Search: “zapier”

22 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 4 Vulnerability 3 Ransomware 3 Model release 2 AI industry 2 Threat actor 2 Exploit / PoC 2 AI policy 1 Malware 1 Policy & legal 1 Data breach 1

SeverityAll critical 10 high 3 medium 1 low 3 info 5

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement

Zscaler ThreatLabz reports SloppyRAT, a new Windows RAT delivered via ClickFix lures that supports reconnaissance, reverse SOCKS proxying, and lateral movement for ransomware affiliates.

Zscaler ThreatLabz first observed SloppyRAT in June 2026, delivered through multi-stage ClickFix chains that abuse finger.exe, a renamed curl.exe, and IronPython to load a reflective Python payload. The C++ implant implements 47 PowerShell-like commands via native APIs and direct syscalls, modifies Microsoft Defender settings, and establishes a reverse SOCKS proxy that lets operators pivot into internal networks. It is linked to CastleLoader and CastleRAT components and uses certificate-pinned HTTPS C2 with an EtherHiding fallback via Polygon JSON-RPC. Zscaler assesses it as an intrusion-enablement tool for ransomware operations, though flawed persistence logic suggests the family is still under development.

GBHackersupdated Sep 11, 09:12 UTC · 5d agofirst Sep 11, 06:17 UTC · 5d agoMalware in the wild 3 sources

Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results

NCSC, FBI, and AIVD warn Iranian state-linked actors deliver CHOSEN BRICK Windows spyware via fake AI apps, antivirus installers, and MRI-result lures.

A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK (FBI tracking name: HEAVYGRAM), Iranian state-linked Windows spyware targeting dissidents, activists, and journalists worldwide since at least 2025. Lures impersonate Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass, and operators pivot conversations from corporate to personal devices to bypass enterprise controls. The spyware persists via Registry Run keys, adds Microsoft Defender exclusions, uses per-victim Telegram bots for command-and-control, and exfiltrates screenshots, audio, email, and chat data via Telegram and cloud services, with some victim data appearing on pro-Iranian leak sites.

GBHackersupdated 12:00 UTC · 4h agofirst 06:57 UTC · 9h agoMalware in the wild 5 sources

Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.

ClickFix malvertising campaigns deliver MacSync, a macOS infostealer sold as MaaS that bypasses Gatekeeper via Terminal commands and steals credentials.

Threat actors use ClickFix social-engineering lures, SEO poisoning, and malvertising impersonating brands like Claude, ChatGPT, Zoom, and Docker to trick users into pasting curl-to-zsh commands into Terminal, evading Gatekeeper and notarization checks. The MacSync Stealer (formerly Mac.c, emerged April 2025, linked to developer 'Mentalpositive') is a 64-bit Mach-O stager with single-byte XOR string obfuscation that daemonizes, polls C2 with custom API-key headers, streams AppleScript payloads into osascript, and persists via fake LaunchAgents. It steals browser credentials, Keychain data, SSH keys, session tokens, and crypto wallets, exfiltrating archives in 10MB HTTP PUT chunks. Microsoft documented more than 30 related MacSync domains.

GBHackersupdated Sep 10, 09:53 UTC · 6d agofirst Sep 10, 07:01 UTC · 6d agoMalware in the wild 2 sources

How Zapier transformed core marketing processes with ChatGPT Work

Zapier's enterprise marketing team uses ChatGPT Work to cut lead-funnel drop-offs and automate reporting.

OpenAI published a customer story on how Zapier's enterprise marketing team adopted ChatGPT Work. Use cases include reducing lead funnel drop-offs, building campaign assets, and automating reporting. This is marketing case-study content rather than a product or research announcement.

OpenAI NewsAug 10, 00:00 UTC · Aug 10, 2026AI industry

The AI graveyard: a running list of projects and startups that didn’t make it

TechCrunch compiles a running list of failed AI products and startups, including Relay, OpenAI's Sora, Humane AI Pin, Notion Mail, and Microsoft's Recall.

TechCrunch's 'AI graveyard' tracks notable AI products and startups that shut down or underperformed, citing S&P Global data that about 42% of AI initiatives are abandoned. Examples include the Relay automation startup, OpenAI's Sora video platform (shut March 2026), ChatGPT Atlas browser (discontinued August 9), Notion Mail (shutting September 22), and Apple's delayed Siri AI that contributed to a $250 million settlement. Hardware failures include the Humane AI Pin ($230 million raised, assets sold to HP for $116 million) and the Rabbit R1, which sold 100,000 units but received poor reviews. Microsoft's Recall feature remains controversial after a researcher demonstrated a tool extracting its captured data.

TechCrunch · AISep 15, 19:00 UTC · 21h agoAI industry1

Tricky 'SynkLoader' Multitool May Herald Ransomware

Researchers detail SynkLoader, an advanced multilingual multitool that hijacks screens to steal passwords and may precede ransomware attacks.

Dark Reading reports analysis of SynkLoader, an advanced, multilingual malware family functioning as a multitool loader. The family revives an older technique — screen hijacking — to enable effective password theft, alongside several novel features. Analysts assess its activity may be a precursor to ransomware deployments, making early detection valuable for defenders.

Dark ReadingAug 24, 15:02 UTC · 23d agoMalware

Foul Language: WordlistLoader Disguises Malware as Ordinary Text

ClickFix-style campaigns deploy WordlistLoader, which disguises malware as ordinary text, to deliver the increasingly prevalent Amatera infostealer.

Researchers describe WordlistLoader, a new loader that disguises malicious payloads as ordinary text or wordlist files to evade detection. It is being used in ClickFix-style social engineering campaigns to deliver Amatera, an increasingly prevalent infostealer. The obfuscation technique helps the campaign slip past file-type-based inspections.

Dark ReadingAug 24, 20:51 UTC · 22d agoMalware in the wild

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Huntress dissects MacSync Stealer, a macOS infostealer delivered through fake Claude Code download pages in Google search results.

Huntress SOC analysts published a reverse-engineering analysis of MacSync Stealer, a macOS infostealer distributed through fraudulent Claude Code download pages surfaced via web searches. Users searching for Anthropic's Claude coding tool are redirected to fake download pages that install the stealer, abusing developer trust in popular AI tooling. The writeup covers the analysis of the sample and its delivery chain.

HuntressAug 17, 04:00 UTC · Aug 17, 2026Malware in the wild

Fake Claude Opus 5 app delivers malware and wipes its own tracks

A fake 'Claude Opus 5' GitHub repository impersonating Anthropic distributes RevStealer, a Windows infostealer stealing passwords, crypto wallets and VPN credentials.

Morphisec identified a malicious GitHub repository, Claude-Opus-5-Free-Desktop, impersonating Anthropic to distribute a roughly 101 MB download that launches RevStealer, a Windows information-stealing malware. The malware targets browser credentials, Windows Credential Manager, a dozen password managers, more than fifty cryptocurrency wallets, VPN, messaging, game launcher and streaming accounts, streaming stolen data to its server before deleting itself. It evades analysis with ten sandbox and VM checks, indirect system calls, Windows Defender exclusions, a fake verification window, and a Polygon blockchain smart contract fallback for C2. Only 1 of 66 antivirus engines flagged the sample at check time.

Help Net SecuritySep 1, 00:00 UTC · 15d agoMalware

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business NewsSep 2, 02:55 UTC · 14d agoData breach in the wild1

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.

Gen Digital researchers found commodity infostealers extending their collection rules to local AI coding agent data from Claude, Cursor, Codex, Cline, Continue and OpenCode on Windows and macOS. Amatera targets Cline and Continue, Remus targets Claude, Cursor and OpenCode, and CallbackBeaver added Claude and Cursor with more than 5,000 samples observed in 30 days; Djinn Stealer hits Claude, Codex, Gemini, Cline, OpenCode and Kilo on macOS. Stolen data includes access and refresh tokens, prompt histories, conversation databases and MCP configurations holding API keys, potentially exposing connected source-control, cloud and ticketing systems. Remus is assessed as a Lumma Stealer variant using EtherHiding C2 resolution via Ethereum smart contracts.

GBHackersSep 9, 07:05 UTC · 7d agoMalware in the wild1

Iranian spies hit Windows machines with Chosen Brick data-stealing malware

FBI, UK NCSC, and Dutch AIVD warn Iranian intelligence uses Chosen Brick spyware against dissidents, stealing contacts, emails, and messaging data.

A joint advisory from the FBI, UK NCSC, and Dutch AIVD says Iranian state cyber actors have used the Chosen Brick Windows malware since at least 2025 to surveil dissidents, activists, and journalists. Attacks begin with heavily researched WhatsApp and Telegram messages impersonating trusted contacts, tricking victims into opening fake installers resembling Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass. The malware persists via the HKCU Run registry key, adds Microsoft Defender exclusions, uses victim-specific Telegram bots for C2, captures screen and audio, steals emails and Telegram/WhatsApp data, and can wipe systems.

The Register · SecuritySep 15, 18:01 UTC · 22h agoThreat actor in the wild1

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security NewsSep 9, 11:41 UTC · 7d agoMalware in the wild2

Iranian cyber targeting of dissidents, activists and journalists

UK NCSC, FBI, and Dutch AIVD expose CHOSEN BRICK spyware used by Iranian state actors against dissidents, activists, and journalists worldwide.

A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK, a Windows spyware family used by Iranian state cyber actors since at least 2025 against dissidents, activists, and journalists in the UK, US, and Netherlands. Actors build rapport on WhatsApp and Telegram impersonating known contacts or platform support, then deliver disguised payloads resembling apps such as Telegram, Norton, RunwayML, or fake MRI results. The malware persists via HKCU Run registry keys, adds Microsoft Defender exclusions, and uses a unique Telegram bot C2 per victim. Capabilities include screen capture, microphone recording, process enumeration, email and messaging data theft, file deletion, and system wiping; victim data has appeared on pro-Iranian leak sites.

NCSC UKSep 15, 12:00 UTC · 1d agoThreat actor in the wild2

Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

FBI, NCSC, and AIVD detail Iran MOIS spyware CHOSEN BRICK/HEAVYGRAM, Telegram-controlled Windows malware spying on dissidents since 2023.

A September 15 joint advisory from the FBI, UK NCSC, and Dutch AIVD attributes the Windows spyware HEAVYGRAM (NCSC name CHOSEN BRICK) to Iran's Ministry of Intelligence and Security, with the campaign dating to autumn 2023 and targeting dissidents, journalists, and activists in the UK, US, Netherlands, and worldwide. Delivered via messages impersonating known contacts or tech support, the malware assigns each victim a dedicated Telegram bot for command-and-control and exfiltration, and can take screenshots, record microphone audio, steal Telegram/WhatsApp data, saved passwords, and emails, download more malware, and wipe the computer. Persistence uses a registry Run key (SMQDService or winappx) plus Microsoft Defender exclusions, with stolen data exiting via Telegram and cloud storage services like Vultr and Storj. The US Justice Department seized four pro-Iranian leak sites in March that had published stolen victim data.

The Hacker NewsSep 15, 16:29 UTC · 1d agoMalware in the wild1

Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone

Citizen Lab confirms Pegasus zero-click iMessage spyware infected a Serbian student activist's iPhone amid at least 14 spyware targets in Serbia during 2026.

The Citizen Lab, with the SHARE Foundation, confirmed an iMessage zero-click exploit infected a Serbian student protest movement member's iPhone with NSO Group's Pegasus spyware, with high-confidence indicators from December 2025 to January 2026. The exploit was addressed by Apple in iOS 18.4.1, released April 2025. At least 14 people in Serbia, including students, activists, an MP, and a councilor, were targeted with advanced spyware since the start of 2026, coinciding with March 29, 2026 local elections; a new Android spyware similar to NoviSpy was also found on a confiscated device.

The Hacker NewsSep 3, 08:43 UTC · 13d agoThreat actor in the wild

Atomic macOS (AMOS) Stealer Activity

Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.

Unit 42 analyzed an AMOS (Atomic macOS Stealer) infection from August 5, 2026, initiated via a page at getmacouscloud[.]com instructing users to paste a command into Terminal. The command fetched a Zsh script from ferncore13[.]com that delivered a Mach-O installer to /tmp/helper and supporting files under /Library/Application Support/.com.apple.accountsd/ and .com.apple.metadata.mds/. AMOS collected browser data, credentials, cryptocurrency wallets (Binance, TonKeeper), Telegram data, and FileGrabber content such as AWS and gcloud files, uploading it via HTTP POST to C2 server 161.35.146[.]120. AMOS has been advertised on Telegram since April 2024 and distributed via ClickFix campaigns, malicious ads, and cracked-software sites.

Palo Alto Unit 4210:00 UTC · 6h agoMalware in the wild

Pegasus and NoviSpy Used Against Serbian Protesters

Citizen Lab confirmed zero-click Pegasus infected a Serbian student activist's iPhone, part of the largest documented Serbian spyware wave targeting at least 14 people.

The Citizen Lab, with the SHARE Foundation, confirmed a Serbian student protest movement member's iPhone was infected with NSO Group's Pegasus via an iMessage zero-click exploit between December 2025 and January 2026; Apple patched the exploit in iOS 18.4.1. SHARE Foundation has documented at least 14 targeted individuals since early 2026, including student activists, civil society figures, an opposition MP and a local councilor, coinciding with the March 2026 local elections. SHARE and Amnesty Tech also found a new NoviSpy variant on a student activist's Android phone after Serbian authorities seized it during police questioning.

Security AffairsSep 3, 20:17 UTC · 12d agoThreat actor in the wild

REVSTEALER ramps up: analysis of up-and-coming infostealer

Elastic Security Labs analyzes REVSTEALER, an emerging infostealer harvesting browser credentials, cryptocurrency wallets, and gaming accounts.

Elastic Security Labs published a deep-dive analysis of REVSTEALER, described as an up-and-coming infostealer. The malware targets browser data, cryptocurrency wallets, and gaming accounts, with credential harvesting as its core function. The report tracks the family's capabilities as it ramps up activity in the wild.

Elastic Security LabsSep 2, 00:00 UTC · 14d agoMalware in the wild

Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone

Citizen Lab and SHARE Foundation confirm a Serbian student activist's iPhone was infected with NSO Group Pegasus via a zero-click iMessage exploit.

Forensic analysis found high-confidence infection indicators on the activist's iPhone during December 2025 and January 2026, using an iMessage zero-click exploit the Citizen Lab believes was patched as of iOS 18.4.1, released April 2025. The target was among at least 14 Apple Threat Notification recipients in Serbia's student movement, civil society, and opposition politics documented by the SHARE Foundation. Targeting occurred ahead of key 2026 election cycles; Amnesty Tech also confirmed a new NoviSpy version on another student movement member's device.

Infosecurity MagazineSep 3, 15:25 UTC · 13d agoThreat actor in the wild

The Nansh0u Campaign – Hackers Arsenal Grows Stronger

Guardicore researchers detail the Nansh0u campaign's growing arsenal, with three attacks traced to South African IPs hosted by VolumeDrive.

Guardicore security researchers analyzed three attacks detected in early April through the Guardicore Global Sensor Network (GGSN). All three attacks originated from source IP addresses in South Africa hosted by the VolumeDrive ISP. The write-up catalogs the expanding arsenal and tooling used by the Nansh0u campaign attackers and includes indicators of compromise.

Akamai BlogSep 8, 15:13 UTC · 8d agoThreat actor in the wild

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Cisco Talos details ClearFake WebDAV chains delivering Amatera stealer to a Ukrainian government organization, with cryptocurrency and credential theft payloads.

Cisco Talos investigated DLL executions named 'verification.google' via WebDAV UNC paths at a Ukrainian government organization, tracking the actor as UAT-10820 and assessing with moderate confidence the activity is Russian and opportunistic rather than targeted. The infection chain uses ClearFake JavaScript injected via a Cloudflare Worker, EtherHiding storage on BNB Smart Chain contracts, and a ClickFix fake Google CAPTCHA prompt to deliver Amatera stealer. Secondary payloads differ by C2: one loader deploys ZigCryptoStealer with a Go reverse TCP proxy and a vulnerable driver that kills EDR, while the other installs an unauthorized NetSupport Manager with a Russia-based C2. Similar Amatera chains were separately documented by Malwarebytes and Blackpoint Cyber, but with no shared infrastructure.

Cisco TalosSep 8, 10:01 UTC · 8d agoMalware in the wild1