Security Stuff

A threat actor known as Woodgnat has been deploying a new remote access trojan called Mistic RAT in attacks against organizations across education, insurance, IT, and professional services sectors. The group functions as an initial access broker with ties to multiple ransomware families including Qilin, Black Basta, and Akira, casting a wide net to identify victims they can sell network access to....

The US cybersecurity agency CISA is warning that attackers are actively exploiting three critical vulnerabilities in Ubiquiti UniFi OS devices, all rated with perfect 10 out of 10 severity scores. The flaws, which include an authentication bypass and command injection vulnerability, were reportedly exploited as zero-days before being patched last month, with users reporting automated attacks that...

Nathan Austad has been sentenced to 18 months in prison for his role in a 2022 credential-stuffing attack on DraftKings, where hackers used stolen login credentials to access over 60,000 accounts and steal approximately $600,000 from 1,600 users. Austad also ran a website selling compromised accounts and had about $465,000 in cryptocurrency from his criminal activities. He is the third person sent...

The Department of Justice has seized a Huione Cloud account linked to cyber scam money laundering operations. While specific details about the scope and nature of the investigation weren't provided in the brief announcement, the action represents continued government efforts to crack down on cryptocurrency and digital platform-based financial crimes connected to overseas cyber fraud schemes.

Cybersecurity firm XM Cyber has demonstrated a technique that allows a standard macOS user without administrative privileges to silently disable enterprise endpoint security tools like EDR and MDM agents without triggering alerts. The attack chains together known macOS behaviors, including exploiting kernel code-signing trust cache persistence and injecting malicious payloads into application file...

We're entering a new era where AI models are discovering software vulnerabilities at an unprecedented scale, creating what experts call "apex agentic adversaries." Organizations are being urged to implement five critical steps to defend against these AI-powered threats, while also modernizing their security infrastructure by transitioning from traditional VPNs to zero-trust network...

Critical security flaws have been discovered in Cordyceps CI/CD systems that put more than 300 GitHub repositories at risk of supply-chain attacks. The vulnerabilities could allow attackers to compromise the software development and deployment pipeline, potentially injecting malicious code into widely-used software projects. Organizations using affected repositories are urged to review their CI/CD...

Researchers have discovered a macOS vulnerability that lets attackers with standard user privileges disable security tools like CrowdStrike Falcon and Kandji MDM without needing administrator access. The flaw exploits how macOS caches application trust information, allowing attackers to impersonate legitimate app components and execute privileged operations that should be restricted. According to...

At least nine organizations, including several cybersecurity firms like HackerOne, Huntress, and Recorded Future, have disclosed they were affected by a supply chain attack on market intelligence platform Klue. Attackers used compromised legacy credentials to access Klue's systems and steal OAuth tokens for Salesforce integrations, allowing them to exfiltrate business data including names, em...

European cybersecurity firm Paradigm Shift has disclosed a new unpatchable BootROM exploit called Usbliter8 that affects millions of iPhones with A12 and A13 chips, including the iPhone XS, XR, and 11 models from 2018 and 2019. The exploit requires physical USB access to the device and allows attackers to bypass Apple's secure boot chain and execute code at the device's lowest level befo...

Fortinet has confirmed that a large-scale campaign called FortiBleed, which has compromised over 86,000 device credentials across 194 countries, does not exploit new vulnerabilities but instead relies on credential reuse from previous breaches and brute-force attacks against weak passwords. The company says the attacks leverage previously disclosed authentication bypass flaws that were patched in...

The recent ShinyHunters cyberattacks on major organizations like the University of Nottingham, 7-Eleven, and Medtronic reveal a fundamental shift in how modern breaches occur. Instead of exploiting software vulnerabilities, attackers are now primarily targeting stolen credentials, compromised authentication tokens, and misconfigured identity systems to simply log in rather than break in. Security...

Microsoft has attributed last week's supply chain attack on the Mastra NPM framework to North Korean state-sponsored hackers known as Sapphire Sleet. During a 45-minute window on June 17th, attackers compromised a maintainer account and published 141 malicious packages containing a typosquat dependency that deployed cross-platform malware targeting cryptocurrency wallets and system informatio...

Attackers are actively exploiting a vulnerability in the Gravity SMTP WordPress plugin that allows unauthenticated users to steal sensitive system information including API keys, database details, and server configurations. Security firm Defiant reports they've blocked over 17 million exploit attempts since May, with a surge in June targeting the flaw tracked as CVE-2026-4020. Site owners run...

Security researchers have discovered a memory leak vulnerability in Squid Proxy called Squidbleed that has existed since 1997, similar to the infamous Heartbleed flaw. The vulnerability allows attackers who control an FTP server to potentially steal sensitive data like credentials and session tokens from other users in shared proxy environments like corporate networks and public Wi-Fi hotspots. Th...

Canada's spy agency obtained a groundbreaking warrant allowing it to remotely clean malware from private devices infected by a botnet. This marks the first known instance of intelligence services using legal authority to directly access and repair civilian computers without individual owner consent. The unprecedented move highlights evolving approaches to cybersecurity threats, where governme...

This weekly cybersecurity recap covers several critical security developments including browser vulnerabilities, EDR evasion tools, and malware threats. The roundup highlights new attack vectors ranging from a television botnet and OpenBSD security flaw to an Android trojan, underlining the continuing escalation in cyber threats across multiple platforms.

Legacy infrastructure systems can become a major security liability when deploying AI agents in enterprise environments. Organizations need to ensure their older technology stacks don't create vulnerabilities that AI-powered threats could exploit, while also preventing legacy systems from limiting the effectiveness of AI-driven security tools. The key is modernizing infrastructure alongside A...

Google has set a September 30th deadline for Android developers in four countries to complete a verification process. The verification requirement appears to be part of Google's ongoing efforts to enhance security and trust on the Android platform by ensuring developer accountability in these specific regions.

Cybersecurity researchers have identified a new threat called OXLOADER, a malicious loader being distributed through fraudulent Google ads to deploy CastleStealer malware. The campaign demonstrates how attackers continue to exploit trusted advertising platforms to compromise systems. This discovery highlights the ongoing challenge of malvertising as a delivery mechanism for credential-stealing mal...

French President Emmanuel Macron urged wealthy democracies to cooperate on AI regulation at a G7 summit that included OpenAI's Sam Altman and other top AI executives, while criticizing the Trump administration's recent directive blocking foreign access to Anthropic's most advanced AI models as a "strictly nationalist" reaction. The restrictions on Anthropic have fueled Eur...

Hackers are actively exploiting a vulnerability in the Gravity SMTP WordPress plugin that exposes API keys, putting website security at risk. The flaw allows attackers to access sensitive authentication credentials that could be used to compromise email systems and other connected services. WordPress site administrators using this plugin are urged to update immediately to protect their API keys fr...

Cisco has announced it's acquiring identity lifecycle security company WideField Security to enhance Splunk's Agentic SOC capabilities, though no financial details were disclosed. WideField's technology discovers human and non-human identities, maps security exposures, and provides AI-powered behavioral analytics for real-time threat detection. This marks Cisco's third cybersec...

Cybersecurity firms Huntress and Recorded Future were hit by a supply chain attack targeting market intelligence platform Klue that began on June 11th. Hackers accessed Klue's backend servers and pushed malicious code to harvest OAuth tokens, then used the Salesforce integration to exfiltrate business data including customer contacts, price quotes, and sales information over a 24-hour period....

Microsoft has identified a sophisticated Windows malware called CryptoBandits that functions as both a cryptocurrency clipper and a lightweight backdoor, routing traffic through a built-in Tor client and local SOCKS5 proxy to avoid detection. The malware spreads via malicious shortcut files, propagates through USB devices, and continuously polls its command-and-control server every 500 millisecond...