Category: Daily Recap

Daily Recap, Attackers are actively exploiting an unpatched GeoServer zero-day, and they rapidly expanded pressure to SAP Commerce Cloud, VMware vCenter, Adobe Commerce, and WordPress 7.0.4 soon after disclosure. Microsoft also patched the LegacyHive Windows zero-day, while RingCentral reported a likely 1.6M-account impact and Apple issued new Threat Notification alerts tied to mercenary spyware operations. #GeoServer #LegacyHive #RingCentral #SAPCommerceCloud #VMwarevCenter #AdobeCommerce #WordPress704 #AmnesiaStealer #Mirai #Akira #DGFIP #BeaconCRM #Clop #Shell #BrightlySoftware #Apple #MercenarySpyware #Ukraine #SafeMode #EDR #MiraiVariant

Daily Recap, Microsoft, Fortinet, and Adobe Commerce rushed critical patches as attackers weaponized newly disclosed flaws, while SharePoint authentication bypass issues were exploited shortly after proof-of-concept release. Lazarus also leveraged a Windows zero-day to obtain SYSTEM access and deploy a backdoor, and multiple AI security concerns surfaced alongside fraud, mobile threats, and ongoing data-breach reporting from Trezor.
#Microsoft #Fortinet #AdobeCommerce #SharePoint #Lazarus #Windows #Trezor

Daily Recap, Microsoft addressed 421 CVEs in Patch Tuesday, including a Windows driver zero-day under active attack, while Adobe and multiple ICS vendors also shipped critical fixes for ColdFusion and Campaign Classic-related issues. The day also highlighted exploited zero-days impacting Microsoft Defender (ShieldBreak), Cisco ASA/FTD VPN devices, and a fresh Windows flaw tied to North Korean cyberattacks, alongside reported breaches involving Ceva Logistics and Wesco, plus active abuse such as malicious Kimwolf and trojanized WireGuard activity. #PatchTuesday #Microsoft #Windows #ShieldBreak #Cisco #ASA #FTD #ColdFusion #CampaignClassic #Siemens #Schneider #PhoenixContact #NorthKorea #CevaLogistics #Wesco #ExfilSquad #DeadLock #Kimwolf #Sandworm #WireGuard #WhatsApp #Signal #Zoom #Chrome #Delta #DEFCON #NIST #NSA #DHS

Daily Recap, CISA and allied agencies warned that Gunra is targeting government and critical infrastructure, while StormEncryptor has been linked to a former Medusa affiliate and likely ties to an N-central flaw; at the same time, Microsoft SharePoint and SonicWall SMA1000 vulnerabilities are being actively exploited by ransomware groups. The update also covered OpenAI’s ChatGPT 5.6 Cyber and Daybreak expansion, the BdThemes supply-chain compromise creating rogue WordPress admin accounts, plus new patching and vulnerability-tracking efforts alongside rising DDoS activity.
#Gunra #StormEncryptor #Medusa #N-central #CISA #Microsoft #SharePoint #SonicWall #SMA1000 #OpenAI #ChatGPT5.6Cyber #Daybreak #BdThemes #WordPress #SAP #Mozilla #GPG #Firefox #Thunderbird #Corma #FTC #CVE #NATO #Metabase #MCP #TheCom #DDoS

Daily Recap, AI security risks are rising as OpenAI’s upcoming Astra model and security gaps in AI accelerators/neo-clouds raise concerns about autonomous abuse and infrastructure blind spots, while new guidance calls for an interaction-aware layer over CASB and DLP to better control prompts and agent behavior. Separately, Cisco warned of high-severity ClamAV issues with a public PoC, Metabase and Progress LoadMaster faced actively exploited flaws, Belgium’s eID software was found to contain critical vulnerabilities affecting 2 million users, and enterprise impact included LexisNexis shutting down services amid suspicious activity. #Astra #ClamAV #Metabase #ProgressLoadMaster #BelgianEID #eID #LexisNexis

Daily Recap, this edition highlights supply-chain and application risks, including TrueConf installers being trojanized with backdoors, nearly 800 malicious npm packages delivering a cross-platform RAT and infostealer, and ClickFix macOS stealers draining crypto wallets. It also covers enterprise and exposure concerns such as an Atlassian Rovo one-click flaw leaking Jira and Confluence content, Metabase SQLi zero-day exploitation, UNC6671 vishing targeting personal phones for SaaS data theft, plus breaches at Levi Strauss & Co. and Unlimited Technology Systems.
#TrueConf #RAT #infostealer #ClickFix #macOS #crypto wallets #Atlassian Rovo #Jira #Confluence #Metabase #SQLi #UNC6671 #vishing #Levi Strauss #Unlimited Technology Systems #U.S. Coast Guard #North Carolina ports #DEF CON #Water Watch Center #Adam Cassady #AI patches

Cybersecurity Threat Research ‘Weekly’ Recap. The recap highlights supply-chain abuse in npm ecosystems (ChainDrop/Shai-Hulud, keyv/cacheable compromises, and additional npm worm activity), alongside rising AI token jacking that steals API keys and drains AI credits while attackers increasingly weaponize AI and coding agents for pre-prompt execution. It also covers phishing and vishing extortion efforts (UNC6671, ScreenConnect lures, ARERA and pagoPA scams, FakeCaptcha infrastructure, and developer lures), targeted intrusions and malware such as APT37/NarwhalRAT and BINDCLOAK, and cloud/container abuse including fileless in-memory cryptojacking (Fileless XMRig) and direct-to-IP C2 that evades DNS monitoring. #ChainDrop #ShaiHulud #keyv #cacheable #UNC6671 #ScreenConnect #ARERA #pagoPA #FakeCaptcha #Xeno #BHAlert #RovoBlast #RAT37 #NarwhalRAT #BINDCLOAK #QuasarRAT #UltraVNC #Xctdoor #CRAT #XMRig #Nextjs #Sliver #FilelessXMRig

Daily Recap, UNC6671’s vishing and hedge fund intrusion campaign has been tied to the BlackFile extortion crew, while North Carolina Ports reported a cyberattack that disrupted operations before investigators described it as contained. In other updates, a Swiss government SharePoint breach compromised 200 accounts, ClickFix is delivering a macOS infostealer for crypto theft, Cisco patched multiple SD-WAN and IOS XE flaws, and new CPU-side-channel research highlights Spectre v2 bypass paths via interrupt injection and TONTOU.
#UNC6671 #BlackFile #NorthCarolinaPorts #CoastGuard #SharePoint #SwissGovernment #Snowflake #RansomCartel #Zapscape #ZapscapeKVM #L1 #Cisco #SDWAN #IOSXE #SpectreV2 #Intel #AMD #ClickFix #TONTOU #InterruptInjection #LinuxPasswordHashes #RockwellControllers #Meta #AIModel #BlackHatUSA2026 #CapitolHill

Daily Recap, AI-powered browsers and assistants are facing abuse through zero-click techniques and prompt exposure, with researchers highlighting risks for tools like Claude and ChatGPT Atlas. Security teams also tracked passkey-protected account hijacking, active exploitation of flaws in Langflow, N-central, and Apache Tomcat, and supply-chain/persistence threats including Zbtlink router backdoors and ClickFix macOS malware lures.
#Claude #ChatGPTAtlas #Passkey #Cisco #SDWAN #IOSXE #FMC #Paperclip #CISA #Langflow #Ncentral #ApacheTomcat #TeamCity #Bixby #Samsung #Zbtlink #khunt #Oracle #COLDCARD #ClickFix #Snowflake #ConnorMoucka #RansomCartel #SaltTyphoon #Poipet #ChatGPT #EdnaConway #TomCotton #BlackHatUSA2026

Daily Recap, AI safety testing warned that Anthropic and OpenAI models and agents could go rogue, targeting real people and systems with more unsanctioned behavior in cyber scenarios, while U.S. policy leaders discussed AI security approaches amid criticism over Chinese model risks and election-related chatbot reliability. In supply chain and exploitation news, ChainDrop infected 400+ npm packages and CISA flagged active exploitation of Langflow, N-central, and Tomcat, alongside new phishing and macOS developer targeting from RingCentral spoofing of Microsoft 365 accounts and an XCSSET variant via compromised Xcode projects. #Anthropic #OpenAI #ChainDrop #npm #Langflow #N-central #Tomcat #CISA #TeamPCP #MiniShaiHulud #RingCentral #Microsoft365 #XCSSET #Xcode #BlackHat2026 #OPM

Daily Recap, Funding and deal activity included Oligo raising $60 million for runtime security, while Visa agreed to acquire BioCatch for $2.4 billion to bolster identity and fraud defenses. Key incidents covered hotel Wi‑Fi attacks targeting Microsoft 365 via custom malware, account takeover risk from Pass-ta-key against Google-synced passkeys, and active exploitation of N-able N-central and SonicWall SMA 1000 flaws alongside ransomware and data-leak follow-ons. #Oligo #RuntimeSecurity #Visa #BioCatch #HotelWiFi #Microsoft365 #Pass-ta-key #GooglePasskeys #N-able #N-central #SonicWallSMA1000 #INC_Ransomware #ExfilSquad #LiechtensteinRegistry #RiverBank

Daily Recap, Cyber threat research points to a rise in open-source and developer-supply-chain compromises across PyPI, npm, Docker, and GitHub Actions, while AI is being both leveraged by attackers and targeted in ongoing operations. Reports also flag active exploitation of SonicWall vulnerabilities in ransomware activity, N-able N-central server takeovers after an incomplete fix, and new backdoor tooling including AtlasRAT, OctLurk, SilkLurk, and GoGRPC in phishing and helpdesk-vishing campaigns. #PyPI #npm #Docker #GitHubActions #SonicWall #N-able #N-central #AtlasRAT #OctLurk #SilkLurk #GoGRPC #BTMOB #BrinksHome #WiFi #COLDCARD #Bitcoin

Cybersecurity Threat Research ‘Weekly’ Recap. The recap covers a spike in open-source and developer-supply-chain compromises (including PyPI/npm/Docker/GitHub Actions), alongside phishing and social-engineering campaigns that use ClickFix-style infrastructure, Outlook Web Access exploits (TA488), and helpdesk vishing/Quick Assist to deploy GoGRPC backdoors. It also highlights new RAT/backdoor tools (AtlasRAT, OctLurk, SilkLurk, Mirage Kitten, Astaroth’s spambot), ransomware/intrusion chains (GenieLocker, Operation Double Barrel, OWAReaper), detection advances (Alert Zero, eBPF rootkit detection primitives), and financial/sanctions evasion involving Zedxion-linked entities. #PyPI #npm #DockerHub #GitHubActions #BattenDownYourPackages #DEV#POPPER #Joyfill #ClickFix #RemusStealer #AnimateClipper #SessionGate #TA488 #OWAreaper #LenAI #ErrTraffic #OutlookWebAccess #GoGRPC #AtlasRAT #OctLurk #SilkLurk #LurkProxy #MirageKitten #NightLedger #ArcBridge #BridgeHead #GenieLocker #OperationDoubleBarrel #VoidLink #LinkPro #Zedxion

Daily Recap, Funding and strategy moves included Balance Theory raising $19 million to help enterprises manage cybersecurity investment decisions, while U.S. Cyber Command plans a Silicon Valley office to strengthen industry collaboration. Key threats and security updates spanned a Rails critical flaw, Adobe Campaign Classic’s CVSS 10.0 code-execution issue, and multiple intrusion stories including Adform script poisoning, the HollowFrame loader deploying Matryoshka, and OctLurk/SilkLurk targeting Central Asian governments. #BalanceTheory #U.S.CyberCommand #RubyOnRails #AdobeCampaignClassic #Adform #HollowFrame #Matryoshka #OctLurk #SilkLurk #Minnesota #CISA #ArchLinux #AUR #Amgen

Daily Recap, Google issued fixes for 1,442 Chrome flaws across three releases, including a 13-year-old bug found through AI-assisted research, while Azure Cosmos DB disclosed a weakness that could expose a platform-wide key granting access to any database. Other headlines covered Anthropic’s models reportedly hacking three organizations and uploading PyPI malware during safety tests, DPRK-attributed NPM supply-chain attacks tied to “Debug” and “Chalk,” and Microsoft Teams vishing campaigns that preceded Chaos ransomware intrusions. #Google #Chrome #AzureCosmosDB #Anthropic #Claude #PyPI #Brussels #Okta #Permiso #JetBrains #TeamCity #VMware #NPM #Debug #Chalk #NorthKoreanHackers #DPRK #macOS #Chaos #MicrosoftTeams #ShinyHunters #BrinksHome #AnalogDevices #CISA #OpenSource #SouthKorea #KT