and Microsoft Windows. The chain includes RCE flaws in Chromium's JavaScript engine (CVE-2026-85046, CVE-2026-87491) and a Windows Advanced Local Procedure Call privilege-escalation zero-day (CVE-2026-85880), enabling sandbox code execution, sandbox escape and system privileges. APT31 delivered the chain via phishing links to NGOs, mining and commodity trading firms in the US, installing a browser extension disguised as Google Gemini to surveil activity and steal credentials. Other groups (UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) targeted US aerospace, Vietnamese manufacturing, and Indonesian and Singaporean organizations; fewer than 20 victims were directly observed but the true count is likely higher.
88
60
60