57
57
57
42
42
57
57
57
57
47
57
57
42
57
57
42
42
57
42
57
42
Exposed Vite servers are being probed for AWS and Azure credentials
F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.
F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.
65
Passkey-themed phishing attacks lead to Microsoft 365 data theft
Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.
Microsoft attributes passkey- and SSO-themed social engineering activity, observed since May 2026, to Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (tied to BlackFile members now operating as Helix). Attackers impersonate corporate IT help desks by phone or SMS, urging fake passkey, MFA, or SSO updates and directing victims to adversary-in-the-middle phishing pages or device-code authentication flows that yield credentials, session tokens, and OAuth tokens. Post-compromise behavior includes Microsoft Graph enumeration of users, SharePoint, and OAuth grants, plus persistence via attacker-controlled MFA methods. Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.
78
Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion
Anthropic disrupted Midnight Blizzard campaigns where AI agents automatically rebuilt malware to evade detection, targeting 20+ government and defense organizations.
Anthropic's threat intelligence report documents the Russian state-nexus actor Midnight Blizzard using Claude to automatically monitor, modify, and redeploy malware until it evaded security products. The campaign hit more than 20 organizations, including Ukrainian and European government ministries, defense bodies, embassies, and think tanks, with mailbox theft from two drone component manufacturers and compromise of hotel guest Wi-Fi via DNS hijacking. The report also describes financially motivated groups GTG-50020 and GTG-50021 targeting AI credentials, including a prompt-injection attack on an automated evaluation sandbox that yielded production API keys and attempts to reach a pre-release Claude model across roughly 30 AI companies.
85
IT help-desk vishing tricks executives into handing over Microsoft 365 access
Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.
Arctic Wolf is tracking a campaign, PREY-0058, sharing tradecraft with Google Threat Intelligence Group's UNC6671, in which callers posing as internal IT talk employees through fake passkey/MFA setups. Operator-controlled adversary-in-the-middle pages harvest passwords and MFA approvals to seize session tokens, then actors enumerate and bulk-exfiltrate data from SharePoint, OneDrive, Exchange, and Box. Extortion brands include BlackFile, Pink, Helix, Cinder, and Redact; targets are mostly US-based executives in construction, healthcare, real estate, finance, and professional services, with exfiltration shifting to residential proxies like NodeMaven.
68
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
Google Threat Intelligence Group and Mandiant track extortion group UNC6671, which uses vishing calls impersonating IT help desks to lure employees to adversary-in-the-middle phishing pages that capture credentials, MFA tokens, and session tokens. The group then registers adversary-controlled MFA devices, pivots through identity providers into Microsoft 365, Okta, and other SaaS applications, and runs automated Python and PowerShell exfiltration scripts. UNC6671 has rotated through extortion brands including BlackFile, Redact, Pink, Helix, and Falcon, and Google tracked over $10.6 million in Bitcoin payments between January 7 and May 12, 2026, with initial demands exceeding $3 million. The actor has hit dozens of organizations in North America, Australia, and the UK, shifting toward high-value financial and legal firms in July 2026.
78
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.
Palo Alto Networks Unit 42 tracks two ongoing intrusion clusters, CL-CRI-1131 (Mexican transportation, federal ministries, municipal water utilities) and CL-CRI-1163 (Brazilian financial sector), both using living-off-the-land techniques, SOCKS5 relays, and custom RATs. The attackers appear to orchestrate operations via commercial LLMs like Claude and GPT-4.1, evidenced by iterative batch scripts and AI-generated tunneling tool naming. The Mexican campaign (also reported as Operation Escaneo by CloudSEK) exfiltrated sensitive data via dynamic-DNS infrastructure with rotated multi-SAN TLS certificates between February and June 2026. This signals broader adoption of AI-enhanced operations by diverse threat groups in the region.
72
McKesson copes with fallout from data theft extortion attack
McKesson discloses a data theft extortion attack by ShinyHunters affecting oncology and medical-surgical customers, with a reported $55 million demand.
McKesson disclosed that attackers gained access to some of its third-party applications and stole data associated with a subset of customers in its oncology, multispecialty, and medical-surgical business units; the intrusion ran for four days from August 21 and was discovered August 25. ShinyHunters claimed responsibility and listed McKesson on its data-leak site, reportedly demanding more than $55 million with a September 1 deadline. Flashpoint analysts say the group typically uses social engineering and identity weaknesses with valid credentials to access cloud-hosted environments, making the intrusion hard to detect. McKesson, which distributes about one-third of pharmaceuticals used in North America with $403.4 billion in annual revenue, says operations continue and it has reasonable assurance of no ongoing unauthorized activity.
80
ATF confirms cyberattack hit system containing info on its investigation targets
Qilin ransomware group claimed breaching the ATF, exposing data on investigation targets; the agency says a standalone system was hit with no mission impact.
The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed a cyberattack on a standalone system holding information about targets of ATF investigations, designated a major incident, with no impact on case management, lab, or eForms systems. Qilin, a Russian-speaking affiliate-based ransomware group, claimed responsibility, though ATF declined to confirm involvement or the root cause. Qilin has claimed hundreds of victims across 60+ countries since 2022 and partners with Scattered Spider and Moonstone Sleet.
78
Officials disrupt Chinese espionage operation that hit multiple federal agencies
FBI and DOJ seized QTFY infrastructure, disrupting a Chinese state-sponsored group that compromised federal agencies and critical infrastructure since 2018.
Authorities seized three domains powering QScan and QTRouter, the hacking suite of QTFY, a Chinese government-funded group operating through front company Nanjing Xinjiuwei Network Technology. Targets include the Departments of Energy, Justice, and Health and Human Services, the Federal Reserve, NASA, NIH, financial institutions, defense contractors, utilities, telecoms, and hospitals; the group exploited zero-days in Ivanti, Pulse Secure, Fortinet, Citrix, and others, intruding three DOE national labs in September 2024. QScan carried over 200 proof-of-concept exploits and processed more than two million scanning tasks in a single day in 2024.
88
The GTA VI leaks are breaking the internet. Security researchers have seen this before.
A hacker or insider leaked GTA VI gameplay footage before launch, triggering Take-Two DMCA subpoenas against Discord, Google, Microsoft and X.
The persona "CyberLeek" published stolen Grand Theft Auto VI gameplay footage and a manifesto, in what experts call a familiar data extortion playbook with monetization via watermarks, crypto wallets and a memecoin. Take-Two Interactive obtained DMCA subpoenas against Discord, Microsoft and X, and sent copyright notices to Google, treating the case like an insider threat investigation. GTA VI is projected to earn $3.3–5.2 billion in launch-week sales, raising financial and reputational stakes. Related leak websites went offline after the subpoenas.
72
Interpol targets Black Axe’s illicit financial web in latest international sting
Interpol's Operation Jackal IV made 58 arrests across four continents, disrupting Black Axe money-laundering, BEC, and sextortion networks and seizing millions.
Interpol-coordinated Operation Jackal IV produced 58 arrests and identified 263 suspects across Africa, Europe and South America, targeting Black Axe and other West African organized crime financial networks. Romanian authorities dismantled a call-center investment scam valued at roughly 143 million euros, while South African police made 39 arrests, seized $2.67 million and blocked 257 bank accounts tied to romance and investment scams targeting retirees. Argentine investigators identified 196 people in a Crime-as-a-Service network supplying website domains and laundering support, and Interpol noted the groups' growing focus on sextortion of victims as young as 14.
60
Google researchers uncover criminal zero-day exploit likely built with AI
Google links a likely LLM-built criminal zero-day for an open-source admin tool to planned mass exploitation and maps AI-assisted threats.
Google Threat Intelligence Group linked a zero-day exploit for a popular open-source web-based administration tool, enabling 2FA bypass with valid credentials via a semantic logic error, to a criminal group, citing educational docstrings, a hallucinated CVSS score, and textbook Python as signs of LLM authorship; the vendor was notified before a planned mass exploitation campaign. The report also details Russia-nexus malware families CANFAIL and LONGSTREAM using AI-generated decoy code, the PROMPTSPY Android backdoor driving the UI through the Gemini API, APT27 using Gemini to build relay tooling, and the TeamPCP (UNC6780) supply chain compromise of LiteLLM and Trivy repositories that planted the SANDCLOCK credential stealer.
78
Apollo discloses data breach from ongoing wave of attacks hitting financial sector
Apollo Global Management confirmed a breach of cloud platforms by BlackFile-linked social engineering attackers, exposing personal data including Social Security numbers.
Apollo Global Management disclosed that attackers accessed some of its cloud platforms between July 6 and July 10, 2026. The company determined on August 12 that compromised data included names, dates of birth, contact information, home addresses, and Social Security numbers. Google attributed the broader campaign against financial sector organizations to BlackFile, a threat group affiliated with The Com that operates extortion brands Redact, Pink, Helix, and Falcon. Apollo, which manages $1.05 trillion in assets, is the first victim to formally confirm sensitive personal data was compromised in this wave, with Blackstone and Bain Capital also reportedly targeted.
82
AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn
NSA, CISA, FBI, DOE and EPA warn hackers are using AI-generated scripts to actively attack Siemens S7 PLCs across critical-infrastructure sectors.
A joint cybersecurity advisory from the NSA, CISA, FBI, Department of Energy and EPA warns of an active threat campaign targeting water, food, energy, chemical, manufacturing and commercial facilities via Siemens S7 Series programmable logic controllers. The actors use internet scanning to find exposed or poorly protected PLCs, then deploy AI-generated exploitation scripts disguised as legitimate monitoring tools, an OT first that dramatically lowers the expertise required for ICS attacks. Siemens says no new S7 vulnerabilities are involved, only exploitation of misconfigurations, and it is coordinating with CISA's ProductCERT. The warning follows a joint FBI-EPA advisory confirming attacks at water and wastewater utilities in at least 12 states since July 27.
72
The long tail of Clop’s PTC hack is just beginning to emerge
Clop mass-exploited CVE-2026-12569 in PTC Windchill and FlexPLM in early June, claiming data theft from dozens of large organizations.
Clop began sending extortion emails in mid-July after exploiting CVE-2026-12569 in PTC Windchill and FlexPLM, likely as a zero-day in early June before PTC's June 17 disclosure and patch. Confirmed victims include Toast and Zebra, while GE, Philips and Shell are among claimed victims. CISA added the flaw, which allows unauthenticated remote code execution, to its KEV catalog on June 25. ReliaQuest said the group used a custom Windchill-specific web shell for credential theft and large-scale exfiltration, echoing its past MOVEit and Oracle E-Business Suite mass-exploitation campaigns.
85
Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics
CISA, FBI, and HHS updated their Medusa ransomware advisory, reporting over 500 victims and detailing the gang's access-broker and exploit tactics.
A joint advisory update from CISA, the FBI, and HHS expands the March 2025 Medusa guidance, drawing on a year of FBI investigations. The ransomware-as-a-service group's known victim tally grew from more than 300 to more than 500 between March 2025 and April 2026, with the Healthcare and Public Health sector frequently hit. Medusa pays access brokers $100 to $1 million, has exploited flaws such as Fortra GoAnywhere and BeyondTrust vulnerabilities, and leverages newly announced exploits within 24 hours, sometimes a week before public disclosure. The group uses living-off-the-land techniques, remote monitoring and management software, and RDP for lateral movement, and has been linked to actors including Microsoft-tracked Storm-1175 and North Korean hackers targeting healthcare.
72
Hacker claims millions of records stolen from corporate Azure tenants
Threat actor TheHatman claims millions of employee records stolen from Azure tenants of nine Fortune 500 firms, including McDonald's, Vodafone, Kyndryl, and TCS.
A threat actor known as TheHatman posted large internal employee directories on cybercrime forums over the past week, claiming each was pulled directly from the victim organization's Azure tenant. McDonald's tops the list at roughly 1.7 million records, followed by TCS (~800,000), Vodafone (~425,000), and HCL (~250,000), with IHG, Kyndryl, Gap, Hexaware, and Wyndham also named. Hudson Rock found samples consistent with standard Azure directory exports and suspects infostealer-derived credentials rather than a systemic Azure zero-day. TCS filed a statement with the Bombay Stock Exchange saying it found no credible evidence of a breach and the data appears over four years old.
72
Details emerge on BlackFile's recent attacks on financial companies
BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.
Google Threat Intelligence Group (tracking BlackFile as UNC6671, linked to The Com) reports the extortion group remains active, shifting focus to the financial sector and med tech organizations, with new Redact-brand extortion demands issued last week. The group impersonates IT support in voice-phishing attacks using hundreds of recruited callers, targets large firms in what researchers call big-game hunting, and processes an average of 1.5 new victims daily. Extortion demands start around $3 million and are typically negotiated below $1 million; Flashpoint observed infrastructure targeting Blackstone, Bain Capital, Moody's, CME, and Apollo, though compromise is unconfirmed. Mandiant has responded to more than two dozen BlackFile compromises since January, and victims face escalation tactics including swatting.
70
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk
QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.
German incident response firm QUIRSOS assessed with moderate confidence that a suspected China-nexus actor, likely operating in UTC+08:00 hours, exploited VMware vCenter flaw CVE-2026-59310 (CVSS 9.8 directory traversal) beginning five days after Broadcom's July 29 patch. The campaign compromised 361 unique victim IPs across 47 countries, most in Germany, the US, Turkey, Iran, and France. The actor abused cron jobs, a XOR-obfuscated 'linuxFile' WebSocket backdoor with systemd/cron persistence, a JSP web shell, SSH authorized-keys manipulation, and a reverse SSH tool, with one Babuk deployment reported. A separate vCenter 'vcenter_admin' account creation consistent with CVE-2026-59309 exploitation was also observed from August 1.
78