Tag: attack
-
Cronos blockchain restarts after $74 million Tectonic exploit
The Cronos blockchain network has resumed trading activity after a price-manipulation attack on the Tectonic cryptocurrency lending platform allowed an attacker to borrow $74 million. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cronos-blockchain-restarts-after-74-million-tectonic-exploit/
-
‘TerminalFix’ Campaign Weaponizes PowerShell for Enterprise Attacks
The ClickFix-style campaign features a sophisticated, multistage attack chain that includes reverse tunnels into victim organizations’ networks. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/terminalfix-campaign-weaponizes-powershell-enterprise-attacks
-
Microsoft warns of TerminalFix attacks deploying reverse tunnels
A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-warns-of-terminalfix-attacks-deploying-reverse-tunnels/
-
AI Model Rules Are Not Security Controls
OpenAI’s Hugging Face attack postmortem shows agents don’t care about rules, they need strong controls. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/model-knowing-rules-is-not-security-control
-
Hidden Attack Slips Past Claude Code Auto Mode
Researcher Gets Malicious Code Past Anthropic’s Automated Checks. Anthropic’s Auto Mode is designed to let Claude Code work with fewer human approvals. Security researcher Johann Rehberger found a way to get malicious code past those checks while Claude was carrying out a routine request to summarize a website. First seen on govinfosecurity.com Jump to article:…
-
How vulnerable are single sign-on systems to modern credential attacks
Secure your SSO with phishing-resistant MFA and continuous monitoring. Learn to mitigate risks like session theft and credential sprawl to protect identity. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/how-vulnerable-are-single-sign-on-systems-to-modern-credential-attacks-2/
-
Indeed Job Scam: Fake Recruiters Are Spreading Android Spyware
Scammers are using fake Indeed interview apps to infect Android phones with spyware. Learn how the attack works and how job seekers can avoid it. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-indeed-fake-interview-app-android-malware/
-
PaperCut issues emergency patches as threat actors target chained vulnerabilities
The print management software maker faced a wave of attacks in 2023 aimed at higher education customers. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/papercut-emergency-patches-threat-actors-chained-vulnerabilities/829184/
-
âš¡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
The boring parts caused most of the trouble.A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional.Elsewhere, fake apps, helpful support calls, cheap banking…
-
Cloudflare Unveils Adaptive Intelligence to Counter AI-Fueled Bot Attacks
Cloudflare introduces real-time defense against automated cyberattacks. I still have friends who are convinced that every attack on their websites is deliberately targeting their companies. Nah. These days anyone with a modest budget can easily rent networks of compromised devices, mask their location behind real home Internet addresses, and launch AI-enabled attacks that mimic people……
-
Berlin confirms data theft after Rhysida ransomware attack claims
Berlin’s city administration has confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware gang listed it on their data leak site. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/berlin-confirms-data-theft-after-rhysida-ransomware-attack-claims/
-
Aurora Ransomware Hackers Use Cursor AI Agent for Hands-On Exploitation and ESXi Attacks
Aurora ransomware operators have been observed using Cursor Agent, powered by Claude Sonnet, to support hands-on intrusion activity across ten victim organizations, while deploying a purpose-built Linux encryptor designed to disrupt VMware ESXi environments. The findings show how ransomware affiliates are integrating agentic AI into established post-compromise workflows rather than relying on it as a…
-
Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets
Tags: ai, attack, cybercrime, data-breach, group, infrastructure, intelligence, network, ransomware, russia, threatThreat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX’s artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security.The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its First seen on…
-
Shai-Hulud Trinitite Worm Infects Popular TanStack Query npm Package to Steal Developer Secrets
A new Shai-Hulud supply-chain attack dubbed Trinitite has compromised the npm package @7nohe/openapi-react-query-codegen, a TanStack Query code-generation library with more than 150,000 weekly downloads. The malicious releases deploy an evolved Mini Shai-Hulud worm designed to steal developer, cloud, CI/CD, package-registry, Kubernetes, Vault, and source-control credentials before using recovered access to spread through additional packages. While…
-
Android 17 Adds New Network Security Features to Block 2G SMS Blaster Attacks
Android 17 introduces a new set of network security controls to reduce cellular downgrade attacks, protect local networks, and limit metadata exposure during encrypted web sessions. This update includes carrier-managed 2G shutdown capabilities designed to combat SMS blaster campaigns that increasingly target users in public spaces. Google states the Android 17 changes focus on four…
-
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
The U.S. Department of Justice (DoJ) on Friday corrected a previously issued press statement that several of its agencies were victims of attacks carried out by Chinese threat actors, instead now pointing out that they were among those targeted.Last week, the DoJ said the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department…
-
LACMA Data Breach: A 4-Day Attack, a Year of Fallout
LACMA says a four-day cyberattack may have exposed Social Security, financial, and medical data, prompting public disclosure and a proposed lawsuit. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-lacma-data-breach-four-day-attack-year-fallout/
-
Exploited RCE Flaws and Infrastructure Attacks Define this Cybersecurity Week in August 2026
Weekly summary of Cybersecurity Insider newsletters for August 2026. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/weekly-roundup/exploited-rce-flaws-and-infrastructure-attacks-define-this-cybersecurity-week-in-august-2026/
-
PaperCut warns of hackers using printer management software flaw in attacks
PaperCut released an emergency advisory on Thursday evening saying vulnerabilities in their print management software, PaperCut NG and MF, are under active exploitation. First seen on therecord.media Jump to article: therecord.media/papercut-warns-of-hackers-using-printer-management-vulnerabilities
-
Russian-Speaking Hackers Used Cursor AI in Attacks on Seven Companies, Report Says
Russian-speaking hackers used Cursor AI during attacks on corporate networks, reportedly speeding reconnaissance, VPN access and exploitation attempts. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-cursor-ai-hackers-aur0ra-ransomware/
-
Identity-Based Attacks Drive 85% of Education Ransomware, Sophos Finds
Identity-based cyberattacks accounted for 85% of ransomware attacks experienced by education organizations over the past year, according to a new Sophos survey. The findings show ransomware attackers turning more often to identity abuse for initial access. The State of Ransomware in Education 2026 report draws on responses from 226 IT and cybersecurity leaders at lower..…
-
Palo Alto Networks Researchers Say First Wave of AI-Enabled Attacks Has Begun
Cybersecurity researchers from Palo Alto Networks this week reported that it became apparent that the latest generation of AI models would be able to discover thousands of vulnerabilities in applications. A wave of attacks that are leveraging AI to exploit those vulnerabilities is now underway. Sam Rubin, senior vice president of the Unit 42 cybersecurity..…
-
PaperCut NG/MF vulnerabilities exploited in zero-day attacks
Two vulnerabilities (CVE-2026-82078, CVE-2026-81578) affecting print management solutions PaperCut NG and PaperCut MF are being exploited by attackers, PaperCut Software has … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/27/papercut-ng-mf-vulnerability-attack/
-
Over 8,300 Gitea servers vulnerable to code execution attacks
Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks/
-
700 OpenAI Agents Coordinate Attack on Hugging Face and Gain Remote Code Execution
OpenAI’s ExploitGym evaluation environment reportedly became the site of a large-scale, unsanctioned multi-agent campaign after hundreds of models found ways to communicate across supposedly isolated sandboxes. An investigation published by METR describes how the activity, which began on July 8, involved agents operating across several models, including GPT-5.6 Sol and an internally persistent model identified…
-
Polymorphic Phishing Attack Generates Unique Credential-Stealing Page on Every Visit
A newly analyzed phishing operation is using server-side polymorphism to generate a distinct credential-harvesting page for virtually every request, undermining detection approaches built around file hashes, fixed HTML identifiers, and static JavaScript signatures. The campaign came to light after a phishing message submitted to the SANS Internet Storm Center (ISC) pointed recipients to a URL…
-
Authorities arrest 2 alleged members of prolific hacking group TeamPCP
The group infected more than 1,000 organizations in a relentless supply-chain attack campaign. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/08/authorities-arrest-2-alleged-members-of-prolific-hacking-group-teampcp/
-
Without Path Erasure, a Security Flywheel is Just a Hamster Wheel
Tags: attackSecurity teams can reduce attacker optionality by eliminating attack paths through subtractive architecture, shifting investment from reactive alerting toward durable architectural hardening. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/without-path-erasure-a-security-flywheel-is-just-a-hamster-wheel/
-
PaperCut Zero-Day Under Active Attack: Emergency Patch Released
PaperCut warns that a zero-day in NG and MF is being exploited. The company already release emergency patches to address it. PaperCut Software warns that attackers are actively exploiting a zero-day in its NG and MF print management products. The flaw has no CVE yet, and the company has not released technical details. PaperCut issued…
-
Unitree G1 Humanoid Robot Flaws Allow Unauthenticated Root RCE Over Bluetooth
Security researcher Boschko has revealed two vulnerabilities in Unitree’s G1 humanoid robot that can be exploited to achieve unauthenticated remote code execution (RCE) from nearby devices via Bluetooth Low Energy (BLE). This research, referred to as UniBLEed, indicates that the attack can compromise the robot’s Locomotion PC, the component responsible for essential functions, without requiring…