Latest Cybersecurity News, page 38

TThe Hacker NewsinCyber Attacks·Aug 23high

Jewelbug Threat Actor Leverages XG-Web for Espionage and Crypto Fraud

The China-linked threat actor known as Jewelbug has been observed conducting cyber espionage operations targeting governments and militaries while simultaneously engaging in cryptocurrency fraud. Both malicious campaigns are administered from a single control panel, XG-Web, a browser-centric remote-access and information-stealing framework that transforms a victim's browser into a full remote-control tool. The operations were reported by The Hacker News on August 14, 2026.

11m

TThe Hacker NewsinThreat Intelligence·Aug 23medium

ThreatsDay Bulletin: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw and 17 Additional Cybersecurity Updates

The latest ThreatsDay Bulletin from The Hacker News provides a comprehensive overview of this week's diverse cybersecurity landscape, featuring GhostJacking AI attacks that exploit AI system resources, EtherHiding ClickFix campaigns leveraging social engineering through fraudulent click-fix guides, and a Cursor CLI flaw posing potential command execution risks. The bulletin also includes 17 additional updates spanning cloud service misconfigurations, malware variants, data breach disclosures, and various scam operations targeting global users and organizations.

11m

TThe Hacker NewsinCyber Attacks·Aug 23high

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Acronis Threat Research Unit has identified an ongoing cyberattack campaign delivering a new backdoor named PATCHCORD. The implant, written in C/C++, targets Afghan telecom providers and South Asian critical infrastructure organizations through sector-specific lures, including fake VPN installers impersonating Afghan Telecom. The campaign aims to establish unauthorized access for potential espionage and data exfiltration.

11m

TThe Hacker NewsinMalware·Aug 23high

AmnesiaStealer Targets macOS Chromium Browsers via Counterfeit GitHub Pages

Researchers have identified AmnesiaStealer, a new macOS-oriented information stealer written in Rust, capable of hijacking Chromium-based browsers to steal session data and potentially grant live browser control. The malware is distributed through fraudulent GitHub download pages that impersonate legitimate software, employing ClickFix-style social engineering to trick users into executing the payload.

11m

TThe Hacker NewsinMalware·Aug 23high

New WindRelay Android Malware Turns Phones into NFC Relays for Contactless Payment Fraud

Researchers at Group-IB have identified a new Android malware family called WindRelay that abuses NFC capabilities to relay live card data from victims' phones to fraudsters. The malware is used in conjunction with the known SpyNote RAT, enabling contactless payment fraud. The campaign was first detected in 2026, with details published on August 13, 2026.

12m

TThe Hacker NewsinThreat Actors·Aug 23high

North Korean Remote IT Workers Infiltrate Government and Businesses via Fraudulent Job Applications

North Korean state-sponsored IT workers are infiltrating government agencies and private businesses by applying for remote positions using fake identities and stolen personally identifiable information. The FBI is actively investigating a specific case involving a North Korean remote IT worker who gained employment at an unnamed organization. These operatives use sophisticated interview techniques and fraudulent documentation to bypass hiring vetting, posing risks of data exfiltration, intellectual property theft, and compromised security postures for affected entities.

12m

TThe Hacker NewsinCyber Attacks·Aug 23critical

Active Exploitation of CVE-2026-55040 in Microsoft SharePoint Following Public PoC Release

Threat actors have begun exploiting CVE-2026-55040, a critical security feature bypass vulnerability in Microsoft SharePoint, following the release of public proof-of-concept code. The flaw, which stems from weak authentication mechanisms, allows unauthenticated attackers to bypass security features. Microsoft released a patch as part of its July 2026 Patch Tuesday updates. The vulnerability carries a CVSS score of 9.1, indicating critical severity. Organizations using SharePoint are urged to apply the latest security updates immediately to mitigate the risk of active exploitation.

11m

TThe Hacker NewsinZero-Day·Aug 23high

Lazarus Group Exploits Windows Zero-Day in Operation Dream Job Campaign

Check Point Research attributes a zero-day exploitation of a Microsoft Windows vulnerability to the Lazarus Group, a North Korean threat actor, in a campaign designated Operation Dream Job. The attacks target defense and aerospace companies in France, Germany, Brazil, and India, delivering a previously unseen backdoor after achieving SYSTEM-level access.

11m

TThe Hacker NewsinMalware·Aug 23high

737 Malicious Chrome VPN and Proxy Extensions Intercepting Browser Traffic Discovered

Security researchers have identified 737 free VPN and proxy extensions in the Chrome Web Store that primarily target Russian-speaking users seeking access to blocked services. The extensions, published across at least 40 developer accounts, have accumulated approximately 75,486 installs. Once installed, the extensions intercept browser traffic and route it through attacker-controlled proxy infrastructure, enabling potential traffic interception and data theft. Of the identified extensions, 274 have been found to impersonate 66 legitimate services. Google Chrome is the affected platform.

11m

TThe Hacker NewsinSecurity Advisories·Aug 23high

Enterprise Defenses Recovered at the Edge and Collapsed Inside

Analysis of over 338 million attack simulations in H1 2026 shows that while average prevention effectiveness is strong, internal defenses lag significantly behind edge defenses, indicating that attackers are succeeding by evading detection rather than overwhelming systems.

11m

BBleepingComputerinMalware·Aug 23medium

New Manic Android Malware Discovered with Nearby Device Data Exfiltration Capability

Security researchers have identified a new Android malware strain named Manic targeting users in multiple European countries. The malware features a fallback data exfiltration mechanism that utilizes nearby infected devices to transmit stolen information. The discovery was reported by BleepingComputer, though specific technical details regarding the exfiltration method, infection chain, and exact victim count remain under review.

11m

BBleepingComputerincyber attacks·Aug 23critical

Critical Zimbra RCE Flaw Actively Exploited in the Wild

CERT Polska has issued an advisory warning that a critical vulnerability in Zimbra Collaboration Suite is being actively exploited by attackers. The flaw allows remote code execution, posing significant risk to organizations globally. Users are urged to apply security updates and monitor official advisories for mitigation guidance.

11m

BBleepingComputerinRansomware·Aug 23high

Rogue ransomware affiliate poses as recovery firm to steal payments

A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. The scheme targets victims in the interim between infection and public disclosure, potentially leading to financial loss and compromised data recovery.

11m

BBleepingComputerinData Breaches·Aug 23high

Sakura Internet Data Breach Exposes Up to 1.36 Million Accounts

Japanese cloud and data center service provider Sakura Internet disclosed a security incident involving unauthorized access to its sales management system. Customer contract and membership information of up to 1.36 million accounts may have been exposed. The company has not detailed the specific attack vector or confirmed whether data was exfiltrated.

11m

BBleepingComputerinCyber Attacks·Aug 23high

Hackers Compromise 14,500 Dahua IP Cameras in 35-Day Campaign

A large-scale campaign attributed to hackers compromised over 14,500 Dahua IP cameras over a 35-day period, researchers report. The operation, dubbed CameraSwarm, primarily affected devices in Ukraine and Russia. The compromise of network-connected cameras raises concerns about surveillance, botnet recruitment, and network pivoting capabilities.

11m

BBleepingComputerinCyber Attacks·Aug 23high

US Cyber Agencies Issue Warning on AI-Enhanced Threats to Siemens S7 PLCs

U.S. cybersecurity agencies, including CISA and the NSA, have issued a warning that threat actors are leveraging AI-generated scripts to exploit vulnerabilities in Siemens S7 Series programmable logic controllers. The advisory highlights risks to operational technology environments across critical infrastructure sectors, though specific exploitation details and affected sectors remain under investigation.

11m

BBleepingComputerinCyber Attacks·Aug 23high

Password spraying attacks surge 155x in H1 2026, exploiting MFA gaps

Huntress researchers observed a 155-fold increase in password spraying attacks during the first half of 2026. One campaign generated over 81 million login attempts within a two-week period, exploiting legacy authentication protocols and gaps in multi-factor authentication policies that left certain login flows unprotected.

11m

BBleepingComputerinSecurity Advisories·Aug 23medium

Microsoft resolves Windows Defender crash issue following security update

Microsoft has released a fix for a bug that caused Windows Defender to crash on certain systems after a recent security update. The issue resulted in 0xc0000005 access violation errors, potentially leaving systems without real-time protection. The company has not reported active exploitation of the bug.

11m

BBleepingComputerinZero-Day·Aug 23critical

CISA Warns of Active Exploitation of Critical Windows IKE Extension RCE Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical-severity remote code execution (RCE) vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. Organizations are urged to apply Microsoft's security update immediately and monitor for indicators of compromise.

12m

KKrebs on SecurityinCyber Attacks·Aug 23high

Canadian Man Pleads Guilty in Snowflake Extortions and AT&T Data Theft

Connor Riley Moucka, 26, of Kitchener, Ontario, has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations using the Snowflake cloud data platform. The plea also covers the theft of call and text history records from over 100 million AT&T customers. The case was reported by Krebs on Security on August 6, 2026.

11m

KKrebs on SecurityinMalware·Aug 23high

Generic TV Streaming Boxes Found to Run Ad Fraud Operations, Spoofing Mobile Devices

A new analysis by security researchers, reported by Krebs on Security, finds that generic TV streaming boxes—often sold for a one-time fee with promises of unlimited content—are not only secretly renting out users' Internet connections but also spoofing themselves as mobile phones to click ads on AI-generated websites. This sprawling ad fraud operation defrauds online merchants and advertising networks, while users face degraded network performance and potential legal/ethical issues.

13m

KKrebs on SecurityinPrivacy·Aug 23medium

LG to Suspend Smart TV Apps That Turn WebOS Devices into Residential Proxies

LG Electronics USA announced it will suspend apps on its webOS smart TV platform that function as always-on residential proxy nodes. The decision comes after researchers found that a significant portion of apps in LG's store allow unknown third parties to route internet traffic through users' TVs, raising privacy and security concerns.

12m

KKrebs on SecurityinVulnerability·Aug 23high

Microsoft's July 2026 Patch Tuesday Addresses Record 570 Flaws, Nearly Triple Last Month

Microsoft released its July 2026 Patch Tuesday update, fixing at least 570 security vulnerabilities across Windows, Office, and Azure—nearly triple the number patched in June. The company attributes the surge to AI-assisted vulnerability discovery. While no active exploits are confirmed, the sheer volume underscores an expanded attack surface, prompting urgent calls for prioritization.

12m

KKrebs on SecurityinSecurity Advisories·Aug 23high

CISA Credential Leak Exposes AWS Govcloud Keys in Public GitHub Repository

A contractor for the Cybersecurity and Infrastructure Security Agency inadvertently published dozens of internal CISA credentials, including AWS Govcloud keys, in a public GitHub repository. The exposure remained undetected for approximately six months until KrebsOnSecurity notified CISA in July 2026. The agency's subsequent postmortem identifies significant gaps in secret management and access controls.

11m