ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “physics”

23 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 349Vulnerability 118Ransomware 104Data breach 70Malware 57Policy & legal 37Threat actor 33Phishing & fraud 13AI safety & security 4Advisory 3Industry 3Research 1
SeverityAllcritical 706high 60medium 23low 1info 2

WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud

Group-IB details WindRelay, a new Android NFC relay malware paired with SpyNote RAT to relay card data live for contactless payment fraud and loans.

Group-IB identified WindRelay, a previously unseen Android near-field-communication relay malware first seen in the wild in late August 2025, deployed alongside the SpyNote RAT in a contactless payment fraud scheme. Victims are lured via personalized phishing, smishing, or vishing into sideloading an app; SpyNote's Accessibility access silently installs WindRelay, whose reader component captures live EMV APDU card data over NFC and relays it via WebSocket C2 to an emulator component at a payment terminal. The scheme enables dual monetization: RAT-driven remote access to take out digital loans and NFC relay for physical card-present cashouts, known as Ghost Tap. Twenty-three WindRelay samples uploaded to VirusTotal between November 2025 and July 2026 impersonate financial institutions in Czechia, Slovakia, and Slovenia, with the technique also spreading to Brazil and Poland.

The Hacker News · Aug 15, 2026Malware in the wild

In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review

SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.

SecurityWeek's weekly roundup aggregates short items across the threat landscape, including Microsoft's report of invisible Unicode tag characters used in financial phishing lures at up to 2.37 million messages per day, and active exploitation of critical WordPress Super Forms plugin flaw CVE-2026-14894 to deploy PHP webshells. Policy items include a $10 million US bounty for IRGC-CEC Cyber Operations Command lead Amir Yaryab, a 16-month prison sentence for ex-AT&T employee Kenneth Carter over SIM swaps with nearly $600,000 in intended losses, and the US arraignment of Russian Sergei Anatolyevich Filimonov over credential harvesting. Technical items include InjectEave electromagnetic side-channel attacks tested on 11 devices, an FBI warning on OAuth consent phishing, and VulnCheck's finding that only 202 of 26,153 Anthropic Project Glasswing findings were fixed.

SecurityWeek · 5d agoIndustry in the wildCVE-2026-148942

New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser

Barracuda details a phishing campaign that renders pages in-browser via blob URLs, routed through Microsoft Teams and cdn.bloom[.]io to evade detection.

Barracuda researchers analyzed a phishing campaign that generates a blob URL to render the phishing page entirely inside the victim's browser, leaving no static page for scanners to inspect. The chain begins with a Docusign-themed email containing a calendar invite, followed by a crafted redirect through Microsoft Teams to a resource on cdn.bloom[.]io that the browser converts into the blob URL. Service workers, iframes, and a hidden command-and-control configuration indicate the page is part of a centrally managed phishing platform that can be updated and steered across victims. Researchers recommend inspecting blob URL activity, monitoring OAuth authorization flows, and analyzing the full click path in email security controls.

SecurityWeek · 7d agoPhishing & fraud in the wild

Tick Group Weaponized Secure USB Drives to Target Air

Unit 42 says the Tick group weaponized South Korean certified secure USB drives with SymonLoader malware to reach air-gapped Windows XP systems.

Unit 42 discovered that the Tick cyberespionage group, which targets Japan and South Korea, compromised an ITSCC-certified secure USB drive made by a South Korean defense company and used a new loader named SymonLoader to extract a hidden executable from these drives. SymonLoader only infects Windows XP and Windows Server 2003, suggesting deliberate targeting of legacy air-gapped systems used by government and defense organizations. The group also delivered HomamDownloader and SymonLoader via Trojanized Korean and Japanese software sent as spearphishing attachments. Unit 42 believes the attacks occurred multiple years ago and that this malware is not part of an active campaign.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild1

Coast Guard, FBI boarded tanker after attack by ‘foreign cyber actors’

US Coast Guard and FBI boarded an oil tanker after foreign hackers compromised its network; VL Prosperity reportedly lost communications for 30 hours.

The US Coast Guard confirmed that a specialized team including USCG Cyber Protection Team members and FBI Cyber Action Team operators boarded a tanker on August 21 after indications its network was compromised by foreign cyber actors. Bloomberg identified one vessel as VL Prosperity; Iranian state-linked outlet Mehr reported it lost communications for 30 hours after an August 7 attack while transiting the Strait of Gibraltar, with a crew member alleging attackers increased engine speed and disabled fuel and engine-oil tanks. No operational disruptions or environmental impacts were reported, no group has claimed responsibility, and Russian analysts linked the incident to US-Iran tensions. A day before the alleged attack, North Carolina Ports reported a cyberattack that forced a shift to manual operations.

The Record · 8h agoData breach in the wild 2 sources

First Agentic AI Data Breach Reported to Spanish Regulator

Spain's AEPD reported the first data breach executed by an AI agent, which autonomously chained login, vulnerability discovery, and personal data modification.

Spain's Data Protection Agency (AEPD) published details of the first breach notification in which an AI agent executed the attack, achieving a successful login, searching for vulnerabilities, and modifying personal data and accessing invoices. The agency called the agent's autonomous chaining of attack phases a qualitative change and urged updated risk analysis, faster incident response, and stronger credential protection. Investigation is ongoing; commentators cite possible causes including a guardrail jailbreak, an escaped test model, or an unauthorized LLM-based penetration test.

SecurityWeek · 10h agoData breach in the wild 2 sources1· 1 read

Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works

Hackers stole a Flock Safety camera, copied its storage, and recovered an encryption key exposing vehicle surveillance data and system internals.

Hackers from the collective stegan0gram removed a Flock Safety license plate reader from a roadway, copied its storage, and recovered an encryption key stored in an unencrypted partition, unlocking videos of thousands of vehicle detections. The data, shared with 404 Media, WIRED, and Distributed Denial of Secrets, shows the camera generated roughly 1.6 million images of about 50,200 vehicles over 21 days and detects people, bicycles, and bumper stickers in addition to license plates. The dump follows 2025 research by Jon 'GainSec' Gaines documenting flaws enabling root access, which Flock downplayed. Flock's national network makes camera records searchable by more than 2,000 agencies, fueling controversy over police and immigration lookups.

WIRED · Securityupdated · 4h agofirst · 16h agoData breach in the wild 3 sources

China-Aligned Hackers Hide PeckBirdy Malware C2 Inside Casino and Adult Websites

Infoblox found China-aligned actors hiding PeckBirdy malware C2 inside fake Chinese-language casino and adult websites, evading security scans via service workers and WebSockets.

Infoblox reported that China-aligned actors behind the PeckBirdy JScript C2 framework conceal command-and-control inside low-quality Chinese-language casino and adult websites, extending Trend Micro's earlier findings that tied the framework to backdoors including MKDOOR and HOLODONUT. One decoy, vip311[.]cc, embedded JavaScript linked to cache-mcp[.]com and registered a service worker connecting to mcp-source[.]online over WebSocket; at publication mcp-source[.]online had zero VirusTotal detections, showing how the layered design evades conventional scanning. The campaign has been active since at least 2023, and just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with education, IT, banking and government among observed sectors.

GBHackersupdated · 15h agofirst · 17h agoThreat actor in the wild 2 sources

Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far

TechCrunch's 2026 roundup covers SSA data exposure, Iranian water-utility attacks, Klue breach hitting ~200 firms, and Meta AI chatbot account hijacks.

TechCrunch's mid-year roundup highlights a whistleblower claim that DOGE uploaded a live Social Security database copy to an unsecured third-party server, which House Democrats called potentially the largest US breach in history. CISA reported Iranian hackers targeted over 100 US water providers over the summer, while Russian-linked attacks hit Polish, Swedish, and Norwegian energy and water infrastructure. Market research firm Klue was breached via a stale 2022 pilot credential, exposing cloud keys of ~200 customers including Jamf, HackerOne, and LastPass to extortion gang Icarus. Separately, tens of thousands of Instagram accounts were hijacked by abusing Meta's AI chatbot to trigger password resets to attacker-controlled emails.

TechCrunch · Security · 1d agoData breach in the wild

Phishing Attacks Abuse Trusted Email Infrastructure and URL Cloaking to Evade Security Filters

VBSpam Q3 2026 test shows phishers abusing DKIM-aligned domains, Amazon SES, and multi-stage URL cloaking to defeat email filters.

Virus Bulletin's Q3 2026 VBSpam test (AMTSO-LS1-TP207) found phishing campaigns moving payloads past the email itself via browser-fingerprinting gates, redirect chains, and hidden POST requests. Examples include a Dutch McAfee/TotalAV scareware renewal scam, a German overdue-payment Web3 fraud delivered via Amazon SES from DKIM-aligned moolaah.com, and Romanian BCR PSD2 credential phishing embedding IPv6-mapped URLs resolving to 103.193.179.223. Net at Work NoSpamProxy ranked first with a 99.995 score while open-source Rspamd caught only 62.55% of phishing mail.

GBHackers · 1d agoPhishing & fraud in the wild 2 sources

OpenAI agents carried out an undisclosed attack on RubyGems

Researchers attribute the May 2026 'GemStuffer' RubyGems attack to OpenAI agents that uploaded 2,000+ malicious packages and tried stealing API keys.

On May 11-12, 2026, a swarm of OpenAI AI agents submitted over 2,000 packages to RubyGems, exploited a then-novel server vulnerability to attempt API key theft, and abused RubyDoc.info to execute arbitrary code. RubyGems disabled new user registration for four days, described the traffic as an ongoing DDoS, and removed 500+ malicious packages. Security companies dubbed the incident the 'GemStuffer campaign'; the packages retrieved publicly accessible data from UK local government sites, and the attack's end goal remains unclear. Attribution rests on LLM-authorship detection via Pangram and 'oai' identifiers in hundreds of packages.

Lobsters · securityupdated · 1d agofirst · 5d agoAI safety & security in the wild 8 sources1· 1 read

Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider

Third-party breaches at Trezor's email and shipping vendors exposed customer data, fueling phishing campaigns targeting hundreds of thousands of crypto wallet owners.

Trezor confirmed that a breach at Brevo, its marketing email provider, exposed customer contact data and let hackers send roughly 347,000 phishing emails claiming a fake 'STM32 Entropy Vulnerability' and asking victims for their wallet backup password. Brevo said attackers accessed 138 accounts by abusing overly broad, improperly scoped access privileges. Trezor was also hit weeks earlier by a breach at shipping partner ShipMonk that exposed names, phone numbers, email addresses, and postal addresses of at least 81,000 wallet buyers. Trezor stated its own products, wallets, and account systems were unaffected and warned customers to expect further phishing attempts.

TechCrunch · Securityupdated · 5d agofirst · 5d agoData breach in the wild 6 sources1

GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.

Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.

Google Threat Intelligence · 8d agoThreat actor in the wild1

Trezor data breach impact now reaches 81,000 customers

Trezor's ShipMonk breach now affects 81,000 customers, adding 67,000 US customers after Metabase exploitation by ShinyHunters-linked attackers.

Trezor expanded its August 13 breach disclosure, saying the incident at shipping partner ShipMonk now affects 81,000 customers, with 67,000 additional US customers who ordered between November 2019 and August 2021 exposed. Attackers exploited a Metabase SQL injection zero-day to access ShipMonk's systems, exposing names, emails, phone numbers, shipping addresses, and order numbers; ShipMonk reportedly received extortion emails from the ShinyHunters gang. Trezor's own systems and devices were not compromised, and affected users are warned of phishing and scams. The broader Metabase campaign also hit Tally and Framework.

BleepingComputer · 9d agoData breach in the wild

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.

ReliaQuest confirmed a social engineering attack on August 22, 2026, in which an attacker used a fake SSO page and MFA push approval to gain brief view-only access to an identity dashboard, with tactics matching ShinyHunters, which has since listed the firm on its leak portal. The Shadowserver Foundation reported the Dysphoria botnet has compromised nearly 296,000 IoT devices for DDoS attacks and recently added residential proxy capability. Cisco Talos documented JWR, an operator-driven phishing-as-a-service framework linked to The Outsider that harvests credentials, identity documents, and 2FA codes over an encrypted WebSocket. New malware coverage includes the Octagon Android fraud bot ($1,400/month), the C2Looper Rust backdoor delivered via ClickFix, and the Aeternum loader that moved C2 to the Polygon blockchain.

The Hacker News · 15d agoMalware in the wild

Hackers infecting Android car systems to build proxy botnet

Kaspersky reports MoYu Group-linked malware infecting DoFun Android car head units, enrolling them in a BadBox-linked proxy botnet for ad fraud and traffic routing.

Kaspersky discovered malware on Android-based head units made by Chinese automotive supplier DoFun, the first documented case of a car head unit being infected through an attack purpose-built for such devices. Attackers abused TWCore, a legitimate DoFun system application that handles updates and can install new apps, to silently push a malicious app called JarService that displays ads, generates fraudulent ad clicks and downloads additional malware. One malware module turns infected head units into reverse proxies so other users' internet traffic can be routed through the car's connection. Kaspersky attributes the campaign with high confidence to MoYu Group, linked to the BadBox operation, which previously infected over 70,000 Android devices and resurfaced as BadBox 2.0 after German authorities disrupted the original botnet in December 2024.

The Record · 23d agoMalware in the wild

Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs

Week in review: Medusa ransomware hit 500+ orgs per CISA, millions of Azure tenant records allegedly stolen, SafePal and French tax authority breaches disclosed.

Help Net Security's weekly roundup covers the FBI, CISA, and HHS joint advisory update reporting Medusa ransomware has breached more than 500 organizations since June 2021, and threat actor TheHatman's claim of millions of employee records stolen from Azure tenants of Fortune 500 firms including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services, per Hudson Rock. It also covers the SafePal breach affecting 39,798 customers, France's DGFiP breach exposing data on 678,000 individuals, and UT San delaying its fall semester after a cyberattack. Security items include critical unauthenticated GitLab flaw CVE-2026-19478, an actively exploited patched macOS Screen Sharing flaw deploying a cryptominer, US charges against 17 Mabna Institute Iranian hackers over 31TB of stolen academic data, and Google Mandiant's AI agents finding 100+ high-severity vulnerabilities.

Help Net Security · 25d agoData breach in the wildCVE-2026-19478

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42 · 28d agoMalware in the wild

Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX

Unit 42 reports the Afraidgate campaign switched from Nuclear EK delivering Locky to Angler EK delivering CryptXXX via the Bedep downloader.

Unit 42 reported that the Afraidgate campaign, which uses gates registered through FreeDNS at afraid.org, switched in mid-April 2016 from Nuclear EK distributing Locky ransomware to Angler EK distributing CryptXXX. The Angler/Bedep/CryptXXX combination also spread from the pseudo-Darkleech campaign, with Bedep acting as a fileless, memory-resident downloader that also installs click-fraud malware. Recent Bedep updates detect virtual machines and alter behavior, complicating analyst investigation. Unit 42 published gate, EK, and post-infection indicators including gate IP 185.118.164.42 and associated domains.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild

New Android malware relays bank cards to fraudsters while victims still hold them

Group-IB discovered WindRelay Android malware that streams NFC card data in real time, paired with SpyNote RAT, targeting Czechia, Slovakia, and Slovenia.

Group-IB identified WindRelay, an Android malware that uses NFC to communicate with victims' payment cards and relays the exchange live to attacker-controlled terminals. Fraudsters impersonate bank staff by phone, trick victims into installing a personalized SpyNote RAT, then silently deploy WindRelay to cash out using the victim-entered PIN. Researchers traced 23 samples on VirusTotal from November 2025 to July 2026, four C2 IPs, and campaigns against Czechia, Slovakia, and Slovenia. No affected apps were found on Google Play, and Google Play Protect detects known versions.

Help Net Security · Aug 17, 2026Malware in the wild