/

Últimas ameaças

1.086 casos · pág. 11/55

unit42.paloaltonetworks.com · medium

BUGSTER actor uses jailbroken Hermes Agent and DeepSeek V4 for credential theft, VoIP fraud planning and Wi-Fi cracking, hitting Indian universities

Unit 42 analyzed the operational environment of a previously unreported, financially motivated, English-speaking actor using the handle BUGSTER. The actor ran the Hermes Agent framework with DeepSeek V4 as its reasoning engine and the Cursor IDE as a secondary tool, with safety controls disabled in both. With AI-generated scripts and reco…

securityaffairs.com · · 8 fontes · 8 atualizações medium

DHS orders federal civilian agencies to remove DeepSeek products and third-party tools built on them, and bars new purchases under FASCSA

The Department of Homeland Security (DHS), under Secretary Markwayne Mullin, has issued an order under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). It directs federal civilian agencies to stop buying and to remove products and services from Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates. It a…

gbhackers.com · · 3 fontes · 3 atualizações medium

Check Point: AI-integrated antidetect browsers Kameleo, AdsPower and MultiLogin scale account takeover, fraud and influence operations

Check Point Research reports that commercial antidetect browsers, notably Kameleo, AdsPower and MultiLogin, are widely referenced on Russian-language underground forums and marketplaces. They are used for account takeover, payment card fraud (carding), fraudulent loan applications, ad-revenue fraud, bulk creation of fake accounts and coor…

securityweek.com · medium

Rapid7 Q3 2026: High-severity flaws exploited in 3 days on average, ransomware dominates, AI limited to 8% of incidents

Rapid7's Q3 2026 threat landscape report finds that high-severity vulnerabilities were exploited an average of three days after disclosure, with 71% exploited within the first seven days. 79% of them are classed as 'holy grail' flaws, meaning remote and needing no credentials or user interaction. Ransomware remains the dominant threat. Th…

securityweek.com · · 2 fontes · 2 atualizações high

Google Chrome 156 fixes 353 vulnerabilities, including six critical memory corruption and use-after-free flaws

Google promoted Chrome 156 to the stable channel for Windows, macOS and Linux on October 20, 2026, fixing 353 vulnerabilities, six of them critical (gbhackers.com, securityweek.com). The critical flaws are five memory corruption bugs and one use-after-free in Accessibility. Most of the 353 are memory safety issues: 163 memory corruption b…

bleepingcomputer.com · high

ClickFix surges to 52% of Push detections, with fake AI tool lures (InstallFix, LLMshare) delivering malware via search ads

ClickFix and its variants (FileFix, InstallFix, TerminalFix, ConsentFix) are now the most common browser-based attack technique seen by Push Security. They averaged 52% of Push detections through Q2 2026 and reached 67% in August, overtaking AiTM and device code phishing. The newest lures impersonate AI tools: ANY.RUN linked 1,258 public …

industrialcyber.co · medium

Resilience claims analysis: ransomware drives ~70% of energy-sector cyber losses; MFA bypass and exposed OT controllers widen exposure

Resilience's report Cyber risk in energy and utilities analyzes cyber insurance claims filed between Jan. 1, 2023 and Sept. 5, 2026. Email compromise made up 21% of energy and utilities claims, against 10% across the rest of the portfolio. Ransomware was only 9% of claims but about 70% of incurred losses including reserves. In several cas…

industrialcyber.co · low

Singapore CSA and Google tabletop exercise sets safeguards and access controls for autonomous AI agent risks

The Cyber Security Agency of Singapore (CSA) and Google convened policymakers, critical infrastructure leaders and AI safety experts on Oct. 14 at Singapore International Cyber Week 2026. The tabletop exercise examined security risks from increasingly autonomous AI agents that act at machine speed. Participants concluded that perimeter de…

industrialcyber.co · low

GAO Strategic Plan 2027-2032 sets congressional oversight of federal cybersecurity, critical infrastructure and AI risks

The U.S. Government Accountability Office (GAO) published its Strategic Plan 2027-2032, which sets out how it will support congressional oversight of federal cybersecurity, critical infrastructure protection and emerging technology risks. The plan cites persistent cyber threats, evolving national security risks and advances in artificial …

wired.com · · 2 fontes · 2 atualizações high

GhostShares: Meta Muse AI share links expose ~6,800 private chats via passive DNS; Meta suspends sharing

Researchers at Claroc disclosed GhostShares, a design flaw in Meta's Muse AI assistant that lets anyone discover shared conversations through passive DNS. Muse share links use the domain cf.metaaiusercontent.com and embed the conversation title and a random identifier in the hostname. Once a browser resolves the name, passive DNS sensors …

infosecurity-magazine.com · medium

Nord Security: 2,894 ransomware attacks in Q3 2026, up 50% YoY, led by rival groups The Gentlemen and Qilin

Nord Security reports 2,894 ransomware attacks between July and September 2026, a 50% increase year over year and an 8.6% rise over Q2 2026. Researchers attribute the rebound to the market stabilizing after law enforcement takedowns of LockBit, BlackCat and RansomHub, which suppressed activity during 2025. The Gentlemen (383 attacks) narr…