Tag: threat
-
Stronger Security Drives Ransomware Groups to Recruit From Within
Some security researchers have observed an uptick in insider-assisted ransomware attacks, but malicious insiders pose other threats that cost companies millions. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/stronger-security-drives-ransomware-groups-to-recruit-from-within
-
Critical Langflow Flaw Exploited as Attacks on AI Platform Rise
The attacks targeting CVE-2026-0768 are the latest threat against the low-code AI development platform, which is receiving more attention from adversaries this year. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/critical-langflow-flaw-exploited-attacks-rise
-
AI Model Evaluator METR Hit by Credential Theft, Probing
In one attack, threat actors stole an API key that ultimately led to the consumption of $600,000 in public AI model credits for the security nonprofit. First seen on darkreading.com Jump to article: www.darkreading.com/identity-access-management-security/ai-model-evaluator-metr-credential-theft-probing
-
Critical Langflow flaw exploited to steal OpenAI and AWS keys
Tags: ai, credentials, exploit, flaw, framework, open-source, openai, remote-code-execution, threat, vulnerabilityThreat actors are exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, an open-source framework for building AI applications, to steal credentials, tokens, and keys. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/
-
Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr.The vulnerability in question is CVE-2026-82329 (CVSS score: 9.8), a case of authentication bypass that could lead to administrative access in Artifactory.”JFrog Artifactory contains an authentication weakness that, under default First seen on thehackernews.com Jump…
-
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024.Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as “specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers.” The adversary First seen on…
-
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024.Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as “specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers.” The adversary First seen on…
-
5 Big Takeaways From CrowdStrike’s 2026 Partner Summit
CrowdStrike sees solution and service provider partners as increasingly essential to putting the pieces together when it comes to securing the AI and agentic revolution, along with protecting against intensifying threats powered by the same LLM technologies, top CrowdStrike executives said during the cybersecurity giant’s 2026 Partner Summit Monday. First seen on crn.com Jump to…
-
5 Big Takeaways From CrowdStrike’s 2026 Partner Summit
CrowdStrike sees solution and service provider partners as increasingly essential to putting the pieces together when it comes to securing the AI and agentic revolution, along with protecting against intensifying threats powered by the same LLM technologies, top CrowdStrike executives said during the cybersecurity giant’s 2026 Partner Summit Monday. First seen on crn.com Jump to…
-
5 Big Takeaways From CrowdStrike’s 2026 Partner Summit
CrowdStrike sees solution and service provider partners as increasingly essential to putting the pieces together when it comes to securing the AI and agentic revolution, along with protecting against intensifying threats powered by the same LLM technologies, top CrowdStrike executives said during the cybersecurity giant’s 2026 Partner Summit Monday. First seen on crn.com Jump to…
-
5 Big Takeaways From CrowdStrike’s 2026 Partner Summit
CrowdStrike sees solution and service provider partners as increasingly essential to putting the pieces together when it comes to securing the AI and agentic revolution, along with protecting against intensifying threats powered by the same LLM technologies, top CrowdStrike executives said during the cybersecurity giant’s 2026 Partner Summit Monday. First seen on crn.com Jump to…
-
5 Big Takeaways From CrowdStrike’s 2026 Partner Summit
CrowdStrike sees solution and service provider partners as increasingly essential to putting the pieces together when it comes to securing the AI and agentic revolution, along with protecting against intensifying threats powered by the same LLM technologies, top CrowdStrike executives said during the cybersecurity giant’s 2026 Partner Summit Monday. First seen on crn.com Jump to…
-
What Does a SOC Look Like When AI Is Part of the Architecture? A Closed-Door Working Session on September 15
Alert volumes are climbing. And in July, the theoretical version of the AI threat stopped being theoretical. An autonomous agent framework driven by OpenAI models ran an end-to-end intrusion against Hugging Face, executing roughly 17,600 recorded actions across a four… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/what-does-a-soc-look-like-when-ai-is-part-of-the-architecture-a-closed-door-working-session-on-september-15/
-
The HuntDetection Gap: Choosing an AI Threat Hunting Solution in 2026
If you’re in the market for an AI threat hunting solution, chances are you’re evaluating based on investigation quality. That’s an understandable and reasonable metric to go on investigation quality is important, and most vendors focus their marketing on it. It’s not, however, the most important metric. Pretty much every vendor has decent investigation The…
-
Mirage Kitten Hackers Use Fake Coding Challenges to Deploy NodeRabbit and PollCat RATs
Iran-linked threat actor Mirage Kitten is targeting software developers with fake recruitment assessments that hide two newly identified cross-platform remote access trojans: NodeRabbit and PollCat. The campaign uses recruiter impersonation on LinkedIn and other job-search platforms, weaponized Node.js projects, and cloud-hosted ZIP archives to gain covert access to developer endpoints across Windows, Linux, and macOS.…
-
Hackers Exploit Critical Langflow and Ruby on Rails Flaws in Active RCE Attacks
Tags: ai, attack, cloud, control, credentials, cve, cyber, exploit, flaw, hacker, rce, remote-code-execution, theft, threat, vulnerabilityThreat actors are actively exploiting two newly disclosed remote code execution vulnerabilities affecting Langflow and Ruby on Rails. These campaigns focus on cloud credential theft, host reconnaissance, and the establishment of command-and-control (C2) functions. VulnCheck researchers have reported exploitation targeting CVE-2026-0768 in Langflow, a low-code platform for building AI-powered applications and automated workflows. This vulnerability…
-
Hackers Exploit Langflow RCE Flaw to Harvest OpenAI and AWS Credentials
Tags: ai, credentials, cve, cyber, exploit, flaw, hacker, openai, rce, remote-code-execution, threat, vulnerabilityThreat actors are actively exploiting a critical remote code execution vulnerability in Langflow, a low-code platform used for building AI-powered applications and automating workflows. This vulnerability, tracked as CVE-2026-0768, affects the code validator in Langflow’s custom component editor. According to Caitlin Condon, VP of Security Research at VulnCheck, the flaw allows unauthenticated remote code execution…
-
Five Plead Guilty to Using ATM Jackpotting Malware in Cash Theft Scheme
Five Venezuelan nationals have pleaded guilty in a federal case involving attempts to deploy ATM jackpotting malware against cash machines in Kansas. This case highlights a growing cyber-physical threat targeting financial institutions across the United States. The case arose from an FBI investigation into an alleged scheme to force automated teller machines (ATMs) to dispense…
-
White House Launches Pilot Program in Texas to Protect Water Infrastructure
Project Watershed 250 will see water providers in Texas provided with federal and private sector cybersecurity resources amid rising nation-state threats First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/white-house-texas-protect-water/
-
Critical JFrog Artifactory Authentication Bypass Exploited in the Wild
Security researchers have issued warnings that attackers are actively exploiting a critical authentication bypass vulnerability in JFrog Artifactory, tracked as CVE-2026-82329. This vulnerability allows the generation of administrator-level access tokens. According to a post from the security research firm watchTowr dated September 1, its threat intelligence team has already observed exploitation activities targeting this flaw.…
-
Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones
The most common way into a company last year was to ask.A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix, and…
-
AI-Enhanced BraZetsu Malware Powers Underground Market Selling Access to Corporate Networks
BraZetsu, a Python-based Windows malware framework allegedly operated by the Brazilian threat actor Exilware to identify, profile, and monetize compromised corporate systems. Rather than behaving like a conventional infostealer, BraZetsu appears designed to support an Initial Access Broker operation, converting infected endpoints into cataloged access offerings for an underground marketplace. The framework is reportedly the…
-
Fake OpenAI, Anthropic and DeepSeek Crawlers Target .env Files and Cloud Credentials
Threat actors are impersonating AI web crawlers from organizations such as OpenAI, Anthropic, DeepSeek, Google, Perplexity, and Amazon to scan internet-facing servers for exposed secrets, according to a GreyNoise research report published on August 28, 2026. This activity involves automated scanners that use forged crawler user-agent strings to request sensitive files, including .env configurations, AWS…
-
SLEEPWALKER Malware Uses Raw Packets, DNS and VMware VMCI for Covert Communications
A newly analyzed Windows backdoor named SLEEPWALKER uses a passive command-and-control model designed to evade conventional beaconing-based detections. Raw-packet activation, DNS-based tasking support, VMware VMCI communications, named-pipe capabilities, and in-memory payload execution. No threat actor, victim, delivery chain, or live campaign has yet been attributed to the malware. SLEEPWALKER is an unsigned 64-bit Windows DLL…
-
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis
Cybersecurity researchers have disclosed a new technique dubbed GuardBreaker that’s been put to use by a Russia-aligned threat actor known as UAC-0099 against a target in Ukraine with an aim to interfere with artificial intelligence (AI)-assisted analysis.The idea, ESET said in a series of posts on X, is to deliberately trip a large language model’s…
-
Fake Claude Opus 5 App Deploys RevStealer to Steal Passwords, Crypto Wallets and Sessions
Threat actors are exploiting demand for generative AI tools to distribute RevStealer, a Windows-focused information stealer hidden inside a trojanized Electron application that impersonates a free desktop version of Anthropic’s Claude Opus 5. Instead a stealthy credential theft tool engineered to evade sandboxes, endpoint monitoring, and post-infection investigation. The primary lure, branded “Claude Opus 5…
-
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck.The vulnerabilities in question are listed below – CVE-2026-0768 (CVSS score: 9.8) – A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the…
-
Fire Ant Hackers Compromise Cisco Routers and TACACS Servers to Target Critical Infrastructure
China-nexus threat actor Fire Ant has expanded its espionage operations from VMware hypervisors to the trusted infrastructure layer, compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. Security firm Sygnia, which investigated the activity, said Fire Ant has remained active since it was first reported in 2025. The actor’s latest operations show…