ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “devtools”

61 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 23Ransomware 9Threat actor 6Exploit / PoC 5Data breach 5Vulnerability 4Research 2Phishing & fraud 2Industry 1AI industry 1Advisory 1AI safety & security 1Policy & legal 1
SeverityAllcritical 9high 25medium 22low 3info 2

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.

SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.

The Hacker News · 21d agoResearch2

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.

The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.

The Hacker News · 29d agoExploit / PoC in the wildCVE-2026-59310CVE-2026-65400CVE-2026-688201

Tell HN: OpenAI keeps re-enabling the 'allow training' setting

A Hacker News user reports OpenAI's 'allow training' setting re-enables itself after being disabled, raising concerns about opt-out data usage.

A Hacker News user reports resetting OpenAI's 'allow training' opt-out multiple times, with careful tracking, only to find the setting re-enabled on later checks. Commenters speculate about backend sync failures, optimistic UI updates and local storage behavior, or deliberate re-enabling to widen training data usage. Some users report the setting remained disabled, including one EU citizen.

Hacker News · security · 5d agoAI industryHN 66↑ · 18 comments

Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild

Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.

Chrome 153 (153.0.8010.36/.37) rolls out to Windows, Mac, and Linux with 230 security fixes, among the largest patch batches in recent Chrome history. The headline flaw is CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google confirmed is exploited in the wild; it was reported by Jihyeon Jeong of Compsec Lab at Seoul National University for a $2,500 bounty. The release also closes five Critical-rated flaws, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, mostly use-after-free and out-of-bounds write bugs in WebGL and Cast, plus 43 High-severity issues across ANGLE, PDFium, V8, DevTools, and Payments. Several bugs were surfaced with AI-assisted discovery tools, including OpenAI's Codex Security team, and top bounties reached $5,000 for CVE-2026-87504.

Cyber Security News · 6d agoVulnerability in the wildCVE-2026-87491CVE-2026-87464CVE-2026-87488+7 CVEs1

Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-85046)

Google patched 12 Chrome flaws including in-the-wild V8 zero-day CVE-2026-85046; CISA added it to the KEV catalog.

Google released Chrome 152.0.7977.82/.83 for Windows and Mac (152.0.7977.82 for Linux) fixing 12 vulnerabilities, including CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine being exploited in the wild. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 18, 2026. This is Chrome's sixth zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645. The other 11 fixes include use-after-free, out-of-bounds, race condition and input validation flaws in Skia, WebGL, DevTools, Network, Compositing and other components.

Qualys ThreatPROTECT · 8d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-2441CVE-2026-3909+14 CVEs

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.

Manifold Security found 77 extensions uploaded to the Open VSX marketplace between July 26 and August 1, 2026 that impersonate real Microsoft VS Code Marketplace tools, with all 77 sending data to mangorbit.com. 58 lightweight variants exfiltrate the hostname, while 19 recon variants collect editor details, OS username, Git remote hosts, CI environment variables (GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, Codespaces, Gitpod), and installed extension IDs. The recon variant retries for up to seven days and can fall back to a DNS TXT record for exfiltration if the primary domain is blocked. The extensions were removed from Open VSX by August 3, 2026; the disclosure follows a separate npm supply chain campaign, ChainDrop, which compromised 450 packages with a Shai-Hulud worm variant.

The Hacker News · 14d agoMalware

$20 per zero-day is already the WordPress plugin reality

TrendAI and CHT Security used an AI pipeline to find over 300 verified WordPress plugin zero-days at roughly $20 per vulnerability.

A pipeline built in three days by TrendAI and CHT Security, presented at Ekoparty Miami, paired AI-driven static analysis with automated Docker provisioning and Chrome DevTools MCP dynamic verification to surface more than 300 critical zero-days in WordPress plugins within 72 hours. The run consumed about 222 million tokens across 95 tasks, averaging roughly $20 per verified vulnerability, with findings including pre-auth RCE, SQL injection, privilege escalation, SSRF, and an AI-assembled downgrade attack chain. Dynamic verification eliminated over 80% of false positives, but manual review at 30-60 minutes per finding remains the bottleneck, straining ZDI and NIST triage backlogs.

Help Net Security · 22d agoResearch1

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Ontinue disclosed TWINLOOT, a Python implant hiding C2 in SharePoint dead drops and Teams TURN relays, harvesting credentials and pivoting via reverse SOCKS5.

Ontinue's Cyber Defense Center identified TWINLOOT during a July 2026 campaign investigation: a modular, PyArmor-hardened Python implant (a 39 MB bootstrap-fat.pyc loader) whose entire C2 infrastructure lives inside trusted Microsoft services. Tasking flows through SharePoint Online file dead drops polled every 15 seconds via the Microsoft Graph API, while interactive operator access uses WebRTC DataChannels relayed by Microsoft Teams TURN servers; Graph traffic is driven by the victim's own headless Edge browser. The implant harvests Windows credentials with fake lock screens, offers a reverse SOCKS5 pivot for lateral movement to SMB, RDP, WinRM, and MSSQL, executes commands, and persists on hosts. Initial access is assessed to be Teams social engineering masquerading as IT support, prompting a PowerShell command to download the payload.

The Hacker News · 28d agoMalware

AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS

Jamf details AmnesiaStealer, a new Rust-based macOS infostealer that hijacks Chromium sessions for live attacker-controlled browser access and steals Keychain data.

Jamf Threat Labs disclosed a three-stage macOS infostealer called AmnesiaStealer distributed via a fake GitHub download page using a ClickFix-style lure that tricks users into pasting a Base64 command into Terminal. The Rust payload harvests the Keychain, Apple Notes, Telegram sessions, Safari cookies, and 16 Chromium-family browsers, and captures the system password via a native prompt validated with dscl. A remotely fetched stream_module gives operators hidden, interactive browser control via the Chrome DevTools Protocol, streaming a live session at roughly 3fps. It persists via a root LaunchDaemon impersonating Apple's crash reporter and leverages the TCC bypass CVE-2020-9771 against macOS Catalina.

The Hacker News · Aug 15, 2026Malware in the wildCVE-2020-9771

AmnesiaStealer Gives Attackers Live Control of Victims’ macOS Browsers

Jamf Threat Labs analyzed AmnesiaStealer, a Rust-based macOS infostealer spread via fake GitHub pages that also grants live hidden browser control.

AmnesiaStealer is a three-stage Rust infostealer distributed through counterfeit GitHub download pages using the ClickFix technique, a lure shared with Atomic Stealer and MacSync campaigns. It harvests the keychain, 16 Chromium browsers, Apple Notes, Telegram and documents, reusing a password captured via a fake installer dialog. A third-stage stream module clones the victim's browser profile headlessly and lets operators drive the session via Chrome DevTools Protocol, while persistence uses a LaunchDaemon impersonating Apple's com.apple.ReportCrash.agent. On macOS 26 it may replace Chrome's Safe Storage key, a useful detection signal.

Security Affairs · Aug 14, 2026Malware in the wild