Latest Cybersecurity News, page 15

BBleepingComputerinRansomware·Sep 17medium

Ransomware Costs Extend Far Beyond the Ransom, BCDR Strategies Key to Reducing Financial Blow

A new analysis from Datto, published by BleepingComputer, highlights that the ransom payment is often only a small fraction of the total cost of a ransomware attack. Downtime, recovery efforts, remediation, and legal obligations can add millions to the financial impact. The article emphasizes that a mature business continuity and disaster recovery (BCDR) strategy can significantly reduce downtime and provide a faster, more predictable recovery path, thereby lowering the overall cost.

12m

CCISA AdvisoriesinSecurity Advisories·Sep 17info

CISA Releases Guidance on Cyber Decoy Strategies to Enhance Detection and Response

The Cybersecurity and Infrastructure Security Agency (CISA) has published guidance titled 'Using Cyber Decoys to Strengthen Detection and Response.' The advisory is designed to help defensive teams at varying levels of cybersecurity maturity plan and implement cyber decoy strategies. These strategies aim to strengthen detection and response capabilities against adversaries who use legitimate credentials, native tools, and living-off-the-land (LOTL) techniques for discovery, lateral movement, and data access. The guidance introduces decoy concepts such as tripwires, breadcrumbs, and honeytokens, and maps these techniques to the MITRE Engage and MITRE ATT&CK frameworks. By assuming a threat actor may gain access as part of a Zero Trust model, the guidance seeks to complement continuous monitoring and verification, create high-fidelity alerts, reduce alert fatigue, and facilitate detection of post-compromise activity.

22m

TThe Hacker NewsinCyber Attacks·Sep 17high

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky has identified three threat activity clusters—NightEagle (APT-Q-95), Hacking Cat, and Toy Ghouls—targeting Russian enterprises. The campaigns involve backdoors, ransomware, and wipers, with NightEagle employing new persistence and lateral movement techniques. Specific victims and scale remain undisclosed.

11m

TThe Hacker NewsinSecurity Research·Sep 17high

Single Browser Extension Could Hijack AI Assistants Across Chrome, Edge, Opera Neon, Comet, and Claude

Security researchers at Forever Security have demonstrated that a single ordinary browser extension could take control of AI assistants integrated into five Chromium-based products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension. Once installed, the extension could access each product's built-in AI with a single click, potentially enabling prompt injection, data exfiltration, or unauthorized actions. The findings highlight the risks of granting broad permissions to browser extensions and the need for stronger isolation of AI features.

12m

DDark readinginCyber Attacks·Sep 17high

BragJack Attack Turns Browser AI Assistants into Malicious Agents

Researchers have disclosed a novel attack vector, dubbed BragJack, that hijacks the agentic AI assistants embedded in web browsers. The attack can trick these AI systems into accessing sensitive information, performing malicious actions on behalf of the user, and exfiltrating data. While specific technical details and affected browsers remain unconfirmed, the discovery highlights emerging risks as AI assistants become more autonomous.

11m

BBleepingComputerinMalware·Sep 17high

KREMLIN Banking Malware Bypasses Browser Checks to Force-Install Malicious Chrome, Edge Extensions

A banking malware operation using the KREMLIN toolkit has been active since mid-2025, bypassing browser security checks to force-install malicious Chrome and Edge extensions. These extensions steal credentials, session tokens, and sensitive data. The operation was reported by BleepingComputer on September 16, 2026. Users are advised to update browsers and exercise caution with extensions.

11m

BBleepingComputerinMalware·Sep 17high

Iranian State-Linked Hackers Deploy CHOSEN BRICK Windows Malware in Global Surveillance Campaign

Government agencies have issued warnings about a Windows malware strain named CHOSEN BRICK, attributed to Iranian state-linked hackers, used to spy on dissidents, activists, and journalists globally. The campaign underscores ongoing threats to civil society and the need for robust endpoint defenses.

12m

TThe Hacker NewsinCVE·Sep 17critical

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

A critical vulnerability in WSO2 API Manager, tracked as CVE-2026-5430, is under active exploitation. The flaw, which stems from improper verification of cryptographic signatures, allows attackers to forge admin tokens and bypass JWT authentication, potentially leading to account takeover. Organizations using WSO2 API Manager are urged to apply patches immediately.

12m

TThe Hacker Newsincybersecurity·Sep 17critical

Active Exploitation of Critical Vulnerability in Issabel Framework

A critical vulnerability in Issabel Framework, a web-based framework for open-source unified communications PBX software, is under active exploitation. Tracked as CVE-2026-89026, the flaw carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3, allowing unauthenticated remote attackers to execute arbitrary operating system commands. Exploitation was reported following publication on 2026-09-16, though specific attack details remain unverified.

11m

DDark readinginCyber Attacks·Sep 17high

North Korean APT Targets South Korean Media and Automotive Sectors with Novel Linux Espionage Toolkit

A likely North Korean advanced persistent threat (APT) group has been linked to a campaign against South Korean media and automotive companies. The attackers used a previously undocumented Linux espionage toolkit to compromise load balancers, gain unauthorized access to communications, and further exploit victim networks. The full scope of the operation remains undisclosed, and attribution is reported as 'likely' rather than confirmed.

11m

BBleepingComputerinSecurity Advisories·Sep 17info

Picus Security Warns of Accelerating Zero-Day Exploitation Window in AI-Driven Threat Landscape

A recent advisory from Picus Security, as reported by BleepingComputer, highlights how artificial intelligence is reducing the time between vulnerability disclosure and active exploitation. The report argues that traditional defense reliance on patch availability and public exploits is no longer sufficient, urging organizations to implement exploitability validation, security control testing, and autonomous pentesting to close exposure gaps before attackers move.

12m

CCISA AdvisoriesinSecurity Advisories·Sep 17info

NIST and CISA Release Interagency Report on Protecting Tokens and Assertions from Forgery and Misuse

The National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) have published a final interagency report providing implementation recommendations to protect identity assertions, access tokens, and cryptographic mechanisms. The report addresses risks of token forgery, theft, and misuse that adversaries could exploit to move laterally across enterprise networks. It incorporates feedback from the Joint Cyber Defense Collaborative and supports Executive Order 14306 on secure software development practices.

11m

BBleepingComputerinCyber Attacks·Sep 17high

Hackers Exploit WooCommerce Wholesale Lead Capture Plugin to Deploy PHP Backdoors

Security researchers report that unidentified hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress. The flaw allows attackers to upload a PHP backdoor, potentially leading to full site compromise, data theft, and further malicious activities. No patch information has been provided at this time.

11m

TThe Hacker NewsinMalware·Sep 17high

BambooToken Malware Exploits MQTT Protocol for Multi-Platform Control

Cybersecurity researchers have detailed a malware campaign tracked as BambooToken, which uses the Message Queueing Telemetry Transport (MQTT) protocol as a command-and-control channel. The operation, active since at least February 2023, targets organizations in Asia and South America, leveraging MQTT's lightweight nature to maintain covert remote access on both Windows and Linux systems.

11m

BBleepingComputerinData Breaches·Sep 17high

CenterPoint Energy Confirms Customer Data Stolen in Cyberattack

CenterPoint Energy, a major U.S. utility provider, has confirmed a data breach that compromised some customers' personal information. The disclosure follows an attacker leaking data allegedly stolen from the company. The full scope of the incident remains unclear, and the company is advising customers to monitor their accounts.

11m

DDark readinginMalware·Sep 17high

VectraRAT Malware-as-a-Service Platform Targets Windows Enterprises

Dark Reading reports on a malware-as-a-service platform identified as VectraRAT, which allegedly offers threat actors a Windows implant, command-and-control infrastructure, and an operator panel for comprehensive remote access. The service is said to be available for approximately $250 per month, lowering the barrier to entry for remote operations against Windows enterprise networks. No independent verification of the pricing structure or operational scope has been conducted.

11m

TThe Hacker NewsinMalware·Sep 17high

Iranian Intelligence Service Deploy Telegram-Controlled Malware for Global Surveillance

Cybersecurity authorities from the United States, the United Kingdom, and the Netherlands have issued a joint advisory warning of a Windows-based malware variant attributed to Iran's intelligence service. The malware, controlled via the Telegram messaging platform, is designed for surveillance of dissidents, journalists, and activists worldwide. Capabilities include exfiltrating emails and chat messages, capturing screenshots, and activating device microphones for recording. The advisory notes the malware likely spreads through social engineering but does not detail the specific infection vector. No patches are available; mitigation focuses on monitoring Telegram-based command-and-control traffic and enhancing endpoint security.

12m

TThe Hacker NewsinMalware·Sep 17high

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Researchers at Elastic Security Labs have identified a previously undocumented Brazilian banking malware operation, tracked as REF9334, that delivers a toolkit called KREMLIN. Active since at least May 2025, the threat actor uses lures impersonating a dozen Brazilian banks to install malicious browser extensions on Google Chrome and Microsoft Edge, enabling credential theft and session token hijacking.

12m

DDark readinginSecurity Advisories·Sep 17medium

Microsoft Issues Emergency Fixes Following Patch Tuesday Glitches

Microsoft has released emergency out-of-band patches to resolve issues introduced by the company's massive September Patch Tuesday update, which addressed nearly 1,000 CVEs but caused glitches affecting system stability for some users.

11m

BBleepingComputerinThreat Actors·Sep 16high

Malicious Admin Menu Editor Pro Plugin Backdoors WordPress Sites

A threat actor compromised the maintainer's website for the Admin Menu Editor Pro WordPress plugin and distributed malicious updates to paying customers. These updates created a hidden user account with administrative privileges, allowing unauthorized access to affected sites without the knowledge of site owners. The incident impacts an estimated 1,500 WordPress installations.

11m

BBleepingComputerinVulnerability·Sep 16high

Acronis Warns of Actively Exploited Privilege Escalation Flaw in cPanel Backup Plugin

Acronis has disclosed a high-severity local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk. The flaw may be exploited by local attackers to elevate privileges on Linux systems. The vendor reports the vulnerability is being actively exploited in the wild and has released security updates urging immediate patching.

31m

CCISA AdvisoriesinCVE·Sep 16critical

Six Critical Vulnerabilities Discovered in Digital Watchdog VMAX DVR and NVR Product Lineups

CISA has issued an advisory detailing six vulnerabilities affecting Digital Watchdog VMAX DVR and NVR product lines. Exploitation could allow unauthenticated remote attackers to gain full administrative control, access live and recorded surveillance footage, alter device configurations, and use compromised devices as network pivot points. CVSS scores range from 6.5 to 9.6, with CVE-2026-66890 rated CRITICAL. Digital Watchdog has released updated firmware to address the flaws.

52m

CCISA AdvisoriesinVulnerability·Sep 16critical

CISA Advises Critical Patches for mySCADA myPRO Manager Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an industrial control systems advisory regarding two vulnerabilities affecting mySCADA myPRO Manager version 2.1 and below. CVE-2026-73807 is a critical authentication bypass allowing access to privileged management functions, while CVE-2026-82567 is a medium-severity flaw enabling unauthenticated SMS transmission through a connected GSM modem. mySCADA Technologies has released version 2.2 containing fixes for both issues.

12m

CCISA AdvisoriesinCVE·Sep 16medium

Schneider Electric SCADAPack x70 Products Affected by Insufficiently Protected Credentials Vulnerability

Schneider Electric has disclosed a vulnerability in its SCADAPack x70 series of Remote Terminal Units. The issue, tracked as CVE-2026-81861, involves insufficiently protected credentials that could expose authentication information and lead to unauthorized access to RTU configuration through the Secure Lock functionality. The vulnerability affects SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 models. Schneider Electric rates the base severity as medium with a CVSS v3.1 score of 6.5. No active exploitation has been reported, but the vendor recommends immediate implementation of Role-Based Access Control (RBAC) and network segmentation as mitigations.

12m