Tag: attack
-
ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations. Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026. CrowdStrike’s October 7 investigation assessed…
-
ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations. Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026. CrowdStrike’s October 7 investigation assessed…
-
ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations. Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026. CrowdStrike’s October 7 investigation assessed…
-
ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations. Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026. CrowdStrike’s October 7 investigation assessed…
-
Google puts new limits on AI agents that hunt threats and fix vulnerabilities
Google Cloud is adding new controls to CodeMender, its AI tool for finding and fixing software vulnerabilities, allowing businesses to isolate attack simulations and target … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/05/google-cloud-ai-agents-security-controls/
-
Russian APT29 Targets Mobile Users with Watering Hole Attacks
Russia-linked group APT29 targeted iOS and Android users through hijacked websites and a compromised analytics service. Sekoia says a large-scale watering hole campaign is going after iOS and Android users, and it links the campaign to APT29 (aka SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, and The Dukes), the Russian group tied to the SVR foreign intelligence service. A watering hole…
-
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country.Describing the threat as active and ongoing, the activity involves the use of publicly-available AI-driven offensive security tools First seen…
-
U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog
Tags: attack, cisa, cve, cyber, cybersecurity, exploit, infrastructure, kev, malicious, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple flaw, tracked as CVE-2024-27834 (CVSS score of 5.5), to its Known Exploited Vulnerabilities (KEV) catalog. >>This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant…
-
U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog
Tags: attack, cisa, cve, cyber, cybersecurity, exploit, infrastructure, kev, malicious, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple flaw, tracked as CVE-2024-27834 (CVSS score of 5.5), to its Known Exploited Vulnerabilities (KEV) catalog. >>This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant…
-
U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog
Tags: attack, cisa, cve, cyber, cybersecurity, exploit, infrastructure, kev, malicious, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple flaw, tracked as CVE-2024-27834 (CVSS score of 5.5), to its Known Exploited Vulnerabilities (KEV) catalog. >>This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant…
-
AI-Powered BOSSAI Attacks Expose Patient Records and Emergency Dispatch Data in Taiwan
BOSSAI, an agentic attack platform run by one operator that exposed emergency medical and dispatch data in Taipei. The campaign targeted hundreds of organizations in eleven countries, including emergency services, banks, universities, military systems and e-commerce sites. Confirmed breaches hit universities and emergency providers, with medical data and PII exfiltrated. A Taipei fire department patient-care…
-
More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus
Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have all come forward over the last week to report data breaches traced back to Amadeus IT Group, a company that builds and maintains platforms for flight reservation, ticketing and check-in platforms. First seen on therecord.media Jump to article: therecord.media/asian-airlines-announce-data-breach-it-provider-incident
-
Vercel rolls out new protection against stolen session cookie attacks
Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/vercel-rolls-out-new-protection-against-stolen-session-cookie-attacks/
-
Hackers stole DreamHost customer files and inboxes during months-long attack
The web host said hackers exploited a vulnerability to access customer emails and files during a “deliberate attack.” First seen on techcrunch.com Jump to article: techcrunch.com/2026/11/04/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack/
-
Cyberattack Hits French Blood Banks as Hackers Target Refrigeration Systems Across Europe
Cyberattacks disrupted refrigeration monitoring systems at three French blood banks, amid similar attacks targeting European supermarkets. A cyberattack has hit three regional blood banks in France, disrupting systems used to monitor and control refrigerated storage facilities. The incident took place overnight between Sunday and Monday, at roughly the same time hackers were targeting supermarket refrigeration…
-
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.The attacker’s code then runs as root, according to advisories that Debian, Ubuntu, and APT’s developers published on November 4. The attack needs APT to retry failed downloads, which…
-
NIKKE PC game launcher hacked to spread remote access, data-stealing malware
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game’s PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/
-
Google Calendar phishing campaign hijacks sessions, bypasses MFA
A phishing campaign used Google Calendar invites, trusted redirects, and fake login pages to hijack corporate Google sessions and bypass MFA protections. Material Security examines how Operation CloudFire tracked the attacks, blocked malicious messages, and helped take down nearly 900 domains used by the attackers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa/
-
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker.”The injected JavaScript code collects browser and device attributes,” Sekoia researchers Amaury-Jacques Garçon and…
-
CISA flags WordPress RCE flaw as actively exploited in attacks
Tags: attack, cisa, cybersecurity, exploit, flaw, infrastructure, rce, remote-code-execution, vulnerability, wordpressThe US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks/
-
France Blood Service Cyber-Attack Sends Blood Storage Temperatures to 110°C
A supplier of the French National Blood Service was hit by a cyber-attack in which hackers turned cold rooms hosting blood samples up to 110°C (230°F) First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/france-blood-service-cyberattack/
-
French blood banks hacked in latest cyber-attack on Europe
Temperature and defrosting thresholds raised to ‘very high levels’ at three cold stores stocking vital blood productsFrance’s national blood service has said hackers accessed control systems and boosted temperatures at three cold stores stocking vital blood products, in an apparent escalation of recent cyber-attacks on fridges and freezers across Europe.<a href=”https://presse.efs.sante.fr/actualites/l-efs-confirme-l-incident-de-cybersecurite-impactant-un-de-ces-prestataires-d-equipement-frigorifique-2c07c-08a0a.html”>The French blood service (EFS)…
-
M&S boss bemoans last week’s budget as ‘whole lot of nothing’
Stuart Machin hits out at Labour but welcomes expected UK-EU food deal as retailer reveals half-year resultsThe chief executive of Marks & Spencer has called John Healey’s first budget as chancellor a “whole lot of nothing” and bemoaned an “onslaught of taxation and regulation” from the Labour government despite welcoming an expected deal on EU…
-
Hackers Alter Refrigeration Settings, Forcing European Stores to Discard Food
Hackers changed refrigeration settings at European supermarkets, forcing stores to discard produce, while UK suppliers reported attacks on… First seen on hackread.com Jump to article: hackread.com/hackers-alter-refrigeration-settings-european-discard-food/
-
CISA flags WordPress RCE flaw as actively exploited in attacks
Tags: attack, cisa, cybersecurity, exploit, flaw, infrastructure, rce, remote-code-execution, vulnerability, wordpressThe US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks/
-
CISA Warns of Active Attacks Exploiting WordPress Core Code Execution Vulnerability
Tags: attack, cisa, cve, cyber, cybersecurity, exploit, infrastructure, kev, software, vulnerability, wordpressThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a WordPress Core vulnerability in its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. This vulnerability, identified as CVE-2026-119977, allows unauthenticated attackers to execute server-side code during a specific software upgrade window. CISA added this vulnerability to the catalog on November 3, 2026,…
-
CISA Warns of Active Attacks Exploiting WordPress Core Code Execution Vulnerability
Tags: attack, cisa, cve, cyber, cybersecurity, exploit, infrastructure, kev, software, vulnerability, wordpressThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a WordPress Core vulnerability in its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. This vulnerability, identified as CVE-2026-119977, allows unauthenticated attackers to execute server-side code during a specific software upgrade window. CISA added this vulnerability to the catalog on November 3, 2026,…
-
3AM Ransomware Hackers Use AI-Assisted Attacks to Breach UK Schools and Spread Across Windows Domains
A ransomware affiliate known as 3AM compromised a UK school network using a mix of traditional intrusion techniques and patterns suggesting the involvement of artificial intelligence. According to Bitdefender’s investigation on November 3, this operation appears to follow a suspected hybrid workflow: a human operator selects the targets while a language model may handle repetitive…
-
3AM Ransomware Used Human-AI Hybrid Tactics in UK School Estate Compromise
Bitdefender highlighted a unique human-AI approach during a September attack on a UK school estate, which resulted in financial data being exfiltrated First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/3am-ransomware-hybrid-ai-uk-school/
-
Hackers use n-day exploits in zero-click attacks on iOS, Android devices
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices/