Chick-fil-A has confirmed that over 13,000 customers had their accounts breached in a wave of credential stuffing attacks targeting its website and mobile app between June 17 and June 19. […]
Chick-fil-A data breach affects more than 13,000 customers Read More »
Slopsquatting, phantom squatting, and HalluSquatting all exploit the same late-binding attack pattern, where AI coding agents trust hallucinated package, repo, or domain names. ActiveState explains how pre-fetch verification and governed dependency management can help stop these attacks before malicious code enters the pipeline. […]
Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack Read More »
Europol has flagged 4,340 URLs for removal during a multi-week operation targeting online content linked to “The Com,” a loosely organized network of nihilistic violent extremist groups. […]
Europol flags 4,340 URLs for removal in ‘The Com’ crackdown Read More »
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand’s Ministry of Finance, which runs the country’s treasury and tax collection. The agent then worked through the ministry’s network on its own, checking hosts for ways to
Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry Read More »
The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings. The malware families in question are: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and a modified web browser credential
Golden Chickens Resurfaces With Four New Malware Families and Modular Implants Read More »
Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software’s source code. Every version before 4.14.0 is affected. NodeBB has fixed them all, and administrators
NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats Read More »
Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis says the underlying memory flaws may lead to remote
Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Read More »
The Clop ransomware gang (also tracked as Cl0p) is targeting Internet-exposed PTC Windchill and FlexPLM instances in a new data theft extortion campaign. […]
Clop ransomware targets Windchill, FlexPLM in data theft attacks Read More »
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign that involves the use of a malicious program that’s dressed up as a Notepad++ plugin to compromise Windows systems. The activity has been attributed by the agency to a threat cluster it tracks as UAC-0099, a Russia-aligned group that has previously
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks Read More »
A new Dolphin X remote access trojan claims to use an AI-powered profiling feature to score and rank infected users, helping cybercriminals identify which victims should be targeted first. […]
New Dolphin X malware uses AI to rank high-value targets Read More »