Find what you’re looking for
Browse everything
6,854 results in Threat Reports
Critical Alert: Chinese Threat Actors Actively Exploiting Zyxel and Veeam Vulnerabilities
CISA has added CVE-2026-7273, a stack-based buffer overflow vulnerability in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog following evidence of active exploitation by suspected Chinese threat actors. The attackers successfully compromised 996 Zyxel switches across 48 countries since August 2026, using crafted HTTP requests to execute operating system commands and deploy TFTP tools for data exfiltration. Simultaneously, Arctic Wolf reported active exploitation of CVE-2026-32996 in Veeam Agent for Windows, allowing local privilege escalation to SYSTEM-level access through manipulation of gRPC named pipe sessions. These incidents highlight the growing trend of threat actors rapidly weaponizing newly disclosed vulnerabilities to target network infrastructure and backup systems, emphasizing the critical need for immediate patch deployment and enhanced monitoring of privileged access controls in enterprise environments.
WordPress Comment2Shell: When Anonymous Comments Become Server Backdoors
In September 2026, WordPress patched a critical vulnerability (CVE-2026-93485) dubbed 'Comment2Shell' that allowed anonymous attackers to inject malicious scripts through comments. The flaw exploited a gap in WordPress's comment processing, where line breaks in HTML attributes could bypass sanitization and execute JavaScript when pages loaded. If an administrator viewed a compromised page, the script could leverage their elevated privileges to upload web shells and achieve remote code execution on the server. This vulnerability highlights the evolving sophistication of web application attacks targeting content management systems. As WordPress powers over 40% of websites globally, such zero-click exploits represent a significant threat vector for cybercriminals seeking to compromise web infrastructure at scale.
Critical D-Link Router Zero-Day Exposes Network Infrastructure to Immediate Exploitation
D-Link disclosed a critical zero-day vulnerability (CVE-2026-86296) affecting DIR-822A dual-band Wi-Fi routers in September 2026. The maximum-severity flaw stems from a stack-based buffer overflow in the DHCP server component, allowing unauthenticated attackers on the local network to send crafted DHCP packets and potentially achieve remote code execution. With public proof-of-concept exploit code available and no patch currently released, affected devices face immediate exploitation risk for botnet recruitment and DDoS attacks. This incident highlights the persistent threat landscape targeting legacy network infrastructure, particularly as threat actors increasingly weaponize published exploits to rapidly compromise unpatched devices for large-scale cybercriminal operations.
Meta Muse AI Assistant Vulnerability Exposes Critical Backdoor Risk in 2026
In September 2026, security researcher Patrick Wardle discovered a critical vulnerability in Meta's Muse AI assistant for macOS that allows attackers with existing system access to hijack the assistant and turn it into a backdoor. The flaw exploits an undocumented setting called 'endo_voyager_dictation_endpoint' that redirects voice dictation to attacker-controlled servers, enabling theft of authentication tokens, interception of user commands, and unauthorized access across all connected devices and services. Since Muse operates with broad permissions across files, email, calendar, and smart home systems, compromised instances provide attackers extensive access while appearing as legitimate application activity to security tools. This incident highlights the emerging security risks of AI assistants with extensive system permissions and cross-device synchronization capabilities. As organizations increasingly adopt AI agents for productivity and automation, the potential for these tools to become high-value attack vectors represents a significant shift in the threat landscape requiring new security considerations.
SideCopy APT Expands to Target Indian Academic Institutions with Advanced ReverseRAT Campaign
The Pakistan-linked APT group SideCopy has expanded its targeting beyond Indian government entities to include academic institutions through sophisticated spear-phishing campaigns in 2026. The threat actors utilize weaponized ZIP archives containing malicious LNK files that abuse mshta.exe to execute obfuscated HTML applications, ultimately deploying the ReverseRAT malware for data exfiltration and remote access. The attack chain employs multi-stage obfuscation, anti-forensic self-deletion routines, and encrypted command-and-control communications to evade detection while harvesting system metadata, credentials, and sensitive documents from compromised networks. This incident highlights the evolving threat landscape where state-sponsored groups are diversifying their target profiles to include educational institutions, recognizing their value as repositories of intellectual property and research data. The sophistication of SideCopy's techniques demonstrates the growing challenge organizations face in defending against adaptive APT groups that continuously refine their tradecraft.
Inside Real Google Workspace Breaches: OAuth Social Engineering Attack Analysis
Multiple Google Workspace environments have been compromised through sophisticated social engineering campaigns combined with malicious OAuth applications. Attackers bypassed traditional credential-based security by convincing users to authorize malicious applications, granting direct access to corporate Google Workspace data and services. These incidents demonstrate how threat actors exploit user trust and application authorization mechanisms rather than relying on stolen passwords or software vulnerabilities, resulting in significant data exposure and lateral movement across connected applications. These attacks highlight the growing trend of identity-centric compromise vectors as organizations increasingly adopt cloud-first strategies. With OAuth-based attacks rising 300% in 2026 and social engineering remaining the top initial access vector, enterprises face mounting pressure to implement zero-trust controls that verify application legitimacy and user intent beyond simple authentication.
EvilTokens PhaaS Platform Disrupted After Compromising 12,000 Microsoft Accounts
In September 2026, Microsoft's Digital Crimes Unit successfully disrupted the EvilTokens phishing-as-a-service platform that had compromised over 12,000 Microsoft accounts across 10,000+ organizations since February 2026. The platform specialized in device-code phishing attacks that bypassed multi-factor authentication by abusing OAuth 2.0 device authorization flows, targeting wholesale distribution, construction, financial services, healthcare, and education sectors. Two suspected administrators were arrested in the UK, though the threat remains active with affiliates creating clone platforms. This incident highlights the escalating sophistication of phishing-as-a-service operations and the growing threat of device-code authentication abuse, which has seen a 37x surge in attacks as cybercriminals adopt AI-powered tools for enhanced targeting and evasion.
Check Point Zero-Day Attack: How CVE-2026-93616 Compromised Enterprise Security Infrastructure
Check Point Software released emergency hotfixes in September 2026 to address CVE-2026-93616, a critical path traversal vulnerability in Security Management Servers that allows unauthenticated attackers to upload and execute arbitrary scripts. The company confirmed active exploitation against multiple customers, with attackers leveraging the flaw to gain unauthorized access to centralized security management infrastructure that controls enterprise network policies and logs. This represents the latest in a series of Check Point zero-day exploitations targeting critical infrastructure components. This incident highlights the growing trend of threat actors targeting network security management platforms as high-value entry points into enterprise environments, reflecting an evolution toward infrastructure-level attacks that bypass traditional perimeter defenses.
NPM Indexed-BTRee Malware: How Attackers Evolved Beyond Install Scripts
In June 2026, threat actors deployed a sophisticated supply chain attack through the malicious npm package 'indexed-btree,' which mimicked the legitimate 'sorted-btree' package. Unlike traditional attacks that rely on install scripts, this campaign embedded malware directly within application runtime code, specifically in the BTree.prototype.set() method. The malware performed host fingerprinting, communicated via Slack and Telegram channels, and used the EtherHiding technique to retrieve encrypted payloads from Ethereum smart contracts. The campaign generated approximately €230,933 in cryptocurrency profits and affected millions of downloads before removal. This incident demonstrates how attackers are rapidly adapting to npm's version 12 security controls that restrict automatic execution of lifecycle scripts. The shift toward runtime-based malware delivery represents a significant evolution in supply chain attack methodologies, requiring defenders to implement layered security controls beyond traditional install-time scanning.
ClosedQuorum Malware: The Dawn of Fully Autonomous AI-Driven Cyber Attacks
ClosedQuorum represents a significant evolution in malware automation, utilizing multiple AI models including Google Gemini, DeepSeek, Qwen, and Mistral to make autonomous tactical decisions during post-compromise operations. Discovered by Cisco Talos researchers in September 2026, this Go-based Windows malware operates without human operator commands, using AI voting systems to determine actions like credential theft, process injection, and persistence mechanisms. The malware demonstrates complete attack chain automation, exfiltrating stolen credentials through Discord webhooks while eliminating the need for real-time human oversight. This incident marks the emergence of AI-driven autonomous malware operations, coinciding with increasing concerns about AI integration in cybercriminal activities and the need for enhanced detection capabilities against machine-speed attacks that can operate continuously without human intervention.
ShinyHunters Targets FBI: Zero-Day PeopleSoft Attack Exposes Government Cloud Vulnerabilities
In September 2026, the ShinyHunters extortion gang claimed to have breached FBI systems using a zero-day vulnerability in Oracle PeopleSoft, allegedly accessing FBI-managed AWS GovCloud infrastructure and stealing 2-3TB of sensitive data including employee and job applicant information. The threat actors defaced the FBI Jobs website and claimed access to Criminal Justice, HR, and Medlink services before the FBI quickly took affected systems offline. ShinyHunters stated the attack was retaliation against an FBI FLASH report published in May 2026 that detailed the group's activities and demanded corrections within one week. This incident highlights the growing trend of threat actors targeting government infrastructure through supply chain vulnerabilities and using high-profile breaches as leverage against law enforcement agencies. The exploitation of zero-day vulnerabilities in enterprise applications like PeopleSoft demonstrates the critical need for enhanced security measures in government cloud environments.
Chinese State-Sponsored Hackers Exploit WordPress and ZyXEL Flaws in Massive Government Data Theft Campaign
A Chinese-speaking threat actor linked to the Red Heron group conducted a sophisticated multi-vector campaign from June to August 2026, exploiting critical vulnerabilities in WordPress Core (CVE-2026-63030, CVE-2026-60137) and ZyXEL GS1900 switches (CVE-2026-7273) to breach government and business organizations across 48 countries. The attackers compromised 996 devices and exfiltrated over 18,500 sensitive records containing government personnel data, law enforcement information, and plaintext credentials through advanced reconnaissance and database infiltration techniques. This incident highlights the growing sophistication of state-sponsored threat actors who leverage publicly available exploits within days of their release to target critical infrastructure and government entities. The campaign's timing coincided with increased geopolitical tensions and demonstrates how adversaries rapidly weaponize disclosed vulnerabilities to achieve strategic intelligence objectives.