4+ day, 17+ hour ago   (532+ words) KnowBe4 found hackers abusing trusted Google services to hide phishing pages that steal Microsoft credentials and enable persistent ScreenConnect remote access. A familiar Google address in a suspicious email may be exactly what attackers want you to trust. KnowBe4 Threat Lab uncovered…...

5+ day, 5+ hour ago   (610+ words) Researchers used AI to build WeWorm, a zero-click WeChat exploit that could hijack accounts through unanswered calls before Tencent mitigated the flaw. Security company Calif said it created a proof-of-concept worm that could hijack WeChat accounts on iPhones and Android…...

6+ day, 6+ hour ago   (404+ words) Fake Minecraft sites continue distributing WeedHack malware through SEO poisoning and trusted hosting platforms despite disruption of its original C2 infrastructure. Disrupting WeedHack’s command-and-control infrastructure did not stop its distribution. Fake Minecraft client sites and trusted hosting services continued serving the…...

1+ week, 3+ day ago   (623+ words) Coder’s compromised module registry served malicious Terraform modules that stole cloud, CI/CD, AI, and SSH credentials during a 14-hour attack window. Coder confirmed that an unidentified attacker compromised infrastructure supporting its module registry and served modified Terraform modules designed…...

1+ week, 2+ day ago   (710+ words) Google patched CVE-2026-85046, the sixth Chrome zero-day exploited in the wild in 2026. Here’s how to update your browser and stay protected. Chrome users have another actively exploited zero-day to worry about, and this one sits inside the engine that powers…...

1+ week, 6+ day ago   (695+ words) China-linked Fire Ant hackers compromised Cisco IOS XR routers, management hosts, and authentication systems to create covert paths into other networks. Compromising a server can expose one machine. Compromising the right router can give attackers visibility into an entire network....

1+ week, 6+ day ago   (546+ words) Infostealer malware is stealing authenticated Claude browser sessions, letting attackers access paid AI accounts and consume victims’ usage allowances. Anthropic is alerting users that threat actors are deploying commodity infostealer malware to hijack active, authenticated browser sessions, giving hackers unauthorized…...

2+ week, 3+ day ago   (389+ words) A global RMM phishing campaign is abusing trusted remote access tools across 46 countries, with US activity accounting for about 45%. Attackers are turning legitimate IT support software into a route for remote access. Because RMM tools are widely used by administrators…...

2+ week, 5+ day ago   (613+ words) Trust is becoming the attack surface. Today’s threats are exploiting everything from forgotten cloud credentials and convincing phishing lures to trusted software and nearby devices. Read past newsletters here. Thousands of Leaked AWS Keys Still Work Thousands of publicly exposed…...

3+ week, 4+ day ago   (417+ words) Several of the critical WebLogic Server flaws could allow remote attackers to compromise vulnerable systems without authentication. Several of the most critical fixes affect Oracle WebLogic Server, where remotely exploitable vulnerabilities could compromise business critical applications and sensitive data. CVE…...