Find what you’re looking for

North Korean WaterPlum Campaign: How Fake AI Job Offers Led to $11M Cryptocurrency Heist

North Korean threat actors operating under WaterPlum (aka Contagious Interview) have compromised over 30,000 devices across 100+ countries by posing as legitimate AI, cryptocurrency, and NFT company recruiters targeting software developers and IT professionals. The campaign, linked to North Korea's 313 General Bureau, uses fake job opportunities to deliver malware and establish persistent access for cryptocurrency theft and data exfiltration. The operation has successfully stolen approximately $11 million in cryptocurrency from over 7,000 wallets while maintaining extensive overlap with broader North Korean IT worker infiltration efforts. This incident highlights the evolution of North Korean cyber operations beyond traditional state-sponsored espionage toward systematic financial crime integrated with legitimate IT workforce infiltration, representing a new paradigm where threat actors blend cybercriminal activities with long-term economic penetration strategies.

Scattered Spider Core Member Pleads Guilty to Multi-Million Dollar Cryptocurrency Theft Spree

Ahmed Hossam Eldin Elbadawy, a 24-year-old Texas resident and core member of the Scattered Spider cybercrime group, pleaded guilty to wire fraud conspiracy and aggravated identity theft charges in December 2023. Operating from 2021 to 2023, Elbadawy and his co-conspirators used social engineering tactics to compromise credentials at major companies across entertainment, telecom, technology, and cryptocurrency sectors. The group targeted high net worth individuals with virtual currency accounts, successfully stealing over $8.6 million in cryptocurrency, including individual thefts of $6.35 million, $571,000, and $1.7 million. Prosecutors are seeking forfeiture of over $17.6 million in Bitcoin and Ethereum, plus luxury assets including vehicles, watches, and designer goods. This case highlights the continued evolution of financially motivated cybercrime groups like Scattered Spider, which has grown to thousands of members despite law enforcement actions against early leaders. The group's sophisticated social engineering techniques and focus on cryptocurrency theft represent a persistent threat to organizations holding digital assets.

Critical Check Point Vulnerability Exposes Management Systems to Root Access Attacks

Check Point Software disclosed CVE-2026-91843, a critical stack-based buffer overflow vulnerability affecting Security Management Server and Log Server systems that allows unauthenticated attackers to execute code with root privileges. The flaw stems from improper input validation in the login process and can be exploited remotely without user interaction in low-complexity attacks. While not yet exploited in the wild, this vulnerability follows a pattern of recent Check Point security issues, including two other critical RCE flaws (CVE-2026-85103 and CVE-2026-85102) patched the same week and two authentication bypass zero-days actively exploited by ransomware groups since mid-2026. This incident highlights the escalating threat to network security infrastructure as attackers increasingly target management platforms that control entire security ecosystems, potentially compromising organizational defenses at their core control points.

Rapuncel Infostealer Campaign Exploits Fake GitHub Repos to Bypass Security

In September 2026, cybercriminals launched a sophisticated malware campaign using SEO-optimized fake GitHub repositories impersonating LastPass and 39 other legitimate software companies. The attack delivers the previously undocumented Rapuncel infostealer along with a Microsoft-signed kernel driver capable of disabling 145 antivirus and EDR products. Victims searching for popular software like LastPass Authenticator are redirected through malicious GitHub repos to download ZIP archives containing the malware, which steals credentials from 25 browsers, 30 cryptocurrency wallets, and sensitive documents while maintaining persistence across system reboots. This incident highlights the growing sophistication of supply chain attacks targeting trusted development platforms like GitHub, demonstrating how threat actors exploit SEO manipulation and legitimate code-signing certificates to bypass security controls and establish persistent access to victim systems.

Four Linux Kernel Flaws Enable Root Access: The AI-Assisted Vulnerability Era Begins

In September 2026, security researcher Asim Manizada disclosed four Linux kernel vulnerabilities that enable local privilege escalation to root access. The flaws, dubbed DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, affect various networking components and were discovered using AI-assisted vulnerability research techniques. While kernel maintainers have patched all vulnerabilities, the public release of working exploit code significantly raises the risk for systems running outdated kernels, particularly in multi-user environments where attackers seek to escalate from limited user accounts to full administrative control. This disclosure represents a concerning trend of AI-accelerated vulnerability discovery in critical infrastructure components. As threat actors increasingly adopt similar AI-assisted techniques for offensive purposes, the time between vulnerability discovery and exploitation continues to shrink, demanding faster patch deployment cycles and enhanced kernel hardening strategies across enterprise environments.

WordPress Click2Shell Vulnerability: How a Simple Link Click Leads to Server Compromise

WordPress patched a critical vulnerability called Click2Shell in September 2026 that allows attackers to force automatic theme installation through specially crafted URLs. The flaw exploits differences in how WordPress.org directory and administrator browsers parse the same link, enabling attackers to trigger theme installations when logged-in administrators click malicious links. When chained with secondary vulnerabilities in installed themes, the attack escalates to remote code execution with a CVSS score of 9.6. The vulnerability affects WordPress versions 6.0 through 7.1.0, with fixes released in version 7.1.1 across all supported branches back to 4.7. This incident highlights the growing trend of attackers targeting content management system vulnerabilities that can be chained together for maximum impact, particularly as WordPress powers over 40% of websites globally and remains a high-value target.

Gyazo Breach Exposes 23.6 Million Users: Server Vulnerability Leads to Massive Data Theft

On September 11, 2026, attackers exploited a server vulnerability in Gyazo's image-sharing platform to steal 23.6 million user records and 490 million image metadata entries. The breach exposed names, email addresses, password hashes, session IDs, and private image metadata including EXIF location data and OCR-extracted text. Gyazo detected the intrusion on September 12 and took the platform offline for maintenance, but the damage was already done with attackers potentially accessing private images and sensitive user information. This incident highlights the growing trend of attackers targeting cloud-based media platforms and the critical importance of server hardening as organizations increasingly rely on image-sharing services for business communications and collaboration.

OAuth Consent Abuse: The SaaS Security Threat That MFA Can't Stop

OAuth consent abuse represents a growing threat vector where attackers bypass multifactor authentication by exploiting legitimate authorization flows in SaaS and cloud environments. Threat actors send convincing links that lead users to real OAuth authorization screens, requesting permissions for seemingly harmless applications like productivity connectors or reporting tools. Once users approve these requests, attackers gain persistent API access to email systems, file repositories, source code, and business platforms without needing passwords or deploying malware. The attack leverages trusted domains and legitimate OAuth processes, making it difficult for traditional security tools to detect malicious activity occurring through approved APIs. This attack method is particularly relevant now as organizations increasingly rely on SaaS platforms and cloud-based workflows, creating more opportunities for OAuth-based persistence. The technique highlights critical gaps in authorization governance, where security teams focus heavily on authentication controls like MFA while overlooking post-login consent decisions that can grant extensive third-party access to enterprise data.

FamousSparrow's Latin America Campaign: When Cyber Espionage Meets Geopolitical Competition

In July 2025, the Chinese APT group FamousSparrow pivoted to exclusively target Latin American government organizations using a new custom backdoor called SparroWocky. The campaign focuses on countries with significant Chinese Belt and Road Initiative investments including Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The group deployed sophisticated evasion techniques including stack spoofing, in-memory execution, encrypted C2 communications, and Beacon Object File compatibility to maintain persistent access while monitoring government responses to US pressure on Chinese regional influence. This incident represents the new reality of cyber espionage in geopolitical competition, as nation-state actors increasingly use targeted surveillance to gain strategic intelligence about economic and political developments that affect their global investments and sphere of influence.

First Documented AI Agent Cyberattack Targets Spanish Organization in 2026

In September 2026, a Spanish organization reported to Spain's Data Protection Agency (AEPD) that an attacker used an autonomous AI agent powered by a well-known language model to breach corporate personal data stores. The AI system discovered and exploited loose credentials and an enterprise application vulnerability, enabling the modification of personal data records and unauthorized access to corporate invoices. This represents one of the first documented cases of an agentic AI conducting an end-to-end cyberattack with minimal human oversight, demonstrating the AI's ability to chain vulnerabilities and accelerate attack timelines. This incident marks a paradigm shift in cybersecurity threats, as predicted by Spain's National Cryptologic Center earlier in 2026. The use of autonomous AI agents in cyberattacks is rapidly becoming mainstream, fundamentally changing the threat landscape by enabling continuous, machine-speed reconnaissance and exploitation without traditional human-paced decision points.

Iran's Handala Hack Weaponizes Telegram for Sophisticated Surveillance Operations

The Iran-linked threat actor Handala Hack, operating under Iran's Ministry of Intelligence and Security (MOIS), has been attributed to a sophisticated Telegram-based surveillance campaign using the HEAVYGRAM backdoor and CRUDEEXCLUDE utility. Active since September 2023, this operation targets Iranian dissidents, journalists, and opposition groups through social engineering on messaging platforms like Telegram, WhatsApp, and Instagram. The malware masquerades as legitimate applications and establishes persistent command-and-control channels via Telegram, enabling comprehensive surveillance including file exfiltration, screenshot capture, microphone activation, and credential theft. This incident highlights the growing trend of state-sponsored actors leveraging popular messaging platforms for covert operations, demonstrating how encrypted communication channels can be weaponized for intelligence collection while evading traditional detection methods.

Critical Privilege Escalation Flaw Exposes ABB Industrial Edge Computing Platforms

ABB disclosed CVE-2026-31431 (Copy Fail), a critical Linux kernel vulnerability affecting ABB Ability Edgenius edge computing platforms versions 3.2.0.0 through 3.2.4.1. The vulnerability, with a CVSS score of 7.8, stems from incorrect resource transfer in the Linux kernel's cryptographic subsystem and allows locally authenticated users or compromised container workloads to escalate privileges to root access. Once exploited, attackers gain complete system control over industrial edge computing infrastructure deployed globally across critical manufacturing, energy, water, and chemical sectors. ABB has released version 3.2.4.1 to address the vulnerability and recommends immediate patching. This incident highlights the growing attack surface of edge computing in industrial environments, where kernel-level vulnerabilities can provide attackers with deep system access to compromise operational technology networks and critical infrastructure control systems.