Find what you’re looking for
Browse everything
6,877 results in Threat Reports
Unveiling 'ShieldBreak': A New Zero-Day Threat in Microsoft Defender
In August 2026, security researcher Nightmare Eclipse disclosed a zero-day vulnerability named 'ShieldBreak' in Microsoft Defender, allowing attackers to escalate privileges to SYSTEM level on fully patched Windows 10, Windows 11, and Windows Server systems. This exploit leverages a user-mode callback hook during a Defender cloud-hydration scan via the Cloud Filter API (cfapi), effectively bypassing the previous 'RoguePlanet' patch (CVE-2026-50656). The proof-of-concept demonstrated a 100% success rate on tested systems. This incident underscores the persistent challenges in securing endpoint protection platforms and highlights the need for continuous vigilance and rapid response to emerging threats. Organizations must reassess their security postures, especially concerning privilege escalation vulnerabilities, to mitigate potential risks associated with such exploits.
Signal Introduces Automatic Key Verification to Strengthen Chat Security
In August 2026, Signal introduced Automatic Key Verification, a feature designed to enhance user security by automatically verifying the integrity of encrypted conversations. This system employs trusted third-party auditors to ensure that public encryption keys associated with user accounts remain consistent and unaltered, thereby mitigating the risk of man-in-the-middle attacks. Users can enable this feature through the app's privacy settings, providing a seamless method to confirm secure communications without manual safety number verification. The implementation of Automatic Key Verification addresses the growing concern over sophisticated interception techniques targeting encrypted messaging platforms. By automating the verification process, Signal aims to bolster user confidence and maintain the platform's reputation for robust security in an era where digital communication threats are increasingly prevalent.
Urgent: Microsoft SharePoint CVE-2026-55040 Exploited in the Wild
In July 2026, a critical vulnerability identified as CVE-2026-55040 was discovered in Microsoft SharePoint's JWT token validation pipeline. This flaw allowed unauthenticated attackers to impersonate any SharePoint user, including administrators, by bypassing authentication mechanisms. Microsoft addressed this issue in their July 2026 Patch Tuesday updates, urging organizations using SharePoint Enterprise Server 2016 and SharePoint Server 2019 to apply the patches promptly. The urgency of this patch was underscored when, shortly after its release, proof-of-concept exploit code became publicly available and was actively used in attacks targeting unpatched SharePoint servers. This rapid weaponization highlights the critical need for organizations to maintain up-to-date security measures and promptly apply patches to mitigate emerging threats.
Unmasking the Threat: North Korean IT Worker Impersonation in 2026
In July 2026, the U.S. Department of State issued an alert regarding North Korean IT workers impersonating foreign nationals to secure remote employment with U.S. companies. These operatives utilized falsified identities, AI-generated profiles, and deepfake technologies to bypass standard hiring processes. Once employed, they exfiltrated sensitive data, including source code and proprietary information, and funneled salaries back to North Korea, thereby circumventing international sanctions and funding the regime's activities. This incident underscores the evolving sophistication of social engineering tactics in cyber threats. The integration of AI and deepfake technologies into these schemes highlights the urgent need for organizations to enhance their identity verification and remote hiring protocols to prevent similar infiltrations.
Lazarus Group's Operation Dream Job: Exploiting Windows Zero-Day to Target Defense Firms
In July 2026, the North Korean state-sponsored Lazarus Group exploited a Windows zero-day vulnerability (CVE-2026-68820) to target defense-sector companies in Europe and India. This vulnerability, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys), allowed attackers to escalate local privileges to SYSTEM level. The group utilized this exploit in their Operation Dream Job campaign, delivering malicious payloads through fraudulent recruitment offers to employees in defense, aerospace, and aviation organizations. The attacks led to unauthorized access, data exfiltration, and deployment of advanced malware, including the FudModule rootkit and the Troy backdoor, compromising sensitive military technologies such as surveillance sensors, drones, and robotics. This incident underscores the persistent threat posed by nation-state actors leveraging zero-day vulnerabilities to infiltrate critical sectors. The Lazarus Group's continued evolution in tactics, including the use of sophisticated malware and exploitation of legitimate web infrastructure, highlights the need for organizations to adopt proactive cybersecurity measures, such as timely patch management, employee training on social engineering tactics, and robust network monitoring to detect and mitigate such advanced persistent threats.
FBI Issues Warning on Rising Sextortion Threats Targeting Online Accounts
In August 2026, the FBI issued a public service announcement warning that cybercriminals are targeting both adults' and children's online accounts to steal sexually explicit images and videos. These attackers gain unauthorized access through methods such as phishing, social engineering, and exploiting weak passwords. Once obtained, the explicit content is used to blackmail victims, sold on criminal marketplaces, or shared with other malicious actors, leading to further exploitation and harassment. This incident underscores a growing trend in cyber threats where personal and sensitive data are exploited for financial gain and coercion. The increasing sophistication of these attacks highlights the urgent need for enhanced cybersecurity measures, public awareness, and proactive defense strategies to protect individuals from such exploitation.
Critical Adobe Commerce Vulnerability CVE-2026-71362: Immediate Action Required
In August 2026, a critical vulnerability (CVE-2026-71362) was identified in Adobe's Commerce and Magento platforms, allowing unauthenticated attackers to hijack customer accounts. The flaw, stemming from improper handling of customer identity in session management, enabled unauthorized access to sensitive customer data. Security firm Sansec reported active exploitation attempts, emphasizing the urgency for immediate patching. This incident underscores the persistent threat posed by web application vulnerabilities, highlighting the necessity for robust session management and prompt application of security updates to protect customer information and maintain trust.
Hundreds of Fake Chrome VPN Extensions Compromise User Security
In August 2026, researchers uncovered a campaign involving over 737 malicious Chrome browser extensions that impersonated reputable VPN services such as Proton VPN, NordVPN, and ExpressVPN. These extensions, downloaded nearly 75,000 times primarily by Russian users, rerouted all browser traffic through SOCKS5 proxies controlled by a single operator. This setup allowed the threat actor to monitor users' browsing activities, including destination URLs and any unencrypted data transmitted over HTTP. The extensions employed deceptive tactics, including advertising non-existent premium server locations and using misleading disclosures to evade detection. Despite Google's removal of over 200 of these extensions, more than 500 remained available in the Chrome Web Store at the time of discovery. This incident underscores the persistent threat posed by malicious browser extensions and highlights the need for vigilant scrutiny of browser add-ons. Users are advised to verify the authenticity of extensions before installation and to regularly review and manage their browser's proxy settings to prevent unauthorized data interception.
Understanding the 'Plug and Pwn' Attack: A New Threat to Windows Systems
In August 2026, security researchers unveiled the 'Plug and Pwn' attack, exploiting Windows' Plug and Play feature to gain SYSTEM privileges by emulating USB devices. By presenting fake USB hardware, attackers could trigger Windows to install vulnerable vendor software automatically, leading to unauthorized access. Notably, some attack vectors required no user interaction or physical device connection, utilizing Remote Desktop Protocol (RDP) to achieve the same outcome. This method underscores significant vulnerabilities in Windows' device installation processes, potentially allowing attackers to execute arbitrary code with elevated privileges. The 'Plug and Pwn' attack highlights the evolving sophistication of hardware-based exploits and the critical need for organizations to reassess endpoint security measures. As attackers increasingly leverage legitimate system functionalities for malicious purposes, it becomes imperative to implement stringent device installation policies and monitor for anomalous hardware behaviors to mitigate such threats.
Lazarus Group's Operation Dream Job: Exploiting Windows Zero-Day to Deploy 'Troy' Backdoor
In August 2026, the North Korean state-sponsored Lazarus Group exploited a zero-day vulnerability, CVE-2026-68820, in the Windows Ancillary Function Driver for WinSock (AFD.sys) to target defense and aerospace companies across France, Germany, Brazil, and India. Utilizing their 'Operation Dream Job' campaign, they lured professionals with fake job offers, leading victims to download malicious PDFs or trojanized PDF viewers. This method facilitated the deployment of a new backdoor named 'Troy,' granting the attackers remote access and control over compromised systems. The campaign's sophistication underscores the persistent threat posed by Lazarus Group to critical industries worldwide. This incident highlights the evolving tactics of nation-state actors in leveraging zero-day vulnerabilities combined with social engineering to infiltrate high-value targets. Organizations must remain vigilant, ensuring timely patching of vulnerabilities and educating employees about the risks of unsolicited job offers and phishing attempts.
Android Malware Exploits NFC to Commit Financial Fraud
In August 2026, cybersecurity firm Group-IB uncovered a sophisticated Android malware campaign combining the SpyNote Remote Administration Tool (RAT) and WindRelay NFC relay malware. Attackers impersonated bank employees, convincing victims to install a malicious app granting remote access. Utilizing SpyNote, they installed WindRelay, transforming the device into a fraudulent contactless reader to capture and relay credit card data, enabling unauthorized transactions. This operation, executed within a 13-minute phone call, resulted in unauthorized loans and financial losses for victims. This incident underscores a significant escalation in mobile malware sophistication, particularly in exploiting NFC technology for financial fraud. The seamless integration of remote access tools with NFC relay capabilities highlights the evolving tactics of cybercriminals, emphasizing the need for heightened vigilance and advanced security measures to protect against such multifaceted threats.
City-Forum Data Theft Attacks: A Wake-Up Call for SaaS Security
In August 2026, a data theft campaign named 'City-Forum' was identified, targeting misconfigured Salesforce Experience Cloud and ServiceNow customer portals. The attackers exploited overly permissive sharing rules and portal configurations, allowing unauthorized access to sensitive data through anonymous guest accounts. The campaign, traced to the IP address 158.220.87.79 associated with the domain city-forum.com, has been active since at least March 2025, affecting various sectors including telecommunications, finance, enterprise software, and public services. The 'City-Forum' attacks underscore the critical importance of securing SaaS platforms against unauthorized access. Organizations must review and tighten guest-user permissions and sharing settings to prevent data exposure. This incident highlights a growing trend of cybercriminals exploiting misconfigurations in widely used platforms, emphasizing the need for continuous monitoring and proactive security measures.