Cybersecurity News

Title: Spectre Attack Against Cloudflare Workers Demonstrates Remote JWT Theft at 12 Bits Per Second Summary: Researchers have published a proof-of-concept attack demonstrating a remote Spectre side-channel against Cloudflare Workers, successfully extracting a JSON Web Token from a co-located Worker in a production environment at a rate of up to 12 bits per second—a significant improvement over previous research from 2021. Body: A newly disclosed proof-of-concept demonstrates a successful remote Spectre attack targeting Cloudflare's Workers platform. The research team was able to extract a JSON Web Token (JWT) from a victim Worker running in the same environment as an attacker-controlled Worker, all within the production infrastructure. This new attack achieves a data exfiltration rate of up to 12 bits per second. This represents a 360-fold increase in transmission speed compared to an earlier Spectre-based attack against the same platform, which was demonstrated in 2021. The ability to remotely leak sensitive credentials like JWTs from co-located workloads poses a significant concern for multi-tenant serverless environments. The end-to-end experiment was conducted using two Worker instances: one serving as the attacker and the other as the victim. The attack was designed and executed solely by the researchers to validate the vulnerability and measure its practical impact. Details on the specific exploitation techniques and the attack chain have been published in the official disclosure. This research highlights the ongoing challenges of securing shared cloud infrastructure against speculative execution side-channel attacks. While microarchitectural mitigations exist, verifying their effectiveness in dynamic edge computing platforms remains a complex and ongoing task. For further details, please see the original report by The Hacker News. Source: The Hacker News URL: https://thehackernews.com/2026/08/cloudflare-workers-spectre-attack-leaks.html

Title: The Next Phase of Phishing: AI Agents Are Now Attacking and Defending Inboxes Summary: Traditional email defenses that rely on scanning for malicious links or attachments are no longer sufficient. The threat landscape has shifted from malicious payloads to malicious intent, and with the rise of AI agents on both sides, the battlefield has moved to an agent-versus-agent paradigm. Body: The core methodology of most email security tools has remained largely static for the better part of a decade. The standard approach involves scanning incoming messages for known signatures, bad links, or dangerous attachments. This strategy was effective when the threat resided solely in the payload. However, this model is breaking down as cybercriminals shift the focus from what is in the message to what the message intends to achieve. The landscape is now evolving further, as the threat actor on the other end of the conversation is no longer a human being, but an autonomous AI agent. This evolution marks a transition through distinct phases of phishing. The earliest iterations, often referred to as Phishing 1.0, relied on crude social engineering and easily detectable malicious content. While effective in their time, these attacks were relatively straightforward for security filters to identify and block. The current shift signifies a move away from static detection methods toward understanding the semantic context of a conversation. As AI agents become capable of conducting entire email exchanges, simulating human behavior and reasoning, they complicate the ability of traditional security tools to distinguish between legitimate business requests and malicious manipulation. Defenders must now fight fire with fire, deploying their own AI agents to analyze intent and behavior rather than just parsing code, signaling a new era where the success of an attack or defense depends on the sophistication of the algorithms on either side of the inbox. Source: The Hacker News Original Article: https://thehackernews.com/2026/08/phishing-30-fight-moves-to-agent-versus.html

Title: Operation CameraSwarm: Over 14,500 Dahua Devices Compromised via Credential Attacks and Auth Bypasses Summary: Threat actors compromised more than 14,530 Dahua video surveillance devices in a campaign spanning from June 17 to July 22, 2026. The operation, tracked as Operation CameraSwarm, leveraged credential stuffing, two distinct authentication-bypass vulnerabilities, and a peer-to-peer (P2P) relay technique to gain unauthorized access. The findings were reconstructed from a 407 MB exposed working directory containing 2,616 files. Body: Researchers at Hunt.io have published a detailed analysis of a significant attack wave targeting Dahua devices. Between June 17 and July 22, 2026, at least 14,530 units were successfully compromised. The attackers employed a multi-pronged strategy combining brute-force credential attacks with exploitation of two separate authentication-bypass flaws, followed by the use of a P2P relay technique to maintain access and obfuscate command-and-control traffic. The investigation was made possible by the discovery of a 407 MB working directory left exposed by the threat actors. This directory, containing 2,616 files, allowed researchers to reconstruct the entire kill chain and attribute the activity to a campaign now codenamed Operation CameraSwarm. While the specific CVE identifiers for the authentication-bypass flaws were not disclosed in the initial reporting, the combination of weak credential reuse and unpatched vulnerabilities is cited as the primary vector for the initial compromise. The use of the P2P relay method is particularly noteworthy, as it leverages the devices' legitimate remote-access features to blend malicious traffic with standard operational data, making network-based detection more difficult. This incident underscores the critical importance of changing default credentials, enforcing strong password policies, and ensuring firmware is updated to address known authentication bypasses. Organizations using Dahua equipment should immediately audit their device exposure and review P2P settings. Source: The Hacker News Original Article URL: https://thehackernews.com/2026/08/hackers-compromised-14500-dahua-devices.html

Title: Clop-Attributed Web Shell Targets PTC Windchill, Engineered for Data Exfiltration and Extortion Summary: New analysis from ReliaQuest has detailed a JSP web shell deployed against PTC Windchill and FlexPLM servers. The tool appears purpose-built for enterprise PLM environments, enabling credential decryption and systematic mapping of engineering vaults as part of an extortion-focused campaign linked to the Clop ransomware group. Body: Recent research from ReliaQuest has shed light on the operational capabilities of a JSP-based web shell observed following the exploitation of a critical vulnerability in PTC Windchill and FlexPLM servers. The shell is not a generic backdoor but a highly specialized tool tailored for enterprise Product Lifecycle Management (PLM) infrastructure. The malware is described as a fully featured extortion platform. Its core functions include decrypting stored credentials and mapping sensitive vault data, which typically contains proprietary engineering files, CAD drawings, and other intellectual property central to manufacturing and design workflows. This level of specificity suggests the threat actors have a deep understanding of the target environment’s data hierarchy. Given the destructive potential and the focus on high-value industrial data, the deployment is attributed to Clop, a ransomware group known for leveraging zero-day vulnerabilities in file transfer and enterprise software to conduct mass data theft and subsequent blackmail campaigns. Security teams running PTC Windchill or FlexPLM environments are advised to review their server logs for unauthorized JSP file writes and to audit access to credential stores. The original report from ReliaQuest provides additional indicators of compromise and technical details. Source: Original analysis by ReliaQuest, as reported by The Hacker News. URL: https://thehackernews.com/2026/08/clop-linked-windchill-web-shell.html

Title: Microsoft Ties Over 30 Rotating Domains to MacSync Stealer Campaign Summary: Microsoft Defender Experts have identified and linked more than 30 dynamic web domains to the MacSync Stealer, a macOS-specific information stealer. The attribution was achieved by correlating repeated endpoint and network behavioral patterns across shifting infrastructure, allowing researchers to track the malware's lifecycle from initial payload retrieval to data staging and exfiltration. Body: Microsoft's threat intelligence team has published new findings connecting a network of more than 30 rotating domains to the MacSync Stealer, a credential and data-stealing malware targeting macOS systems. According to Microsoft Defender Experts, the attribution relied on aligning multiple endpoint and network signals, rather than a single static indicator. The investigation revealed that the operators behind MacSync Stealer frequently change their hosting infrastructure to evade detection. However, Microsoft observed recurring behavioral consistencies across these domains that linked them to the same malicious operation. These correlations allowed researchers to reconstruct the malware's operational flow, which spans distinct phases: the initial payload delivery, subsequent data collection, local staging of stolen files, and the final exfiltration to attacker-controlled servers. Microsoft noted that definitive attribution required a high-confidence convergence of several behavioral triggers from both the compromised endpoints and the network traffic generated by the malware. While the specific technical details of the behavioral signatures were not fully disclosed, the report emphasizes that the domains were not randomly associated but shared a distinct operational fingerprint with the MacSync Stealer family. Organizations running macOS environments are advised to review their security logs for connections to the identified domains and to monitor for unusual data staging or outbound transfer patterns that align with the described lifecycle. Source: The Hacker News Original Article: https://thehackernews.com/2026/08/microsoft-links-30-rotating-domains-to.html