Latest Cybersecurity News, page 51

BBleepingComputerinMalware·Aug 23medium

New Manic Android Malware Discovered with Nearby Device Data Exfiltration Capability

Security researchers have identified a new Android malware strain named Manic targeting users in multiple European countries. The malware features a fallback data exfiltration mechanism that utilizes nearby infected devices to transmit stolen information. The discovery was reported by BleepingComputer, though specific technical details regarding the exfiltration method, infection chain, and exact victim count remain under review.

21m

BBleepingComputerincyber attacks·Aug 23critical

Critical Zimbra RCE Flaw Actively Exploited in the Wild

CERT Polska has issued an advisory warning that a critical vulnerability in Zimbra Collaboration Suite is being actively exploited by attackers. The flaw allows remote code execution, posing significant risk to organizations globally. Users are urged to apply security updates and monitor official advisories for mitigation guidance.

11m

BBleepingComputerinRansomware·Aug 23high

Rogue ransomware affiliate poses as recovery firm to steal payments

A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. The scheme targets victims in the interim between infection and public disclosure, potentially leading to financial loss and compromised data recovery.

21m

BBleepingComputerinData Breaches·Aug 23high

Sakura Internet Data Breach Exposes Up to 1.36 Million Accounts

Japanese cloud and data center service provider Sakura Internet disclosed a security incident involving unauthorized access to its sales management system. Customer contract and membership information of up to 1.36 million accounts may have been exposed. The company has not detailed the specific attack vector or confirmed whether data was exfiltrated.

11m

BBleepingComputerinCyber Attacks·Aug 23high

Hackers Compromise 14,500 Dahua IP Cameras in 35-Day Campaign

A large-scale campaign attributed to hackers compromised over 14,500 Dahua IP cameras over a 35-day period, researchers report. The operation, dubbed CameraSwarm, primarily affected devices in Ukraine and Russia. The compromise of network-connected cameras raises concerns about surveillance, botnet recruitment, and network pivoting capabilities.

11m

BBleepingComputerinCyber Attacks·Aug 23high

US Cyber Agencies Issue Warning on AI-Enhanced Threats to Siemens S7 PLCs

U.S. cybersecurity agencies, including CISA and the NSA, have issued a warning that threat actors are leveraging AI-generated scripts to exploit vulnerabilities in Siemens S7 Series programmable logic controllers. The advisory highlights risks to operational technology environments across critical infrastructure sectors, though specific exploitation details and affected sectors remain under investigation.

11m

BBleepingComputerinCyber Attacks·Aug 23high

Password spraying attacks surge 155x in H1 2026, exploiting MFA gaps

Huntress researchers observed a 155-fold increase in password spraying attacks during the first half of 2026. One campaign generated over 81 million login attempts within a two-week period, exploiting legacy authentication protocols and gaps in multi-factor authentication policies that left certain login flows unprotected.

11m

BBleepingComputerinSecurity Advisories·Aug 23medium

Microsoft resolves Windows Defender crash issue following security update

Microsoft has released a fix for a bug that caused Windows Defender to crash on certain systems after a recent security update. The issue resulted in 0xc0000005 access violation errors, potentially leaving systems without real-time protection. The company has not reported active exploitation of the bug.

11m

BBleepingComputerinZero-Day·Aug 23critical

CISA Warns of Active Exploitation of Critical Windows IKE Extension RCE Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical-severity remote code execution (RCE) vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. Organizations are urged to apply Microsoft's security update immediately and monitor for indicators of compromise.

12m

KKrebs on SecurityinCyber Attacks·Aug 23high

Canadian Man Pleads Guilty in Snowflake Extortions and AT&T Data Theft

Connor Riley Moucka, 26, of Kitchener, Ontario, has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations using the Snowflake cloud data platform. The plea also covers the theft of call and text history records from over 100 million AT&T customers. The case was reported by Krebs on Security on August 6, 2026.

21m

KKrebs on SecurityinMalware·Aug 23high

Generic TV Streaming Boxes Found to Run Ad Fraud Operations, Spoofing Mobile Devices

A new analysis by security researchers, reported by Krebs on Security, finds that generic TV streaming boxes—often sold for a one-time fee with promises of unlimited content—are not only secretly renting out users' Internet connections but also spoofing themselves as mobile phones to click ads on AI-generated websites. This sprawling ad fraud operation defrauds online merchants and advertising networks, while users face degraded network performance and potential legal/ethical issues.

23m

KKrebs on SecurityinPrivacy·Aug 23medium

LG to Suspend Smart TV Apps That Turn WebOS Devices into Residential Proxies

LG Electronics USA announced it will suspend apps on its webOS smart TV platform that function as always-on residential proxy nodes. The decision comes after researchers found that a significant portion of apps in LG's store allow unknown third parties to route internet traffic through users' TVs, raising privacy and security concerns.

12m

KKrebs on SecurityinVulnerability·Aug 23high

Microsoft's July 2026 Patch Tuesday Addresses Record 570 Flaws, Nearly Triple Last Month

Microsoft released its July 2026 Patch Tuesday update, fixing at least 570 security vulnerabilities across Windows, Office, and Azure—nearly triple the number patched in June. The company attributes the surge to AI-assisted vulnerability discovery. While no active exploits are confirmed, the sheer volume underscores an expanded attack surface, prompting urgent calls for prioritization.

12m

KKrebs on SecurityinSecurity Advisories·Aug 23high

CISA Credential Leak Exposes AWS Govcloud Keys in Public GitHub Repository

A contractor for the Cybersecurity and Infrastructure Security Agency inadvertently published dozens of internal CISA credentials, including AWS Govcloud keys, in a public GitHub repository. The exposure remained undetected for approximately six months until KrebsOnSecurity notified CISA in July 2026. The agency's subsequent postmortem identifies significant gaps in secret management and access controls.

11m

TThe Hacker NewsinVulnerability·Aug 23critical

Critical NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Send Spacecraft Commands

A chain of vulnerabilities in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, could allow unauthenticated attackers to issue arbitrary commands to the spacecraft and instrument command bus. The issue is tracked as GHSA-p9r8-2q67-fp86 and has a CVSS v3.1 score of 9.4.

22m

TThe Hacker NewsinMalware·Aug 23high

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Zimperium zLabs researchers have detailed an updated version of the ToxicPanda (aka TgToxic) Android banking malware, now featuring 167 remote commands and a PIN harvesting workflow that targets more than 140 banking and cryptocurrency applications. The malware's global footprint has expanded, and it is being used alongside GoldDigger to enhance on-device fraud capabilities.

31m

TThe Hacker NewsinMalware·Aug 23high

40 Malicious Firefox Extensions Disguised as Web3 Products Identified in 'Offside Wallet Theft Factory' Campaign

Researchers from Socket Threat Research have identified 40 malicious Mozilla Firefox extensions that pose as legitimate Web3 products, including OKX Wallet, Rabby Wallet, and TronLink, to facilitate cryptocurrency wallet theft. These extensions are part of a larger campaign dubbed "Offside Wallet Theft Factory," which encompasses 77 browser add-ons sharing source code and infrastructure overlaps. The malicious extensions were designed to mimic the appearance and functionality of trusted wallet interfaces, tricking users into revealing private keys or seed phrases, which were then exfiltrated to attacker-controlled servers. The findings highlight a significant threat to the Firefox add-on ecosystem and users interacting with decentralized finance (DeFi) platforms.

22m

BBleepingComputerinvulnerability·Aug 23critical

CISA Issues Urgent Warning on Actively Exploited MLflow Vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the MLflow open-source AI engineering platform to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively exploiting the flaw. Federal civilian agencies have been directed to remediate the vulnerability by a specified deadline. The advisory highlights the risk of unauthorized access or compromise of systems running vulnerable MLflow instances, though specific exploitation details, affected versions, and patch information remain limited in the public report.

11m

TThe Hacker NewsinVulnerability·Aug 23critical

Citrix Patches Critical Authentication Bypass in NetScaler ADC and Gateway

Citrix has released security updates to address two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical-severity authentication bypass. The flaws affect customer-managed deployments, including certain FIPS and NDcPP builds, as well as SecurAccess. Organizations are urged to apply the patches immediately.

11m

BBleepingComputerinVulnerability·Aug 23critical

Critical Elementor Pro Vulnerability Allows Remote Code Execution on WordPress Sites

A critical vulnerability has been discovered in the Elementor Pro WordPress plugin that could allow attackers to upload executable files, leading to remote code execution (RCE) on the server. This could result in full site compromise, data theft, and malware distribution. The vendor has been notified, and users are advised to update as soon as a patch is available.

12m

BBleepingComputerinPhishing·Aug 23medium

Kaseya Advises MSPs on Detecting AI-Powered Phishing That Bypasses Email Filters

Kaseya has published guidance for Managed Service Providers (MSPs) on detecting and containing phishing attacks that evade traditional email filters. With AI enabling more personalized and convincing lures, the vendor recommends monitoring identity, email, and endpoint activity to identify and respond to threats that reach the inbox.

11m

DDark readinginMalware·Aug 23high

Grandoreiro Banking Trojan Resurfaces in Mexico Campaign with Enhanced Evasion

The Grandoreiro banking Trojan has resurfaced following a law enforcement takedown, deploying enhanced evasion and obfuscation features in a targeted campaign against Mexican users. The malware is designed to steal banking credentials and facilitate financial fraud, with new techniques aimed at bypassing security controls and analysis.

21m

TThe Hacker NewsinCVE·Aug 23critical

Microsoft Entra ID Maximum-Severity Flaw (CVSS 10.0) Exploited in the Wild

Microsoft has disclosed a maximum-severity remote code execution vulnerability in its cloud-based identity service, Entra ID (formerly Azure Active Directory), tracked as CVE-2026-69836 with a CVSS score of 10.0. The company confirmed that the flaw has been exploited in the wild, but stated that no customer action is required, indicating the issue has been mitigated at the service level.

11m

BBleepingComputerinData Breaches·Aug 22medium

SickKids Data Breach Exposes Employee and Job Applicant Information

Toronto's Hospital for Sick Children (SickKids) confirmed a cybersecurity incident that exposed the personal information of current and former employees and job applicants. The breach stemmed from a flaw in third-party software, and the organization confirmed that clinical systems and patient records remained unaffected.

21m