ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Infodig”

25 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPhishing & fraud 1
SeverityAllcritical 0high 0medium 0low 0info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ZDI-26-669: Adobe Acrobat Reader DC JBIG2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI advisory ZDI-26-669 details an out-of-bounds read (CVE-2026-81978) when Adobe Acrobat Reader DC parses JBIG2 files.

The Zero Day Initiative published advisory ZDI-26-669 for an out-of-bounds read triggered when Acrobat Reader DC parses JBIG2 files. Successful exploitation allows a remote attacker to disclose sensitive information from affected installations. User interaction is required, such as opening a malicious file or visiting a malicious page. ZDI rated the issue 3.3 and assigned CVE-2026-81978.

ZDI Published Advisories · 6d agoAdvisory 19 sourcesCVE-2026-81978

ZDI-26-643: Oracle VirtualBox VMSVGA Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI publishes ZDI-26-643 for CVE-2026-60162, an out-of-bounds read information disclosure flaw in Oracle VirtualBox VMSVGA, rated CVSS 6.1.

Zero Day Initiative published advisory ZDI-26-643 describing an out-of-bounds read in Oracle VirtualBox's VMSVGA component. Local attackers with the ability to execute high-privileged code on the guest system can disclose sensitive information. ZDI rated the issue CVSS 6.1 and assigned CVE-2026-60162.

ZDI Published Advisories · 7d agoAdvisory 6 sourcesCVE-2026-60162

The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment

Rapid7 analyzes how fraud marketplaces are fragmenting into specialized shops after larger marketplaces were dismantled, aided by new MITRE F3 framework

Rapid7 reports a shift from large known fraud marketplaces to a fragmented environment of smaller specialized storefronts such as Xleet, Blackpass, Infodig, and Styx, operating across dark web channels, Telegram, and P2P options. These Fraud-as-a-Service shops sell stolen accounts, PII, synthetic identity generation, infrastructure, and money laundering support, supporting schemes like business email compromise. MITRE's Fraud Fighting Framework (F3), introduced in early 2026, aims to help security teams prioritize monitoring of fraud TTPs, particularly account takeover techniques. Fraud damages are anticipated to approach hundreds of billions of USD.

Rapid7 Blog · 5d agoPhishing & fraud

ZDI-26-582: Cisco Identity Services Engine PatchUpdateListener Directory Traversal Information Disclosure Vulnerability

Cisco Identity Services Engine's PatchUpdateListener has an authenticated directory traversal (CVE-2026-20148, CVSS 4.9) enabling sensitive information disclosure.

ZDI advisory ZDI-26-582 describes a directory traversal information disclosure vulnerability in the PatchUpdateListener component of Cisco Identity Services Engine. Remote attackers can disclose sensitive information, but valid authentication is required to exploit the flaw. ZDI assigned a CVSS rating of 4.9 and CVE-2026-20148.

ZDI Published Advisories · Aug 13, 2026VulnerabilityCVE-2026-20148

ZDI-26-615: (0Day) pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Zero Day Initiative disclosed an uncontrolled search path flaw in pdfforge PDF Architect's update service, allowing local privilege escalation (CVSS 7.8).

ZDI published advisory ZDI-26-615 describing a local privilege escalation vulnerability in the activation-service Update Service of pdfforge PDF Architect. An uncontrolled search path element lets local attackers escalate privileges, but they must first be able to execute low-privileged code on the target. ZDI rated the issue 7.8 and tagged it as a 0-day disclosure.

ZDI Published Advisories · 16d agoVulnerability

Anthropic Users Hit by Infostealer Attacks, Session Thefts

A threat actor used multiple infostealers to harvest session data and hijack Claude accounts belonging to an unknown number of users.

Dark Reading reports that a threat actor deployed a variety of infostealer families to collect session information, which was then used to access Claude accounts belonging to an unknown number of users. Anthropic has not disclosed the scale of the compromise. The incident underscores session token theft via infostealer logs as an effective route into AI platform accounts.

Dark Reading · 15d agoMalware in the wild

Seattle Times and Newsday sue OpenAI and Microsoft for infringement

The Seattle Times and Newsday sued OpenAI and Microsoft for copyright infringement, seeking destruction of datasets and models trained on their journalism.

The Seattle Times and Newsday allege OpenAI used their journalism as training data without permission and that its chatbots reproduce passages of their reporting, seeking destruction of copies of their works, training datasets, and AI models that incorporate them. Microsoft is named as co-defendant because Copilot is built on OpenAI technology. The suit follows similar actions by The New York Times, Ziff Davis, Merriam-Webster, Encyclopedia Britannica, and nearly 400 local newspapers.

The Verge · AI · 9d agoAI policy1

ZDI-26-613: (0Day) pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI published ZDI-26-613, an unpatched memory corruption flaw in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-613, a memory corruption vulnerability in pdfforge PDF Architect's PDF file parsing that allows remote code execution on affected installations. User interaction is required, meaning the target must visit a malicious page or open a malicious file. ZDI assigned a CVSS score of 7.8 and classifies the issue as a 0day.

ZDI Published Advisories · 16d agoAdvisory

Infostealers Are Hijacking Claude Sessions and Draining Subscriptions

Infostealers hijacked active Claude sessions to bypass 2FA, drain paid usage and run unauthorized charges; Anthropic is revoking sessions and refunding.

Anthropic confirmed that infostealer malware on user machines stole active Claude login sessions, letting attackers bypass passwords, MFA, and SSO and drain paid usage and run unauthorized charges. Affected families identified on Windows include Vidar, LummaC2, StealC, RedLine, and Acreed, plus Atomic Stealer on a small number of Macs; the malware typically arrived via unofficial downloads or malicious apps. Anthropic signed users out, removed saved payment cards, revoked affected sessions, and is refunding unauthorized charges, noting phones and tablets were not involved.

Security Affairs · 16d agoMalware in the wild

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

Huntress analysts trace one X direct message into separate Mac and Windows malware chains delivering AMOS infostealer and NetSupport Manager RAT.

Huntress SOC analysts dissected a malware campaign distributed via an X direct message styled as a Google Docs sidebar. macOS users were routed to the AMOS infostealer, while Windows users received NetSupport Manager remote access malware. The write-up details how a single message branched into two distinct delivery paths per operating system.

Huntress · 4d agoMalware in the wild

ZDI-26-612: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-612, an unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-612, an out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Successful exploitation allows remote code execution on affected installations. User interaction is required, as the target must visit a malicious page or open a malicious file; ZDI assigned a CVSS score of 7.8 and lists the flaw as a 0day.

ZDI Published Advisories · 16d agoAdvisory

Infostealers are hijacking Claude accounts at users’ expense

Malwarebytes reports infostealers are stealing Claude session cookies to hijack Anthropic accounts and consume victims' usage at their expense.

Anthropic warned that infostealer malware operators are harvesting Claude session cookies from infected machines. Attackers replay the stolen cookies to take over users' accounts and consume their usage quotas, affecting the victims' own access. The activity involves observed account hijacking rather than a flaw in Claude itself.

Malwarebytes Labs · 15d agoMalware in the wild

ZDI-26-611: (0Day) pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

ZDI published ZDI-26-611, an unpatched out-of-bounds read in pdfforge PDF Architect App Object enabling remote code execution (CVSS 7.8).

The Zero Day Initiative disclosed ZDI-26-611, an out-of-bounds read vulnerability in the App Object component of pdfforge PDF Architect that can lead to remote code execution. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI rated the issue 7.8 on the CVSS scale and marks it as a 0day pending a vendor patch.

ZDI Published Advisories · 16d agoAdvisory

ZDI-26-551: OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI advisory ZDI-26-551 discloses CVE-2026-18292, memory corruption in OriginLab OriginPro OGG file parsing enabling remote code execution with user interaction.

OriginLab OriginPro contains a memory corruption vulnerability when parsing OGG files, tracked as CVE-2026-18292 with CVSS 7.8. Remote code execution requires user interaction, meaning the target must open a malicious file or visit a malicious page. ZDI published the finding as advisory ZDI-26-551.

ZDI Published Advisories · Aug 11, 2026VulnerabilityCVE-2026-18292

Malicious Ads Infostealer League

Malicious advertisements delivered an infostealer in a widespread malvertising campaign.

The report describes malicious advertisements that distribute an information-stealer to users who click or interact with the ads. Infostealers typically harvest saved browser passwords, session cookies, and cryptocurrency wallet data from infected machines. The specific malware family, ad networks abused, and victim counts are not stated in the headline.

Infosecurity Magazine · Aug 16, 2026Malware in the wild

ZDI-26-557: (Pwn2Own) Amazon Smart Plug Insecure Fallback Information Disclosure Vulnerability

ZDI disclosed a Pwn2Own information disclosure flaw (CVSS 4.3) in Amazon Smart Plug, letting unauthenticated network-adjacent attackers access sensitive information.

The Zero Day Initiative published ZDI-26-557 for an insecure fallback information disclosure flaw in Amazon Smart Plug, demonstrated at Pwn2Own. Unauthenticated network-adjacent attackers can disclose sensitive information on affected installations. ZDI rated the issue CVSS 4.3.

ZDI Published Advisories · Aug 12, 2026Advisory

ZDI-26-614: (0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI published ZDI-26-614, another unpatched out-of-bounds write in pdfforge PDF Architect PDF parsing enabling remote code execution (CVSS 7.8).

The Zero Day Initiative published ZDI-26-614, a second out-of-bounds write vulnerability in pdfforge PDF Architect's PDF file parsing. Attackers can execute arbitrary code on affected installations, provided the user visits a malicious page or opens a malicious file. The flaw carries a ZDI-assigned CVSS score of 7.8 and remains unpatched (0day).

ZDI Published Advisories · 16d agoAdvisory

Cortex Xdr

Stub page for Palo Alto Cortex XDR with no article text, offering no news content for classification.

The item contains only the title 'cortex xdr' and no article body. It references Palo Alto Networks' Cortex XDR product but provides no event, release, or threat information. Classified as general vendor/industry content with minimal relevance.

Palo Alto Unit 42 · 8d agoIndustry

What the 3M ChatGPT case reveals about AI governance

3M litigation shows ChatGPT prompts can become discoverable evidence, forcing enterprises to govern AI conversation records.

In the Watson Grinding explosion litigation, an engineering expert retained by 3M had used ChatGPT, and a surfaced prompt asked the system to 'show how 3M is 0% at fault'; after an off-record deposition demand, more than 350 pages of previously unproduced ChatGPT material were provided. The author argues AI interaction histories are becoming part of decision records and discovery material, a trend the American Bar Association has already examined. Enterprises are urged to manage retention, ownership, sharing, and deletion of AI conversation logs across tools like ChatGPT, Copilot, Claude, and Gemini.

CSO Online · 2d agoPolicy & legal

ZDI-26-638: Oracle Outside In Technology WPS File Parsing Memory Corruption Remote Code Execution Vulnerability

ZDI disclosed memory corruption in Oracle Outside In Technology's WPS file parsing (CVE-2026-60414) enabling user-triggered remote code execution.

Zero Day Initiative published ZDI-26-638, a CVSS 7.8 memory corruption vulnerability in WPS file parsing within Oracle Outside In Technology. Remote attackers can execute arbitrary code on affected installations by convincing the target to visit a malicious page or open a malicious file, so user interaction is required. The issue is tracked as CVE-2026-60414. The advisory reports no exploitation.

ZDI Published Advisories · 7d agoVulnerability 4 sourcesCVE-2026-60414

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.

Okta analyzed a 7 GB infostealer dump from August 2, 2026 covering 5,871 infected machines in 162 countries and found 555 of 44,791 JWTs related to AI services, plus 1,843 unexpired JWTs and JWEs (largely set by OpenAI via NextAuth.js) and 24 still-valid API keys for Google Gemini, OpenAI, Groq and OpenRouter. Valid session tokens and API keys can be replayed with anti-detect browsers like Camoufox to bypass credential and MFA checks, fueling an underground market for AI account access known as LLMjacking, where attackers rack up victims' AI compute bills. Some 17.7% of the JWTs contained plaintext PII usable for social engineering. Google's GTIG reported growing buyer demand for Claude, Gemini, Cursor and Devin credentials, and Mandiant handled an incident where an actor used an exposed GitHub PAT to deploy unauthorized AI infrastructure and scale high-performance compute.

The Hacker News · 7d agoThreat actor in the wild1

ZDI-26-599: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability

ZDI published advisory ZDI-26-599 for a use-after-free information disclosure flaw (CVE-2026-57238, CVSS 3.3) in Foxit PDF Reader requiring user interaction.

The Zero Day Initiative released advisory ZDI-26-599 describing a use-after-free vulnerability in Foxit PDF Reader's annotation handling. The flaw allows remote attackers to disclose sensitive information when a target opens a malicious file or visits a malicious page. ZDI rated the issue CVSS 3.3 and assigned CVE-2026-57238.

ZDI Published Advisories · 23d agoAdvisoryCVE-2026-57238

DeepZero: Open-source hunting for vulnerable Windows drivers

DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.

DeepZero is a free, open-source Python pipeline orchestrator that automates hunting for exploitable Windows kernel drivers relevant to BYOVD (bring your own vulnerable driver) attacks. Its seven-stage YAML pipeline parses PE headers, filters for kernel-mode drivers with IOCTL surfaces, excludes drivers listed on loldrivers.io, then runs headless Ghidra decompilation, Semgrep scanning, and an LLM-based exploitability assessment. The maintainer reports multiple verified vulnerabilities in the Snappy Driver Installer corpus, some still in the disclosure process, and notes findings involving plug-and-play-created device objects may need physical hardware to confirm.

Help Net Security · 9h agoTools

ZDI-26-573: Linux Kernel KSMBD Response Header Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI disclosed an unauthenticated out-of-bounds read (CVE-2026-68431) in Linux Kernel KSMBD causing sensitive information disclosure, CVSS 9.3.

The Zero Day Initiative published ZDI-26-573 describing an out-of-bounds read in the Linux Kernel KSMBD response header handling. Unauthenticated remote attackers can disclose sensitive information, but only systems with ksmbd enabled are affected. ZDI assigned a CVSS score of 9.3 and the identifier CVE-2026-68431.

ZDI Published Advisories · Aug 13, 2026VulnerabilityCVE-2026-68431

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline

Cyble walkthrough maps how infostealer logs move from endpoint infection through aggregation and enrichment to dark web credential marketplace sales.

Cyble breaks the credential theft pipeline into stages: infostealer execution harvesting browser credential stores, cookies, session tokens, crypto wallets, and FTP configurations; aggregation of stealer logs via C2 panels into bundled archives; parsing and enrichment against previously leaked datasets; and final listing on dark web marketplaces. Enrichment adds employer and role context that raises prices and enables credential stuffing across reused passwords. The report advises SOC teams to monitor stealer logs and marketplace chatter early rather than waiting for breach alerts.

Cyble · 6d agoMalware1