Latest Cybersecurity News, page 37

TThe Hacker NewsinCyber Attacks·Aug 24high

Clop-Linked Web Shell Exploits PTC Windchill Flaw to Decrypt Credentials and Map Engineering Data

A JavaServer Pages web shell, attributed to the Clop ransomware group, has been deployed in the wild following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers. The shell functions as an extortion platform capable of mapping sensitive vault data and decrypting credentials. The vulnerability, tracked as CVE-2025-3866, affects enterprise Product Lifecycle Management environments. PTC and ReliaQuest have been referenced in connection with the flaw and its analysis, respectively. The full extent of victim impact and data exfiltration remains under investigation.

11m

TThe Hacker NewsinVulnerability·Aug 24high

Microsoft Copilot Personal Vulnerabilities Disclosed as CoSnitch

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal, tracked collectively as CoSnitch. The flaws involve an undocumented URL parameter surfaced by the assistant that could allow a single click on a crafted link to silently exfiltrate data from connected apps and the Copilot session context. Microsoft has not yet released an official patch.

11m

TThe Hacker NewsinVulnerability·Aug 24high

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Security researchers from watchTowr and VulnCheck have reported two critical vulnerabilities currently being exploited in the wild. The primary flaw affects MLflow, an open-source AI platform, where a Server-Side Request Forgery (SSRF) vulnerability can be leveraged to steal cloud credentials and sensitive secrets. The second vulnerability impacts FUXA, an open-source SCADA/HMI platform designed for industrial automation and operational technology environments. Both products are witnessing malicious scanning and exploitation efforts, with affected instances likely exposed to the internet.

11m

TThe Hacker NewsinRansomware·Aug 24high

Ransom Busters Claims to Hack Ransomware Servers, Demands Fees from Victims

A threat actor identifying itself as Ransom Busters has been observed sending unsolicited emails to organizations affected by ransomware attacks. The group claims to have compromised ransomware group servers and offers to delete stolen data in exchange for fees ranging from $20,000 to $60,000. Security researchers at GuidePoint have flagged the activity as anomalous, noting that such proactive outreach from third parties is unusual in the ransomware landscape.

11m

TThe Hacker NewsinSecurity Research·Aug 24medium

Security Researchers Demonstrate Self-Propagating AI Payloads Spreading via System Prompt Files

Researchers from Anthropic and EPFL have demonstrated that self-propagating payloads can spread between autonomous AI agents through editable system prompt files used for state persistence. The technique, tested in a simulated six-agent coding environment, raises concerns about the integrity of autonomous AI systems.

11m

TThe Hacker NewsinMalware·Aug 24high

New TWINLOOT Malware Abuses SharePoint and Teams for Stealthy Command-and-Control

Cybersecurity researchers at Ontinue have disclosed a previously undocumented Python implant framework called TWINLOOT. The malware is hardened with PyArmor and operates its entire command-and-control (C2) infrastructure through SharePoint Online and Microsoft Teams, making detection difficult by blending in with legitimate traffic. The framework is designed for credential theft and lateral movement across networks.

12m

TThe Hacker NewsinCyber Attacks·Aug 24high

Single Attacker Scrapes Salesforce and ServiceNow Portals Since 2025

Research published by the agent security platform Reco identifies a sustained scraping campaign, dubbed 'City Forum,' targeting Salesforce and ServiceNow customer portals across multiple industries. The activity is traced to a single IP address, 158.220.87.79, with reports indicating the operation has been active since at least 2025. The exact method of access and specific victim data remain under investigation.

11m

TThe Hacker NewsinMalware·Aug 23high

16 Typosquatted RubyGems Packages Deploy Information Stealer Targeting Credentials and Crypto Wallets

A typosquatting campaign has been identified distributing malicious RubyGems packages designed to steal browser-stored credentials and cryptocurrency wallet data from Windows users. Researchers from OpenSourceMalware are tracking the threat under the moniker "StubMaker." The campaign includes packages with names intentionally similar to legitimate projects, relying on user error during installation. Analysis indicates the packages execute an information stealer upon installation, targeting data stored in browsers and cryptocurrency wallet applications. The discovery was reported on August 18, 2026.

11m

TThe Hacker Newsindata-breaches·Aug 23medium

SafePal Hardware Wallet Maker Reports Authorization Flaw Exposing Customer Data

SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone numbers, and purchase details of approximately 39,798 customers. Affected individuals were notified via email on August 16, 2026. The company states no evidence of active exploitation has been reported, and the plug-in authorization flaw has been patched.

11m

TThe Hacker NewsinVulnerability·Aug 23high

CISA Adds Actively Exploited Ray Framework Vulnerability to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability impacting the Ray distributed computing framework to its Known Exploited Vulnerabilities (KEV) catalog. The inclusion is based on evidence of active exploitation in the wild. The framework, which is Python-native and open-source, is widely used to scale artificial intelligence and machine learning workloads. While the advisory confirms active exploitation, specific technical details such as the CVE identifier, precise attack vector, and scope of impact remain limited in the initial reporting.

11m

TThe Hacker Newsinvulnerability·Aug 23high

Snowflake GitHub Actions Vulnerability Could Allow Command Injection via Crafted Issues

Researchers from Wiz have disclosed a GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository. The flaw, located in the .github/workflows/jira_issue.yml workflow, could potentially allow command execution via crafted GitHub issues. The workflow was designed to run on issue activity and contained internal Jira credentials, raising concerns about credential exposure and lateral movement if exploited.

11m

TThe Hacker NewsinCyber Attacks·Aug 23high

Kaspersky Details Cavern C2 Framework Evolution Blending DNS and Google Apps Script

Kaspersky researchers have identified new components in the Cavern (Cav3rn) command-and-control framework used by Iranian nation-state hackers. The framework has evolved to leverage DNS tunneling and Google Apps Script to blend into legitimate traffic, targeting entities in Israel. The ongoing monitoring since December 2025 has revealed previously unreported capabilities that expand the threat actor's operational reach.

11m

TThe Hacker NewsinCyber Attacks·Aug 23high

Weekly Cybersecurity Recap: VMware Exploits, Windows Zero-Day, MCP Attacks, and Browser Hijacks

During the week of August 17, 2026, cybersecurity incidents included exploitation of VMware ESXi vulnerabilities, active exploitation of a Windows zero-day, attacks targeting the Model Context Protocol (MCP), and browser hijacking campaigns. The reported events highlight that high-cost attacks are not always the most sophisticated, with exposed services, legacy bugs, and supply-chain trust issues serving as primary entry points.

11m

TThe Hacker NewsinSecurity Research·Aug 23high

MCP Servers Can Leak Enterprise Secrets via Plaintext Configs and Over-Permissioned Access

A new analysis highlights how MCP servers can expose enterprise secrets through plaintext configuration files, over-permissioned access, and prompt injection. As organizations increasingly adopt AI agents, these exposures can silently become a major security gap, often before security teams are aware the server is running.

11m

TThe Hacker NewsinZero-Day·Aug 23critical

Unisoc VoLTE Video Call Exploit Chain Achieves Full Android Kernel Access

Security researchers from SSD Secure Disclosure have detailed a two-stage exploit chain that achieves full Android kernel access on devices using Unisoc modem firmware through a VoLTE video call. The advisory, published August 17, 2026, represents the second stage of a chain first disclosed in March 2026, which revealed remote code execution in the Unisoc modem firmware. The second stage escalates privileges to kernel level. Unisoc has not provided a fix as of publication.

11m

BBleepingComputerinSecurity Advisories·Aug 23medium

Named Pipes Under Attack: Securing Windows Interprocess Communication

A recent advisory from ThreatLocker, reported by BleepingComputer, highlights that Windows named pipes—used for interprocess communication—can expose privileged services to untrusted processes when access controls are weak. The guidance outlines defensive measures including endpoint verification, command authorization, strict input validation, and narrowly scoped privileges to reduce exploitation risk.

11m

BBleepingComputerinMalware·Aug 23high

Supply-Chain Attack Uses Legitimate Update App to Infect Android Car Head Units with Proxy Botnet Malware

A supply-chain attack targeting Android-based car head units is leveraging a legitimate device-update app to distribute malware that turns compromised devices into a proxy botnet or uses them for ad fraud. The attack was reported on August 22, 2026, and affects users globally, though specific regions are not disclosed. The malware is delivered during the update process, potentially degrading device performance, consuming data, and exposing users to further malicious activity. No specific patch is available; users and manufacturers are advised to audit update channels and monitor for unusual network behavior.

12m

TThe Hacker NewsinCyber Attacks·Aug 23high

Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies

Researchers have identified Evooo1Bot, a Linux botnet family derived from the publicly leaked Mirai source code, which exploits known vulnerabilities in edge‑network devices to conscript them as SOCKS5 proxies. The malware retains the original DDoS functionality while extending the framework with proxy‑routing capabilities. No zero‑day vulnerabilities have been reported; the attacks rely on unpatched known flaws.

11m

TThe Hacker NewsinMalware·Aug 23critical

Active Exploitation of CVE-2026-65400 in macOS Screen Sharing Deploys Monero Miner

The Netherlands National Cyber Security Centre (NCSC-NL) has issued an advisory warning that a critical authentication flaw in Apple macOS Screen Sharing (CVE-2026-65400, CVSS 9.8) is being actively exploited in the wild. Attackers are leveraging the vulnerability to gain unauthorized access to internet-exposed macOS systems and deploy a Monero cryptocurrency miner. Apple has released security updates to address the vulnerability, and users are strongly advised to apply the latest macOS updates immediately.

11m

TThe Hacker NewsinThreat Intelligence·Aug 23high

Cybercriminals Invest Nearly $7 Million in Expired Doments for Large-Scale Malware and Scam Redirection

Threat actors spent approximately $7 million during the first half of 2026 to acquire expired domains through dropcatching techniques. By inheriting existing web traffic, SEO rankings, and backlink profiles, these domains are being used to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox identified 50,400 such domains registered in the period, highlighting a growing abuse of the domain lifecycle for malicious infrastructure.

11m

TThe Hacker NewsinCyber Attacks·Aug 23high

Mustang Panda Deploys Signed Windows Rootkit with Updated CoolClient Backdoor

Kaspersky reports that the threat actor known as Mustang Panda (aka HoneyMyte) has updated its CoolClient backdoor with a signed Windows kernel-mode rootkit. The rootkit is capable of hiding malicious processes, files, registry objects, and C2 network information from detection. Victims have been identified in Myanmar, Mongolia, and Pakistan, though the full scope and infection vectors remain under investigation.

11m

TThe Hacker NewsinCyber Attacks·Aug 23high

Chrome DevTools Protocol Technique Enables Session Hijacking on Windows Browsers

Researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Chrome or Microsoft Edge process on Windows. The method allows an operator with existing code execution on the host to access cookies, saved data, and authenticated browser sessions. The technique does not require user interaction and leverages the DevTools protocol to interact with the browser process.

11m

TThe Hacker NewsinPhishing·Aug 23high

CTM360 Warns of Global Recruitment Phishing Campaign Using Browser-in-the-Browser Traps

Researchers from CTM360 have identified a large-scale, global phishing campaign themed around recruitment. The operation uses fake interview scheduling pages and Browser-in-the-Browser (BitB) windows to harvest Google and Facebook credentials. In more sophisticated instances, the campaign relays multi-factor authentication (MFA) prompts in real time to facilitate account compromise. The activity was detailed in a report titled RecruitTrap, published by CTM360 and covered by The Hacker News on August 14, 2026.

11m

TThe Hacker NewsinPrivacy·Aug 23high

Apple Issues Fresh Spyware Threat Notifications to Users in 110 Countries

Apple has sent new threat notifications to users in 110 countries, alerting them that they may be targeted by mercenary spyware attacks. The company stated it has now notified customers in over 150 countries to date, with notifications beginning in late 2021. Apple did not attribute the attacks to specific threat actors or provide technical details about the exploit vectors used.

11m