Search: “creddata”

Rare Not Random Using Token Efficiency for Secrets Scanning

Researcher proposes token efficiency (string length divided by BPE token count) as a better post-regex filter than entropy for secrets scanning, validated on CredData.

The post explores whether Byte-Pair Encoding tokenization can replace Shannon entropy as the primary filter for candidate secrets captured by regex in tools like Gitleaks. It defines 'token efficiency' as string length divided by token count under the cl100k_base tokenizer; secret-like strings such as GitHub tokens tokenize into many small tokens and score low, while natural text scores high. Evaluating labeled secrets from the CredData dataset shows a usable separation, with roughly 2.5 suggested as a minimum cutoff versus Gitleaks' 3.5 entropy threshold. The technique is positioned as a post-regex filtering step rather than a standalone detector.

Lobsters · security·Sep 12, 06:42 UTC · 4d agoResearch

Dark Caracal Adds New Malware to Cyber Espionage Arsenal

Dark Caracal added GoCaracal, a modular malware framework, expanding its espionage toolkit for data theft and persistent access.

Dark Caracal, a known espionage-focused threat group, has added GoCaracal, a new modular malware framework, to its arsenal. The framework broadens the group's ability to steal victim data and maintain persistent access, according to Dark Reading coverage on 2026-08-26. The addition indicates continued investment in the group's offensive toolset.

Dark Reading·Aug 26, 21:33 UTC · 21d agoMalware in the wild

Serial Microsoft 0-day hunter drops yet another Defender exploit

Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC that bypasses September patches and reads files as SYSTEM.

Zero-day researcher Nightmare Eclipse (MSNightmare) published ShieldCrash, their 11th Microsoft zero-day, a proof-of-concept bypass of the ShieldBreak patch (CVE-2026-69414), which itself had bypassed the fix for RoguePlanet (CVE-2026-50656). ShieldCrash works on Windows 10, Windows 11, and Windows Server systems that have applied the September 2026 patches and allows arbitrary file reads as SYSTEM, though not arbitrary writes or a full SYSTEM shell. Microsoft has not said when it plans to patch the issue. The researcher recently also released zero-days affecting CrowdStrike Falcon (FalconFlank), Kaspersky endpoint antivirus (HardBreacher, patched), and Gen Digital's Avast (PrettyPrague).

The Register · Security·Sep 9, 17:23 UTC · 7d agoExploit / PoCCVE-2026-69414CVE-2026-50656

CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials

Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.

Zscaler ThreatLabz analyzed the CaptiveCrunch credential theft campaign first reported by Microsoft on July 31. Microsoft attributes the activity to Storm-2945, a sub-cluster of Russia-linked Midnight Blizzard (APT29, Cozy Bear, NOBELIUM, BlueBravo). The actor manipulates DNS and HTTP traffic on captive portal networks at hotels and conference centers, redirecting victims to attacker-controlled infrastructure for Microsoft 365 credential harvesting, device code phishing, and malware delivery. Evidence indicates shared captive portal services were compromised rather than each venue being breached individually.

Zscaler ThreatLabz·Aug 11, 22:06 UTC · Aug 11, 2026Threat actor in the wild

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.

Palo Alto Networks Unit 42 details CL-CRI-1171, a cybercrime cluster operating a pay-per-install (PPI) marketplace that has delivered multiple malware families for at least two years. The group used at least eleven YouTube gaming channels with hundreds of thousands of followers, plus SEO poisoning promoting trojanized software such as a Bluetooth driver and WinDirStat, infecting gamers and corporate endpoints including critical infrastructure and government entities. A single shared loader delivered payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz between July 2025 and April 2026, with more than 10,000 distinct loader samples and over 200 rotating C2 domains identified. YouTube terminated the malicious channels after Unit 42 notified the platform.

Palo Alto Unit 42·Sep 9, 10:00 UTC · 7d agoMalware in the wild1

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback

Dark Caracal targeted a Venezuelan communications organization with new Go-based GoCaracal malware and an updated Bandook backdoor using Ethereum smart-contract C2 fallback.

Arctic Wolf Labs linked a June 2026 intrusion against a communications organization in Venezuela to Dark Caracal, an espionage group associated with Lebanon's General Directorate of General Security (GDGS). The group deployed a previously undocumented Go-based framework called GoCaracal in lightweight and extended builds alongside a Delphi-loaded Bandook backdoor, with delivery via phishing emails carrying weaponized SVG attachments through URL shorteners. The extended build uses a custom Solidity contract, BulletproofC2, on Ethereum to retrieve replacement C2 addresses without redeploying malware, and Arctic Wolf traced 249 related samples from January to July 2026 showing a modular evolution arc.

Security Affairs·Aug 27, 20:31 UTC · 20d agoThreat actor in the wild

ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities

ENISA launched the CRA Single Reporting Platform, making EU manufacturers report actively exploited vulnerabilities and severe incidents through one portal.

ENISA switched on the Cyber Resilience Act's Single Reporting Platform on 11 September 2026, the same day CRA reporting obligations became binding on manufacturers. Reports require an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days (one month after notification for severe incidents). Filings go through an EU Login account with MFA, are routed to a coordinating CSIRT chosen by the manufacturer, and no API is available in the first release. Open-source software stewards fall under the same obligations from 11 December 2027.

Help Net Security·Sep 14, 12:23 UTC · 2d agoPolicy & legal

MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferra

eSentire uncovered a malware-as-a-service campaign pairing ClickFix social-engineering lures with the ErrTraffic and Cruciferra malware families.

Threat researchers at eSentire identified an ongoing malware-as-a-service (MaaS) campaign that combines ClickFix social-engineering lures with the ErrTraffic and Cruciferra malware families. The campaign relies on ClickFix-style deception to trick users into executing malicious actions that deliver the malware. Further technical detail on affected sectors or infection volumes was not provided in the disclosure.

Infosecurity Magazine·Aug 19, 15:00 UTC · 28d agoMalware in the wild

ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability

ZDI publishes ZDI-26-645 for CVE-2026-84387, an authenticated command injection RCE in Fortinet FortiSandbox via crontab backup, rated CVSS 7.2.

Zero Day Initiative published advisory ZDI-26-645 describing a command injection flaw in Fortinet FortiSandbox's write_remote_backup_to_crontab function. Remote authenticated attackers can execute arbitrary code through the cronValue parameter. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-84387.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoAdvisoryCVE-2026-84387

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.

GBHackers·Sep 11, 12:24 UTC · 5d agoMalware in the wild2

CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

Critical ZooKeeper flaw lets any authenticated client delete arbitrary empty persistent or container znodes by bypassing ACL checks.

CVE-2026-79993 (critical severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific empty znodes in the data tree regardless of ACL restrictions on the znode or its parent. This can corrupt coordination state for dependent distributed systems like Kafka, HBase, or Solr clusters relying on ZooKeeper.

oss-security·Sep 15, 18:24 UTC · 1d agoVulnerabilityCVE-2026-79993

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase warns an actively exploited zero-day (CVE-2026-72898, CVSS 10.0) grants unauthenticated admin access; Framework, n8n, and Kilo Code disclosed data exposure.

Metabase disclosed a maximum-severity SQL injection affecting versions x.58 through x.63 that lets unauthenticated attackers inject SQL via the /api/session/reset_password endpoint and gain administrator access to Metabase instances. Metabase Cloud was attacked, patches were released, and CISA added CVE-2026-72898 to the KEV catalog with a federal remediation deadline of August 14, 2026. Downstream victims include Framework (customer names, IPs, addresses, phone numbers, and emails accessed), n8n (136 customer records, five with bcrypt-hashed passwords), and Kilo Code (Slack access tokens). Wiz estimates roughly 13% of cloud environments run self-hosted Metabase, with about 2,500 instances internet-accessible.

The Hacker News·Aug 12, 13:47 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-72898CVE-2023-38646

Mathspace discloses data breach affecting over 1 million people

Mathspace disclosed a Metabase breach exposing data of 1,079,819 students, parents, and staff in Australia and New Zealand.

Mathspace confirmed attackers exploited a vulnerability in its self-hosted Metabase reporting system, gaining administrator access without legitimate login and downloading data on over 1 million people (1,079,819 total) in Australia and New Zealand. Access began August 10, data was downloaded August 27, and the theft was confirmed September 3, 2026. No credentials, academic records, or school-account links were exposed, but affected individuals are warned of targeted phishing. The incident joins a broader campaign against Metabase instances, including Trezor's provider ShipMonk, Framework, and Tally, linked to ShinyHunters via extortion emails and leak-site listings.

BleepingComputer·Sep 7, 13:05 UTC · 9d agoData breach in the wild

Cron Job Injection in Remote Backup

Fortinet FortiSandbox command injection flaw (CVSS 6.7) in remote backup cron jobs lets privileged attackers execute arbitrary code via crafted HTTP requests.

Fortinet advisory FG-IR-26-167 discloses a command injection vulnerability (CWE-77, CVSSv3 6.7) in FortiSandbox's remote backup cron job functionality. A privileged attacker can execute unauthorized code or commands via crafted HTTP requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit

A researcher known as Nightmare-Eclipse published another zero-day exploit, dubbed ShieldCrash, targeting Windows Defender.

Dark Reading reports that the disgruntled researcher tracked as Nightmare-Eclipse continued a vendetta against Microsoft by publishing a new zero-day exploit named ShieldCrash for Windows Defender. The brief report does not detail affected versions, exploitation prerequisites, or whether exploitation has been observed.

Dark Reading·Sep 10, 15:29 UTC · 6d agoExploit / PoC1

Russian hackers abuse hotel Wi-Fi networks to steal Microsoft 365 credentials and deploy malware

Help Net Security·Aug 4, 00:00 UTC · Aug 4, 2026Malware1

New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender

Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC bypassing ShieldBreak patches to gain System privileges on Windows.

The researcher known as Nightmare Eclipse released a PoC zero-day exploit dubbed ShieldCrash against Microsoft Defender on fully patched Windows systems. The exploit grants arbitrary file read with System privileges and can be used to drop the SAM database. It bypasses Microsoft's September 3 fixes for ShieldBreak (CVE-2026-69414), which itself bypassed patches for the RoguePlanet race condition (CVE-2026-50656). Microsoft has been contacted for comment and has not yet responded.

SecurityWeek·updated Sep 10, 12:18 UTC · 6d ago·first Sep 10, 07:09 UTC · 6d agoExploit / PoC 2 sourcesCVE-2026-50656CVE-2026-694141

RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families

Unit 42 names RANCOR, a previously unidentified espionage group targeting Southeast Asian political entities with newly discovered PLAINTEE and DDKONG malware families.

Unit 42 tracks a previously unidentified group it dubs RANCOR conducting highly targeted espionage attacks in Singapore and Cambodia using two custom malware families, DDKONG and PLAINTEE. Attacks appear to have begun with spear phishing, with decoy political news documents hosted on legitimate sites including a Cambodian government website and Facebook. Infrastructure links to IP 89.46.222[.]97 and KHRAT-associated domains such as facebook-apps[.]com, and the activity is grouped into two clusters tied together by PLAINTEE usage and similar targeting.

Palo Alto Unit 42·Aug 17, 13:24 UTC · Aug 17, 2026Threat actor1

VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch

SOCRadar's Threat Research Unit documents VectraRAT, a previously unreported full-stack Malware-as-a-Service platform built entirely from scratch.

SOCRadar's Threat Research Unit (STRU) documented VectraRAT, an undocumented Malware-as-a-Service platform. Unlike most MaaS offerings derived from leaked builders, VectraRAT was built entirely from scratch. The report details the platform's architecture and capabilities offered to affiliate customers.

SOCRadar·updated 14:36 UTC · 8h ago·first Sep 14, 12:50 UTC · 2d agoMalware 3 sources

Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs

Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.

PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.

Cyber Security News·Sep 9, 14:07 UTC · 7d agoMalware in the wild

Fortinet Confirms Critical Zero Day

Fortinet has confirmed a critical zero-day vulnerability; the available headline provides no product, CVE, or exploitation details.

Infosecurity Magazine's headline states that Fortinet has confirmed a critical zero-day vulnerability. The available source text contains no additional details on affected products, CVE identifiers, exploitation status, or available fixes. Defenders should treat specifics as unconfirmed pending a vendor advisory.

Infosecurity Magazine·Aug 16, 00:00 UTC · Aug 16, 2026Exploit / PoC in the wild

Fortinet security advisory (AV26-023) - Update 1

CISA added Fortinet CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its KEV catalog; Canadian Cyber Centre urges patching.

The Canadian Centre for Cyber Security updated advisory AV26-023, which relays January 2026 Fortinet advisories covering FortiFone, FortiOS, FortiSASE, FortiSIEM, and FortiSwitchManager. On September 9, 2026, CISA added CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its Known Exploited Vulnerabilities catalog. Related Fortinet flaws include unauthenticated local configuration access (CVE-2025-47855) and unauthenticated remote command injection (CVE-2025-64155). Administrators should review the advisories and apply available updates.

Canadian Centre for Cyber Security·Sep 9, 19:57 UTC · 7d agoExploit / PoC in the wildCVE-2025-25249CVE-2025-47855CVE-2025-64155

Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day

Researcher Chaotic Eclipse released ShieldCrash, a PoC showing Microsoft Defender's CVE-2026-69414 patch is incomplete, enabling arbitrary file reads as SYSTEM.

Security researcher Chaotic Eclipse published ShieldCrash, a proof-of-concept exploit for the Microsoft Malware Protection Engine privilege escalation vulnerability CVE-2026-69414 (ShieldBreak). The PoC performs arbitrary file reads with SYSTEM privileges on all supported Windows versions, including systems running the September 2026 security updates and Malware Protection Engine version 1.1.26080.3. The researcher claims Microsoft's patch fixed several exploit paths but missed a specific condition that still enables the attack. His recent releases also include zero-day PoCs targeting Nvidia, Kaspersky, Avast, and CrowdStrike Falcon.

Security Affairs·Sep 9, 07:53 UTC · 7d agoExploit / PoCCVE-2026-69414

Abyssos: Technical Analysis of a New Modular RAT

Zscaler ThreatLabz analyzes Abyssos, a new modular C++ RAT offering credential theft, file exfiltration, and VNC-based remote access.

Zscaler ThreatLabz identified a new malware family tracked as Abyssos in late June 2026. Abyssos is a modular remote administration tool (RAT) written in C++ that supports credential theft, file exfiltration, and remote access via VNC. The malware is under active development, with multiple version numbers and obfuscation passes designed to evade security products. The analysis covers its core features, configuration, obfuscation, and network communication protocol.

Zscaler ThreatLabz·Aug 10, 15:51 UTC · Aug 10, 2026Malware

Trezor data breach impact now reaches 81,000 customers

Trezor's ShipMonk breach now affects 81,000 customers, adding 67,000 US customers after Metabase exploitation by ShinyHunters-linked attackers.

Trezor expanded its August 13 breach disclosure, saying the incident at shipping partner ShipMonk now affects 81,000 customers, with 67,000 additional US customers who ordered between November 2019 and August 2021 exposed. Attackers exploited a Metabase SQL injection zero-day to access ShipMonk's systems, exposing names, emails, phone numbers, shipping addresses, and order numbers; ShipMonk reportedly received extortion emails from the ShinyHunters gang. Trezor's own systems and devices were not compromised, and affected users are warned of phishing and scams. The broader Metabase campaign also hit Tally and Framework.

BleepingComputer·Sep 7, 12:16 UTC · 9d agoData breach in the wild

Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPrague

Researcher Chaotic Eclipse released PrettyPrague, a PoC zero-day privilege escalation exploit against fully patched GenDigital Avast Antivirus.

Security researcher Chaotic Eclipse (also known as INFINITE NIGHTMARE or MSNightmare) published a PoC named PrettyPrague exploiting a zero-day privilege escalation flaw in Avast Antivirus. The PoC abuses a flaw in the Avast Sandbox to dump the Windows SAM database and spawn a SYSTEM-level shell, reportedly working on fully patched Avast and patched Windows 11 25H2. The researcher believes the flaw may also affect other GenDigital products such as AVG and Norton. It follows his recent HardBreacher PoC for a Kaspersky Endpoint Security privilege escalation flaw.

Security Affairs·Sep 1, 14:33 UTC · 15d agoExploit / PoC

Fraudsters steal $6 million from Tectonic crypto platform after inflating token price

Attackers inflated Tectonic's Tonic token price 100x in 20 minutes and borrowed $74 million against it, stealing $6 million before Cronos halted activity.

Attackers manipulated the price of Tectonic's thinly traded Tonic token, raising it more than 100-fold in 20 minutes, then used the inflated tokens as collateral to borrow assets in an attempted $74 million theft. About $6 million left the platform; Cronos halted blockchain activity and later restored roughly $69 million in frozen funds via an on-chain rollback. Tectonic plans a phased reopening and a postmortem. TRM Labs says market manipulation now accounts for one in eight crypto hacks, with 32 incidents in 2026, and compares the case to the 2022 Mango Markets manipulation that led to a criminal conviction.

The Record·Aug 31, 19:42 UTC · 16d agoPhishing & fraud

PEEP: A Browser RAT Posing as a Chrome Extension

SOCRadar's STRU analyzed PEEP, an emerging Chromium-based RAT disguised as a Chrome extension enabling post-exploitation control of browsers.

SOCRadar's Threat Research Unit (STRU) identified and analyzed PEEP, a Chromium-based post-exploitation toolkit distributed as a browser extension. PEEP provides RAT-style capabilities while posing as a legitimate Chrome extension. It is assessed as an emerging threat worth monitoring by defenders.

SOCRadar·Sep 4, 09:50 UTC · 12d agoMalware

ZTNA Portal Improper Certificate Validation

Fortinet fixed an improper certificate validation flaw (CVSS 7.3) in FortiOS and FortiProxy Agentless ZTNA portal enabling unauthenticated man-in-the-middle attacks on backend traffic.

Fortinet advisory FG-IR-26-174 discloses an improper certificate validation vulnerability (CWE-295) in the FortiOS and FortiProxy Agentless ZTNA portal, rated CVSSv3 7.3. A remote and unauthenticated attacker can perform a man-in-the-middle attack on the communication channel between the ZTNA portal and the backend destination website. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory

C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2

Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor likely tied to ransomware actors and delivered via ClickFix chains, using GitHub for C2.

In July 2026, Zscaler ThreatLabz identified C2Looper, a new Rust-based backdoor family. The malware supports arbitrary command execution, reconnaissance, and deployment of second-stage payloads, and uses GitHub as its command-and-control channel. ThreatLabz assesses with low-to-medium confidence that it is delivered through multi-stage ClickFix infection chains and is likely leveraged by a ransomware-related threat actor. The analysis covers multiple C2Looper variants, their network protocols, and capabilities.

Zscaler ThreatLabz·Aug 17, 14:06 UTC · Aug 17, 2026Malware in the wild1

Fortinet security advisory (AV26-898)

Canadian Cyber Centre advisory AV26-898 flags Fortinet vulnerabilities across FortiOS, FortiProxy, FortiPAM, FortiSandbox and FortiMonitorOnSight, urging administrators to apply updates

The Canadian Centre for Cyber Security relayed Fortinet PSIRT advisories (AV26-898) listing vulnerabilities affecting FortiOS 7.6.1-7.6.6, FortiProxy 7.6.2-7.6.6, FortiPAM Chrome extensions 7.4/8.0, FortiSandbox 4.4 and 5.0, FortiSandbox Cloud and PaaS 5.0.4-5.0.5, and FortiMonitorOnSight 7.2. The bulletin does not detail individual CVEs or exploitation. Administrators and users are encouraged to review the linked Fortinet advisories and apply the necessary updates.

Canadian Centre for Cyber Security·Sep 9, 13:48 UTC · 7d agoAdvisory1