threat-intel First Malware Built Specifically for Car Head Units Fuels Botnet Researchers at Kaspersky have identified a new malware specifically designed for car head units, linked to the BadBox botnet. This represents a significant expansion of the BadBox threat, which has previously targeted Android TV boxes and now aims to compromise vehicle infotainment systems for fraud and other malicious… SecurityWeek · 5d ago High CNbotnetmalwaresupply-chain
threat-intel The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution A recent analysis by Palo Alto Unit 42 found that while a significant number of AI-enabled malware samples exist in research and testing environments, only a small fraction (around 12) reached production endpoints across… Palo Alto Unit 42 · 5d ago Medium USCNGBaimalwarethreat intelligence
vulnerability CISA Warns of Exploited Oracle WebLogic Vulnerability The CISA has issued a critical warning to federal agencies about a widely exploited vulnerability in Oracle WebLogic servers (CVE-2026-21962). This flaw allows attackers to execute code remotely without authentication, a… SecurityWeek · 5d ago Critical CVE-2026-21962CNoracleweblogicvulnerability
threat-intel Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet A new malware family, dubbed JarService, is targeting Android car head units developed by DoFun, leveraging the built-in update mechanism to spread ad fraud and proxy botnet capabilities. The campaign is attributed to th… The Hacker News · Aug 21, 2026 High CNandroidcarmalware
threat-intel Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation Four critical vulnerabilities – affecting macOS, SharePoint, vCenter, and IKE – are currently being actively exploited in the wild. These flaws have led to widespread attacks, including the deployment of ransomware and b… The Hacker News · Aug 19, 2026 Critical CVE-2026-65400CVE-2026-55040CVE-2026-59310DEUSTRvulnerabilitycyberattackransomware
threat-intel New Zealand says China tried using space investments to spy on local affairs New Zealand intelligence agencies have uncovered evidence that China has been attempting to utilize its growing investments in space technology to conduct espionage operations targeting local affairs. This involves lever… The Register · Aug 14, 2026 High CNespionagespace-basedsurveillance
threat-intel Chinese Loongson processors have leaky caches, researchers find Researchers have discovered a significant security vulnerability in Chinese Loongson processors, specifically related to their cache memory. This allows attackers to potentially extract sensitive data from the processors… The Register · Aug 13, 2026 Medium CNvulnerabilitycachechina
Des cibles françaises au cœur d’une plateforme cybercriminelle A ZATAZ investigation has uncovered a list of French organizations targeted by a cybercriminal group, Krybit, who are aggressively recruiting affiliates through a platform offering a lucrative 80% revenue split. The grou… ZATAZ · Aug 7, 2026 FRMXUSransomwarerecruitmentcybercrime
threat-intel China launches mysterious probe into security of Palo Alto Networks' products Chinese authorities are investigating the security of Palo Alto Networks' products, raising concerns about potential vulnerabilities and a broader effort to monitor and control cybersecurity technology within China. This… The Register · Aug 7, 2026 Medium CNcybersecuritychinapalo alto
threat-intel CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited The U.S. CISA has added three vulnerabilities to its KEV catalog, including a critical code injection flaw in Langflow, a Tomcat encryption bypass, and an authentication bypass in N-able N-central. These flaws are curren… The Hacker News · Aug 5, 2026 Critical CVE-2026-9198CVE-2026-34486CVE-2026-18556CNvulnerabilitythreat-actorai
threat-intel QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer A long-standing supply chain attack targeting QuickFox, a VPN tool used by overseas Chinese users, has been ongoing since August 2025. The attack, attributed to tactical overlaps with the Chinese state-sponsored threat a… The Hacker News · Aug 5, 2026 High CNsupply-chainmalwarechina
threat-intel Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks A Chinese-speaking threat actor, operating under the aliases knaithe and KnYuan, is leveraging AI to conduct autonomous cyberattacks. Using the Hermes Agent framework and DeepSeek, they autonomously identified and exploi… Palo Alto Unit 42 · Jul 30, 2026 High CVE-2026-33017CVE-2026-21858CVE-2025-68613CNaiautonomousvulnerability
threat-intel Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates A remote access trojan (RAT) called Flying Eagle, along with a related control kit called Night Dragon, is circulating through criminal Telegram channels. Researchers have identified 170 servers hosting the RAT framework… The Hacker News · Jul 29, 2026 High CNandroidrattelegram
threat-intel Hackers used autonomous AI agent to spy on Thailand's finance ministry Hackers used an autonomous AI agent, Hermes developed by Nous Research, to conduct a cyber-espionage campaign targeting Thailand's Ministry of Finance. The agent independently explored the ministry's network, gathering i… The Record · Jul 27, 2026 High CNaicyberespionageautonomous agent
threat-intel Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware The China-linked cybercrime group behind tax-themed phishing campaigns is utilizing a sophisticated crypter service called Cruciferra to deliver a wide range of malware, including remote access trojans and information st… The Hacker News · Jul 27, 2026 High CNcrypterransomwarephishing
threat-intel TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments A threat actor linked to East Asia has been targeting government entities in the Middle East using a sophisticated attack chain leveraging Telegram for command-and-control. The campaign utilizes malware families like TEL… The Hacker News · Jul 27, 2026 High CNedr evasiontelegramcommand and control
vulnerability Scans for ESAFENET CDG 3 Document Management System Weak Logins, (Sun, Jul 26th) A scan targeting ESAFENET CDG, a Chinese-focused document management system, revealed weak default passwords and vulnerabilities, including SQL injection and XSS. Threat actors are leveraging existing exploit scripts to… SANS Internet Storm Center · Jul 26, 2026 Medium CNdefault passwordsql injectionxss
threat-intel GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft A Chinese cybercrime group, known as CylindricalCanine (a sub-group of GoldenEyeDog), has been linked to a significant security breach at DigiCert, a code-signing certificate provider. The attackers exploited a vulnerabi… The Hacker News · Jul 17, 2026 High CNcode-signingphishingmalware
threat-intel US Charges Russian Individuals and Firms for Running Cybercrime Services The US Justice Department has charged three Russian nationals and two companies – ML.Cloud and Media Land – with operating cybercrime services that facilitated attacks against numerous US entities, resulting in tens of m… SecurityWeek · Jul 15, 2026 High CNNLFIcybercrimehostingservicesrussian
threat-intel Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found A popular Chrome and Edge header-editing extension, ModHeader, was found to contain a hidden browsing history collector, despite claims it didn't collect data. Researchers at Stripe OLT discovered the collector was dorma… The Hacker News · Jul 13, 2026 High CNextensiondata-collectionheader-editing
