Find what you’re looking for
Browse everything
6,854 results in Threat Reports
Massive Infostealer Campaign Exposes Thousands of AI Service Tokens, Bypassing MFA Protection
In August 2026, cybersecurity researchers analyzed a 7GB infostealer dump containing data from 5,871 infected machines across 162 countries, revealing thousands of unexpired authentication tokens for AI services including Google, OpenAI, Anthropic, and others. Information stealers like Lumma Stealer and Vidar harvested session tokens, API keys, and JSON Web Tokens (JWTs) that threat actors can replay to bypass credential-based authentication and multi-factor authentication, effectively gaining unauthorized access to premium AI services without traditional login processes. The stolen data included 555 AI-related JWTs and 2,937 encrypted tokens, with 17.7% containing plaintext personally identifiable information, enabling account takeovers, resource theft, and unauthorized AI service usage sold on underground markets. This incident highlights the growing cybercriminal focus on AI credential theft as premium model access costs create strong financial incentives for stealing rather than purchasing legitimate access, while the proliferation of anti-detect browsers and session replay tools makes monetizing these stolen tokens increasingly accessible to threat actors.
Critical Vulnerability in Lean Theorem Prover Enables Fabrication of Mathematical Proofs
Trail of Bits researchers discovered a critical vulnerability in Lean 4 theorem prover versions up to 4.33.1 that allowed fabrication of mathematical proofs through string manipulation exploits. The flaw in String.Pos.Raw.extract function created inconsistencies between logical definitions and compiled native code, enabling attackers to manufacture contradictions and prove false theorems, including a bogus proof of Fermat's Last Theorem. This supply-chain vulnerability affects the integrity of formal verification systems used in critical software development and mathematical research. This incident highlights the emerging risks in AI-assisted code generation and formal verification tools as they become integral to software supply chains. With increasing reliance on theorem provers for security-critical applications, vulnerabilities in these foundational tools pose systemic risks to mathematical proofs and software verification processes.
StyleSmuggler Attack: How CVE-2026-75650 Exposes Critical E-Commerce Security Gaps
In September 2026, Adobe disclosed CVE-2026-75650, dubbed 'StyleSmuggler,' a critical remote code execution vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source platforms. The vulnerability, scoring a maximum CVSS of 10.0, allows unauthenticated attackers to inject PHP code through Magento's email template engine and execute arbitrary commands by triggering payment failure reminder emails. Active exploitation began on September 4, 2026, with threat actors deploying Rust-based Linux backdoors and PHP web shells on compromised e-commerce storefronts worldwide. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog within 24 hours of disclosure, emphasizing the severity and widespread targeting of unpatched Magento installations. This incident highlights the critical security risks facing e-commerce platforms as attackers increasingly target template injection vulnerabilities in widely-deployed content management systems. With millions of online stores running vulnerable Magento versions and the rise of automated exploitation frameworks, organizations must prioritize rapid patching and comprehensive security monitoring for their web applications.
Inside CL-CRI-1171: The Massive Pay-Per-Install Network That Hid in Plain Sight
In September 2026, Unit 42 researchers uncovered CL-CRI-1171, a sophisticated pay-per-install (PPI) malware distribution network that operated undetected for over two years. The cybercrime group leveraged YouTube gaming channels with hundreds of thousands of followers and SEO poisoning techniques to distribute multiple malware families including Insomnia RAT, ARKTunnel, and Docro Hijacker. The operation used OfferLoader, a custom Inno Setup-based loader, to deploy over 10,000 distinct payload combinations across corporate networks, critical infrastructure, and government entities while evading detection through clever gating mechanisms and unremarkable appearance. This campaign highlights the growing threat of commodity infrastructure being weaponized for large-scale malware distribution, particularly as threat actors increasingly target younger demographics through gaming platforms and use legitimate-seeming tools to bypass security scrutiny.
CIA's Operation Absolute Resolve Showcases Cyber Intelligence as Mission-Critical Capability
CIA Deputy Director Michael Ellis revealed that Operation Absolute Resolve, which led to the apprehension of Nicolás Maduro, was enabled by cyber intelligence operations conducted by the agency's Center for Cyber Intelligence. The mission demonstrated how the CIA has reorganized to place cyber operations at the center of intelligence collection, allowing U.S. special operations forces to locate and capture the target within four minutes of landing. The operation reportedly included cyberattacks that caused power outages during the mission, showcasing the integration of cyber capabilities with traditional field operations. This disclosure highlights the evolving role of cyber intelligence in modern military and intelligence operations, as nation-state actors increasingly rely on digital capabilities to support kinetic operations and achieve strategic objectives in contested environments.
Russian National's $6.3M Bank Account Takeover Scheme Exposes Critical Security Gaps
In November 2023, Russian national Sergei Anatolyevich Filimonov orchestrated a sophisticated bank account takeover scheme that defrauded financial institutions of over $6.3 million. The operation involved creating spoofed banking domains, purchasing sponsored search links to redirect victims, and harvesting over 5,000 customer login credentials. The cybercriminals specifically targeted accounts with large balances, including those belonging to corporate employees in Georgia, and built infrastructure to bypass multi-factor authentication and other security controls. This case exemplifies the growing sophistication of financially motivated cybercriminals who combine social engineering, domain spoofing, and credential harvesting to target high-value accounts. The FBI's identification of $28 million in total attempted losses demonstrates the massive scale these operations can achieve.
Chinese AI Giants Caught in Massive U.S. Model Distillation Campaign
In 2024, Chinese AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI engaged in systematic distillation of U.S. frontier AI models according to a joint advisory from NSA, CISA, and FBI. The companies spent billions of tokens across millions of exchanges with models like Claude, ChatGPT, Google Gemini, and xAI's Grok to extract proprietary capabilities and strengthen their domestic AI systems. The attackers used sophisticated evasion techniques including distributed accounts, proxy networks, third-party aggregators, and gray market access to circumvent geographic restrictions and detection mechanisms. This incident highlights the growing threat of AI-enabled economic espionage as artificial intelligence becomes central to national competitiveness, with state-sponsored actors leveraging legitimate AI APIs for large-scale intellectual property theft through automated distillation campaigns.
Microsoft's Record-Breaking Patch Tuesday: Managing 974 Vulnerabilities in the AI Era
Microsoft released its largest-ever Patch Tuesday update in September 2026, addressing 974 vulnerabilities across its product suite, including two actively exploited zero-day vulnerabilities. The massive security update included CVE-2026-81963 affecting the Windows Update Stack and CVE-2026-85880 affecting Windows Advanced Local Procedure Call, both enabling privilege escalation attacks. Microsoft's use of AI-assisted vulnerability discovery has dramatically increased the volume of disclosed vulnerabilities, with over 100 rated as critical across Windows, Office, SQL Server, and developer tools. Despite the record-breaking number of vulnerabilities, security researchers noted that active exploitation rates have not increased proportionally. This incident highlights the growing challenge organizations face in vulnerability management as AI-driven discovery tools uncover more security flaws at an unprecedented pace. The massive patch volume reflects broader industry trends where automated security research is creating larger attack surfaces while simultaneously improving defensive capabilities through faster identification of potential weaknesses.
Microsoft's Record-Breaking Windows 10 Security Update: 966 Vulnerabilities Patched
Microsoft released Windows 10 KB5122878 as part of the September 2026 extended security update program, addressing a record-breaking 966 vulnerabilities including two actively exploited zero-day flaws. This update targets Windows 10 Enterprise LTSC users and ESU program participants, bringing systems to build 19045.7725 with critical security patches, Secure Boot certificate improvements, and fixes for Remote Desktop audio redirection issues. The massive patch release underscores the ongoing security challenges facing legacy Windows environments as Microsoft phases out mainstream support. This update highlights the critical importance of extended security programs as organizations struggle to migrate from Windows 10 amid escalating cyber threats and the growing attack surface of unpatched legacy systems.
PoisonedRefresh Rootkit: Advanced Threat Targets F5 BIG-IP Infrastructure
In September 2026, security researchers discovered a sophisticated Linux rootkit campaign targeting F5 BIG-IP APM devices. Attackers exploited CVE-2025-53521, a critical remote code execution vulnerability, to deploy the 'PoisonedRefresh' rootkit that injects fileless web shells directly into memory. The malware intercepts PHP file operations, modifies scripts in memory without altering disk files, and creates password-protected backdoors while maintaining persistence across system upgrades. This advanced attack demonstrates the evolution of infrastructure targeting, as threat actors increasingly focus on critical network appliances that provide extensive access to organizational traffic and systems. With 795 vulnerable endpoints still exposed online, this incident highlights the urgent need for robust patch management and enhanced monitoring of network infrastructure devices.
Slim Spider's Cloud-Native Attack on Brazilian Financial Infrastructure Exposes Critical Security Gaps
In March 2026, the Brazil-based threat actor Slim Spider executed a sophisticated multi-stage attack against a Brazilian financial institution, targeting cryptocurrency custody secrets and instant payment infrastructure. The attackers leveraged custom Bash scripts to steal temporary cloud credentials, enumerated secrets in cloud credential managers, and deployed backdoors mimicking legitimate infrastructure binaries. They successfully infiltrated managed Kubernetes clusters via Azure DevOps, deployed malicious pipelines, and created automated panels for bulk Pix payment fraud. The campaign resulted in the compromise of multiple Brazilian banks and fintech organizations, with devastating potential for cryptocurrency wallet theft and unauthorized financial transactions. This incident represents a critical shift in cybercrime tactics, as threat actors increasingly demonstrate sophisticated cloud-native attack capabilities specifically targeting high-value digital financial assets and instant payment systems across Latin America.
DoppelCart Fraud Network Exposes Massive E-Commerce Security Gap
In September 2026, cybersecurity researchers discovered DoppelCart, the largest documented fake e-commerce network comprising over 119,000 fraudulent domains, primarily using the .SHOP TLD. The operation impersonates 44,182 legitimate brands by copying product catalogs and branding, then uses WebSocket connections to steal payment card data, CVV codes, and personal information in real-time during checkout. The network affects 2.72% of all .SHOP domains and significantly surpasses previous operations like BogusBazaar's 75,000 sites, with over 105,000 shops remaining active at discovery. This incident highlights the evolving sophistication of financial fraud networks and their ability to operate at unprecedented scale through automated domain generation and brand impersonation, representing a critical threat to consumer trust and e-commerce security.