60
60
60
60
60
60
60
60
Week in review: F5 data breach, Microsoft patches three actively exploited zero-days
60
60
ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories
Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.
Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.
25
60
⚡ Weekly Recap: SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
60
60
60
60
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024
60
60
60
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.
70
60
45
60
60
60
60
60
60
60
60
60
60
60
Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.
Google Threat Intelligence Group says attackers are targeting proprietary AI models across healthcare, government, and media, exfiltrating API credentials, and co-opting victim cloud environments to run unauthorized AI workloads. TeamPCP (Altered Spider/UNC6780) is conducting supply chain compromises of PyPI, npm, and Docker Hub, deploying the SANDCLOCK and DUSTMAKER credential stealers, with DUSTMAKER using AI workspace poisoning and prompt injection for defense evasion. One financially motivated actor used an autonomous multi-agent framework to compromise thousands of third-party credentials in under six hours without human intervention. China-nexus groups UNC6508 and Basin Castle (Mustang Panda) used local open-weight LLMs and commercial LLMs like Gemini, Claude, and Codex for espionage tasks and evading provider monitoring.
72
60
60
60
60
60
60