Tag: access
-
Chainalysis discloses data breach from “offensive agentic techniques”
Blockchain analytics firm Chainalysis disclosed a data breach after attackers used “offensive agentic techniques” to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chainalysis-discloses-data-breach-from-offensive-agentic-techniques/
-
Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks
Hackers impersonated IT help desk personnel on Microsoft Teams to gain remote access and abuse Active Directory Certificate Services (AD CS), turning approved support sessions into privileged authentication paths. Microsoft disclosed two intrusions on October 30, 2026, involving certificate template abuse and NTLM relay. The attacks did not exploit a Teams vulnerability. Instead, operators combined…
-
Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks
Hackers impersonated IT help desk personnel on Microsoft Teams to gain remote access and abuse Active Directory Certificate Services (AD CS), turning approved support sessions into privileged authentication paths. Microsoft disclosed two intrusions on October 30, 2026, involving certificate template abuse and NTLM relay. The attacks did not exploit a Teams vulnerability. Instead, operators combined…
-
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
Tags: access, authentication, cve, cybersecurity, exploit, flaw, infrastructure, ivanti, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild.The vulnerabilities are listed below – CVE-2026-111357 (CVSS score: 8.8) – A missing authentication for a critical function vulnerability that could allow a First…
-
Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls
Attackers have chained critical PHP2Shell vulnerabilities with the Fragnesia Linux kernel flaw to gain root access on Palo Alto Networks PAN-OS systems. The campaign reportedly compromised 24 internet-facing firewalls before reaching an internal firewall management server, bringing the total to 25 compromised systems. Hunt.io’s investigation cites Dream Research’s campaign analysis and describes a transition from…
-
Anthropic VS code extension on Cursor backdoored for nearly 12 hours
Tags: accessIt’s still unknown how attackers got access to Anthropic’s verified Cursor account. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/
-
Applebee’s exposed customers’ personal data after leaving database password in app
EXCLUSIVE: A security researcher discovered the hardcoded credential in Applebee’s app, allowing unrestricted access to customers’ personal data. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/30/applebees-exposed-customers-personal-data-after-leaving-database-password-in-app/
-
AI Agent Identity Crisis Forces Banks to Restrict Access
Financial Firms Face Pressure to Balance Customer Access With Data Protection. The lack of reliable ways to identify an artificial intelligence agent has caused many companies, especially banks and other financial institutions, to block most agent traffic amid rising interest in agents from enterprises and regular consumers. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ai-agent-identity-crisis-forces-banks-to-restrict-access-a-33266
-
AI Agent Identity Crisis Forces Banks to Restrict Access
Financial Firms Face Pressure to Balance Customer Access With Data Protection. The lack of reliable ways to identify an artificial intelligence agent has caused many companies, especially banks and other financial institutions, to block most agent traffic amid rising interest in agents from enterprises and regular consumers. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ai-agent-identity-crisis-forces-banks-to-restrict-access-a-33266
-
DHS Orders Civilian Agencies to Purge Acronis Software
DHS Cites Root Access in Barring Swiss Firm From Federal Networks. The U.S. Department of Homeland Security has ordered civilian agencies to stop buying and remove Acronis backup and security products, extending a ban that already covered intelligence and defense systems – though the order’s public rationale rests on the access the Swiss company’s tools…
-
Cursor Confirms Anthropic Claude Code Extension Compromised
Up to 5,000 Users Downloaded Backdoored Extension From Cursor Marketplace. Attackers backdoored the official Claude Code VS Code extension, being distributed on the Cursor Marketplace, designed to give attackers persistent SSH access to any endpoint on which the extension was installed. Cursor said about 5,000 users downloaded the malicious extension. First seen on govinfosecurity.com Jump…
-
Hackers Use Cursor and Claude AI to Automate Attacks in Aur0ra Ransomware Operations
Tags: access, ai, attack, credentials, cyber, cybercrime, exploit, group, hacker, ransomware, sophos, threatThe GOLD OGRE cybercrime group is using AI coding agents, including Cursor and Anthropic’s Claude, to automate intrusions for Aur0ra ransomware (Aurora). Sophos researchers say the agents moved from credential access to domain administrator with little human involvement. Aur0ra ransomware AI attacks In May 2026, Sophos Counter Threat Unit (CTU) researchers reported an AI-assisted post-exploitation…
-
Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware
A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport. First seen on hackread.com Jump to article: hackread.com/fake-github-repo-ai-coding-agents-solanacry-malware/
-
Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials
Hackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances, allowing them to execute commands with root access, steal credentials, and probe internal networks. Volexity has identified the unknown attacker as UTA0576 and traced the exploitation back to October 3, 2026, targeting an appliance that was fully patched at the time.…
-
Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit
Dream found that a suspected Chinese-nexus actor gained root access to Palo Alto Network firewall servers to target government organizations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-us-government-chained-php2/
-
Drupal warns of critical Commerce Core flaw exploited in attacks
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/
-
Drupal warns of critical Commerce Core flaw exploited in attacks
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/
-
New AI-Powered NIK C2 Malware Uses OpenAI API to Help Hackers Steal Data and Control Windows PCs
Cisco Talos has uncovered NIK C2, a Go-based, 64-bit Windows remote access tool that embeds a working OpenAI client. Operators can send prompts through an infected machine and read the model’s replies in their C2 panel. NIK C2 malware According to technical research published by Cisco Talos, the implant talks to its server over TLS-secured…
-
Datenleck: Mitarbeiter soll KI-Agenten Zugriff auf Pentagon-System gewährt haben
Ein Accenture-Mitarbeiter soll einem KI-Agenten Zugang zu einem Pentagon-System gewährt haben. Dabei gelangten offenbar Daten nach außen. First seen on golem.de Jump to article: www.golem.de/news/datenleck-mitarbeiter-gewaehrte-ki-agenten-zugriff-auf-pentagon-system-2610-214666.html
-
Malicious Claude Code VS Code Extension Installs Persistent SSH Backdoor to Give Attackers Remote Access
A trojanized version of the Claude Code extension, identified as anthropic.claude-code version 2.1.313, contains a malicious loader that enables persistent SSH access to developer systems. Researchers analyzed an artifact obtained from Open VSX and discovered 66 lines of JavaScript added to the legitimate extension bundle. This additional code lets the attacker’s script run before the…
-
Datenleck: Mitarbeiter gewährte KI-Agenten Zugriff auf Pentagon-System
Ein Accenture-Mitarbeiter soll einem KI-Agenten Zugang zu einem Pentagon-System gewährt haben. Dabei gelangten offenbar Daten nach außen. First seen on golem.de Jump to article: www.golem.de/news/datenleck-mitarbeiter-gewaehrte-ki-agenten-zugriff-auf-pentagon-system-2610-214666.html
-
Datenleck: Mitarbeiter gewährte KI-Agenten Zugriff auf Pentagon-System
Ein Accenture-Mitarbeiter soll einem KI-Agenten Zugang zu einem Pentagon-System gewährt haben. Dabei gelangten offenbar Daten nach außen. First seen on golem.de Jump to article: www.golem.de/news/datenleck-mitarbeiter-gewaehrte-ki-agenten-zugriff-auf-pentagon-system-2610-214666.html
-
Fake IT help desk callers got by on little more than names and email addresses
Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/30/cisco-talos-it-help-desk-vishing/
-
EUVD-2026-108569 / CVE-2026-115547 – Böswillige Admins führen im Okta Access Gateway Systembefehle aus
First seen on security-insider.de Jump to article: www.security-insider.de/okta-access-gateway-kritische-code-injection-cve-2026-115547-a-0b8c2f27901ec1b1dce8dd9f3320b41c/
-
Accenture Employee Allegedly Gave Claude Code AI Agent Administrative Access to Pentagon Systems
An Accenture employee reportedly linked a personal Claude Code account to a secure Department of Defense production environment, granting the AI coding agent administrative access and potentially exposing credentials and sensitive network information to an external service. According to WIRED’s investigation, published October 29, the agent operated on the Pentagon network for approximately two months…
-
Accenture Employee Allegedly Gave Claude Code AI Agent Administrative Access to Pentagon Systems
An Accenture employee reportedly linked a personal Claude Code account to a secure Department of Defense production environment, granting the AI coding agent administrative access and potentially exposing credentials and sensitive network information to an external service. According to WIRED’s investigation, published October 29, the agent operated on the Pentagon network for approximately two months…
-
3 Ways AI Agents Already Operate in Your Browser
AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional security tools may struggle to distinguish their activity from human users. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/3-ways-ai-agents-already-operate-in-your-browser/
-
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/ir-trends-q3-2026/
-
Bluesky blocks links to leaked DHS employee data as government seeks takedowns
The social networking site is facing criticism for blocking access to the site, which identifies thousands of ICE agents and other employees working for Homeland Security. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/29/bluesky-blocks-links-to-leaked-dhs-employee-data-as-government-seeks-takedowns/