Search: “Work Panel”

1,459 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 263 Malware 263 Vulnerability 205 Exploit / PoC 157 Policy & legal 142 Industry 101 Threat actor 84 Phishing & fraud 81 Data breach 79 Research 25 Advisory 17 AI tools & infra 11 AI safety & security 10 AI industry 9

SeverityAll critical 589 high 343 medium 273 low 213 info 41

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

A weekly bulletin aggregating short security updates, including the City-Forum data-theft campaign, a ShipMonk breach, a Cursor CLI flaw, and GhostJacking AI attacks.

The Hacker News ThreatsDay Bulletin bundles roughly 20 short updates across cloud services, AI tools, malware, breaches, and scams. Highlights include the City-Forum campaign pulling data from unauthenticated guest access in Salesforce Experience Cloud and ServiceNow Service Portals since March 2025, and a ShipMonk breach exposing Trezor customer order data for orders in seven countries between May 10 and August 8, 2026. Other items cover a patched Cursor CLI flaw that let cloned repositories run commands before the workspace-trust prompt, Okta's analysis of the Work Panel vishing console used by actors like UNC6671, and GhostJacking AI agent hijacking via a patched Claude Desktop sandbox escape. Meta also launched an on-device WhatsApp Scam Alert machine learning model that keeps message content on the device.

The Hacker NewsAug 18, 16:30 UTC · 29d agoIndustry

An ALPHV (BlackCat) representative discusses the group’s plans for a ransomware ‘meta

The RecordJan 17, 00:00 UTC · Jan 17, 2023Ransomware

Threat Spotlight: Holiday Greetings from Pro PoS – Is your payment card data someone else’s Christmas present?

Cisco TalosDec 17, 16:23 UTC · Dec 17, 2015Vulnerability

Telnet service left enabled and without a password on SIMATIC HMI Comfort Panels

The RecordJan 18, 00:00 UTC · Jan 18, 2023Vulnerability CVE-2021-31337

Neuberger: Counter Ransomware Initiative focused on ‘expanding the tent,’ with Jordan, Costa Rica, Colombia joining

The RecordMay 8, 12:38 UTC · May 8, 2023Ransomware

Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

GuidePoint reports a ransomware affiliate posing as 'Ransom Busters' charges victims $20,000-$60,000 to delete stolen data, and details UNC6671's $8M AitM extortion wave.

GuidePoint's GRIT team reports that 'Ransom Busters', likely a ransomware affiliate active across multiple RaaS operations including DragonForce, Settra and Anubis, proactively emails victims claiming it deleted their stolen data and backups for a $20,000-$60,000 fee, citing claimed access to RaaS administrative panels for over three years. Two analyzed intrusions shared tooling: SoftPerfect Network Scanner for reconnaissance, s5cmd-based exfiltration to AWS cloud storage, an RMM tool installed via PowerShell, a backdoor account with password 'Numlock!123' and the same attacker hostname DESKTOP-BBETH6K. Separately, GRIT detailed UNC6671's (Cordial Spider) adversary-in-the-middle vishing operation running since April under five extortion brands, with more than $8 million across 15 Bitcoin wallets, an average of $600,000 per payment, and 78 phishing sub-domains across 76 organizations, 40% in financial services.

The Hacker NewsAug 18, 17:35 UTC · 29d agoThreat actor in the wild1