News archive Page 25
918 articles · sorted newest first · page 25 of 39
Looking for a specific story? Search and filter the full archive.
Chick-fil-A: 13,000 Accounts Hit in Credential Stuffing
Chick-fil-A confirmed 13,000+ customer accounts compromised via credential stuffing on its website and mobile app, June 17–19, 2026.
BlueNoroff Active: Zoom Phishing Profiles Crypto Wallets
North Korea's BlueNoroff is running an active phishing kit impersonating Zoom and Teams. Campaign profiles wallets before malware delivery. Confirmed.
Slopsquatting Has Three Names. The Attack Is the Same.
Slopsquatting, phantom domains, and HalluSquatting share one mechanism: AI coding agents trust hallucinated package names that attackers pre-register.
Open-Source AI Agent Used in Gov Post-Exploitation Attack
A threat actor deployed Hermes AI in YOLO mode to automate post-exploitation during an alleged breach of Thailand's Finance Ministry — a documented first.
Hotel Wi-Fi DNS Hijacked to Serve Fake M365 Pages
Attackers are reconfiguring DNS on hotel Wi-Fi devices to redirect guests to fake Microsoft 365 login pages and harvest corporate credentials.
Steam Forums Weaponized in ClickFix Cryptominer Campaign
Fake fix posts on Steam discussion forums are walking gamers into running commands that silently install XMRig cryptominers. What happened and what to check.
Bing Image Workers Ran SYSTEM Commands via Crafted SVGs
Microsoft patched two critical CVEs after XBOW found Bing's image processing ran arbitrary commands as NT AUTHORITY\SYSTEM on crafted SVG input.
Certighost: Working Exploit Reaches AD Domain Controllers
Researchers published a working Certighost exploit: any AD user can obtain a Domain Controller certificate and run DCSync to extract the krbtgt hash. No CVE assigned.
Insurance Sector Phishing Has Evolved to Real-Time AiTM
CTM360 research traces how insurance-focused phishing campaigns evolved from credential theft to real-time session hijacking that defeats standard MFA entirely.
ShinyHunters Breach Data Now Fueling Sextortion Emails
Threat actors are targeting email addresses from ShinyHunters data leaks with $2,000 Bitcoin sextortion demands. What the campaign looks like and what to do.
JS Malvertising Assembles Malware in Browser Memory
Fake Solana, Luno, and TradingView sites run malicious JavaScript that builds malware in browser memory — no file written, standard AV misses it.
Fastjson 1.x RCE Exploited: No Patch Available
Fastjson 1.x (CVE-2026-16723, CVSS 9.0) is under active attack. No patch exists. An unauthenticated JSON request runs code as the Java process.
DevMan RaaS Offers Affiliates Centralized Build Portal
PRODAFT documents DevMan RaaS — tracked as Funky Mantis — operating a unified portal for payload builds, victim management, and affiliate payouts.
GitLab RCE PoC Published: No Admin Rights Required
A working RCE exploit for self-managed GitLab 18.11.3 is now public. Any authenticated user can execute server commands as git — no admin rights needed.
Clop Hits Windchill and FlexPLM in Data-Theft Push
Clop is running an active data-theft campaign against internet-exposed PTC Windchill and FlexPLM. No encryption — straight to exfiltration and extortion.
AI Agents: Attacker, Auditor, and Attack Surface
Redis zero-days, an unattended breach, eight NodeBB bugs — AI agents drove security news all week from three different directions. None of this is coincidence.
200 CVEs a Day: Why CVSS Scores Mislead Defenders
Q2 2026 brought ~200 new CVEs daily and 49% year-over-year growth. CISA's KEV grew just 13%. Talos shows why CVSS alone can't be your patch queue.
M365 Outage: Automation Bug Pulled Too Many IP Routes
Microsoft traced the July 23 M365 outage to a bug in its automated maintenance system that removed IP routes from more network devices than intended, taking down Azure and M365.
76 Months for Hacking 750 Women's Snapchat Accounts
An Illinois man received a 76-month federal sentence for compromising over 750 Snapchat accounts to steal intimate photos — one of the larger account-hacking prosecutions in recent memory.
Chick-fil-A Breach: Credential Stuffing Hits 13,000 Accounts
Chick-fil-A confirmed attackers used credential stuffing to access over 13,000 customer accounts via its website and mobile app in a three-day window in June.
OnTrac Confirms Network Breach, Notifies Customers
OnTrac confirmed hackers breached its corporate network and may have accessed customer PII. Watch for delivery-themed phishing built on your shipping data.
Europol Flags 4,340 URLs in The Com Network Crackdown
Operation Compass: 4,340 URLs flagged, 30 arrests across 28 nations, targeting The Com — the network behind ransomware hits on MGM and UK retailers.
AI Agents Are Outrunning Their Permission Guardrails
Visibility into AI agents is achievable. Enforcing what those agents can actually do — and can't — is proving harder, and this week's incidents are showing the gap.
Hotel Wi-Fi DNS Hijacked to Steal Microsoft 365 Accounts
Attackers modify hotel Wi-Fi gateway DNS to redirect guests to fake Microsoft 365 login pages. ReliaQuest links the campaign to APT28, active since June 2025.