Find what you’re looking for
Browse everything
6,868 results in Threat Reports
AnonyMousKIT Deploys AI Voice Agents in Sophisticated iPhone Passcode Phishing Campaign
AnonyMousKIT, a phishing-as-a-service platform active since early 2024, exploits voice AI agents to extract passcodes from stolen iPhone owners and bypass Apple's Activation Lock security feature. The operation spans 506 domains with 168 storefront brands as resellers, conducting over 200 calls to victims between August 2025 and May 2026. The AI agents impersonate Apple Support representatives, convincing victims to provide device passcodes and Apple ID credentials through sophisticated social engineering tactics, enabling attackers to unlock stolen devices, access iCloud data, and resell hardware at premium prices. This incident represents the alarming evolution of cybercriminal infrastructure, where AI-powered automation enables large-scale social engineering attacks targeting mobile device security. As voice AI becomes more sophisticated and accessible, threat actors are leveraging these technologies to circumvent traditional phishing detection methods and exploit human trust in voice communications.
Iranian Mabna Institute Hackers Sanctioned for Critical Infrastructure Breaches
In August 2026, the U.S. Treasury sanctioned five Iranian cyber actors affiliated with the Tehran-based Mabna Institute and Iran's Ministry of Intelligence and Security (MOIS) for conducting extensive compromises of U.S. critical infrastructure entities since late 2023. The threat actors successfully breached and exfiltrated data from energy companies, defense contractors, healthcare institutions, IT companies, and financial institutions, while also targeting local, state, and federal government offices in summer 2024. The group demonstrated dual motivations of state espionage and personal financial gain, with blockchain analysis revealing $16.8 million in cryptocurrency transactions across 30 wallets. This incident highlights the escalating cyber warfare between Iran and the U.S. following military strikes in February 2026, with Iranian threat actors increasingly targeting critical infrastructure as a form of asymmetric warfare. The emergence of coordinated hacktivist ecosystems and the blending of state-sponsored espionage with financially motivated cybercrime represents a significant evolution in nation-state threat actor behavior.
LACMA Data Breach Exposes Critical Security Gaps in Cultural Institutions
The Los Angeles County Museum of Art (LACMA) disclosed a significant data breach that occurred in July 2025, where attackers gained unauthorized access to their systems for four days before detection. The incident exposed highly sensitive personal information of customers and employees, including Social Security numbers, medical records, health insurance information, partial financial account details, and government-issued identification numbers. The investigation took over a year to complete, with the full scope of compromised data only identified in February 2026, highlighting the complexity and severity of the breach. This incident underscores the growing threat to cultural institutions and the healthcare sector, as attackers increasingly target organizations storing mixed personal and medical data for identity theft and fraud schemes.
Carhartt Breach Analysis: How Synthetic Data Inflated ShinyHunters' 2026 Attack Claims
In August 2026, the ShinyHunters ransomware group claimed to have breached Carhartt and stolen over 50GB of customer data containing millions of records from their Databricks analytics platform. Initial reports suggested 24+ million customer email addresses were compromised, but detailed forensic analysis revealed that nearly half the dataset consisted of synthetic TPC-DS benchmark test data mixed with legitimate customer records. The actual breach impact was approximately 13 million genuine customer email addresses, along with employee data, purchase history, and personally identifiable information including names, birth dates, and addresses. This incident highlights the growing trend of threat actors targeting cloud analytics platforms like Databricks where organizations often store both production and test data without proper segregation. As ransomware groups increasingly focus on data exfiltration over encryption, the commingling of synthetic and real data in cloud environments creates verification challenges that can lead to inflated breach reporting and misrepresented organizational impact.
Zimbra's Critical RCE Flaw Highlights the New Reality of Emergency Patching
In August 2026, CISA issued a three-day emergency patching directive for CVE-2026-73570, a critical remote code execution vulnerability in Zimbra Collaboration Suite. The flaw allows unauthenticated attackers to execute arbitrary commands on servers with SNMP notifications enabled through specially crafted SMTP requests. Active exploitation was reported by Poland's CERT Polska, prompting the accelerated response timeline. Successful attacks provide access to email communications, calendars, contacts, and organizational intelligence that can facilitate follow-on attacks. This incident exemplifies the shrinking window between vulnerability disclosure and active exploitation, driven by AI-enabled exploit development that reduces the time from patch analysis to working exploits from weeks to mere days.
WordlistLoader: The Steganographic Malware Hiding in Plain English
In August 2026, Gen Threat Labs discovered WordlistLoader, a sophisticated malware loader that uses plain English word lists to disguise and reconstruct malicious code for the Amatera infostealer. The loader operates by mapping 256 ordinary English words to byte values, allowing it to rebuild shellcode while evading detection systems. WordlistLoader is distributed through ClearFake campaigns using ClickFix-style social engineering tactics targeting Windows machines. The malware includes advanced evasion techniques including security hook bypassing, Event Tracing for Windows bypass, and anti-analysis capabilities before delivering the Amatera payload. This incident reflects the growing sophistication of malware evasion techniques as threat actors adapt to improved security detection capabilities. The use of natural language obfuscation represents a significant evolution in steganographic malware delivery methods, making traditional signature-based detection increasingly ineffective against polymorphic loaders.
Oracle WebLogic Under Attack: CVE-2026-21962 Exploitation Campaign Analysis
In August 2026, CISA added CVE-2026-21962, a maximum-severity Oracle WebLogic Server vulnerability, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw allows unauthenticated attackers with network access to compromise Oracle HTTP Server and WebLogic Server Proxy Plug-ins, leading to unauthorized data access and modification. Despite patches being available since January 2026, threat actors have actively exploited this vulnerability alongside other persistent WebLogic flaws, with researchers observing coordinated attacks from specific IP addresses targeting multiple enterprise environments. This incident demonstrates the ongoing challenge of patch management in enterprise environments and the persistent threat to web-facing Oracle infrastructure. The vulnerability's exploitation highlights how attackers continue leveraging a small set of highly-effective, simple-to-exploit vulnerabilities to compromise enterprise systems, particularly in organizations with delayed patching cycles.
Critical WordPress Admin Bypass: miniOrange SAML Vulnerabilities Under Active Attack
In August 2026, security researchers discovered two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin, allowing attackers to gain administrator access without credentials. CVE-2026-61979 and CVE-2026-15981 stem from signature validation flaws that enable attackers to craft malformed SAML responses and bypass authentication entirely. Active exploitation attempts have been observed from multiple IP addresses in what appears to be opportunistic scanning campaigns targeting vulnerable WordPress sites. The vulnerabilities affect the plugin's signature verification process, where malformed signatures trigger OpenSSL errors that are incorrectly treated as valid authentication. DigitalOcean's security team first identified the threat when they detected anomalous admin session attempts from outside their trusted network, revealing an attacker had already obtained admin cookies through these exploits. This incident highlights the growing trend of attackers targeting identity and authentication systems, particularly SAML implementations that serve as critical trust boundaries in enterprise environments. With proof-of-concept code now available and active scanning campaigns underway, organizations face immediate risk from these easily exploitable vulnerabilities.
E4del and PINHOLE RATs Turn FTP Services Into Covert Communication Channels
Cybersecurity researchers have identified a sophisticated new campaign employing FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans (RATs) named E4del and PINHOLE. The threat actors behind this campaign are exploiting legitimate FTP services to establish command-and-control infrastructure while blending seamlessly with regular network traffic. This novel technique allows attackers to maintain persistent access to compromised systems while evading traditional detection methods that focus on more conventional C2 communication channels. The campaign demonstrates advanced operational security awareness and represents a significant evolution in how threat actors establish and maintain covert communication channels. This incident highlights the growing trend of threat actors exploiting legitimate services and protocols for malicious purposes, making detection increasingly challenging for traditional security tools. As organizations continue to expand their digital infrastructure, the abuse of standard network services like FTP for covert communication channels represents a critical blind spot in many security monitoring strategies.
How Frontier AI Models Are Forcing a Vulnerability Management Revolution
The emergence of Frontier AI models like Anthropic's Mythos has fundamentally disrupted traditional vulnerability management practices by enabling machine-speed identification of zero-day flaws and automated exploit chaining. Organizations previously relying on CVSS scores, EPSS rankings, and CISA's KEV list now face an accelerated threat landscape where vulnerabilities are weaponized faster than legacy patching cycles can address them. This paradigm shift demands immediate transformation of vulnerability management programs toward exposure management frameworks that assess true organizational risk beyond traditional scoring metrics. The revolution requires automated patch deployment strategies, ring-based testing methodologies, and critical stakeholder conversations about uptime requirements versus security imperatives in an era of AI-driven exploit development. This transformation represents a critical inflection point as cybersecurity programs must evolve from reactive, siloed approaches to proactive, integrated vulnerability and patch management ecosystems capable of matching AI-driven threat velocity.
How 24 Malicious npm Packages Turned Trusted Mirrors into Phishing Infrastructure
In August 2026, cybersecurity researchers discovered a sophisticated supply chain attack involving 24 malicious npm packages that exploited unpkg mirrors to host fake Cloudflare CAPTCHA pages. The threat actors embedded HTML files within npm packages that, when accessed through mirrors like unpkg.com, rendered convincing phishing pages designed to trick users into malicious actions. The campaign initially redirected victims to typosquat Microsoft login domains before pivoting to abuse KeyVal, a legitimate key-value store service, as a dead drop resolver to dynamically control redirection targets. This incident highlights the evolving threat landscape where attackers increasingly abuse legitimate infrastructure and trusted domains to bypass security controls. Supply chain attacks continue to surge as organizations struggle with securing third-party dependencies, while threat actors demonstrate growing sophistication in leveraging trusted services for malicious infrastructure, making detection and prevention more challenging for traditional security tools.
Mirage2FA Campaign Exposes Critical Gaps in Traditional MFA Security
The Mirage2FA phishing-as-a-service campaign targeted over 4,500 organizations across the US and EU from 2024 to 2026, exploiting Microsoft 365 login flows to bypass two-factor authentication. Using adversary-in-the-middle (AiTM) techniques, attackers stole passwords and session cookies, achieving a 48% compromise rate among targeted email addresses. The campaign primarily affected US-based companies in technology, manufacturing, and education sectors, with attackers gaining authenticated access to Microsoft 365 sessions and SSO-connected services, enabling account impersonation and data theft. This incident highlights the evolving threat landscape where traditional MFA is insufficient against sophisticated phishing operations that steal active sessions rather than just credentials, demonstrating the urgent need for phishing-resistant authentication methods and enhanced session management controls.