Tag: hacker
-
Microsoft Paint Vulnerability Allows Hackers to Execute Malicious Code Remotely Without User Interaction
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious code remotely without any user interaction. This vulnerability is tracked as CVE-2026-83844 and was disclosed on October 13, 2026. It carries an >>Important<< severity rating from Microsoft, and its CVSS 3.1 base score is 8.1, indicating potentially serious consequences, despite…
-
Storm-2603 Hackers Exploit SharePoint and Abuse Cloudflare Tunnel to Hide Remote Access
A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware. The attackers used ToolShell flaws in on-premises SharePoint and ran a memory-only webshell inside the IIS worker process. They then layered several tunnels, including Cloudflare Tunnel, to keep access after the initial foothold was gone. Kaspersky assesses the attribution with moderate confidence.…
-
FBI, CISA warn of cyberattacks targeting refrigeration systems
The FBI and CISA warn that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fbi-cisa-warn-of-cyberattacks-targeting-refrigeration-systems/
-
FBI, CISA warn of cyberattacks targeting refrigeration systems
The FBI and CISA warn that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fbi-cisa-warn-of-cyberattacks-targeting-refrigeration-systems/
-
FBI, CISA warn of cyberattacks targeting refrigeration systems
The FBI and CISA warn that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fbi-cisa-warn-of-cyberattacks-targeting-refrigeration-systems/
-
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Certain configurations of Alpine are affected. Other distros may be as well. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password/
-
Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/
-
Bring a tent, I’ve got the coffee: Lessons from it-sa
Thorsten may have had to camp out in Nuremberg to attend it-sa, but the real story is the initiative to add a formal IT Security apprenticeship program in Germany for the thousands of young hackers ready to join our side. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/bring-a-tent-ive-got-the-coffee-lessons-from-it-sa/
-
(g+) Binance: Nordkoreas Hacker planten Milliardenraub monatelang
Nikkei Asia rekonstruiert den Angriff auf die Kryptobörse und erklärt mit Experten, wie Nordkoreas Hacker vorgehen. First seen on golem.de Jump to article: www.golem.de/news/binance-nordkoreas-hacker-planten-milliardenraub-monatelang-2611-214903.html
-
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign
Russian state-linked hackers targeted users in Ukraine, the United States and Europe in a campaign to steal sensitive information from iPhone and Android devices, researchers found. First seen on therecord.media Jump to article: therecord.media/russia-hackers-smartphone-cyberattacks
-
Hackers Tamper With Refrigeration Controls at France’s National Blood Service
Hackers altered refrigeration controls at three French blood service sites, but staff protected plasma supplies and prevented damage to blood products. First seen on hackread.com Jump to article: hackread.com/hackers-tamper-refrigeration-controls-france-blood-service/
-
Hackers backdoor Linux servers using trojanized CWP web server
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/
-
ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations. Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026. CrowdStrike’s October 7 investigation assessed…
-
ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations. Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026. CrowdStrike’s October 7 investigation assessed…
-
ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations. Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026. CrowdStrike’s October 7 investigation assessed…
-
ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations. Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026. CrowdStrike’s October 7 investigation assessed…
-
ARTEX Hackers Used Claude Code, DeepSeek, and Grok in Attacks Targeting South Korean Banks
A financially motivated threat actor used ARTEX, Claude Code, and multiple large language models in a campaign targeting South Korean financial organizations. Exposed attacker directories revealed session histories, configurations, and operational scripts, showing how AI tooling supported intrusions that resulted in data theft between late September and early October 2026. CrowdStrike’s October 7 investigation assessed…
-
China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10.…
-
China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10.…
-
Hackers Develop New HYFLOCK Ransomware That Encrypts Files and Attempts to Block Recovery
HYFLOCK ransomware operators have developed successive Windows encryptors that lock files, access network shares, and attempt to obstruct recovery, while implementation flaws create sharply different outcomes for victims. The investigation distinguishes demonstrated functionality from promotional claims. Although researchers confirmed encryption and scheduled-task registration, they did not establish successful domain-wide propagation or reliable execution after remote…
-
Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies
Marsalek, a free malware-as-a-service (MaaS) platform that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn. It was active from mid-December 2025 to late May 2026. Researchers counted more than 1,560 registered accounts, over 400 malicious files and more than 29 distribution URLs. Its dashboard let users build…
-
Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies
Marsalek, a free malware-as-a-service (MaaS) platform that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn. It was active from mid-December 2025 to late May 2026. Researchers counted more than 1,560 registered accounts, over 400 malicious files and more than 29 distribution URLs. Its dashboard let users build…
-
Hacker manipulieren Kühlanlagen: Warum veraltete OT-Systeme zum Sicherheitsrisiko werden
Cyberangriffe auf Supermärkte zeigen gravierende OT-Sicherheitslücken. Wie Netzwerksegmentierung, Virtual Patching und sichere Fernwartung schützen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/hacker-manipulieren-kuehlanlagen-warum-veraltete-ot-systeme-zum-sicherheitsrisiko-werden/a47006/
-
Hackers Use ClickFix Tricks to Infect Macs With Phexia Malware That Hides Through Blockchain Infrastructure
Phexia, a modular macOS backdoor and infostealer sold to multiple threat actors. Operators deliver it through ClickFix lures. Since May 2026, newer builds have taken their command-and-control (C2) address from a Polygon smart contract, a technique known as EtherHiding. Victims reach fake verification pages through typosquatted domains and shopping listings. The page copies a command…
-
Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability to Compromise Nearly 1,000 Network Switches
Tags: authentication, cyber, exploit, hacker, network, remote-code-execution, vulnerability, zero-day, zyxelAttackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. They compromised nearly 1,000 devices before Zyxel patched the flaw. Binarly researchers found that the exploit abused a previously unknown bug, not the one Zyxel fixed in June. GreyNoise reported that around August 17, an actor exploited 996 GS1900 switches across 48 countries.…
-
Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability to Compromise Nearly 1,000 Network Switches
Tags: authentication, cyber, exploit, hacker, network, remote-code-execution, vulnerability, zero-day, zyxelAttackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. They compromised nearly 1,000 devices before Zyxel patched the flaw. Binarly researchers found that the exploit abused a previously unknown bug, not the one Zyxel fixed in June. GreyNoise reported that around August 17, an actor exploited 996 GS1900 switches across 48 countries.…
-
MuddyWater Hackers Suspected of Targeting Israeli Organizations With Fake Tax Authority Emails
Israeli organizations have been targeted since September 2026 in a phishing campaign impersonating the Israel Tax Authority and distributing SimpleHelp remote monitoring and management software disguised as tax documents. Investigators suspect MuddyWater involvement, citing the targeting and its documented abuse of legitimate remote-access tools, but the attribution remains unconfirmed. Rather than exploiting software vulnerabilities, the…
-
MuddyWater Hackers Suspected of Targeting Israeli Organizations With Fake Tax Authority Emails
Israeli organizations have been targeted since September 2026 in a phishing campaign impersonating the Israel Tax Authority and distributing SimpleHelp remote monitoring and management software disguised as tax documents. Investigators suspect MuddyWater involvement, citing the targeting and its documented abuse of legitimate remote-access tools, but the attribution remains unconfirmed. Rather than exploiting software vulnerabilities, the…
-
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
Tags: apple, authentication, cisa, cve, cybersecurity, exploit, flaw, hacker, infrastructure, kev, malware, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with First seen on thehackernews.com…