Category: Cyber Security News

Threat actors are sending sextortion emails that use email addresses exposed in past ShinyHunters-linked data breaches to demand $2,000 in Bitcoin. The messages falsely claim device compromise, but evidence suggests the sender is repurposing leaked breach data rather than acting as ShinyHunters itself. #ShinyHunters #Amtrak #Hallmark #Substack #Betterment #CarGurus #ADT #PaneraBread #McGrawHill

A large malvertising campaign is abusing fake Solana, Luno, and TradingView pages to make browsers assemble malware locally in memory, helping the payload evade detection. The operation, linked to the SourTrade campaign, targets retail traders and crypto investors across 25 languages and 12 countries, while using unique session-specific builds to bypass static analysis. #Solana #Luno #TradingView #SourTrade #Bitdefender

Insurance phishing campaigns are evolving from delayed credential theft to real-time account hijacking, where attackers relay victims’ login data and OTPs to legitimate portals during the same session. The investigation also shows how the InsureOTP Kit, sponsored Google ads, and disposable cloud-hosted infrastructure are being used across multiple insurance brands and…

Attackers are exploiting CVE-2026-16723, a critical Fastjson flaw in Spring Boot fat-JAR applications that can lead to unauthenticated code execution with Java process privileges. ThreatBook and Imperva reported in-the-wild activity, while Alibaba has not yet released a patched Fastjson 1.x version and recommends SafeMode or migration to Fastjson2. #CVE-2026-16723 #Fastjson #SpringBoot…

Russian state-aligned hackers in the Laundry Bear campaign are using zero-click phishing emails to target Zimbra Collaboration Suite users across the West, with evidence pointing to espionage activity rather than financial extortion. The operation has hit Ukrainian, U.S., NATO, and other government and commercial entities, prompting urgent patching guidance for Zimbra…

Security researchers at depthfirst published working exploit code for a GitLab flaw that was patched six weeks earlier, enabling authenticated users to run commands as git on unpatched self-managed servers. The chain uses two Oj parser memory corruption bugs in GitLab’s notebook diff renderer to leak a heap pointer, find libc,…

Rockwell Automation has patched four high-severity vulnerabilities in Arena Simulation that could allow arbitrary code execution if a user opens a malicious file. The flaws affect Arena versions up to 17.00.00 and are tracked as CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, and CVE-2026-8314. #RockwellAutomation #ArenaSimulation #CVE-2026-8085 #CVE-2026-8312 #CVE-2026-8313 #CVE-2026-8314…

Lumen Technology’s Black Lotus Labs says residential proxy botnets are rapidly expanding, with nearly 60 million victim IP addresses observed worldwide and millions of devices being used to hide criminal traffic. The report warns that networks like IPIDEA can rebound quickly after disruption, and that the malicious proxy ecosystem is becoming a large, cooperative botnet supply chain. #Lumen #BlackLotusLabs #IPIDEA

Prime Minister Andy Burnham reappointed Liz Lloyd as Britain’s cybersecurity minister while reorganizing the government and splitting cyber policy away from the former Department for Science, Innovation and Technology. Lloyd is now expected to keep pushing the Cyber Security and Resilience Bill and the National Cyber Action Plan, even as the…

Industry groups told CISA they want the CIRCIA incident reporting rule to cover fewer organizations, require reports for fewer incidents, and collect less information when reporting is needed. The debate comes as CISA has missed multiple deadlines for finalizing the rule, while Congress and critical infrastructure stakeholders push for a narrower, more practical final version. #CIRCIA #CISA

A threat actor allegedly used the open-source Hermes AI agent in unattended YOLO mode to automate post-exploitation tasks during an intrusion tied to Thailand’s Ministry of Finance. Hunt.io and Bob Diachenko found exposed directories with web shells, stolen credentials, and logs showing Hermes was used for privilege escalation, enumeration, and internal system traversal. #Hermes #ThailandMinistryofFinance #Huntio #BobDiachenko #Hades

Hackers are compromising hotel and conference center Wi-Fi gateways to alter DNS settings and redirect users to fake Microsoft 365 login pages, with activity linked to multiple regions and industries. ReliaQuest says the campaign may resemble FrostArmada operations tied to APT28, and it can bypass MFA through device-code phishing and malicious proxy tricks. #Microsoft365 #ReliaQuest #FrostArmada #APT28

Zenity Labs disclosed AgentForger, a critical flaw in OpenAI’s ChatGPT Workspace Agents that could let a single phishing link create and deploy an attacker-controlled autonomous agent inside a victim organization. OpenAI fixed the issue on June 8, 2026, after the flaw was shown to abuse URL parameters, connector permissions, and Preview…

Researchers H0j3n and Aniq Fakhrul disclosed Certighost, a flaw in Active Directory Certificate Services that can let a low-privileged user obtain a Domain Controller certificate and escalate to DCSync. Microsoft patched the issue as CVE-2026-54121 in its July 14 update, and the researchers also published a proof-of-concept exploit that automates the…