Tag: access
-
Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests
The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript.Russian cybersecurity company Kaspersky is tracking the First seen…
-
Fake Claude Opus 5 app delivers malware and wipes its own tracks
A malicious GitHub repository impersonating Anthropic and claiming to offer free access to “Claude Opus 5” is delivering RevStealer, Windows information-stealing malware that … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/01/revstealer-malware-claude-opus-5-github/
-
Critical JFrog Artifactory Authentication Bypass Exploited in the Wild
Security researchers have issued warnings that attackers are actively exploiting a critical authentication bypass vulnerability in JFrog Artifactory, tracked as CVE-2026-82329. This vulnerability allows the generation of administrator-level access tokens. According to a post from the security research firm watchTowr dated September 1, its threat intelligence team has already observed exploitation activities targeting this flaw.…
-
Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones
The most common way into a company last year was to ask.A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix, and…
-
North Korea-linked IT Workers Are Getting Hired Inside Western Companies
Huntress found five DPRK-linked workers hired in 2026 using fake identities, remote-access setups and proxy tools to infiltrate legitimate companies. Companies keep accidentally hiring North Korea-linked individuals as remote workers, and Huntress just published the receipts. The security firm’s investigation documents five confirmed cases in 2026 alone where DPRK-aligned workers, tracked under the name FAMOUS…
-
AI-Enhanced BraZetsu Malware Powers Underground Market Selling Access to Corporate Networks
BraZetsu, a Python-based Windows malware framework allegedly operated by the Brazilian threat actor Exilware to identify, profile, and monetize compromised corporate systems. Rather than behaving like a conventional infostealer, BraZetsu appears designed to support an Initial Access Broker operation, converting infected endpoints into cataloged access offerings for an underground marketplace. The framework is reportedly the…
-
What Stood Out to Me at This Year’s DEF CON
Ferdinand Mudjialim, Penetration Tester September 1, 2026 “In many cases, they returned to familiar problems around trust, access, authentication, and what happens when a system is exposed in unexpected ways.” Key Takeaways Restricted systems are only as locked down as… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/what-stood-out-to-me-at-this-years-def-con/
-
Why Enterprises Need AI FinOps, Security to Scale Responsibly
Enterprises Need Unified Cost and Security Controls to Scale AI Agents Responsibly AI agents can run up costs and expand security risks faster than traditional governance can respond. Companies need real-time visibility into every model call, tool invocation and agent action, linking spending, access and outcomes so finance and security teams can control AI jointly…
-
NIS2 compliance: Fixing IAM and access control before the 2026 audit
The NIS2 Directive places direct obligations on organizations across supply chain risk management, incident reporting, and board-level accountability. October brings a new … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/01/nis2-credential-compliance-before-audit/
-
Anthropic Users Hit by Infostealer Attacks, Session Thefts
A threat actor used a variety of infostealers to collect session information and access Claude accounts belonging to an unknown number of users. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/anthropic-users-infostealer-attacks-session-thefts
-
OpenAI Cuts Off Cursor Models After SpaceX Acquisition
OpenAI Cites Distrust of Musk as Cursor Faces Growing Pressure From Rival Coding Tools. After Cursor’s sale to Elon Musk’s SpaceX, OpenAI announced it will gradually cut off access to its models on the vibe-coding platform, citing distrust of the company’s new owner. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/openai-cuts-off-cursor-models-after-spacex-acquisition-a-32700
-
Anthropic Warning: Infostealer Malware Is Hijacking Claude Sessions, Draining Accounts
Infostealer malware is stealing authenticated Claude browser sessions, letting attackers access paid AI accounts and consume victims’ usage allowances. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-claude-session-hijacking-infostealer-malware/
-
Anthropic Warning: Infostealer Malware Is Hijacking Claude Sessions, Draining Accounts
Infostealer malware is stealing authenticated Claude browser sessions, letting attackers access paid AI accounts and consume victims’ usage allowances. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-claude-session-hijacking-infostealer-malware/
-
Zero Standing Privilege vs Least Privilege: What’s the Difference?
The main difference between Zero Standing Privilege (ZSP) and least privilege is that least privilege limits the amount of access an identity has, whereas ZSP limits both the amount of access and its duration. Least privilege grants every user or machine only the minimum permissions necessary to do its job, but those permissions tend to…
-
AWS S3 Bucket Security: Find the Secrets Hiding Outside Git
S3 buckets have quietly become a credential blind spot: years of logs, backups, and pipeline output that nobody ever scans for secrets. In one 2025 incident (Sysdig), attackers reached admin access in eight minutes using IAM keys found in a public bucket. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/aws-s3-bucket-security-find-the-secrets-hiding-outside-git/
-
Agents Without Guardrails: Why Agentic AI Governance Must Focus on Behavior, Not Just Identity
Enterprises have spent decades building security around a familiar question:”¯Who are you? Identity and access management (IAM), authentication, service accounts, OAuth tokens, and role-based access controls all start there. Establish identity, assign permissions, and control access. Agentic AI changes the equation. AI agents do not simply access systems. They reason, select tools, call APIs, retrieve……
-
Attackers plant remote access tools on compromised PaperCut servers
The threat actor targeting internet-facing PaperCut Application Servers is covertly installing legitimate remote access software on them, PaperCut Software shared in the most … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/31/papercut-attack-remote-access-tools/
-
Attackers plant remote access tools on compromised PaperCut servers
The threat actor targeting internet-facing PaperCut Application Servers is covertly installing legitimate remote access software on them, PaperCut Software shared in the most … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/31/papercut-attack-remote-access-tools/
-
Attackers plant remote access tools on compromised PaperCut servers
The threat actor targeting internet-facing PaperCut Application Servers is covertly installing legitimate remote access software on them, PaperCut Software shared in the most … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/31/papercut-attack-remote-access-tools/
-
File servers are here to stay. Here’s how to manage them securely
File servers remain a critical part of many IT environments, but managing access securely can become complex as permissions accumulate. tenfold Software outlines five best practices for simplifying file server administration and maintaining least-privilege access. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/file-servers-are-here-to-stay-heres-how-to-manage-them-securely/
-
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
Claude Code reads files, runs shell commands, invokes MCP tools, and acts through the credentials available on a developer’s machine. Anthropic’s new Compliance API endpoints give security teams their clearest view yet into that activity. They also expose a larger problem: activity logs alone cannot tell you whether an agent’s access is legitimate.AI has moved…
-
AWS Console Private Access can block sign-ins to personal accounts
The AWS Management Console now loads inside a network with no path to the public internet. Console Private Access became generally available on August 28 for virtual private … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/31/amazon-aws-console-private-access/
-
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks.Sygnia, the incident response firm that investigated the intrusion, said the actor First seen…
-
Shai-Hulud Trinitite Worm Infects Popular TanStack Query npm Package to Steal Developer Secrets
A new Shai-Hulud supply-chain attack dubbed Trinitite has compromised the npm package @7nohe/openapi-react-query-codegen, a TanStack Query code-generation library with more than 150,000 weekly downloads. The malicious releases deploy an evolved Mini Shai-Hulud worm designed to steal developer, cloud, CI/CD, package-registry, Kubernetes, Vault, and source-control credentials before using recovered access to spread through additional packages. While…
-
AshSqlite Vulnerability (CVE-2026-77846) Exposes Hidden JSON Fields
CVE-2026-77846, a newly disclosed AshSqlite vulnerability, can allow attackers to access hidden or sensitive fields stored inside JSON and map columns when applications pass untrusted input to AshSqlite’s First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cve-2026-77846-ashsqlite-vulnerability/
-
New Gryxa Toolkit Uses AI-Built Persistence to Fight Back Against Security Teams
A financially motivated threat actor using a new Windows toolkit named Gryxa that combines remote monitoring and management abuse, AI-assisted development, browser credential theft, and aggressive persistence designed to survive incomplete remediation. The toolkit’s most unusual feature is its ability to collect evidence of how defenders removed its visible access and send that information back…
-
Halo-record: Open-source audit trails for AI agents
Brian Kuan wrote halo-record, a small Python package that sits inside an AI agent and writes down the moves it makes: tool calls, model calls, data access, approvals. Each … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/31/halo-record-open-source-ai-agent-audit-trail/
-
Critical Microsoft UFO MCP Flaw Lets Attackers Remotely Control Android Devices Without Authentication
Tags: access, android, authentication, control, cve, cvss, cyber, flaw, microsoft, mobile, open-source, vulnerabilityA critical vulnerability in Microsoft’s open-source UFO Desktop AgentOS could allow remote attackers to access and control Android devices connected via the platform’s Mobile Model Context Protocol (MCP) servers without requiring authentication. This vulnerability is tracked as CVE-2026-73296 and GHSA-24fq-m9rr-g3mm, carrying a CVSS v3.1 score of 9.4. It affects UFO versions up to and including…