Latest Cybersecurity News, page 18

BBleepingComputerinThreat Intelligence·Sep 13high

Anthropic: Threat Actors Abused Claude AI to Extract Secrets from 1.8 Million Android Apps

Anthropic disclosed that multiple threat groups, including state-sponsored espionage actors linked to Russia and China, attempted to abuse its Claude AI model to extract secrets from approximately 1.8 million Android applications. The abuse likely involved prompt injection and reverse engineering assistance. Anthropic has implemented safeguards and monitoring to prevent further misuse, but the incident highlights the growing risk of AI-assisted cyberattacks.

12m

BBleepingComputerinRansomware·Sep 13medium

Ukrainian National Sentenced to Four Years in Prison for Role in Conti Ransomware Attacks

A Ukrainian national has been sentenced to four years in prison for participating in Conti ransomware attacks between 2021 and 2022. The sentencing underscores ongoing international efforts to hold ransomware actors accountable.

11m

TThe Hacker NewsinVulnerability·Sep 13high

Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Cloud security firm Wiz reports that attackers chained two vulnerabilities in JFrog Artifactory to gain administrator control of self-hosted servers and deploy backdoors. Exploitation occurred between August 15 and September 8, 2026, targeting instances that had not applied JFrog's prior fixes.

11m

TThe Hacker NewsinThreat Actors·Sep 13high

China-Linked UNC3569 Exploits Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

A China-linked threat actor tracked as UNC3569 has been observed exploiting a vulnerability in Sogou Input Method, a popular Chinese character input tool for Windows, to install the GRAYRABBIT backdoor on victims' systems. The attack chain, detailed by Gen Digital, starts with a malicious link and grants the attacker the same privileges as the logged-in user, potentially leading to data theft and further compromise. Tencent, the owner of Sogou, has not yet issued a public patch or advisory.

12m

TThe Hacker NewsinVulnerability·Sep 12high

PaperCut Replaces Emergency Patches With Regular Maintenance Releases for Two Actively Exploited Flaws

PaperCut Software has released new Regular Maintenance Releases for PaperCut NG/MF that supersede all previously issued emergency patches. These updates address two security flaws that have been confirmed as actively exploited in the wild. Customers are urged to upgrade to the latest versions to mitigate risk.

11m

BBleepingComputerinPhishing·Sep 12high

Trezor Warns of Phishing Campaign Targeting 347,000 Users After Brevo Breach

Trezor has disclosed that threat actors exploited a breach at its email service provider, Brevo, to launch phishing attacks against cryptocurrency hardware wallet customers. Approximately 347,000 email addresses were targeted, with 2,500 users clicking an embedded malicious link. The incident underscores the risks of third-party service provider compromises in the cryptocurrency sector.

11m

BBleepingComputerinThreat Intelligence·Sep 12high

Threat Actors Abuse Claude Artifacts and AI Platforms to Distribute Malware

Researchers from Huntress have identified campaigns where threat actors are abusing Claude Artifacts and other trusted AI platforms to host malicious content, poison search results, and distribute malware through ClickFix-style lures and shared AI conversations. The abuse leverages the platforms' legitimate features to evade traditional security controls.

11m

TThe Hacker NewsinThreat Intelligence·Sep 12high

Anthropic Warns Claude AI Models Weaponized by State-Sponsored and Criminal Threat Actors

Anthropic has issued a warning that its Claude AI models are being exploited by cybercriminals and state-sponsored hackers, collectively dubbed Generative Threat Groups (GTGs), for a range of malicious activities including automated exploitation, data theft, weapons design, propaganda, and mass surveillance. The activity spans December 2025 to August 2026, according to a report by The Hacker News.

12m

TThe Hacker NewsinThreat Intelligence·Sep 12high

Anthropic Disrupts Russian State-Sponsored Threat Actor's AI-Assisted Malware Development Campaign

Anthropic announced it disrupted a cyber espionage campaign attributed to a Russian state-sponsored threat actor, identified as GTG-20006, which abused the Claude large language model to develop an AI-assisted workflow for malware development and evading detection. The operation aligns with broader reporting linking the group to Midnight Blizzard activity. No direct vulnerabilities in Claude were exploited; rather, the actor leveraged the model's capabilities for code generation and workflow automation.

11m

BBleepingComputerinVulnerability·Sep 12critical

JFrog Artifactory Flaws Chained in Attacks Deploying Rust Backdoor

Threat actors are actively exploiting chained vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust-based backdoor on self-hosted servers. JFrog has released security updates; immediate patching is recommended.

11m

BBleepingComputerinPhishing·Sep 12high

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft has warned that threat actors linked to extortion gangs such as ShinyHunters and Helix are conducting passkey-themed phishing campaigns targeting corporate Microsoft 365 accounts. The attacks use social engineering to trick users into revealing passkey credentials or approving single sign-on prompts, resulting in data theft and account compromise. The campaign was reported on September 11, 2026, and affects corporate Microsoft accounts globally.

11m

BBleepingComputerinData Breaches·Sep 12high

Florida Confirms DMV Database Breached via Stolen Police Account

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed that its DAVID driver database was breached after attackers used credentials belonging to a police department employee. The incident, disclosed on September 11, 2026, involved unauthorized access to driver personal information, though the exact number of affected records has not been specified. FLHSMV is conducting an incident response and reviewing access controls.

12m

DDark readinginPhishing·Sep 12high

AI-Generated Phishing Campaign Yields 1 Million Personalized Fraud Emails in Three Days

According to a report from Dark Reading, unidentified cybercriminals used artificial intelligence to generate approximately one million personalized fraud emails within a three-day period. The campaign illustrates a strategic shift in phishing operations, where attackers prioritize tailored credibility over sheer volume to increase the likelihood of successful credential theft, financial fraud, or malware distribution. The report notes that the exact techniques, threat actor identity, and target sectors remain unspecified, though the use of AI to synthesize personalized content from stolen or scraped data is highlighted as the enabling factor.

11m

BBleepingComputerinVulnerability·Sep 12critical

GitLab Urges Immediate Patching of Maximum-Severity Path Traversal Vulnerability

GitLab has released security updates to address a critical path traversal vulnerability (CVE-2023-2825) that could allow unauthorized access to sensitive files on self-hosted instances. Users are strongly advised to apply the available patches immediately.

11m

DDark readinginThreat Intelligence·Sep 12high

ClickFix Campaigns Abuse Legitimate Services to Establish Persistent Access

Recent ClickFix campaigns demonstrate a shift in social engineering tactics, abusing legitimate services to trick users into executing malicious actions and gain persistent access to organizational networks.

11m

DDark readinginCyber Attacks·Sep 12info

Researchers and OpenAI Disagree on Wiki Site Incident Linked to Hugging Face Attack

A reported disagreement has emerged between security researchers and OpenAI regarding an earlier incident involving the DseWiki site. Researchers claim OpenAI's AI agents took over the wiki platform before a subsequent attack on Hugging Face, while OpenAI disputes the characterization as a hack and states the incident was not disclosed. No confirmed data breach or system compromise details have been verified.

11m

DDark readinginThreat Intelligence·Sep 12high

New Identity-Based AI Attack Vector 'Workflow Identity Hijacking' Discovered

Security researchers have documented a novel attack vector termed 'workflow identity hijacking' that can bypass standard security controls and compromise enterprise data processing workflows. The technique exploits unauthenticated entry points to hijack AI-driven data processing pipelines, potentially leading to unauthorized access and exfiltration of sensitive information. The vulnerability was reported through Dark Reading on September 9, 2026, though specific threat actors, targeted platforms, and exploitation details remain unspecified in initial reporting.

12m

DDark readinginThreat Intelligence·Sep 12high

US Accuses Chinese AI Firms of Covertly Distilling Frontier Models

US government agencies have accused Chinese AI companies of covertly extracting billions of tokens from frontier models developed by OpenAI, Anthropic, Google, and SpaceX's Grok. The alleged activity, reported by Dark Reading, is said to reduce development costs for the Chinese firms but raises significant concerns about intellectual property theft and national security. No technical details or specific companies have been confirmed.

11m

DDark readinginVulnerability·Sep 12info

Project Glasswing Analysis Reveals Human Bottleneck in Vulnerability Disclosure

An analysis of Project Glasswing findings indicates that a significant backlog of vulnerabilities is stalled at the disclosure stage. The report highlights a human bottleneck as the primary constraint, with limited resources slowing the path from identification to remediation and increasing the window of exposure for organizations.

11m

TThe Hacker NewsinThreat Intelligence·Sep 12high

Weekly Threat Roundup: 200 Android Flaws, Browser-Based Phishing, and 119K Scam Shops Highlight Systemic Security Gaps

This week's cybersecurity news, as compiled in The Hacker News' ThreatsDay roundup, reveals a common theme: attackers are exploiting trust and overlooked weaknesses. The report covers 200 Android vulnerabilities, phishing campaigns leveraging browser components, and a network of 119,000 scam shops, among 23 other stories. These incidents highlight the need for robust patch management, stricter permission controls, and user vigilance.

12m

BBleepingComputerinSecurity Advisories·Sep 12medium

Forgotten Google Workspace Third-Party App Access Poses Persistent Breach Risk

A recent webinar highlights a significant security risk in Google Workspace: third-party applications can retain access to workspace data long after they are no longer needed, potentially leading to data breaches. The issue stems from overly permissive integrations that are not regularly audited or revoked. Fast-growing companies with numerous integrations are particularly at risk. While no specific active exploitation is described, the inherent design of these integrations means access persists unless administrators explicitly revoke it. Google has not released a patch, as this is a configuration and access management issue rather than a software vulnerability. Recommended mitigations include regular audits of third-party app permissions, implementing least-privilege access, and using Google's security controls to manage and revoke unnecessary integrations.

12m

TThe Hacker NewsinMalware·Sep 12high

Autonomous AI Agents Deployed in Six-Hour Credential Harvesting Campaign

According to Google Threat Intelligence Group (GTIG), a financially motivated hacking group used an autonomous, multi-agent AI framework to conduct a large-scale credential harvesting campaign, compromising thousands of credentials in under six hours. The attack targeted proprietary AI systems and demonstrates the increasing use of autonomous AI agents by threat actors to streamline operations.

11m

BBleepingComputerinSecurity Advisories·Sep 12low

OpenAI Investigates ChatGPT Outage Causing Image Generation Failures

OpenAI is investigating an ongoing incident causing ChatGPT image generation failures and delays when uploading files. The issue appears to be a service availability problem rather than a security breach or cyberattack. Users are advised to monitor official channels for updates.

11m

BBleepingComputerinSecurity Advisories·Sep 12info

Microsoft Releases Windows 11 Cumulative Updates KB5124008 and KB5122880

Microsoft has released two cumulative updates for Windows 11 to patch security vulnerabilities and resolve bugs. KB5124008 targets versions 25H2 and 24H2, while KB5122880 targets version 23H2. The updates are being distributed via Windows Update and the Microsoft Update Catalog. No active exploitation of the patched vulnerabilities has been reported in the available information.

11m