Brazil crime group Slim Spider drains wallets through cloud key theft
CrowdStrike details Slim Spider, a Brazil-based group stealing crypto custody secrets from financial clouds.
The Latest
SAP patches CVSS 10 OVERPASS kernel bug reachable without credentials
SAP patches OVERPASS, a CVSS 10 kernel bug that lets unauthenticated attackers run commands on SAP hosts.
Planted prompt turned ChatGPT into a hidden Gmail relay
Check Point shows a planted instruction can make ChatGPT exfiltrate Gmail data through a covert channel between accounts.
China’s AI labs stole frontier know-how at industrial scale, US says
NSA, CISA and FBI accuse China-based AI labs of industrial-scale distillation of US frontier model capabilities.
PoisonedRefresh rootkit keeps F5 web shells invisible to disk scans
A fileless rootkit dubbed PoisonedRefresh injects PHP web shells into the memory of compromised F5 BIG-IP APM appliances.
WeWorm proves an unanswered WeChat call can hand over an account
Researchers built a zero-click worm, dubbed WeWorm, that takes over WeChat accounts through incoming calls before Tencent's August fix.
Google fixes in-the-wild V8 bug as Chrome zero-day count hits seven
Chrome 153 closes an out-of-bounds write in V8 that Google says is exploited in the wild, the browser's seventh zero-day…
Microsoft tops 974 fixes in record Patch Tuesday drop
September's Patch Tuesday set a record with 974 fixes, two exploited zero-days and a cluster of potentially wormable bugs.
Largest LGBTQ dating app closes UK suit with £26M payment
Grindr will pay £26M to settle a British lawsuit over pre-2020 data sharing with third parties, including HIV status information.
AI models become ransom bait as thieves threaten to leak them
Google's newest AI Threat Tracker says extortion crews are stealing proprietary AI models and research, then demanding payment to keep…
Bing poisoners push crypto miner behind phony tech support pages
The DFIR Report traces BengalSEO, an India-based search poisoning operation that has steered Bing users into scams and a miner-dropping backdoor since 2015.
BigBear 2.0 phishing panel reveals thousands of stolen Microsoft sessions
CloudSEK says it reached the admin panel of a phishing service holding thousands of session cookies stolen from Microsoft 365…
Bookmarks add-on hides a backdoor that crosses the browser sandbox
SOCRadar details PEEP, a post-compromise toolkit that rides a fake bookmarks extension from the browser out to host-level command execution.
Red Hat identity stack opens anonymous path to admin credentials
Two flaws chained together let a FreeIPA client that has never logged in plant a Kerberos identity into the administrators…
Spotlight
Conde Nast user trove from 32.8 million accounts goes for $15,000
A Russian-language forum seller is offering what analysts call a genuine 32.8 million-account Conde Nast database tied to December's WIRED leak.
Bitcoin sidechain loses $320M to self-proclaimed white hats
Nearly all of the Bitcoin backing Blockstream's Liquid sidechain has been drained, with the responsible hackers promising to return it once a fix ships.
Zero-day hunter adds Avast and Nvidia bugs to a CrowdStrike streak
Nightmare Eclipse adds Avast and Nvidia zero-day exploits to its CrowdStrike drop, and Gen says the Avast bug is fixed.
Check Point cracks JSCeal’s V8 shell to expose Google session replay
Check Point's static deobfuscation exposes JSCeal, a compiled V8 malware family that replays stolen cookies into Google accounts.
Features
N-central zero-day claims split N-able’s advisories as hotfix four ships
N-able's fourth N-central hotfix closes a CVSS 10 pre-auth RCE while its own advisories disagree on whether it is already…
Telerik UI exploit goes public for a chain Progress fixed in July
TantoSec's public tool turns a Telerik UI padding oracle into unauthenticated code execution for shops that skipped the July patch.
Tech support scams turn ScreenConnect into a worm that jumps hosts
Three August lures ended in rogue ScreenConnect clients that spread a four-stage VBScript chain to every new host.
Airport operator refuses ransom, extortionists dump 8.8M records
FulcrumSec dumped MAG airport customer data after the operator refused a ransom, exposing 8.8 million people.
JetBrains’ own Cadence cloud fell to an unpatched TeamCity flaw
JetBrains tells Cadence users to rotate all credentials after attackers breached its own cloud via unpatched TeamCity.
Dormant German wiki hosted 18,000 secret posts from OpenAI agents
Researchers say OpenAI agents left roughly 18,000 posts on a dormant German wiki while coordinating on timed tasks.