Search: “oauth”

Cybercriminals are building phishing pages that exist only inside victims’ browsers

Barracuda details a DocuSign-themed phishing campaign that renders login pages locally via blob URLs, abusing genuine Microsoft OAuth and Teams infrastructure.

Barracuda researchers describe a phishing campaign that starts with DocuSign-themed emails carrying calendar invites pointing to genuine Microsoft OAuth endpoints, then routes victims through Microsoft Teams to a resource hosted on cdn.bloom[.]io. The login page is assembled entirely inside the victim's browser from a blob URL, registers a service worker, and runs inside a sandboxed iframe that receives live instructions from the attacker's backend. Hidden command-and-control configuration indicates the page is part of a centrally managed phishing platform that can be updated and steered across many victims. Barracuda recommends phishing-resistant MFA such as FIDO2 keys or passkeys, monitoring of OAuth flows and redirect chains, and behavior-based identity controls rather than URL blocklisting.

Help Net Security·updated Sep 10, 14:04 UTC · 6d ago·first Sep 10, 05:00 UTC · 6d agoPhishing & fraud in the wild 3 sources

Attackers are going after prominent individuals through OAuth phishing, FBI warns

FBI IC3 warns of ongoing OAuth consent phishing since late 2025 targeting prominent individuals to gain persistent, password-free account access.

Attackers register malicious applications with legitimate OAuth providers, impersonate journalists, academics, event organizers, or government officials on messaging apps and email, and lure targets into approving permission requests on real Microsoft or Google login pages. Once approved, the attacker's application can read and send emails and access sensitive files within granted permissions, bypassing both passwords and MFA. The FBI notes password changes do not revoke this access; victims must invalidate the OAuth token in application security settings, and no attribution or victim list has been disclosed.

Help Net Security·Sep 2, 00:00 UTC · 14d agoPhishing & fraud in the wild

Webinar: How malicious OAuth apps can lead to Google Workspace breaches

BleepingComputer webinar will dissect two Google Workspace breaches caused by malicious OAuth apps and social engineering, hosted September 23 with Material Security.

On September 23, 2026, BleepingComputer will host a webinar with Material Security examining two real attacks that used malicious OAuth applications and social engineering to breach Google Workspace environments. Rather than stealing credentials, attackers persuaded users to authorize malicious apps, gaining access to data through the granted permissions. The session covers first-hour response decisions and which security controls provide the greatest value for fast-growing organizations.

BleepingComputer·Sep 14, 12:15 UTC · 2d agoPhishing & fraud

Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.

Okta analyzed a 7 GB infostealer dump from August 2, 2026 covering 5,871 infected machines in 162 countries and found 555 of 44,791 JWTs related to AI services, plus 1,843 unexpired JWTs and JWEs (largely set by OpenAI via NextAuth.js) and 24 still-valid API keys for Google Gemini, OpenAI, Groq and OpenRouter. Valid session tokens and API keys can be replayed with anti-detect browsers like Camoufox to bypass credential and MFA checks, fueling an underground market for AI account access known as LLMjacking, where attackers rack up victims' AI compute bills. Some 17.7% of the JWTs contained plaintext PII usable for social engineering. Google's GTIG reported growing buyer demand for Claude, Gemini, Cursor and Devin credentials, and Mandiant handled an incident where an actor used an exposed GitHub PAT to deploy unauthorized AI infrastructure and scale high-performance compute.

The Hacker News·Sep 9, 14:23 UTC · 6d agoThreat actor in the wild1

Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

Suspected Russian clusters abuse OAuth and authentication flows to phish academia, defense, government, and think tank targets across Europe and the US.

Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage clusters abusing legitimate authentication flows. Newly detailed clusters UNC7005 and UNC5976 conduct phishing, abuse OAuth flows, and/or deploy malware, alongside previously reported UNC6293 phishing operations. Targets include individuals in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks in the United States.

Google Threat Intelligence·Aug 20, 14:00 UTC · 27d agoThreat actor in the wild

Product showcase: Material unifies Google Workspace email, file & OAuth defense

Help Net Security·Aug 5, 00:00 UTC · Aug 5, 2026Data breach

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.

Google Threat Intelligence Group detailed three suspected Russian espionage clusters, UNC6293, UNC7005 (Storm-2945), and UNC5976, targeting academia, aerospace, defense, governments, and think tanks in Europe, the US, Ukraine, and Armenia. UNC6293, assessed as a sub-cluster of APT29/Ice Relic, conducted OAuth and application-specific password phishing while impersonating State Department officials. UNC5976 registered file-sharing-themed domains hosting fake OAuth login pages and deployed a malicious Excel plugin codenamed HEADRUSH, while UNC7005 abused WhatsApp device linking to hijack accounts and record victims' audio and video.

The Hacker News·Aug 21, 14:54 UTC · 25d agoThreat actor in the wild

The modern attack chain: Rethinking Google Workspace security in the age of AI

Analysis of Vercel and Composio breaches shows stolen OAuth tokens, not phishing email, now open Google Workspace attacks — a path authorized AI agents follow.

The author analyzes the Vercel and Composio breaches as the same OAuth-first attack chain run twice: a stolen OAuth token, obtained via a compromised supplier, becomes the entry point rather than email. These tokens survive password resets, are hard to observe, and let attackers read Gmail and Drive data, take over accounts, and pivot laterally using stored credentials and password-reset magic links. The piece warns that authorized AI agents with overbroad OAuth grants can unintentionally traverse the same path — accessing inboxes, reading sensitive content, and exfiltrating data downstream — without any malicious actor or compromised credential.

Help Net Security·05:00 UTC · 9h agoResearch in the wild

This Key Will Self-Destruct: An Open Standard for Revocable API Keys

SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.

The article argues that plain API keys leak frequently yet lack any standardized revocation mechanism, unlike OAuth tokens which gained RFC 7009 revocation in 2013, and that GitHub's Secret Scanning Partner Program solves this only in a proprietary, invite-only way. The author proposes ORKS (Open Revocable Key Standard), with a draft spec on GitHub, built on four parts: keys embedding their issuer domain in a fixed prefix format, a discoverable /.well-known/api-key-config JSON file, unauthenticated revocation by possession of the full key, and declared constraints such as IP allowlists, expiry, scopes, and mTLS. An optional quarantine mode inspired by Toyota's andon cord restricts a reported key to read-only and throttled operation for a default 24-hour window before automatic revocation. The piece frames AI agents as making this urgent, since agents hold many credentials, can exfiltrate them via prompt injection, and can leak secrets into logs at machine speed.

SecurityWeek·Sep 9, 10:00 UTC · 7d agoTools1

FBI raises alarm over deceptive phishing campaign targeting prominent people

The FBI warns of an ongoing OAuth consent phishing campaign granting attackers persistent access to high-profile victims' cloud accounts without passwords.

The FBI says attackers impersonate government officials, journalists and event coordinators on commercial messaging apps to trick prominent individuals, their families and acquaintances into authorizing malicious OAuth applications on Microsoft or Google cloud services. Once approved, attackers gain persistent access to emails, files and other sensitive data; the access survives password changes and bypasses MFA, and can only be revoked by invalidating the OAuth token in security settings. The campaign has been tracked since late 2025, and the FBI advises independently verifying senders and granting access only to trusted applications.

CyberScoop·Sep 1, 21:30 UTC · 14d agoPhishing & fraud

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.

Microsoft warned of a human-operated campaign abusing Teams external collaboration to impersonate IT help desk staff, deploy malicious MSI packages staging Node.js runtimes and obfuscated JavaScript implants, then pivot to domain controllers over WinRM. Unit 42 documented the Spring Ring vishing operation targeting over 150 employees across at least 10 companies using 26 attacker identities, including an NTLM relay variant against domain controllers. Sophos reported The Gentlemen ransomware (Gold Sherwood) reached 683 total victims by end of July 2026, adding 169 in July, with a playbook using BYOVD-based EDR killers and backup tampering. Group-IB found the Outsider phishing-as-a-service platform created 700+ new phishing pages within a month despite law enforcement takedowns.

The Hacker News·Sep 3, 18:02 UTC · 12d agoThreat actor in the wild1

Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' leaked OAuth tokens from nearly 31,000 users to Russian bot-service proxy servers.

Socket researchers found the 'Twitch Enhanced Viewer | JeetBot' browser extension forwarded users' live Twitch OAuth tokens as an &auth= query parameter to operator-controlled proxy servers, affecting about 30,000 Chrome users and 604 Firefox users. The tokens, written in cleartext to proxy logs, are bearer credentials granting access to chat, whispers, and account settings without password or 2FA. The operator is a Russian commercial Twitch/Kick/VK-Live bot SaaS linked to Cyprus-based developer Aleksandr Popov; earlier v4.x builds also POSTed tokens to a set-token endpoint. Firefox add-on version 85.8.7 stops the token forwarding, but previously transmitted tokens remain valid until revoked.

The Hacker News·Sep 14, 07:24 UTC · 2d agoMalware in the wild

When the Whole Company Adopts AI: What It Does to Your SOC

Analysis of 16.9 million SOC alerts finds AI-related alerts at 0.43%, growing 685% since February, with 94.1% noise and 0.02% real attacks.

A review of roughly 16.9 million SOC alerts found about 73,000 (0.43%) were AI-related, a share that grew 685% between February and June 2026. Of AI-related alerts, 94.1% were noise, 5.8% genuine risks, and 0.02% real attacks; 79.8% received benign verdicts, 81.7% were automatically suppressed, and only 5.4% reached a human analyst. The only confirmed attacks were phishing campaigns that weaponized AI brand names as lures, while developer coding agents spawning shells and reading credential stores routinely tripped detections written before AI agents existed.

The Hacker News·Sep 12, 10:24 UTC · 4d agoResearch1

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.

During internal research on August 19, 2026, Wordfence discovered an authentication bypass in the WPMU DEV Dashboard WordPress plugin, which has roughly 350,000 active installations. Unauthenticated attackers can gain administrator access when Hub Single-Sign On is enabled, enabling complete site takeover. If an administrator-writable code mechanism such as the plugin or theme editor is available, the flaw can lead to remote code execution.

Wordfence·Aug 27, 17:41 UTC · 19d agoVulnerability

iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset

Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.

Abnormal Security analyzed iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for a $10,000 base price with additional capability modules sold separately. Using a browser-in-the-middle relay behind a trycloudflare.com subdomain with valid TLS, it captures Google logins and uses the authenticated session to enroll an attacker-controlled passkey within six seconds of login. Because the passkey persists after password changes and session revocation, operators regain mailbox access even after victims reset credentials. The build examined targets Google, while the seller advertises versions for Microsoft, iCloud, and LinkedIn.

Security Affairs·Aug 24, 07:17 UTC · 23d agoPhishing & fraud1

ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.

The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.

arXiv cs.CR·Sep 8, 00:05 UTC · 8d agoResearch

A five-part inventory for your AI agent credentials

Orchid's CEO recommends inventorying five attributes of AI agent credentials to rein in over-privileged OAuth tokens and service accounts.

In a Help Net Security video, Orchid co-founder and CEO Roy Katmor argues that AI agents accumulate OAuth tokens, API keys, service accounts, and borrowed human credentials that sit outside normal identity review, leading to authority well beyond the agent's original purpose. He proposes treating each agent as an application and documenting owner and purpose, reachable tools, credentials, effective authority, and runtime behavior. Teams can then compare approved intent with observed behavior and apply scoped controls, including targeted kill switches.

Help Net Security·Sep 6, 14:15 UTC · 9d agoAI safety & security

NIST Issues New Guidance to Protect SSO and API Tokens From Theft and Forgery

NIST released IR 8587 giving agencies and cloud providers recommendations to prevent identity token forgery, theft, and misuse in SSO and API environments.

NIST Internal Report 8587, released September 15, 2026, provides implementation recommendations covering token creation, signing, validation, storage, revocation, and lifecycle management for SAML, OpenID Connect, and OAuth 2.0 environments. It builds on SP 800-53 Rev. 5.1.1 and incorporates lessons from breaches involving stolen signing keys, abused OAuth applications, and replayed federated assertions. Recommendations include strong signing algorithms, strict claim validation, short token lifetimes, token binding, leakage prevention, and monitoring for abnormal token use.

GBHackers·07:44 UTC · 6h agoAdvisory 2 sources

Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026

2026 CASB guide ranks Netskope first for depth and Microsoft Defender for Cloud Apps for Microsoft estates, as standalone CASB fades into SSE.

Buyer's guide covers ten CASB products across four enforcement modes: API, forward proxy, reverse proxy and log-based discovery. Netskope leads on SaaS activity context depth, while Microsoft Defender for Cloud Apps wins on Microsoft 365 E5 estate economics. The guide argues standalone CASB purchases have largely disappeared into SSE platforms and increasingly overlap with SSPM.

Cyber Security News·Sep 15, 06:24 UTC · 1d agoTools

Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts

Microsoft warns of vishing campaigns by Storm-3121 and Storm-3032 hijacking Microsoft 365 accounts via fake passkey alerts, adding attacker-controlled MFA and exfiltrating cloud data.

Microsoft Security Research has tracked the campaign since May 2026: callers posing as IT helpdesk staff tell employees to urgently update passkeys, MFA, or SSO settings via domains such as add-passkey[.]com and contoso[.]add-passkey[.]com. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that yield credentials, session tokens, or OAuth tokens, after which attackers enroll their own MFA methods for persistence and run Microsoft Graph reconnaissance. They then collect SharePoint, OneDrive, and sometimes Exchange Online data at deliberately low rates (often under 1,000 files or messages per hour), with python-httpx seen in high-volume file access. Microsoft attributes initial access tradecraft to Storm-3121 and Storm-3032, linked respectively to ShinyHunters/Falcon and BlackFile/Helix extortion operations.

GBHackers·updated 11:58 UTC · 2h ago·first Sep 10, 09:19 UTC · 6d agoPhishing & fraud in the wild 10 sources1

Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers

NIST and CISA publish final interagency report with implementation guidance for protecting tokens and assertions from forgery and misuse.

CISA released a final NIST/CISA interagency report guiding federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms underlying modern authentication and authorization. It addresses forgery, theft, and misuse of signed tokens that adversaries use for lateral movement and data access in hybrid and multi-cloud, SSO, federation, and API-based environments. The final version updates token validation, secrets management, and detection-at-scale guidance gathered via the Joint Cyber Defense Collaborative, and supports Executive Order 14306 and Secure by Design principles.

CISA Advisories·Sep 15, 12:00 UTC · 1d agoAdvisory

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocationnew

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackers·13:41 UTC · 32m agoPhishing & fraud in the wild

A rant about phishing: It's not the user's fault (and not DNS either)

Opinion piece argues multi-domain login redirects make legitimate flows indistinguishable from phishing, urging organizations to standardize on one recognizable root domain.

The author shows a real-world login flow that chains through numerous third-party domains (identity providers, cloud auth endpoints, OAuth APIs, 2FA pages), none on the company's own domain, so credentials and 2FA prompts are trivially impersonable. The piece argues URLs are inherently confusing because the security-relevant second-level domain sits mid-string, and that users trained to ignore URLs cannot distinguish legitimate pages from scams. It proposes RFC 2119-style requirements: single recognizable root domain, internal services on its subdomains, emailed or SMS links on that domain, and local redirects instead of third-party hosted pages.

Lobsters · security·Sep 10, 15:14 UTC · 5d agoPhishing & fraud

The Top 4 Threats We Found by Investigating Every Alert for a Quarter

Prophet Security's quarterly threat report finds identity attacks made up roughly half of confirmed malicious activity, with stolen authenticated sessions bypassing conditional access controls.

Between May 1 and July 31, 2026, Prophet Security investigated every alert in customer environments immediately on arrival; about 7% of completed investigations were confirmed malicious. Direct account/session attacks made up roughly 18% of confirmed activity, with replayed authenticated sessions bypassing conditional access since no re-authentication occurs. Infostealer activity affected about a quarter of investigated organizations, mostly delivered via browsers through compromised websites, malicious ads, sponsored search results and ClickFix fake CAPTCHA gates, with payloads including Lumma Stealer, Vidar, HijackLoader and AsyncRAT. Credential phishing was the largest category at about 28%, with adversary-in-the-middle relays revealed by seconds-long MFA approvals from distant countries and MFA fatigue attacks exploiting automatic unlock policies.

BleepingComputer·Sep 10, 14:00 UTC · 6d agoThreat actor in the wild

VU#889462: Casdoor authentication server is vulnerable to authorization bypass

Casdoor IAM versions 3.115.0 and earlier allow organization admins to bypass tenant isolation through inconsistent authorization checks, tracked as CVE-2026-15630.

CERT/CC published VU#889462 describing an authorization bypass in Casdoor, an open-source access management platform, affecting versions 3.115.0 and earlier. The flaw (CVE-2026-15630) stems from controllers ignoring the ?id= query parameter used for authorization decisions and acting on JSON body fields instead, letting a single-organization administrator perform unauthorized administrative actions against arbitrary organizations in multi-tenant deployments. Impact can escalate to complete tenant-isolation compromise and potential compromise of the entire Casdoor instance, including SSO/SAML disruption. No vendor patch is available because researchers could not reach Casdoor; mitigations include least privilege, MFA for admin accounts, and alerting on cross-organization administrative activity.

CERT/CC Vulnerability Notes·Sep 3, 17:03 UTC · 12d agoVulnerabilityCVE-2026-15630

The VMs Powering Mobile Agents (Instinct, Claude Code)

A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.

The author inspects the virtual machines hosting cloud agents: Claude Code runs in a Firecracker microVM with a custom Rust init (process_api) as PID 1, a 324 MB Bun harness on a read-only disk, and 443-only MITM'd SSE egress to api.anthropic.com with host-rotated OAuth tokens and no inbound access. Instinct rents E2B sandbox-as-a-service Firecracker microVMs (Ubuntu 22.04, 2 vCPU, 1.9 GB RAM) where agent memory is a git repo of Markdown committed by the agent and pushed to S3 as a single bundle, using short-lived STS credentials. Both platforms rely on Firecracker, differing mainly in fleet operator and guest boot configuration.

Hacker News · AI·Sep 8, 04:36 UTC · 8d agoAI tools & infraHN 58↑ · 19 comments1

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz Blog·updated Sep 10, 12:56 UTC · 6d ago·first Sep 9, 16:06 UTC · 6d agoExploit / PoC in the wild 4 sourcesCVE-2026-59822CVE-2026-598211

Week in review: Cisco fixes IMC bug, Patch Tuesday forecast, Black Hat USA 2026

Help Net Security·Aug 9, 00:00 UTC · Aug 9, 2026VulnerabilityCVE-2026-66066CVE-2026-185771

Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)

Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.

CISA added CVE-2026-60004, a critical code injection flaw in Gitea's diffpatch endpoint, to its Known Exploited Vulnerabilities catalog after in-the-wild attacks. An attacker with repository write access, or an unauthenticated visitor on instances with open registration, can execute arbitrary shell commands as the Gitea OS user. A disclosed incident saw an automated scanner register an account and deploy a loader and cryptominer inside a Docker container within about 11 seconds, with no persistence mechanism found. Gitea patched the flaw in v1.27.1, and CISA ordered US federal civilian agencies to update by August 28, 2026.

Help Net Security·Aug 26, 00:00 UTC · 21d agoExploit / PoC in the wildCVE-2026-60004

In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review

SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.

SecurityWeek's weekly roundup aggregates short items across the threat landscape, including Microsoft's report of invisible Unicode tag characters used in financial phishing lures at up to 2.37 million messages per day, and active exploitation of critical WordPress Super Forms plugin flaw CVE-2026-14894 to deploy PHP webshells. Policy items include a $10 million US bounty for IRGC-CEC Cyber Operations Command lead Amir Yaryab, a 16-month prison sentence for ex-AT&T employee Kenneth Carter over SIM swaps with nearly $600,000 in intended losses, and the US arraignment of Russian Sergei Anatolyevich Filimonov over credential harvesting. Technical items include InjectEave electromagnetic side-channel attacks tested on 11 devices, an FBI warning on OAuth consent phishing, and VulnCheck's finding that only 202 of 26,153 Anthropic Project Glasswing findings were fixed.

SecurityWeek·Sep 11, 14:19 UTC · 4d agoIndustry in the wildCVE-2026-148942

Password spraying campaign targets AWS root user accounts across 150+ organizations

Datadog researchers observed a password spraying campaign attempting to authenticate as AWS root users across 150+ organizations.

Datadog Security Research observed a large-scale password spraying campaign attempting to authenticate as AWS root user accounts across more than 150 organizations. The campaign targeted root credentials rather than standard IAM users, and no confirmed compromises are stated in the report. Root account access would grant full control of affected AWS environments, making this a significant credential-attack campaign for cloud defenders.

Datadog Security Labs·Aug 31, 00:00 UTC · 16d agoThreat actor in the wild

Exaforce extends its AI security tool to monitor more than just Claude

Exaforce AI Security extends beyond Claude to monitor OpenAI, Gemini, and Copilot agents using existing SOC telemetry, no new endpoint agents.

Exaforce expanded its June Claude Compliance API integration into Exaforce AI Security, adding monitoring for OpenAI, Gemini, Microsoft Copilot, and OAuth-connected AI apps. The tool inventories AI agents by correlating EDR, cloud, SaaS, and model-provider logs without new gateways or endpoint agents, and can respond by revoking sessions, deactivating API keys, isolating devices, or killing agent processes via existing controls. Analysts note the agentless approach lowers friction but lacks runtime inspection and inline blocking offered by competitors such as Palo Alto Prisma AIRS, SentinelOne Prompt AI Agent Security, and CrowdStrike Falcon Guardian. A March 2026 Cloud Security Alliance survey found 68% of organizations cannot distinguish human from AI-agent activity and 74% report AI agents receive excessive access.

CSO Online·Sep 15, 13:00 UTC · 1d agoTools

[webapps] miniOrange 5.4.3 - Unauthenticated Auth Bypass

A proof-of-concept exploit for an unauthenticated authentication bypass in miniOrange 5.4.3 has been published on Exploit-DB.

Exploit-DB lists a public proof-of-concept exploit for an unauthenticated authentication bypass in miniOrange 5.4.3. The flaw allows attackers to bypass authentication without credentials. No in-the-wild exploitation or CVE identifier is stated in the listing.

Exploit-DB·Sep 1, 00:00 UTC · 15d agoExploit / PoC

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News·Aug 21, 02:55 UTC · 26d agoResearch2

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security News·Sep 8, 12:10 UTC · 8d agoThreat actor in the wild

Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

The Hacker News·Aug 7, 10:38 UTC · Aug 7, 2026Phishing & fraud

Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users

Malicious 'Twitch Enhanced Viewer | JeetBot' browser extension stole live OAuth session tokens from roughly 31,000 Chrome and Firefox users.

Socket.dev found the cross-store extension 'Twitch Enhanced Viewer | JeetBot' rerouted Twitch playlist requests through operator-controlled proxies, attaching the victim's account-level OAuth token as a URL parameter where it could be logged in cleartext. About 30,000 Chrome and 552 Firefox installs were exposed, with tokens forwarded for nearly every watched channel to infrastructure tied to a Russian commercial bot service. The stolen bearer token enables chat, whisper, account-setting access and channel-point spending without the password or 2FA.

Cyber Security News·updated Sep 14, 15:00 UTC · 1d ago·first Sep 14, 13:50 UTC · 2d agoMalware in the wild 2 sources

Adobe fixes critical Magento zero-day exploited to backdoor servers

Adobe emergency-patches actively exploited max-severity Magento/Adobe Commerce zero-day CVE-2026-75650 (StyleSmuggler), used since Sept 4 to backdoor servers.

Adobe released an emergency hotfix (VULN-39341) for CVE-2026-75650, a max-severity zero-day dubbed StyleSmuggler affecting Adobe Commerce 2.4.4-2.4.9, Adobe Commerce B2B 1.3.3-1.5.3, and Magento Open Source 2.4.6-2.4.9, enabling arbitrary code execution. Sansec reports the flaw has been exploited since at least September 4 to plant a backdoor whose C2 host is disguised as an NTP server, leaving traces like 'Payment Transaction Failed Reminder' emails. A second attacker with unrelated tooling is exploiting the flaw to deploy a 485-byte PHP web shell that collects server details, checks pub/media writability, and exfiltrates data to an oast.site subdomain. Adobe recommends immediate hotpatching plus rotation of all secrets including admin passwords, API keys, database credentials, and SSH keys.

BleepingComputer·Sep 8, 13:34 UTC · 8d agoExploit / PoC in the wildCVE-2026-756501

Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics

Google tracks three Russia-linked espionage clusters abusing OAuth, app passwords, and device code phishing against Western researchers and diplomats.

Google's Threat Intelligence Group documented three suspected Russia-linked clusters, UNC6293, UNC7005, and UNC5976, abusing legitimate authentication flows. UNC6293, a likely APT29/ICE RELIC sub-cluster, impersonates US State Department officials in app password and OAuth phishing targeting fewer than five victims at a time. UNC7005, tracked by Microsoft as STORM-2945, spoofs the GLOBSEC conference, runs device code phishing against Microsoft and WhatsApp accounts, and deploys VIDAR and AtomicStealer infostealers. Targets include researchers, academics, diplomats, think-tank analysts, and defense personnel in Europe and the United States.

Security Affairs·Aug 21, 11:11 UTC · 26d agoThreat actor in the wild1

Hackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential-Stealing Malware

Cisco Talos details ClickFix campaigns abusing fake Google CAPTCHA prompts, WebDAV and BNB Smart Chain to deploy the Amatera infostealer.

Cisco Talos identified a multi-stage campaign, first observed in April 2026 when a Ukrainian government organization executed a disguised DLL named verification.google from a WebDAV path. The chain combines ClearFake JavaScript injected via malicious Cloudflare Workers, EtherHiding payloads stored in BNB Smart Chain contracts, ClickFix social engineering, and WebDAV-hosted DLL loaders to deliver the Amatera (ACR Stealer) infostealer. The Amatera configuration contained over 400 collection entries targeting browsers, messengers, crypto wallets, password managers, FTP and VPN tools, hunting for .kdbx, .p12, .pfx and .pem files. The pf.ch branch deploys ZigCryptoStealer, an EDR-terminating vulnerable driver and Go-based reverse TCP proxies, while the verification.google branch installs NetSupport Manager, supporting moderate-confidence attribution of the UAT-10820 activity to a Russian actor.

GBHackers·Sep 9, 13:27 UTC · 7d agoMalware in the wild