From BleepingComputer · 40 stories
FBI disrupts proxy network used for Chinese cyber espionage against US critical infrastructure
The FBI has disrupted a proxy network infrastructure that facilitated Chinese cyber espionage operations targeting U.S. critical infrastructure. This infrastructure, tracked by Black Lotus Labs, provided reconnaissance, proxy management, and operational routing capabilities for data theft from various U.S. organizations. The disruption impacts China-linked espionage actors who have increasingly used such networks since 2024.
CISA Warns of Active Exploitation of Critical Progress Kemp LoadMaster Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that a critical command injection vulnerability (CVE-2026-8037) in Progress Kemp LoadMaster is being actively exploited by attackers. This flaw allows unauthenticated attackers to execute arbitrary commands on affected LoadMaster appliances, which are widely used by tech companies and government entities for traffic distribution and application performance.
Microsoft 365 services experience widespread outage in North America
Microsoft 365 services, including Teams, SharePoint, and OneDrive, are experiencing a significant outage primarily affecting users in North America. The disruption began at 10:44 AM ET on July 23, leading to degraded functionality and access issues across multiple platforms, prompting Microsoft to advise customers to review business continuity plans.
CISA Issues Guidance on Zero Trust for Critical Infrastructure Security
CISA has released new guidance emphasizing the implementation of Zero Trust principles in critical infrastructure security. This guidance aims to mitigate threats from state-sponsored actors exploiting identity vulnerabilities, especially in operational technology environments.
Ostium platform suffers $23.7M theft in off-chain attack
Ostium trading platform experienced a $23.75 million theft due to price manipulation via compromised off-chain infrastructure. The incident has halted trading operations as the platform works on security measures and assessing impacts for liquidity providers.
Four AI coding agents affected by sandbox escape vulnerabilities
Security researchers have demonstrated sandbox escape vulnerabilities in Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity. These vulnerabilities exploit file interactions that allow the sandboxed agents to trigger commands outside their protected environment, highlighting significant security shortcomings in AI coding tools.
Hackers Target Russian Government Agencies via ViPNet Software Abuse
A threat actor is exploiting ViPNet's update mechanism to deploy malware against Russian organizations, including government agencies. The campaign, named HelloNet, impacts multiple sectors and reflects ongoing vulnerabilities in widely used security products.
U.S. charges Chen and Zhang for laundering $43 million from investment scams
U.S. prosecutors charged Zhuoying Chen and Haojie Zhang with laundering $43 million from cyber investment fraud. The defendants allegedly managed a network that facilitated the transfer of fraud proceeds to China, impacting numerous victims.
Spirals ransomware encrypts networks within 24 hours after initial compromise
A new ransomware group, Spirals, compromised an IT services firm in South Asia and completed data theft and encryption in under 24 hours. The rapid expansion of ransomware capabilities poses significant threats to corporate network security.
Spanish Police Dismantle €140 Million Cyber Fraud Network, Four Arrested
Spanish Police have dismantled a cybercrime organization involved in €140 million of investment fraud and business email compromise (BEC), arresting four individuals. This operation highlights a sophisticated scheme utilizing over 800 bank accounts and numerous accomplices to launder significant amounts of illicit funds.
Microsoft Entra ID adopts passkeys as default authentication by September 2026
Starting September 2026, Microsoft Entra ID will replace SMS and voice authentication with passkeys as the default method. This transition aims to enhance security against credential theft and phishing attacks, as SMS and voice authentication will be retired in February 2027.
UK charges five in connection with Russian Coms spoofing platform
UK authorities have charged five individuals linked to the Russian Coms caller ID spoofing platform, which facilitated over 1.8 million scam calls. This platform, operational since 2020, enabled criminals to impersonate financial institutions and law enforcement, leading to significant financial losses for victims worldwide.
RedHook Android malware exploits Wireless ADB for elevated privileges
The RedHook Android malware now leverages Wireless ADB to gain shell access without USB connections. This enhancement increases its capability, allowing for sophisticated attacks including credential theft and remote control of devices.
Australia warns of global CMS-targeting campaign exploiting vulnerabilities
The Australian Cyber Security Centre alerted about a global exploitation campaign affecting vulnerable CMS platforms, including WordPress and Joomla. Affected sites have had webshells deployed, allowing attackers persistent access to steal data and compromise services, highlighting the urgent need for security updates.
New Helix vishing group targets SharePoint for data theft
A new cybercriminal group named Helix is using vishing and MFA abuse to steal data from SharePoint environments. The group impersonates employees to trick victims into giving up sensitive information, leading to data extortion practices similar to those of previous groups like ShinyHunters and BlackFile.
Global anti-fraud operation leads to 5,800 arrests and $293M seized
Law enforcement agencies arrested 5,811 suspects and seized $293 million in a worldwide anti-fraud initiative named "Operation First Light 2026." This operation targeted various forms of social engineering fraud and money laundering, and revealed over 142,000 victims across 97 countries.
Malicious SDKs on npm and PyPI Target Paysafe, Skrill, and Neteller Users
At least 17 malicious packages on npm and PyPI masqueraded as legitimate Paysafe, Skrill, and Neteller SDKs, deploying credential-stealing malware. This attack could compromise sensitive user data, impacting developers and businesses relying on these payment services.
Phishing Campaign Impersonates Major Brands to Steal Google Credentials
A phishing campaign is impersonating over 30 prominent brands, including Adobe and Netflix, targeting marketing professionals to steal Google account credentials. By using legitimate HR platforms and real recruiter names, the threat actor enhances the phishing attempt's credibility, making it a significant security threat.
EtherRAT malware spreads via fake IT support calls on Microsoft Teams
Threat actors are using Microsoft Teams to impersonate IT support and deliver EtherRAT malware to corporate networks. This strategy combines phishing emails and remote access tools to compromise systems and gain control.
Former US Air Force Members Sentenced for Multi-Year BEC and Phishing Scams
Two former US Air Force members, Chijioke Timothy Odimegwu and Harafat Mogaji, received federal prison sentences totaling 189 months for their involvement in business email compromise (BEC) and phishing campaigns. They stole over $2.4 million by redirecting legitimate wire transfers and making unauthorized financial transactions, highlighting the ongoing threat of BEC attacks to businesses.
Microsoft Releases Key Windows Security Updates and Support Changes
Microsoft has rolled out security updates KB5101650 and KB5099414 for Windows 11 versions 25H2/24H2 and 23H2, fixing 571 vulnerabilities. Simultaneously, Windows 10 received its KB5099539 update addressing 570 vulnerabilities, with extended support until 2027. Windows 11 24H2 Home and Pro editions will no longer receive updates after October 13, 2026, urging users to upgrade.
Supabase databases expose sensitive user data due to misconfigurations, UpGuard research finds
Cybersecurity firm UpGuard discovered approximately 16,000 Supabase-hosted databases publicly exposing personal data, including names, addresses, phone numbers, and passwords. This exposure stems from common misconfigurations by developers, highlighting security risks associated with rapidly developed applications and the platform's handling of user security.
Compromised GitHub Actions Re-enabled, Resuming Mini Shai-Hulud Malware Execution
Two GitHub Actions repositories, previously compromised in May 2026 by the Mini Shai-Hulud campaign, were re-enabled on September 16, 2026, without the malicious code being removed. This allowed workflows referencing these actions to resume downloading and executing the malware, posing a software supply chain risk.
GitLab Email Address Vulnerability Allows Unauthorized Code Pushes and CI Job Execution
A vulnerability in GitLab's issue-by-email feature allows anyone with a user's private email address to push code and run CI/CD jobs as that user. This occurs because the email address acts as a credential, and GitLab does not verify the sender, enabling unauthorized actions on any project the user can access.
Placeholder domain "third-party.com" used in dev docs now hosts ClickFix attacks
The domain "third-party.com", commonly used as a placeholder in developer documentation, is now serving a fake Cloudflare verification page that attempts to trick Windows users into executing malicious PowerShell commands. This development is significant because it turns a widely accepted documentation practice into a security vulnerability, potentially exposing developers and users to malware through a trusted, yet compromised, resource.
BigCommerce Merchants Alerted to Data Breach via Compromised Ribon App Credentials
BigCommerce has notified merchants of data breaches stemming from compromised credentials for third-party Ribon applications, which attackers used to inject malicious scripts into online stores. The breach exposed shopper information such as names, email addresses, phone numbers, and shipping addresses, affecting multiple BigCommerce customers.
Browser Extension Vulnerability Affects AI Assistants in Chrome, Edge, and Other Browsers
Security researchers at Forever Security demonstrated that a common browser extension could hijack AI assistants in five Chromium-based products, including Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension. This vulnerability allows an attacker's extension to control the AI agent, and in some cases, access user files or activate the camera and microphone, by impersonating the AI vendor's trusted web page.
Microsoft September Updates Cause USB Audio Device Failures on Windows 11 24H2
Microsoft confirmed that the September 2026 security updates, KB5124008 and KB5124012, are causing USB Audio Class 1.0 devices to fail on Windows 11, version 24H2 systems. This issue prevents audio output and displays "Code 10" errors, impacting users who rely on these specific USB audio devices.
ConnectWise warns of new ScreenConnect vulnerability, provides temporary mitigations
ConnectWise issued a security advisory regarding a new vulnerability in its ScreenConnect Remote Access platform that affects file transfer behavior. While a permanent patch is expected later this week, the company has provided temporary mitigation steps for administrators to implement. This vulnerability is significant because ScreenConnect is widely used by IT professionals, and previous flaws in the platform have been actively exploited by threat actors, including ransomware gangs and state-backed groups.
ShinyHunters claims breach of Florida DMV database, stole 200,000 driver records
The ShinyHunters hacking group claims to have breached Florida's Driver and Vehicle Information Database (DAVID) and stolen over 200,000 driver records. The group stated they exploited a password-reset flaw to gain access and are threatening to leak the data if the Florida Highway Safety and Motor Vehicles (FLHSMV) agency does not negotiate. This incident highlights vulnerabilities in government systems holding sensitive personal data.
Ohio Man Sentenced to 15 Years for AI-Generated Porn Sextortion and Cyberstalking
An Ohio man received a 15-year prison sentence for cybercrimes including sextortion and cyberstalking, utilizing over 100 AI models to generate explicit content of victims. This case marks the first conviction under the Take It Down Act, a 2025 law prohibiting non-consensual online publication of explicit content and AI forgeries.
Plex urges users to update desktop clients and media servers for security patches
Plex has released updates for its Media Server and Desktop client to address multiple security vulnerabilities and is urging users to update immediately. These patches are critical as Plex has emailed affected users, a rare action, indicating the severity of the flaws.
Mathspace discloses data breach affecting over 1 million students, staff, and parents
Online learning platform Mathspace reported a data breach impacting over 1 million individuals in Australia and New Zealand. Attackers exploited a vulnerability in the company's self-hosted Metabase internal reporting system to steal personal information.
Microsoft Exchange Online Experiences Widespread Outage Affecting Email and Authentication
Microsoft is investigating a widespread service issue impacting Exchange Online customers, causing email delays, failures, and authentication problems. The outage, tracked as EX1464935, is attributed to core authentication configuration issues within the Exchange Online infrastructure. This incident affects tens of thousands of users and follows several other Exchange Online outages in recent months.
Anthropic's Claude AI Models Experience Elevated Error Rates, Affecting Multiple Services
Multiple Claude AI models, including Mythos/Fable 5.1, Mythos/Fable 5, Opus 5, Opus 4.8, and Opus 4.6, experienced elevated error rates on September 3, 2026, impacting claude.ai, Claude API, Claude Code, and Claude Cowork. Anthropic identified the cause and is working on a fix, with most models recovered except for Opus 4.8 and Opus 5.
Dropbox users affected by security breach due to SSO authentication flaw
Dropbox notified users of unauthorized account access between August 4 and August 21, 2026, stemming from a vulnerability in its single sign-on (SSO) integration with Lenovo IDs. Attackers exploited a missing email verification step in Lenovo's process to create rogue Lenovo IDs, which Dropbox then implicitly linked to existing user accounts without further authentication. This incident highlights critical flaws in federated identity management and the need for robust verification during SSO setup.
Tectonic Crypto Platform Suffers $6 Million Exploit, Cronos Blockchain Halted
The Tectonic decentralized lending platform experienced a security incident where fraudsters manipulated the price of its TONIC token, inflating it over 100 times to borrow assets. Approximately $6 million in Ethereum was stolen, leading the Cronos blockchain to halt activity and then restart, with an additional $68 million prevented from leaving the platform.
Hasbro discloses data breach affecting employee personal and financial information
Toy manufacturer Hasbro has disclosed a data breach impacting an undisclosed number of employees, with personal and financial information exposed. This incident follows a separate cyberattack in March that caused $25 million in revenue loss, though Hasbro has not linked the two events.
GPUThor Rowhammer Attack Bypasses NVIDIA ECC on Ampere GPUs for Root Access
Researchers at the University of Toronto developed GPUThor, a new Rowhammer attack that bypasses NVIDIA's ECC protections on Ampere-class GPUs, enabling denial-of-service and root-level privilege escalation. This attack significantly increases bit-flip rates compared to previous methods, making exploitation practical within minutes.
AnonyMousKIT PhaaS uses AI voice agents to phish iPhone passcodes and disable Activation Lock
A new phishing-as-a-service (PhaaS) platform named AnonyMousKIT automates the retrieval of iPhone passcodes and disables Apple's Activation Lock feature. This service facilitates a criminal ecosystem for selling stolen iPhones, harvesting Apple IDs, and accessing iCloud backups and Keychain credentials.