Claude Mythos is the first model reported to complete a cyber kill chain without step-by-step human direction. The finding does not describe malware or a confirmed victim breach. It is a controlled test, but shows how quickly autonomous attack capability is advancing.

The concern is speed. The model found weaknesses, entered a defended enterprise network, collected credentials, raised privileges, moved between systems and reached domain administrator control.

Those are stages defenders try to interrupt during an intrusion. GitHub hosts projects and discussions using the Claude Mythos name, but did not identify a malware campaign.

The finding comes from Booz Allen’s assessment of autonomous models. It is a benchmark result, not evidence of a named program independently attacking organizations.

Booz Allen said in a report shared with Cyber Security News (CSN) that it tested 18 U.S. and Chinese models as autonomous attackers against a production-grade enterprise network. Researchers used network and host telemetry to measure actions, rather than accept model claims.

Claude Mythos AI Autonomously Executes Full Cyber Kill Chain

The Cyber Weapon Index gave Claude Mythos an 80 score, combining 74 for vulnerability research and 86 for kill-chain attainment.

It was the only model assessed as reaching the final objective. Researchers said it moved from a stolen employee credential to administrator-level control in every credentialed attempt.

The harder scenario began with no credentials. The report says Claude Mythos penetrated from outside and worked out how to raise its access, instead of following a fixed plan.

The reported autonomous AI agent breach illustrates why this development has drawn attention. The test examined whether models could spot weaknesses in compiled software without source code.

Only frontier Anthropic models identified the previously unseen flaw used in testing, and only Claude Mythos reportedly exploited it. The result is from a defined setting, not proof of universal performance.

Other models showed progress without matching the full outcome. Four reached domain access and control, four achieved lateral movement, and two reached credential access.

All but one penetrated the network autonomously. An attacker need not finish every stage alone to cause disruption or give a human operator a head start.

Defenders face a speed problem

The report argues that risk lies in the entire AI system, not only its model. An attack harness can link a model with tools, memory, feedback and an execution environment.

This helps an agent retain context, recover from errors and connect tasks, as seen in agents breaching company networks.

A model that stops short alone can become more effective with automation, tailored prompts and operational tools. The report found that a harness paired with Claude Sonnet could rival Claude Mythos. A public model score, therefore, can leave serious blind spots.

The likely entry routes are familiar: exposed services, unpatched flaws, stolen credentials and weak access controls.

AI reduces the time and expertise needed to test options, analyze results and adapt. AI agents rebuilding attack tools illustrate how persistence after failure can amplify this advantage. The recommended response is to assume an initial foothold and restrict what happens next.

Organizations should connect vulnerability management, detection, containment and response; enforce least privilege, strong identity checks, segmentation and isolation of high-value systems; and test containment while keeping services running.

Teams should test safeguards in deployed configurations, including tool permissions and autonomy levels. The report recommends continuous measurement of models and surrounding systems, plus controlled access for vetted defenders to reproduce threatening behavior.

This exceeds paper compliance when attack methods change quickly. The headline is not that an AI model has become a criminal actor. A controlled assessment found one system capable of completing a realistic sequence of offensive tasks.

The gap between early access and full compromise may be narrowing, making patching, identity protection and segmentation urgent. Related AI-driven government system breaches show why coordinated automation needs preparation.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Claude Mythos AI Autonomously Executes Full Cyber Kill Chain Without Human Guidance appeared first on Cyber Security News.

A new intrusion campaign shows how quickly a Windows domain can be turned into a launchpad for deeper compromise. The operators used a Sliver command-and-control beacon, account creation, credential theft and remote administration to establish control after gaining an initial foothold.

The activity was staged from an exposed server and aimed at one unnamed US organisation. Its scripts were built for a real Active Directory environment, including a planned rollout across 18 hosts, while the recovered material contained no proof that ransomware was deployed in this specific incident.

Analysts at The Hunter’s Ledger identified the operation as a high-risk post-exploitation toolkit and tracked it as UTA-2026-024.

The research ties the infrastructure to a confirmed ransomware incident, but does not name the people behind this intrusion or conclude that they deployed an encryptor.

The Hunter’s Ledger said in a report shared with Cyber Security News (CSN) that the operators combined ordinary public tools with unusually detailed knowledge of the victim’s network.

The result was a durable access package designed to disable safeguards, steal credentials and keep its control channels available.

Hackers Disable Endpoint Protection

After entering the domain, the operators scripted the creation of an Active Directory account with a non-expiring password and added it directly to Domain Admins.

They also created a local administrator, enabled Remote Desktop Protocol access, and turned off Network Level Authentication, expanding the paths available for later movement.

The scripts stopped and disabled eight services associated with the victim’s endpoint protection product, then checked each service state.

They also collected the SAM, SYSTEM and SECURITY registry hives for offline password cracking, while a separate LSASS memory dump and Mimikatz supplied additional routes to credentials.

A central concern is the campaign’s persistence. Scheduled tasks ran as SYSTEM, used forged author details and included backdated registration dates.

One weekly task downloaded the latest attack chain without saving a fixed payload, a tactic similar to remote scheduled task delivery in EtherRAT attacks.

The team also manipulated the victim’s DNS content filter through its administrative interface. It added the attackers’ domain to an allowlist and placed a matching record in internal DNS, making the domain resolve internally and pass the same security control intended to block it.

This approach mirrors a broader pattern in Windows intrusions, where trusted administrative features become the delivery system after access is obtained.

Recent reporting on fake installer campaigns disabling Defender also showed attackers using installer workflows and scheduled tasks to weaken controls before maintaining access. In both cases, the danger is not a single tool but the sequence of actions surrounding it.

Blockchain C2 Complicates Response

Alongside Sliver, the toolkit used a Node.js implant that obtained its command server from an Ethereum smart contract.

The first domain recorded in that contract was the same one inserted into the victim’s DNS configuration, directly connecting the two seemingly different parts of the operation.

The contract changed domains five times over five months, making simple domain blocks short-lived. Yet the contract itself stayed unchanged and publicly readable, giving defenders a better tracking point.

The related beacon also contacted its main server every 60 seconds with no measured timing variation, a useful signal for network hunting.

The recommended response is to reset credentials across the affected domain, not solely for known accounts; review privileged-group additions and SYSTEM tasks; restore the DNS allowlist; rotate the filter administrator password; and remove planted internal DNS entries.

Teams should also look for RDP enabled with Network Level Authentication disabled and monitor the contract for later C2 changes. Security teams should favor behavior over broad signatures for public tools.

Baseline scheduled tasks, alert on fileless download commands running as SYSTEM and review sudden endpoint-protection service changes.

Readers examining related Windows tradecraft can compare Sliver implant activity targeting Germany and ransomware SYSTEM task abuse, which show how familiar components can be chained into an enterprise-wide incident. The pattern deserves sustained, careful attention.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain appeared first on Cyber Security News.

A proof-of-concept zero-click worm dubbed “WeWorm” that it says can spread through WeChat voice calls on both iOS and Android, compromising a target’s WeChat account in seconds without the victim answering the call.

Calif says the bug was reported to Tencent in July and that Tencent has since mitigated the exploit for users, but the research still serves as a stark warning about how mobile messaging apps can become wormable attack surfaces at planetary scale.

WeChat is not a niche target. Tencent says Weixin and WeChat together exceeded 1.4 billion monthly active users as of the end of Q1 2026, while WeChat’s own site describes the platform as serving over 1 billion users with chats and calls across major mobile and desktop platforms.

That sheer reach is what makes Calif’s demonstration so alarming: a memory-corruption flaw in the app’s VoIP stack is not just another messaging bug, but a potential entry point into one of the world’s most deeply embedded communications ecosystems.

According to Calif’s public research listing, WeWorm is described as “the first zero-click worm to spread through WeChat calls across iOS and Android,” and it was published on September 8, 2026, as part of the company’s Android-tagged research work.

Calif frames the finding not as a theoretical edge case but as a live demonstration of how a trusted messaging relationship can be weaponized, with one compromised contact becoming the launch point for attacks against everyone in that person’s social graph.

The company’s demo chain reportedly used three phones to prove cross-platform propagation. A Pixel 10a was used as the initial attacker device, which then called an iPhone 17e and exploited the flaw while the call was still ringing; the compromised iPhone was then used to call another Pixel 10a, which was reportedly taken over in the same way.

In practical terms, that is the textbook definition of a wormable condition in a communications app: the attacker calls the victim, the victim becomes the attacker, and the infection path continues with almost no friction.

What makes the scenario especially dangerous is the “zero-click” aspect. Calif says the victim does not need to answer the call or interact with the phone at all for exploitation to succeed, and even if the person does answer, they hear nothing while the compromise still goes through.

That claim places WeWorm in the most feared class of mobile exploits, where normal user caution offers little protection because there is no malicious link to avoid and no attachment to reject.

Calif also says exploitation yields full control of the victim’s WeChat account, including the ability to read and send messages, place calls, and act on the user’s behalf inside the app.

On its own, account takeover at that level would already be severe for identity abuse, surveillance, fraud, and lateral targeting; chained with additional device-level bugs, Calif says the same access could be extended to full control of the underlying Android or iOS device.

The company specifically links that possibility to its broader AI-assisted exploit research, including Android work such as OEMpocalypse, which it has presented as a path from app-level access to root on several vendor ecosystems.

One condition slightly narrows the attack surface: the attacker must already be on the victim’s friend list. But Calif argues that this is a weak barrier in real-world conditions because once a single trusted contact is compromised, that person’s account can be used to reach additional friends, turning the victim’s social trust network into the worm’s propagation layer.

That is a familiar and troubling pattern in modern communications security, where safety features and trust assumptions designed for convenience can become force multipliers once an adversary gets an initial foothold.

The technical root cause, Calif says, is a memory-corruption bug in WeChat’s VoIP stack, though the company is withholding full exploit details until a later conference presentation.

That restraint matters because memory-corruption flaws in real-time communications code are among the most sensitive bug classes in mobile security, especially when they sit inside call-handling paths that process network data before a user takes any action.

Calif further suggests that this bug is only one example of a broader class of “unconventional attack surfaces” spread across messaging apps, hinting that similar issues may exist in other platforms with rich calling and media features.

WeWorm may be a demo, but its significance is real. Calif has effectively shown that mobile messaging worms are no longer a distant nightmare or a plot device for conference talks; they are a practical research outcome in 2026, built against one of the world’s largest communications platforms and developed at AI speed.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post WeWorm – First 0-Click Worm Spreading Through WeChat Calls Across iOS and Android appeared first on Cyber Security News.

SAP has released its September 2026 Security Patch Day updates, delivering 19 new security notes and one update to a previously issued note.

The patches address vulnerabilities across SAP NetWeaver, SAP Extended Passport Processing, SAP Cloud Application Programming Model, SAP S/4HANA, SAP Integration Suite, SAP Commerce Cloud, and other enterprise products.

The most severe issue is CVE-2026-44756, a critical memory corruption vulnerability in SAP Extended Passport Processing, tracked under SAP Note 3747649. It carries a CVSS score of 10.0, the highest possible severity rating.

The flaw affects multiple SAP kernel and Web Dispatcher versions, including KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, and 9.16 through 9.20.

An unauthenticated remote attacker could potentially exploit the memory corruption flaw to compromise confidentiality, integrity, and availability. Organizations using affected SAP kernel components should treat this update as an emergency patching priority.

Another critical vulnerability, CVE-2026-58240, affects SAP NetWeaver Message Server. SAP Note 3759472 addresses a missing authentication check with a CVSS score of 9.8. The issue affects KERNEL versions 9.16, 9.18, 9.19, and 9.20.

Successful exploitation could allow an attacker without valid credentials to access or interact with exposed services, creating a serious risk to SAP environments.

SAP Security Updates September 2026

SAP also fixed CVE-2026-76969, a critical credential disclosure vulnerability in multitenant applications using the SAP Cloud Application Programming Model library sap/cds-mtxs.

The flaw has a CVSS score of 9.4 and affects versions up to 1.18.3, 2.7.6, 3.9.6, and 4.0.2. Developers and cloud administrators should update affected dependencies quickly, especially where they handle tenant data and application credentials.

A fourth critical issue, CVE-2026-66768, impacts SAP GUI for Java in SAP NetWeaver. The improper access control vulnerability, fixed by SAP Note 3781729, has a CVSS score of 9.0. It affects BC-FES-JAV 8.10 and could allow a low-privileged attacker to gain unauthorized access after user interaction.

The September release also includes high-severity fixes, including CVE-2026-76958, an 8.5-rated XXE flaw in SAP Integration Suite Trading Partner Management that could expose sensitive files, enable server-side requests, or disrupt XML processing.

SAP patched insecure deserialization in SAP NetWeaver Business Client, memory corruption in SAP NetWeaver Application Server for ABAP and ABAP Platform, and CRLF injection in SAP Commerce Cloud Search and Navigation.

The company also released an update for CVE-2026-58243, a high-severity privilege escalation flaw in SAP ABAP Developer Tools originally addressed during the August 2026 Patch Day.

Medium-severity fixes cover SQL injection, server-side request forgery, clickjacking, cross-site request forgery, information disclosure, authorization bypass, and Apache Log4j-related security misconfiguration issues. SAP also patched a low-severity denial-of-service flaw in the SAP Process Integration SOAP Adapter.

SAP administrators should review all relevant security notes in the SAP Support Portal, map them to deployed product versions, test patches under change-control procedures, and apply the fixes as soon as possible.

Internet-facing SAP services, NetWeaver Message Server instances, cloud application dependencies, and systems processing sensitive business data should receive priority attention.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport appeared first on Cyber Security News.

The U.S. Department of State’s Rewards for Justice program has announced a reward of up to $10 million for information leading to the identification or whereabouts of Amir Yaryab, a senior figure in Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC).

U.S. officials allege that Yaryab oversees the command’s Cyber Operations Command, managing cyber units responsible for attacks on critical infrastructure across the U.S., Europe, and the Middle East.

This reward is part of broader efforts to combat malicious cyber activities targeting U.S. critical infrastructure, as outlined under the Computer Fraud and Abuse Act.

U.S. Offers $10 Million Reward

Yaryab is said to lead various components within the IRGC-CEC known as Shahid Hemmat and Shahid Shushtari, both involved in cyber and cyber-enabled information campaigns against multiple sectors, including defense, telecommunications, energy, and finance.

U.S. authorities have linked Yaryab to several IRGC-affiliated groups, including CyberAv3ngers and Dadeh Afzar Arman (DAA), which have been implicated in malware incidents and assaults on civilian infrastructure worldwide.

This recent announcement has intensified scrutiny on the Iranian cyber command, especially as operational technology systems remain vulnerable to internet-based threats. The alert correlates with past warnings about CyberAv3ngers targeting industrial control systems.

A joint advisory issued by CISA, the FBI, NSA, EPA, and international collaborators revealed that IRGC-connected actors began compromising Israeli-made Unitronics Vision Series programmable logic controllers (PLCs) in late 2023. These devices are essential in various sectors, including water treatment, energy, transportation, and healthcare.

Reports indicate that between November 2023 and January 2024, CyberAv3ngers initiated multiple waves of attacks against U.S. based Unitronics PLCs, compromising at least 75 devices, 34 of which were in the U.S. water and wastewater sector.

The attackers primarily targeted internet-exposed devices that used default passwords or lacked password protection. The cyber offensive was not merely a matter of defacement; it involved altering the ladder logic within PLCs, which directly manage the operations of physical devices such as pumps and valves.

Unauthorized changes could disrupt essential functions, and attackers also tampered with device names, software versions, and remote access credentials, complicating recovery efforts.

Moreover, in some incidents, individuals responsible for these attacks replaced human-machine interface (HMI) displays with messages asserting responsibility and threatening Israeli-made equipment. This interference can obstruct plant operators from accessing crucial operational data.

CyberAv3ngers’ activities highlight the significant risks to critical infrastructure posed by weak operational technology security. When attackers compromise PLCs, they can take control of critical industrial processes, leading to potentially disastrous consequences.

In response, organizations operating PLCs and HMIs are urged to mitigate risks by identifying and eliminating devices directly exposed to the public internet. Strong password policies, multifactor authentication, and other security measures should be enforced.

For those using Unitronics Vision Series PLCs, CISA recommends updating engineering workstations and firmware to the latest versions and securing remote access through VPNs and firewalls.

Additionally, maintaining updated asset inventories and monitoring for unusual activities can help prevent such cyber threats. The ongoing activities of CyberAv3ngers underscore the urgent need for robust cybersecurity measures in industrial systems to defend against state-aligned adversaries seeking to disrupt critical services.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks appeared first on Cyber Security News.

Panzer ransomware has entered Italy amid a sharp rise in attacks. The ransomware-as-a-service, or RaaS, operation surfaced on August 5 and listed a kitchen manufacturer in Treviso and a telecommunications engineering firm in Catanzaro among its alleged victims.

The group advertises tools for Windows, Linux, FreeBSD, and VMware ESXi systems. An attack on a virtualization host can disrupt many business applications at once, turning one compromised server into a wider outage.

Panzer posted victims across 11 countries and the campaign arrived as claimed ransomware incidents in Italy reached 212 by September 6, above the 169 recorded during all of 2025.

Researcher Andrea Fortuna said in a report shared with Cyber Security News (CSN) that the Panzer’s victim posts should still be treated carefully.

Doimo Cucine and NTE Italia had not publicly confirmed the incidents when the report was published, but their listing may be a credibility-building tactic.

Panzer Ransomware Targets Italian Manufacturers

Panzer stands out less for a publicly examined encryptor than for the business system surrounding it. Prospective affiliates reportedly apply through Tox, face screening, and receive access to a dashboard for builds, negotiations, payment invoices, leak posts, and team accounts.

The stated split gives affiliates 80 percent of each payment and the platform 20 percent. Operators also claim to monitor new affiliates for signs of researcher or law-enforcement access, showing a controlled recruitment process.

Its ESXi option is particularly serious for manufacturers and telecom providers that run core workloads as virtual machines.

An intruder who reaches a hypervisor could encrypt multiple virtual disks and halt dependent services, rather than affecting a single employee device.

Reporting on VMware vCenter attack techniques illustrates how control of virtualization infrastructure can become a direct path to ransomware deployment.

Panzer also appears to pair encryption with data theft. The group claimed 30 GB of stolen data from Doimo Cucine and 16 GB of sensitive documents from NTE Italia.

Backups may restore systems, but they do not remove the pressure created by a threatened data leak or potential reporting duties. Researchers have not independently confirmed Panzer’s first access method or publicly analysed payload.

Available assessments instead associate the operation, with limited confidence, with password attacks, credential theft, remote-service movement, local data collection, security-tool tampering, and data transfers over alternative protocols.

Possible entry routes include vulnerable internet-facing VPN or gateway devices, exposed Remote Desktop Protocol services, phishing messages with malicious documents, and abused remote-management software.

The focus on exposed access points echoes reporting on RDP and VPN attack routes, where stolen credentials and unpatched perimeter systems open a route into internal networks.

Defending virtualized operations

Italian organizations should begin with remote access. Require phishing-resistant multi-factor authentication for VPN, remote administration, and privileged accounts; remove unnecessary privileges; and rotate credentials immediately when compromise is suspected.

Internet-facing appliances and remote-management tools also need prompt patching and regular exposure reviews.

Segmentation is equally important. Keep domain controllers, backup repositories, vCenter, and ESXi management interfaces away from everyday user networks.

Restrict administrative protocols to monitored management segments, so a compromised workstation cannot easily reach the systems that control an entire virtual estate.

Teams should watch for warning signs before encryption begins: unusual VPN logins, new administrator accounts, unexpected PsExec or WMI activity, unapproved remote-management tools, large archives in user or ProgramData folders, and unfamiliar cloud-transfer utilities.

A new ESXi ransomware campaign underscores why telemetry from hypervisors deserves the same attention as endpoint alerts.

Two commands deserve urgent attention when they appear unexpectedly on a server: vssadmin delete shadows and bcdedit recoveryenabled no.

They can remove recovery options, and responders should isolate the affected host, preserve evidence, and begin incident-response procedures rather than waiting for encryption.

Finally, maintain offline or immutable backups for every platform, including virtual machines, and test restorations routinely.

Monitor large outbound transfers, prepare legal and communications plans for double extortion, and ensure that recovery testing covers the applications and dependencies that keep production and telecom services operating.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS appeared first on Cyber Security News.

AI-powered customer service bots are being given more responsibility inside businesses, including access to customer profiles, billing data, support inboxes, account changes, and refund tools. The research showed that attackers may not need traditional vulnerability scanners or direct application exploitation.

Instead, they can manipulate the data and messages an AI agent receives, causing it to reveal sensitive information or perform actions as a legitimate customer.

One major risk involves chatbot transcript features. Many support bots let users email a copy of a conversation. An attacker could inject malicious text into a chat session and use the transcript function to create a phishing email that appears to come from a trusted support address.

If a customer receives a message from support@company.com, they may be more likely to trust it than a normal phishing attempt.

Email spoofing flaws can worsen the issue. Some AI agents identify users by reading the visible From header in an incoming email. However, email delivery and authentication systems may validate a different sender field.

An attacker could send an email that passes authentication using an attacker-controlled address, prompting the AI system to associate the message with a victim’s account.

AI Bots Tricked Into Stealing Security Codes

In one attack scenario, an AI customer service agent could receive a request that appears to come from a victim. The bot may then retrieve billing data, profile information, or account details.

If the attacker adds their own address to the CC or reply field, the bot could unintentionally send the confidential response to the attacker.

Security researcher Inti De Ceukelaire warned at Bug Bounty Village during DEF CON 34 that these capabilities can be abused through email tricks, prompt injection, identity confusion, and weak authentication checks.

The research also highlighted risks around multi-factor authentication. Some bots require a one-time passcode before making sensitive changes, such as updating a phone number.

But weak email normalization can sometimes allow attackers to reset rate limits by changing the format of an email address while still pointing to the same mailbox.

For example, different systems may treat comments, aliases, or unusual formatting in an email address differently. One component may recognize the address as belonging to the attacker.

At the same time, another backend service could parse embedded data differently and retrieve a victim’s account. This type of flaw is especially dangerous when raw user input is inserted directly into API requests.

AI agents connected to support inboxes can also expose third-party account codes. An attacker may first send an instruction designed to influence the bot’s behavior.

They could then trigger a legitimate password reset email from another service, such as a social media platform, to the company support inbox.

If the AI agent reads the incoming code and follows the earlier malicious instruction, it could forward or leak the code to attacker-controlled infrastructure.

Human approval does not always stop these attacks. A human operator and an AI agent may process different versions of the same email.

Attackers can use multipart messages, hidden HTML, CSS styling, quoted replies, or specially formatted attachments to present a harmless message to a human while exposing a malicious instruction to the AI system.

Knowledge-base poisoning is another growing concern. Customer service agents often use retrieval-augmented generation to answer questions from company documentation.

If a crawler indexes community comments, user profiles, or untrusted pages on the company domain, attackers may plant false instructions or fake discount codes that the AI treats as trusted internal information.

Organizations deploying AI support agents should strictly separate untrusted customer content from system instructions. They should authenticate users with verified session-bound identity controls, normalize email addresses consistently, validate all tool requests server-side, and prevent bots from sending secrets to unverified recipients.

AI agents should also have limited permissions. A chatbot that can read emails, modify accounts, issue refunds, and access third-party verification codes creates a high-value target. Businesses must treat AI agents as privileged automation systems, not just conversational interfaces.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post AI Customer Service Bots Can Be Tricked Into Stealing Security Codes and Acting as Victims appeared first on Cyber Security News.

BigBear 2.0 is a phishing operation designed to steal proof that a user has already passed multi-factor authentication.

It targets Microsoft 365 accounts through convincing sign-in links, then takes over the logged-in browser session rather than attempting to break the authentication factor.

The operation is a rebranded Evilginx2 phishing framework that targets Microsoft 365 accounts. Victims are drawn in through email links that open a proxy page resembling a Microsoft sign-in page.

It relays their traffic to the genuine service while quietly collecting credentials and the session data returned after sign-in.

CloudSEK analysts identified BigBear 2.0 in June 2026 after gaining access to its administrative panel. The researchers linked the activity to an operator using the alias General Boss and found a network of 42 virtual private server nodes.

CloudSEK said in a report shared with Cyber Security News (CSN) that the panel held 5,137 stolen records tied to 461 organizations and 3,331 unique victim IP addresses across more than 40 countries.

Of those records, 474 represented complete authenticated sessions, alongside 1,032 passwords and 4,148 session cookies. The records illustrate an operation that collects both immediate account access and material that may support persistent access later.

BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA

BigBear 2.0 uses an adversary-in-the-middle setup, meaning it sits between the victim and the real Microsoft login service.

It captures the email address and password, lets Microsoft validate the request, and waits for the victim to complete their normal approval or code challenge.

When sign-in succeeds, Microsoft sends an authenticated session cookie to the browser. Because the proxy handled the exchange, it can copy that cookie before forwarding the response.

The attacker can replay it in another browser and enter email, Teams, SharePoint, OneDrive, and connected single sign-on applications as the victim. Microsoft 365 session hijacking campaigns have reported the same account-takeover risk.

This is not a weakness in a one-time password, SMS code, or push notification by itself. These methods confirm the user during the live session, but the proxy steals the resulting proof. BigBear used country-matched residential proxies and scripts that pushed users away from security-key authentication.

The campaign particularly affected IT services and managed service providers, a concern because one compromised provider can offer attackers a route into customer environments.

At least five affiliates were linked to the panel. Phishing kits targeting organizations show this service-based model is spreading.

Containing identity compromise

Organizations should treat a suspected stolen cookie as an identity incident, not merely a password problem. Reset affected passwords, revoke active sessions and refresh tokens, and force a new sign-in for impacted accounts.

Teams should examine mailbox forwarding rules, OAuth consent grants, unfamiliar application access, and sign-in activity for evidence that a hijacked session was used after authentication. This review should begin as soon as suspicious activity is reported.

The most useful long-term control is phishing-resistant authentication, especially FIDO2 or WebAuthn security keys and passkeys where properly deployed.

These methods bind a login cryptographically to the genuine site, making a lookalike proxy far less useful. Passkey attack techniques nevertheless deserve ongoing attention.

Administrators should require compliant devices through Conditional Access, shorten session lifetimes where appropriate, and watch for unusual residential IP ranges or new browser sessions.

Email filtering should inspect links that imitate sign-in pages even when they use valid certificates. Teams can monitor for the distinctive headers and cookies listed below, because infrastructure can be reassigned.

For users, a familiar Microsoft page and successful MFA prompt do not always prove that a browser is connected directly to Microsoft.

Verify unexpected sign-in requests through a trusted bookmark or known application, not an email link. This concern is reinforced by Evilginx session-cookie attacks, which also depend on real-time relaying rather than stolen passwords alone.

The campaign combined cookie theft, geographic proxy matching, and affiliate access. MFA must be paired with phishing-resistant methods, session controls, and rapid token revocation.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft appeared first on Cyber Security News.

Kimsuky has been observed using an AI agent to produce convincing phishing decoys at scale, then hiding malware inside Windows shortcut files. The latest activity shows how ordinary-looking documents can become the first step in compromise.

The campaign begins with spear-phishing messages carrying ZIP archives. Inside is a malicious LNK shortcut disguised as a document, often with a browser-style icon and false details. When opened, it displays a decoy while silently launching PowerShell to fetch additional code.

The 13 samples examined were collected between August 11 and 19, 2026, and used financial and corporate lures. That wider range raises the risk for corporate staff who routinely receive paperwork and financial notices.

Genians researchers identified the activity as a continuation of the Kimsuky-linked Operation GitPower cluster. 

Genians said in a report shared with Cyber Security News (CSN) that the campaign retains GitHub-based command infrastructure while adding evasion and varied decoy formats.

Kimsuky Hackers Use OpenCode AI Agent

The most notable change is evidence of opencode in the Creator and Producer metadata of several PDF lures.

Four documents carried the same August 16 creation timestamp, while their Author field remained set to “anonymous,” supporting the assessment that they were produced automatically rather than assembled one at a time.

The documents were not uniformly polished. Some contained unreplaced placeholder text for payment dates, grace periods, and financial values, a sign that drafts were pushed into use without careful review.

Other PDFs showed HeadlessChrome and Skia/PDF metadata, suggesting a separate workflow that generated HTML content and rendered it into cleaner-looking PDFs.

That combination gives attackers speed without abandoning familiar social engineering. Analysts found 29 retrieved decoy files but only 11 unique documents by MD5, with duplicated content redistributed under randomized names.

Readers can see the earlier context in Kimsuky local LLM phishing lures, where AI-made files were already used to make shortcut-borne attacks appear routine.

Such artifacts can disappear as operators refine their process, so defenders should not use document quality or metadata alone as the test for whether an attachment is safe.

LNK Loaders Hide GitHub-Based Payloads

Every analyzed LNK file launched PowerShell, concealing an encrypted loader in arguments stretching roughly 5,800 to 9,500 characters.

About 300 leading spaces helped keep the command out of sight in the shortcut properties window, while excess padding inflated file sizes to frustrate simple inspection and some automated checks.

After decoding the hidden content, the loader downloads a decoy and a follow-on script from GitHub Raw Content using a hardcoded personal access token.

It then creates randomly named PowerShell files in AppData or Temp, starts PowerShell through conhost.exe --headless, and registers hidden scheduled tasks that impersonate BitLocker, MATLAB, or .NET components.

One Visa-themed variant also pulled code from Pastebin, giving the operators a second delivery route if GitHub access is blocked. The approach builds on North Korea GitHub C2 attacks, where trusted developer platforms were used to blend malicious traffic into ordinary web activity.

Newer variants check for virtual-machine and analysis tools, look for the username “Bruno,” and delete PowerShell command history when they detect a likely research environment.

They also use error documents in some incomplete builds, but the persistence and payload retrieval stages can still run. Comparable LNK PowerShell loader techniques show why opening a file that merely looks like a PDF is not a reliable safety check.

Organizations should quarantine unsolicited ZIP attachments containing LNK files, especially when their icons and descriptions do not match their real type.

Security teams should correlate LNK launches with long command lines, hidden PowerShell, newly created scripts, scheduled-task registration, GitHub Raw requests carrying unusual tokens, and Pastebin access.

This behavior-first approach is more durable than relying on a single domain blocklist or decoy document review, and aligns with lessons from malicious shortcut file campaigns.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Kimsuky Hackers Use OpenCode AI Agent to Mass-Produce Phishing Decoys in LNK Attacks appeared first on Cyber Security News.

South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access.

The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through compromised servers.

The operation appears designed for patience rather than disruption. Attackers likely entered through a groupware portal or mail server, used the edge server as a bridge into internal systems.

That pattern echoes the risks described in stealthy Linux server intrusions, where hidden access can remain active without drawing attention.

Analysts at Rapid7 identified the toolkit and assessed its link to DPRK-aligned advanced persistent threats with medium confidence.

Rapid7 said in a report shared with Cyber Security News (CSN) that the activity likely dates to early 2025, although the precise initial entry point and any exploited vulnerability have not been confirmed.

The affected organizations had ports 80, 443 and 25 exposed, with a groupware login service on port 443 and mail services on port 25.

These systems sit at the network edge, making their compromise serious: an intruder can collect credentials, move deeper inside, and potentially target visitors passing through that server.

DPRK-Linked Hackers Deploy Ted Backdoor

The central component, called ted backdoor, is a modified build of HAProxy 2.8.12, software commonly used to direct website traffic.

Instead of acting like a separate malicious program, it is compiled into the legitimate load balancer and uses its built-in features to inspect decrypted web requests while normal traffic continues to flow.

That placement gives the operators unusual control. The implant can capture session cookies and selected request details, run commands, upload or download files, and inject a malicious script into pages served to chosen visitors.

Its hidden command channel uses a request for a picture-like path, while its code also reduces HAProxy connection counters to make activity harder to spot. Researchers found an SSH keylogger as well as altered versions of crond, agetty, atd, sshd and polkitd.

The stager checks the operating system and whether HAProxy or cron is present before replacing the cron service, copying timestamps from a legitimate SSH binary, and removing chosen words from logs.

This reflects the same concern raised by Linux backdoors stealing SSH credentials: trusted system components can become the attacker’s hiding place.

CurlRAT supplies the remote-control layer. It polls attacker infrastructure for tasks, can execute commands, send system details, install added payloads, and open reverse or interactive shells with elevated privileges. A watchdog monitors HAProxy and reports whether the service starts, stops, reloads, or restarts.

Long-Term Espionage Risks and Defenses

Rapid7 said the combination of credential theft, web-session collection, selective page changes, and traffic redirection points to long-term espionage.

The targeting of South Korean media and automotive firms also fits a regional intelligence-gathering pattern. Readers following Kimsuky espionage activity in Korea will recognize why exposed groupware and stolen credentials remain valuable footholds.

The operators used basic XOR encryption and a substitution method to protect configurations and communications. Their command-and-control domains imitate image delivery services, including one that resembles a popular Korean web platform’s static-content naming style.

Rapid7 also noted overlap in timing and delivery concepts with other DPRK activity, but said more evidence is needed for a firmer attribution. Defenders should review edge systems that handle web traffic, encryption, mail, or runtime modules.

They should compare deployed HAProxy and Linux service binaries against known versions, inspect unexpected shared libraries and cron changes, and rotate credentials that may have passed through affected servers. Independent network monitoring matters because logs on a compromised device may have been altered.

Teams should also investigate unusual requests to image-like paths, unexpected outbound connections from load balancers, and web responses that change only for particular visitors.

Regular patching of groupware and mail servers reduces likely entry opportunities. As shown by recent Asia-focused Linux espionage, post-compromise tools can turn a single exposed server into a durable route across an organization.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post DPRK-Linked Hackers Deploy Ted Backdoor and CurlRAT Against South Korean Firms appeared first on Cyber Security News.

Roundcube Webmail has released security updates for its 1.6 LTS and 1.7 branches, fixing 12 vulnerabilities that could expose users and servers to cross-site scripting, email header injection, cross-user data access, remote-content bypasses, and server-side request forgery attacks.

The new releases, Roundcube 1.6.19 and 1.7.4, address flaws in how the open-source webmail platform processes email content, HTML, Cascading Style Sheets, attachment metadata, contact groups, and remote URLs. Administrators running production deployments of Roundcube 1.6.x or 1.7.x are urged to update as soon as possible.

One of the most serious issues fixed is a zero-click stored cross-site scripting vulnerability involving the injection of TNEF MIME tags into attachment URLs.

TNEF, or Transport Neutral Encapsulation Format, is commonly associated with Microsoft Outlook attachments. An attacker could potentially send a specially crafted email that triggers malicious script execution when the victim views the message, without requiring the user to click a link or open an attachment.

The updates also fix another XSS issue in Roundcube’s HTML editor when handling text/enriched email content. Cross-site scripting weaknesses can allow attackers to execute JavaScript in a victim’s webmail session, creating opportunities to steal session tokens, alter mailbox settings, read messages, or perform actions as the logged-in user.

Several fixes address email header injection risks. These bugs affected the subject field, recipient display name, and an identity’s organization field.

Header injection vulnerabilities can be abused to manipulate email metadata or insert unexpected mail headers if malicious input is not correctly sanitized.

Roundcube also patched a cross-user access issue in SQL-based address books. The flaw involved adding or removing members from contact groups.

It could allow one user to modify another user’s group associations under certain conditions. This type of issue can compromise contact privacy and the integrity of address book data in shared or hosted Roundcube environments.

Remote-content protections received multiple fixes, addressing CSS declaration smuggling, HTML body background property injection, CSS-escape bypasses in FuncIRI attributes, and SVG SMIL source animation techniques that could bypass remote-content blocking.

Roundcube Webmail Patches 12 Security Flaws

The updates further fix an is_local_url() validation bypass involving fully qualified domain names with a trailing dot in stylesheet URLs. Attackers could exploit differences in URL parsing to make an external resource appear local and bypass intended restrictions.

A server-side request forgery bypass was also resolved in the Roundcube CSS proxy. The weakness involved hexadecimal IPv6-mapped IPv4 addresses, which could potentially help an attacker bypass address validation and force the server to request internal or restricted network resources.

Roundcube said full technical details are available in the release notes for versions 1.6.19 and 1.7.4. The project strongly recommends that all organizations operating affected Roundcube installations apply the updates promptly.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Roundcube Webmail Patches 12 Security Flaws, Including Zero-Click XSS and SSRF Bypass appeared first on Cyber Security News.

A counterfeit Minecraft optimisation mod is installing Myth Stealer, malware that can steal browser passwords, cookies and data. Its malicious file looks useful because features work as advertised, giving players little reason to suspect a hidden threat.

The campaign exploits users seeking performance improvements from unofficial add-ons. Once installed, the fake mod starts a multi-stage infection chain that leads to a remote tool that lets its operator collect data and broadly control a Windows device.

Analyst devmihaylov identified the malware while examining samples obtained from a buyer of the commodity stealer.

devmihaylov said in a report shared with Cyber Security News (CSN) that the files initially received zero detections from VirusTotal, showing how lightly distributed threats can evade reputation-based checks.

Minecraft players remain frequent targets for malware distributors. Coverage of fake Minecraft Fabric mods showed how a harmless-looking game download can become the first step in account theft and compromise. The threat pairs a decoy with a loader designed to blend into a gaming setup.

Fake Minecraft Mod

The Java archive presents itself as a companion to a legitimate optimisation project and includes 12 working modules that change game performance settings.

A hidden thirteenth component waits briefly, gathers system information, then retrieves and starts the next stage in the background. That approach matters because victims may see the expected optimisation behavior and conclude the download is safe.

The loader uses a large executable built around a standard runtime and brings a private Java environment, letting the payload run even where Java is not otherwise installed.

Before launching the final stage, the program displays a polished administrator-rights request resembling a normal Windows prompt.

Accepting it can give the malware greater access and helps its installation. It also contains retry logic intended to cope with security software interrupting the process.

The final component is heavily disguised to slow investigation. Its code uses reserved Windows-style names, encrypted text and obstacles that can break basic extraction tools.

This concealment, combined with an apparently genuine mod, makes a quick visual check of a download an unreliable safeguard.

Credential theft and remote control

Myth Stealer targets data stored by Chromium-based browsers and Firefox, including saved usernames, passwords, browsing records and active session cookies.

Stolen cookies can be especially damaging because they may let an attacker reuse an already authenticated web session. Readers can see why browser passwords and cookies remain valuable targets in similar data-theft operations.

The malware also collects system details, chat content, clipboard data and files, can capture screenshots or webcam material.

Its remote-control features include running commands, downloading or deleting files, managing processes and setting itself to start again after a reboot.

Researchers also found functions that could disrupt a victim. These include changing display settings, interfering with the mouse or keyboard, showing misleading full-screen messages and attempting to restrict access to security tools.

They can complicate recovery and pressure users to follow an attacker’s instructions. The operation used web-based reporting channels to receive stolen information, a technique documented in coverage of Discord webhook abuse across other malware campaigns.

Although the analysed command infrastructure was no longer responding when reported, inactive servers do not erase the risk to systems already infected.

Players should obtain mods only from trusted project pages, confirm the developer and file integrity, and avoid downloads promoted through chat links, videos or unofficial file-sharing pages.

This echoes guidance from reporting on trojanized Minecraft mod downloads, where social engineering is central to reaching players.

Anyone who installed a suspicious mod should remove it, run a full security scan and change passwords from a clean device.

They should also sign out of important accounts to invalidate sessions, review browser extensions and look for unfamiliar programs that start automatically. An unexpected administrator prompt during mod installation is a serious warning sign.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Fake Minecraft Mod Deploys Myth Stealer RAT to Steal Browser Credentials and Cookies appeared first on Cyber Security News.

Security researchers have uncovered a significant vulnerability chain in Telerik UI for ASP.NET AJAX, allowing unauthenticated attackers to execute remote code in vulnerable enterprise web applications.

The issue primarily affects Telerik’s RadAsyncUpload component, a widely used file-upload control in ASP.NET WebForms applications.

Progress Software has indicated that the flaw impacts versions from 2010.1.309 to 2026.2.519. The vulnerability was addressed in version 2026.2.708, released as part of the 2026 Q2 SP1 update.

The vulnerability chain includes four distinct flaws: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. While these vulnerabilities are serious, their exploitation requires specific conditions and cannot be applied universally to all default Telerik deployments.

At the heart of the issue is CVE-2026-13182, a padding oracle vulnerability within RadAsyncUpload’s handling of encrypted client states. Telerik employs AES-CBC encryption to safeguard configuration data exchanged between the server and the user’s browser.

A padding oracle occurs when the application provides different error responses for invalid encrypted data. In this case, malformed data results in a distinct error compared to valid padding with invalid JSON content.

Telerik Flaw Chain

This discrepancy enables an attacker to submit modified ciphertext repeatedly, gathering information on how the application decrypts it, ultimately allowing them to recover sensitive data and forge modified encrypted values without needing the encryption key.

Even when the ASP.NET customErrors feature is enabled, researchers noted that exploitation remains possible, albeit more challenging and time-consuming through timing analysis.

Exploiting this oracle, researchers manipulated Telerik’s serializedConfiguration data, which governs settings within the upload control. This enabled attackers to alter the AllowedFileExtensions field, permitting DLL files to be uploaded.

The attack utilized a CBC forgery technique, introducing a “sacrificial” encrypted block within a JSON string. This method preserved necessary configuration from legitimate page loads, including session controls, while inserting malicious entries in the configuration.

The second critical vulnerability, CVE-2026-13181, pertains to the management of upload metadata, where Telerik resolves the .NET type name supplied via the AsyncUploadTypeName value without a proper allowlist.

If a server-side FileUploaded handler reads the UploadResult property, Telerik deserializes corrupt data into the designated type. This behavior can be exploited together with the System.Configuration.Install.AssemblyInstaller gadget, enabling the application to load an uploaded mixed-mode DLL from a temporary directory, executing native code via its DllMain entry point.

The proof-of-concept demonstrated execution of a web shell within the IIS worker process, while an in-memory variant could run commands without writing any files to disk.

To successfully exploit this vulnerability chain, attackers must access a page containing a RadAsyncUpload control with an active server-side FileUploaded event handler that reads UploadResult.

Additionally, an explicit, non-default Telerik.AsyncUpload.ConfigurationEncryptionKey must be configured for the exploitation path to function, which is recommended as a security measure.

Organizations utilizing Telerik UI for ASP.NET AJAX are urged to upgrade immediately to version 2026.2.708 or later. It is critical for administrators to identify pages using RadAsyncUpload and review their upload event handlers to monitor for potential exploitation.

Vigilance against suspicious IIS activity is also necessary, with particular attention to instances of w3wp.exe unexpectedly spawning cmd.exe, the appearance of DLL files in temporary folders, and unexpected .aspx files in web roots.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Telerik Flaw Chain Lets Unauthenticated Attackers Turn Padding Oracle Into Remote Code Execution appeared first on Cyber Security News.

The OpenVPN project has shipped version 2.7.7, a security-focused release that patches seven distinct vulnerabilities spanning the software’s core reliability layer and its Windows-specific service components.

The update, released on September 3, 2026, addresses issues ranging from denial-of-service conditions to buffer overreads and configuration bypasses that could allow attackers to run unauthorized VPN configurations.

The most broadly impactful fix, tracked as CVE-2026-84732, targets OpenVPN’s reliability layer, a component responsible for managing TLS handshakes and acknowledgment packets.

The flaw combined two separate bugs: an unbounded reliable TLS timeout and improper handling of acknowledgments for packets that could never legitimately be outstanding. Both issues were discovered by security researcher Mark Bregman of Fox-IT, and since the reliability layer is shared across all supported platforms, the fix benefits Linux, Windows, and macOS deployments alike.

Six of the seven vulnerabilities specifically affect Windows installations, reflecting how deeply OpenVPN’s Windows service architecture had accumulated edge-case weaknesses.

OpenVPN Fixes 7 Security Flaws

CVE-2026-84256 involved incorrect command-line quoting in the CreateProcess() function, where characters with special meaning to cmd.exe could, in combination with a validation script and a rogue certificate authority, lead to unexpected behavior.

A related flaw, CVE-2026-84226, affected the tapctl utility, which previously invoked netsh.exe without specifying its full file path, a gap that researchers at BreachX Zero Day Labs identified using their Typhon AI Mil v2 tooling.

Local privilege abuse was also on the table. CVE-2026-82312 stemmed from OpenVPN’s use of NULL discretionary access control lists (DACLs) on system objects, including the service exit event and the netsh.exe guard semaphore.

This design flaw enabled a local denial-of-service scenario in which one logged-in user could interfere with another user’s OpenVPN session by blocking the semaphore or triggering spurious events, though the issue applies only to setups that skip the interactive service or rely on the automatic Windows service.

Two additional Windows flaws affected openvpnserv, the Windows service component. CVE-2026-78221 caused a buffer overread when internationalized domain names using UTF-8 encoding were processed, because the NRPT domain size passed to the function was incorrect.

Separately, CVE-2026-78043 revealed that openvpnserv’s configuration path validation failed to block forward slashes, even though Windows file-open APIs treat them as valid path separators. This mismatch could let an attacker slip past administrative restrictions and force openvpn.exe to launch a configuration file it was never authorized to run.

Rounding out the list, CVE-2026-81738 fixed an off-by-one error in write_dhcp_search_str(), where specially crafted DHCP search-domain options could overflow a temporary buffer by a single byte, a bug credited to researchers Andre Kropp of Nexory and ChinhNguyen.

Beyond the CVE fixes, OpenVPN 2.7.7 adds a Linux-specific improvement that validates netlink replies against the originating request, an enhancement suggested by researcher Joshua Rogers.

The release also reduces the number of future keys retained under the EPOCH data-channel format from sixteen to four, easing log noise and resource usage on high-throughput links, alongside several networking bug fixes affecting TCP handshakes, UDP checksum handling, and OpenSSL’s HMAC key management.

Administrators running OpenVPN on Windows should prioritize this update given the concentration of local-privilege and configuration-bypass flaws, while all users benefit from the reliability-layer patch. The release notes and full CVE details are published on the OpenVPN Community Wiki’s security announcements page.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post OpenVPN Fixes 7 Security Flaws Affecting VPN Connections and Windows Systems appeared first on Cyber Security News.

PEEP, a malicious Chrome extension posing as Smart Bookmarks, can steal active login sessions and turn an already compromised Windows computer into a remote backdoor.

The finding shows how a browser add-on can become far more dangerous than a simple data thief when it gains a path to the operating system.

The toolkit does not appear to provide its own way into a device. Instead, attackers need prior code execution or administrative access, then silently place it in Chrome or Edge profiles.

Its installers can alter browser settings so the extension launches without the usual store checks, approval prompts, or visible warnings.

Analysts at SOCRadar identified the operation as PEEP, a Chromium-based post-compromise toolkit derived from the open-source RedExt project.

SOCRadar said in a report shared with Cyber Security News (CSN) that the researchers found a primary build disguised as Smart Bookmarks, version 1.3.0, along with a related testing variant and an exposed development repository.

The scale of confirmed victim impact remains unclear. A server status snapshot recorded 34 agent entries, 10 active sessions, and 507 data records, but test identifiers mean those figures cannot prove the number of infected devices.

Still, the design creates a serious risk because stolen session cookies may let an intruder enter accounts without needing a password again.

Malicious Chrome Extension

Once active, PEEP runs inside the browser and asks for broad access to tabs, cookies, history, bookmarks, downloads, browser settings, scripting, and every website.

It gathers browsing history, open-tab details, session cookies, form data, clipboard contents, screenshots, and local or session storage, creating a broad view of a victim’s online activity.

The session-theft capability is especially concerning because a valid cookie proves that a user has already signed in.

As explained in this guide to stolen browser cookie risks, an attacker who obtains that token may be able to reuse an active session and sidestep a later password or MFA prompt until the session is revoked.

PEEP also accepts commands to open pages, inject JavaScript, change proxy settings, and capture page content. It contacts its command server at regular intervals using unencrypted HTTP, allowing the operator to send tasks and receive collected data.

That behavior resembles other malicious browser add-on campaigns that abuse extensions to monitor sensitive activity.

The native-messaging bridge is what changes the threat from browser monitoring into host control. The browser extension can call a companion Windows program, enabling shell commands, file operations, and discovery of running processes and services under the current user account.

Persistence Raises Cleanup Challenge

PEEP uses several methods to remain in place after installation. Its scripts can forge Chrome Secure Preferences integrity values, use enterprise force-install policies, or sideload the extension.

It can also exploit a ScriptCache fallback, leaving apparently harmless source files while Chrome reloads a previously compiled malicious service worker.

That layered approach means removing the visible extension alone may not be enough. Security teams should identify the listed extension IDs, remove the associated native-messaging host and local artifacts, and review browser policies and registry entries.

The finding follows earlier cases in which a native messaging host backdoor turned Chrome into a route for device-level control.

Organizations should block the identified infrastructure, restrict traffic to the exposed services, and investigate browser processes or PowerShell activity that modifies Secure Preferences files.

Strict extension allow-lists, disabled developer mode, restrictions on external sideloading, and approval of only trusted native-messaging hosts can reduce the chance of a similar installation succeeding.

Defenders should also treat a suspected PEEP infection as both an endpoint and identity incident. Remove the malware, end active sessions, rotate affected credentials, and examine account activity for misuse.

Phishing-resistant MFA and browser protections for stored credentials add useful friction, while the recent Chrome extension supply chain attacks show why every installed add-on deserves careful ongoing review.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Malicious Chrome Extension Can Steal Login Sessions and Turn PCs Into Remote Backdoors appeared first on Cyber Security News.

N-able has released N-central 2026.3 Hotfix 4 to fix CVE-2026-86218. This critical vulnerability could allow an unauthenticated attacker to execute code remotely on an exposed N-central server.

The update, identified as build 2026.3.1.14, was issued for on-premises N-central deployments. N-able urged self-hosted customers to install the hotfix immediately, warning that systems left unpatched remain at risk even though the company has not confirmed exploitation in production environments.

CVE-2026-86218 is a pre-authenticated remote code execution vulnerability. This means an attacker may be able to trigger the flaw without first logging in or providing valid user credentials. If successfully exploited, the issue could allow an attacker to run commands on the N-central server.

N-central is used by managed service providers and IT teams to monitor, manage, automate, and secure customer systems. Because the platform can have broad access across endpoints, networks, credentials, and administrative tools, a compromise of the central management server could create serious downstream risks.

Attackers who gain control of an N-central server could potentially use that access to deploy malicious software, alter monitoring settings, steal stored information, create unauthorized accounts, or move further into managed customer environments.

N-able Released Hotfix

The exact technical details and attack vector for CVE-2026-86218 have not been publicly disclosed. N-able said a third party responsibly reported the flaw through its security disclosure program. The vendor stated that it currently has no confirmation of active exploitation.

However, organizations should not treat the lack of known attacks as a reason to delay patching. Public patch releases can help threat actors identify vulnerable systems and develop exploit attempts.

The new release replaces N-central 2026.3 Hotfix 3, build 2026.3.1.13. Customers running versions 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1, or 2026.3.1 Hotfix 2 can upgrade directly to build 2026.3.1.14. Organizations using older releases should first move to a supported upgrade version and then apply the latest hotfix.

N-able confirmed that hosted N-central customers, also known as NCOD users, do not need to take any action because the patches have already been applied to their environments. The urgent action applies to organizations operating their own self-hosted N-central infrastructure.

The company also said administrators do not need to upgrade N-central agents specifically to address CVE-2026-86218. However, it recommended keeping agents up to date with the latest available version as a general security practice.

Security teams should identify all self-hosted N-central instances, confirm their installed build number, and schedule the update to 2026.3.1.14 as soon as possible.

Administrators should also review server access logs, administrator account activity, remote command execution records, and unusual configuration changes for signs of suspicious behavior before and after patching.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post N-able Released Hotfix for RCE Vulnerability Affecting Platform appeared first on Cyber Security News.

The cybersecurity industry is confronting a threat landscape that is changing faster than most defenders can keep track of. New data from Epoch AI shows that critical and high-severity vulnerability disclosures from major technology firms have gone vertical since the beginning of this spring, climbing from a baseline of a few hundred a month to well over 600, with critical-severity CVEs alone jumping from single digits to more than 600 in recent months.

By June 2026, twenty-one notable organizations, including Microsoft, Google, Apple, Adobe, Oracle, Cisco, and IBM, disclosed around 1,500 high- and critical-severity CVEs, more than 3.5 times the previous monthly record set before the release of Anthropic’s Claude Mythos Preview.

Critical Software Vulnerabilities Surge

That surge did not stop there; by July, disclosures reached roughly 2,500, nearly five times the pre-Mythos baseline and 60 percent above June’s already record-breaking total.

Researchers point to Anthropic’s Project Glasswing, an AI-powered vulnerability discovery initiative, as a major driver behind the spike, with the effort reportedly surfacing more than 10,000 high- or critical-severity flaws, many of which have not yet been individually disclosed.

Whether this reflects a genuine increase in exploitable weaknesses or simply a change in how vulnerabilities are found and classified remains uncertain, but analysts agree that AI-assisted discovery tools have fundamentally altered the pace at which flaws surface.

Compounding the disclosure surge is a parallel collapse in the time attackers need to weaponize new flaws. According to ZeroDayClock, the zero-day rate, meaning the share of exploited vulnerabilities attacked on or before the day of public disclosure, has climbed to nearly 87 percent, up roughly 60 percent from last year and almost quadruple the rate recorded in 2020.

The median time to exploit now sits at around one day, and some researchers project it could shrink to just one minute by next year. As recently as 2018, the median gap between disclosure and first observed exploitation stretched to 771 days; by 2023 that window had fallen to roughly six days, and by 2024 it was down to hours.

The so-called exploit survival curve, which tracks what percentage of eventually-exploited CVEs remain unexploited over time, now falls to zero within about 1.5 months of disclosure, reads the report.

In 2022, half of all exploits that would ever be weaponized were still unexploited at the 1.5-month mark, and even at three months a substantial share had gone untouched. Today, defenders effectively have no cushion once a flaw becomes public.

Security teams prepared to patch cycles measured in weeks are now operating in an environment where exploitation can begin before a fix is even available.

Ransomware operators have already adapted, with more than half of ransomware-linked CVEs in 2025 first identified through zero-day exploitation, up sharply from the prior year.

Industry analysts note that AI is reshaping both sides of the equation, accelerating offensive discovery while also promising to strengthen automated defense and detection capabilities. For now, organizations that delay patching by even a few days are increasingly likely to find that attackers got there first.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Critical Software Vulnerabilities Surge From Under 100 to More Than 600 a Month appeared first on Cyber Security News.

CrowdStrike has unveiled SafeMind, a family of purpose-built security models and harnesses that the company is calling the first agentic system engineered specifically for cyber defenders.

Announced at Fal.Con 2026 in Las Vegas, the launch marks a strategic pivot away from generic frontier AI models toward a dedicated offensive-defensive framework built to operate natively inside the CrowdStrike Falcon platform.

The system emerges from CrowdStrike’s newly established Cyber Superintelligence Lab and represents one of the most ambitious applications of agentic AI in enterprise security to date.

CrowdStrike Launches SafeMind

What sets SafeMind apart from conventional large language model deployments is its dual-model design. Red Tempest, the offensive component, is trained to emulate advanced AI-driven adversaries and probe for exploitable attack paths, while Blue Solano, the defensive counterpart, is built to close those gaps using battle-tested protection measures drawn from real-world incident response.

Rather than functioning as isolated tools, the two models operate inside harnesses that pit them against each other in a continuous, self-improving loop, allowing the system to sharpen its detection and remediation capabilities with every cycle.

Crucially, these harnesses are also compatible with other frontier and open-source models, giving security teams flexibility in model choice without sacrificing cost efficiency.

SafeMind’s differentiation lies heavily in its training foundation. The models were built using telemetry from CrowdStrike’s Falcon sensors, described as the largest pureplay cybersecurity dataset and edge install base in the industry, combined with threat intelligence, Falcon Complete managed detection and response annotations, and fifteen years of frontline incident response fieldwork.

This grounding in operational breach data, rather than generic internet-scale text corpora, is central to CrowdStrike’s argument that purpose-built security models outperform repurposed general-purpose AI systems in adversarial cyber scenarios.

CrowdStrike developed SafeMind in partnership with NVIDIA, using the NVIDIA Nemotron open model family as its foundation, while CoreWeave’s AI Cloud powers both training and inference workloads. NVIDIA CEO Jensen Huang framed the collaboration as part of a broader industry shift, noting that cyber defense is becoming one of the most compute-intensive applications of AI as attackers and defenders both race to scale their use of automated systems.

CrowdStrike CEO George Kurtz echoed that sentiment, stating that the future of cybersecurity “won’t be defined by AI that simply identifies threats, it will be defined by AI that defeats them”.

CrowdStrike’s internal evaluations claim SafeMind delivers a 29 percent higher detection rate than leading frontier and open-source models, along with six-times-faster end-to-end remediation and 99 percent cost savings on detection and remediation workflows.

Dr. Bartley Richardson, CrowdStrike’s chief AI and autonomous systems officer, described the launch as the foundation for the next decade of AI-driven security, emphasizing that CrowdStrike now controls the entire stack “from sensor to harness to model”.

Standalone access to SafeMind’s models and harnesses will roll out through CrowdStrike’s Project QuiltWorks program, offering trusted enterprise customers a pathway to integrate the agentic system beyond the native Falcon deployment.

As AI-enabled attacks continue to scale, SafeMind signals a broader industry move toward autonomous, closed-loop defense systems designed to act on risk rather than merely flag it, positioning CrowdStrike at the forefront of the agentic security race.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post CrowdStrike Launches SafeMind Cybersecurity’s First Agentic System Built for Defenders appeared first on Cyber Security News.

ASUS has issued an urgent security update for ASUS Control Center Enterprise (ACC) after researchers uncovered a maximum-severity vulnerability that lets remote attackers seize complete administrative control over the platform and every device it manages, without needing a password or any user interaction.

Tracked as CVE-2026-75754, the flaw carries a CVSS 4.0 score of 10.0, the highest possible rating, reflecting how easily it can be exploited over a network and the catastrophic scope of what an attacker can achieve once inside.

ASUS Control Center Vulnerability

The vulnerability actually stems from a chain of three separate weaknesses working together. ASUS Control Center is missing authentication on a critical function, meaning certain sensitive operations can be triggered by anyone who can reach the service over the network.

That gap is compounded by a server-side request forgery flaw, which lets an attacker send a specially crafted HTTP request to trick the system into exposing its own encryption key. Once that key is retrieved, a local service on the host automatically enables an SSH listener on TCP port 2222, effectively opening a hidden backdoor into the machine.

The final piece of the chain is arguably the most damaging: ASUS Control Center contains hard-coded credentials baked into the software itself. Attackers who obtain the encryption key can use these fixed credentials to log directly into the newly opened SSH port and land a full root shell, the highest level of system access available on the machine.

From there, intruders can read, modify, or delete any data stored in ACC, and because the platform is designed to centrally manage fleets of servers, PCs, and workstations, a single compromised ACC instance can hand attackers remote control over an entire corporate IT environment.

The flaw affects all versions of ASUS Control Center Enterprise up to and including 4.0.0.2. ASUS is urging every organization running the software to update immediately to version 3.1.0.9 or later, and confirms further fix details are posted on its official Security Advisory page.

Enterprises unable to patch right away should isolate ACC management interfaces from public networks, block inbound and outbound traffic on port 2222, and audit hosts for unexpected SSH listeners as an interim safeguard.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post ASUS Control Center Flaw Allows Attackers to Gain Full Admin Control of the System appeared first on Cyber Security News.

Attackers are actively exploiting an unauthenticated remote access flaw in MikroTik RouterOS, and network administrators worldwide are being urged to patch their devices immediately before compromise turns into a full network takeover.

MikroTik confirmed on September 3, 2026, that it had discovered a serious security vulnerability affecting RouterOS and had already shipped fixes across every release channel, including 7.25 beta 3, 7.24.2 stable, 7.23.4 long-term, and 6.49.21 long-term.

The vendor deliberately withheld technical specifics in its initial advisory, stating plainly that it was “not currently publishing detailed information” in order to give administrators time to update before attackers could reverse-engineer the flaw from public disclosure.

Despite that caution, exploitation began almost immediately, and forum users and researchers quickly pieced together the attack mechanics on their own.

MikroTik RouterOS Vulnerability

According to detailed discussion on the official MikroTik support forum, the vulnerability lives inside a core library used by multiple RouterOS services, meaning any exposed service built on that codebase can be leveraged as an entry point.

One forum contributor who reverse-engineered the issue confirmed it is tied to SSH and grants any unauthenticated remote attacker direct shell access to the device, regardless of whether the router relies on password authentication or SSH key-based login.

In practical terms, if the SSH service is reachable from the internet or an untrusted network, the router is vulnerable until it receives the patch, with no additional credential theft or user interaction required.

Latvia’s national CERT issued its own alert corroborating a marked increase in attacker activity specifically targeting MikroTik routers, urging organizations and home users alike to update immediately to the patched builds MikroTik released. The agency’s guidance mirrored MikroTik’s own version list, reinforcing that the fix spans both the newer 7.x stable and legacy long-term branches.

Evidence of live exploitation surfaced quickly within the MikroTik user community. One administrator reported on Reddit that around September 2, 2026, at 08:00 UTC, an unauthorized user account named “ops” was created by another rogue account labeled “0,” granted both write and policy permissions, with the intrusion traced back to an SSH connection originating from the IP address 82.192.72.4.

The administrator noted that while the rogue account appeared to be used mainly for logging in and no obvious malicious scripts were visible in the configuration, the team suspected deeper compromise that RouterOS itself could not detect, ultimately requiring a full netinstall to guarantee the devices were clean.

RouterOS now includes a built-in detection mechanism to help flag this exact scenario. After upgrading, the operating system automatically inspects the full configuration at startup and sets a device to “Flagged” status if it finds signs of unauthorized tampering, logging a critical entry in the system log.

Devices in this state face operational restrictions, including a block on enabling new scheduler entries, SOCKS proxy, PPTP, L2TP, IPsec, proxy, and SMB configurations, until an administrator performs a manual audit.

MikroTik’s guidance is straightforward: if a device shows as flagged, assume it has been compromised, audit every configuration line, rotate all passwords, and only then clear the flagged state.

Even routers that never show a flagged status should not be considered safe by default; MikroTik and independent researchers both recommend manually reviewing configurations for unrecognized users, scripts, or scheduled tasks after updating, since some compromise artifacts may not trigger the automated detection.

Restricting SSH and other management interfaces from the public internet, enforcing key-based authentication, and limiting administrative access to trusted management networks remain essential complementary defenses while the patch rolls out fleet-wide.

Given the scale of MikroTik’s install base and the confirmed low barrier to exploitation, security teams should treat this as an urgent, internet-facing remote code execution scenario rather than a routine maintenance update.

Upgrading to 7.24.2, 7.23.4, or 6.49.21 (or later), auditing every device regardless of flagged status, and hardening remote management access should be treated as immediate priorities rather than items for the next maintenance window.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Exploiting MikroTik RouterOS Vulnerability in the Wild to Gain Complete Network Access appeared first on Cyber Security News.