Tag: threat
-
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners.Details of the flaws are below – CVE-2026-105133 (CVSS v4 score: 5.5) – An improper authentication vulnerability in the checkSysPwd() function in the “com/ahsay/obs/api/ApiStructsAction.java” First seen on…
-
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
Tags: access, china, cisa, control, cve, cybersecurity, exploit, flaw, infrastructure, kev, threat, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon.The vulnerabilities in question are listed below – CVE-2015-3306 (CVSS score: 10.0) – An improper access control vulnerability in ProFTPD that could allow…
-
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer, a C# information stealer first publicly identified in April 2026, has expanded its capabilities beyond credential theft. New samples analyzed by Flashpoint bypass Chromium app-bound encryption, support remote command execution, and transmit stolen data through small, encrypted TCP exchanges instead of uploading a single archive. Flashpoint has not observed widespread adoption among threat actors.…
-
UK and Allies Warn of Cyber Threat from China’s Integrity Technology Group
The UK, US and allies have issued an alert detailing malicious activity linked to China’s Integrity Technology Group First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/uk-allies-threat-china-integrity/
-
Anthropic Launches Cyber Mission to Protect Critical Infrastructure and Open-Source Software With Claude AI
Anthropic launched its Cyber Mission, a long-term initiative aimed at helping defenders secure critical infrastructure and open-source software. This initiative utilizes frontier Claude models, offers engineering support, conducts threat research, and provides funding. The Cyber Mission introduces two key components: the Critical Infrastructure Defense Program (CIDP) and the OSS Scanner, a free, opt-in service for…
-
FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon.To that end, the agencies seized several domains and blocked access to platforms that were used to scan, and in some cases infiltrate, U.S. critical…
-
Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software
The critical infrastructure defense program will seek to pair Claude models, Anthropic engineers and threat research with the expertise of cybersecurity companies. First seen on cyberscoop.com Jump to article: cyberscoop.com/anthropic-cybersecurity-program-critical-infrastructure-open-source/
-
WorkNest Secure Achieves CREST STAR-FS Accreditation for Red Teaming
WorkNest Secure has achieved CREST Simulated Targeted Attack & Response for Financial Services (STAR-FS) accreditation, recognising its ability to deliver intelligence-led red teaming assessments for organisations operating in high-risk and regulated environments. The accreditation confirms that WorkNest Secure meets CREST’s standards for conducting threat-led penetration testing, using realistic attack scenarios to assess how effectively organisations…
-
The Security Interviews: Evren Karaibrahimgil, Welsh FA
Evren Karaibrahimgil, IT manager at the FAW, on securing the national football association of Wales against evolving cyber threats, with Euro 2028 on home soil in mind First seen on computerweekly.com Jump to article: www.computerweekly.com/feature/The-Security-Interviews-Evren-Karaibrahimgil-Welsh-FA
-
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN.According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company is tracking the cluster under the name Earth Sirrush (previously SHADOW-EARTH-065).ASHVEIN, First seen on…
-
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
Tags: ai, attack, crowdstrike, cybersecurity, data, finance, intelligence, penetration-testing, theft, threat, toolCybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks.The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration.”In this activity, the threat actor leveraged…
-
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Tags: breach, credentials, crypto, cyber, hacker, malicious, malware, software, supply-chain, threatA threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights…
-
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Tags: breach, credentials, crypto, cyber, hacker, malicious, malware, software, supply-chain, threatA threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights…
-
Filigran announces speakers for first THREAD event
Filigran has announced the speaker line-up for THREAD, its first annual event for the cyber defence and threat intelligence community, taking place in Paris on 15 October. The free, one-day gathering at Les Jardins de Saint-Dominique will feature speakers from Accenture, Centrica, Thales Group and the FBI. Its programme combines strategic discussions with practical sessions…
-
Europol and US Spending Watchdog Sound the Alarm Over Quantum Threats
Europol and US Government Accountability Office urge faster transition to post-quantum cryptography First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/europol-us-gao-alarm-quantum/
-
Digital IDs and the AI threat: verification must evolve, not just digitise
By Marc de Beaucorps, Co-founder and CEO of Finovox The UK’s rollout of new digital IDs is being pitched as a straightforward upgrade involving safer age checks, smoother access, and fewer fakes. But from a fraud perspective, “simpler” can be a dangerous word. Identity fraud rarely disappears; it mutates. And when you digitize identity, you…
-
Europol and US GAO Sound the Alarm Over Quantum Threats
Europol and US Government Accountability Office urge faster transition to post-quantum cryptography First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/europol-us-gao-alarm-quantum/
-
FBI and Secret Service Warn of FortiBleed Lockout Threat
The FBI and Secret Service are warning Fortigate admins that their systems are still being targeted First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fbi-secret-service-fortibleed/
-
12 Best SCA Tools Compared (2026): Features Pricing
Snyk is the best developer-platform SCA, Sonatype the repository-firewall powerhouse, and Socket the malicious-package specialist the CVE-scanners aren’t. Twelve options priced across free-floor, developer, registry, compliance, and supply-chain-posture lanes because dependency risk now spans three threats (known CVEs, malicious packages, license exposure) and no single lane covers all three. Quick Verdict: Best SCA at a…
-
Atlassian Vulnerability Comes Under Attack Hours After Details Go Public
Threat actors are exploiting CVE-2026-21589, a critical Atlassian flaw that can expose sensitive files across multiple Data Center products. Threat actors have started exploiting CVE-2026-21589 (CVSS score of 9.3), a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerability could allow attackers to access sensitive files under certain conditions. Affected products include…
-
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
Tags: access, blockchain, cloud, control, credentials, cyber, endpoint, infrastructure, korea, network, north-korea, open-source, service, threat, wormThreat actors are increasingly using blockchain networks as resilient command-and-control infrastructure to steal cloud credentials from developer endpoints and CI/CD environments. Recent campaigns involving the ChainDrop npm worm and the North Korea-linked PolinRider operation show how poisoned open-source packages can harvest short-lived cloud tokens, service-account credentials, deployment secrets, and source-code access tokens while resolving attacker…
-
Critical Citrix NetScaler CVE-2026-88771 Exploited for Reverse Shells and Persistent Access
Attackers are exploiting CVE-2026-88771, a critical pre-authentication command-injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway, to deploy reverse shells, create privileged accounts, and establish persistent access. LevelBlue’s Threat Hunt Operations & Research (THOR) team identified malicious authentication events across multiple customer environments, documenting activity extending beyond vulnerability testing into payload execution and configuration theft…
-
Medical devices patients rely on most are least prepared for quantum attacks
Threat actors are exploiting IT, IoMT, OT and IoT devices across healthcare delivery organizations (HDOs) to deploy ransomware, demand payments and monetize stolen patient … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/forescout-healthcare-quantum-readiness-report/
-
Insider Threat Risks Rise Amid Layoffs and Workforce Changes
Workforce changes can increase insider threat risks. Learn how access controls, credential security, DLP, and third-party oversight can reduce exposure. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/layoffs-lead-to-rise-in-insider-threat-risk/
-
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts.The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since…
-
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts.The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since…
-
South Korea Suspects AI Tool Helped Steal Bank Customer Data
Attack Servers Show Signs Open-Source Penetration Testing Tool Artex Employed. Police in South Korea probing data breaches at multiple banks have found signs on attack servers that the threat actor used a free, open-source and semi-automated penetration testing tool called Artex AI to help steal data pertaining to more than 60,000 individuals. First seen on…
-
Schutzebene für KI-Agenten mit Laufzeitüberwachung und Zugriffskontrolle verhindert Prompt-Injektion
Prompt-Injektion entwickelt sich zu einem Cyberrisiko. In externen Inhalten versteckte Anweisungen können versuchen, die Tools, APIs und Berechtigungen eines KI-Agenten zu aktivieren. Check Point führt <> als Teil des AI-Defense-Plane für die Erkennung auf Dateiebene ein. Integriert in Check-Point-Threat-Emulation analysiert es PDF-Dateien, bevor deren Inhalt ein LLM oder einen KI-Agenten erreicht. Neben der Prompt-Prüfung fügt es…
-
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
The U.S. Federal Bureau of Investigation (FBI) and Secret Service (USSS) on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways.”The campaign exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat First seen…
-
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions.The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software First…