17 casos · pág. 1/1
The Eclipse leak site has listed Taiwan Otsuka Pharmaceutical, a Taiwan-based pharmaceutical manufacturer, and claims to hold about 832 GB of internal company data. The victim page shows a countdown to a claimed publication deadline. The listing gives examples of allegedly stolen material across many business functions, including finance,…
Researcher Harsh Jaiswal of Hacktron describes using the AI-assisted Hacktron CLI with a custom "JDBC driver pack" to audit decompiled JDBC drivers during a bug bounty event. The audit surfaced multiple vulnerabilities across vendor drivers, earning $85,000 in bounties. The headline finding is in the Databricks JDBC driver, where an attac…
Symantec's Threat Hunter Team reports that new versions of the Aoki infostealer now target credential and session files used by AI coding assistants. Earlier versions focused on browser, cryptocurrency wallet and password manager data. Aoki is a relatively new and sparsely documented stealer, first observed earlier in 2026, and its AI-rel…
Cisco disclosed CVE-2026-76488, a medium-severity vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC). An authenticated remote attacker with valid administrative credentials could read sensitive files from the underlying file system of an affected device. The files include key ma…
Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the open-source AI gateway that sits between enterprise applications and providers such as OpenAI, Anthropic and Google. A user with minimal privileges could take full control of the gateway, read sensitive files, execute arbitrary code and harvest the provider API k…
The Citizen Lab disclosed AdFection, the first technical demonstration of zero-click mercenary spyware delivered through targeted online advertising. The Israeli firm Discover-Tech presents itself as a legitimate ad company but acts as a facilitator for several mercenary spyware partners, including Candiru. Its ads covertly direct million…
Recorded Future's Insikt Group tracks the actor behind the October 2026 AI-assisted intrusions into South Korean financial institutions as TAG-217. The group was testing infrastructure and assembling attack tools as early as August 2026, weeks before the campaign became public. South Korea's Financial Services Commission (FSC) disclosed t…
Researcher Pedro Cruz (Hakai Security / The Hacking Club) disclosed nine vulnerabilities in widely used server-side PDF generation libraries, with a combined footprint of over 90 million monthly installs. The cases range from RCE (ReportLab, ReLaXed) through arbitrary file read and SSRF (WeasyPrint, Browsershot) to DoS and file/directory …
In September 2026, researchers reported an attack that began inside a live AI coding assistant session at a software company. The attacker gained control of a developer's session, and the assistant recommended a PyPI package that looked normal. The developer installed it, and a hidden infostealer took source code, repository secrets and h…
Recorded Future's Insikt Group (report of October 16) tracks a suspected Chinese-speaking actor, TAG-217, linked to attacks on South Korean financial institutions. The actor used Claude Code, DeepSeek, Grok and Zhipu AI alongside ARTEX, an open-source Chinese-language AI penetration testing framework. Public reporting cited in the investi…
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud.com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS paylo…
Mandiant and GTIG attribute exploitation of the critical BeyondTrust Remote Support zero-day CVE-2026-102764 to Armory Castle (formerly tracked as UNC5221), a likely Chinese government-backed espionage group. BeyondTrust dates the first known exploitation to Aug. 29 and says it detected and contained the activity Sept. 28. Only a small nu…
SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The inves…
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malici…
The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…
