[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentMalware & Ransomware
Slim Spider Targets Brazilian Finance with Cloud Credential Heists
Meet Slim Spider, a cunning cyber threat actor with a laser-like focus on Brazilian finance, expertly infiltrating cloud environments to steal sensitive credentials and target cryptocurrency assets and instant payment accounts. With a sophisticated grasp of Brazil's financial infrastructure, this adversary has been wreaking havoc on the country's financial sector since at least March 2026.
Threat Actors Exploit AI for Large-Scale Credential Harvesting
Threat actors are supercharging their attacks with AI, using it to scale up credential harvesting and launch more sophisticated campaigns. Google Threat Intelligence Group reports that financially motivated and espionage-focused attackers are increasingly turning to AI to target high-value sectors like healthcare, government, and media.
ChatGPT Exposes Gmail Data to Hidden Channel
Researchers at Check Point found that a sneaky instruction in a ChatGPT conversation can secretly siphon off sensitive data from connected Gmail accounts, sending it to an attacker's hidden channel without raising any red flags. This covert hack can even exfiltrate chat history and files, putting users' private info at risk.
Hackers Return $265M in Bitcoin, Hold $47M in Dispute
In a surprise move, hackers claiming to be "whitehats" returned a whopping 3,400 bitcoin, valued at $265 million, to the Liquid Federation, leaving $47 million still in dispute. The mysterious intruders made their move on September 7, sending the funds back after a daring heist that stole nearly 4,000 bitcoin from the Liquid Network.
OpenAI GPT-6 Astra Exposes Zero-Day Flaws, Tests Monitoring Limits
OpenAI's GPT-6 Astra has reached a critical milestone, showcasing advanced cyber capabilities that can identify and develop zero-day exploits without human intervention. This marks a significant leap forward in AI-powered cybersecurity threats.
WeChat Zero-Click Flaw Exploited to Hijack Accounts via Incoming Calls
A security firm, Calif, has successfully demonstrated a zero-click worm that can hijack WeChat accounts on both iPhone and Android devices with just an incoming call, and fortunately, the exploit has been blocked for all users. This alarming vulnerability was responsibly disclosed to Tencent in July, putting an end to the threat.
Microsoft 365 Phishing Op Exposes Thousands of Credentials
A recent phishing operation exposed a staggering 5,137 records from 461 organizations, including 1,032 plaintext passwords and 474 fully authenticated Microsoft 365 sessions that could be easily exploited. This massive haul highlights the alarming vulnerability of sensitive credentials to clever phishing tactics.
Adobe patches exploited Magento zero-day used to backdoor servers
Adobe has rushed out an emergency patch to fix a critical Magento zero-day vulnerability, known as StyleSmuggler, that's been exploited by hackers to plant backdoors on servers since early September. This max-severity flaw could allow attackers to execute arbitrary code, making it a must-fix for Magento and Adobe Commerce users.
THost9 Android RAT Exploits Exposed ADB Services to Spread
Meet the sneaky THost9 Android RAT that's exploiting exposed ADB services to spread its reach - and it can scan a massive 65,025-host range with ease.
BengalSEO Campaign Exploits Bing Search Results
Meet BengalSEO, a notorious group that's been secretly manipulating Bing search results with sneaky Black Hat SEO tactics since at least 2015, luring victims into malware and tech-support scams. They're masters of creating fake support pages that look legit, but actually serve as traps.
Adobe Patches Zero-Day Flaw Exploited to Deploy Rust Backdoor
Adobe just patched a critical zero-day flaw, CVE-2026-75650, that's been exploited to deploy a Rust backdoor, known as StyleSmuggler, targeting Adobe Commerce merchants - and it's crucial you update ASAP to avoid arbitrary code execution. This severe vulnerability has a CVSS score of 10.0, so don't wait to secure your site.
Malware Exploits Chrome, Edge for Post-Compromise Command Execution
Meet PEEP, a sneaky post-exploitation toolkit that disguises itself as a harmless bookmarks extension in Chrome and Edge, allowing hackers to execute commands on compromised devices. It requires prior admin access to install, cleverly bypassing security checks to forge a sense of legitimacy.
Magento Zero-Day Exploited to Install Linux Backdoor
A newly discovered zero-day vulnerability, dubbed "StyleSmuggler," is being exploited in the wild to install a stealthy Linux backdoor on over 160,000 Magento and Adobe Commerce sites, including 14,000 of the top 1 million sites. This alarming attack has already hit a target running the latest security updates, leaving many sites vulnerable.
Google Discloses Chrome 0-Day Under Active Exploitation
Google just revealed a high-severity Chrome zero-day vulnerability, CVE-2026-85046, that's being actively exploited by hackers, allowing them to execute malicious code inside the browser's sandbox. This type confusion bug in Chrome's V8 engine was reported by researcher Salvatore Gulizia on August 4, 2026.
Microsoft 365 Targets in Fake IT Call Data Theft, Extortion Scheme
Beware of fake IT calls that can trick you into giving away your Microsoft 365 login credentials - scammers are using a clever vishing scheme to steal account details and hold them for ransom. It starts with a convincing phone call from someone claiming to be from IT, directing you to a fake authentication page.
Phishing Service BigBear Exposes 258 Firms to MFA Bypass
BigBear 2.0, a sneaky phishing-as-a-service operation, has compromised 258 companies by bypassing multi-factor authentication (MFA) for Microsoft 365 users worldwide, swiping 5,137 credential records in the process. This cunning attack used an adversary-in-the-middle approach to intercept passwords, MFA tokens, and session cookies, allowing hackers to hijack authenticated sessions with ease.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
Rogue ScreenConnect Clients Propagate VBScript Worm
A sneaky VBScript worm is spreading rapidly through new ScreenConnect connections, launching a four-stage attack chain that wreaks havoc on unsuspecting hosts. This malicious chain was triggered by three distinct initial access routes, including tech-support scams, phishing, and fake refund forms.
Rhysida Ransomware Gang Publishes Stolen Berlin Government Data
The Rhysida ransomware gang has published stolen data from Berlin's government on the dark web after the city refused to pay a €2m ransom, defying the hackers' ultimatum. Berlin's government had stood firm, prioritizing the safety of its staff and citizens over giving in to blackmail.
Hackers Exploit MikroTik Router Flaws to Hijack Devices
Hackers are actively exploiting vulnerabilities in MikroTik RouterOS, using a two-step attack dubbed "MikroTrick" to hijack devices, warns Poland's Computer Emergency Response Team. The team has confirmed that the critical severity flaws, tracked as CVE-2026-67276 and CVE-2026-86060, are being used in real-world attacks.
JSCeal Malware Exploits Stolen Cookies to Bypass Google Authentication
Meet JSCeal, a sneaky malware that's using stolen cookies to outsmart Google's authentication - putting retail traders and cryptocurrency users in its crosshairs. It's spread through clever malvertising tactics, including fake ads on Facebook and Google that lead victims to counterfeit trading sites.
Malware Modules Disable Windows Update, Defender for Crypto Mining
Meet LockAppHost, a notorious malware module that cripples your Windows defenses by disabling updates and Microsoft Defender, making way for a sneaky cryptocurrency miner to take over. By weakening your machine's security, it allows the miner to run undetected, wreaking havoc on your system.
Attackers Exploit MikroTik Routers via Exposed SSH
Hackers are actively exploiting MikroTik routers with exposed SSH services to gain full control, with successful attacks dating back to at least September 2. This critical vulnerability allows attackers to bypass authentication and take control of your router, putting your entire network at risk.
Magento Zero-Day Exploited to Install Persistent Backdoors
A critical Magento zero-day vulnerability, dubbed StyleSmuggler, is being actively exploited to install persistent backdoors on e-commerce stores, with attacks detected as early as September 4. All current versions of Magento Open Source and Adobe Commerce are affected, leaving stores vulnerable until a patch is released.
Hackers Exploit 5,400 Sites to Serve Blockchain-Stored Payloads
Over 5,400 small-business websites, mostly built on WordPress and PrestaShop, have been hijacked to spread modular malware through a sneaky covert channel, with payloads cleverly stored on the BNB Smart Chain test network. This clever scheme uses a fake WebRTC handshake to trick victims into downloading the malware.