Threat Intelligence

An unknown threat actor has compromised 953 online stores, the majority of which run Magento, in a campaign that has been active since July 2025. The activity was detailed by Dutch e-commerce security firm Sansec, which describes the operation as designed to inject a small piece of code into store pages so that malicious JavaScript loader code is served to unsuspecting visitors through Magento CMS blocks. The loader is reportedly built to evade detection by scanners, making it harder for store operators and security tools to spot the compromise through routine checks. Sansec notes the campaign has persisted for months, suggesting the attackers are maintaining access across a large number of storefronts rather than conducting a short-lived burst of activity. Key facts so far: 953 online stores infected Most affected stores run Magento Campaign active since July 2025 Malicious JavaScript loader delivered via Magento CMS blocks Code is designed to evade scanner detection Store owners running Magento should review their CMS blocks for unexpected or obfuscated code and audit recent administrative changes, particularly anything dating back to July 2025. Given the scanner-evading nature of the loader, manual inspection of page content and block configurations is advisable rather than relying solely on automated scanning. Source: The Hacker News Is your organization running Magento, and have you checked your CMS blocks for signs of this loader?

There is likely an AI agent running on a laptop somewhere in your network right now. It stores API keys and database passwords, can reach internal systems, and operates without anyone watching it. Nobody reviewed its access. Nobody owns it. If a human employee had that much reach with that little oversight, most organizations would classify it as an insider risk. Yet many teams still treat the agent as just another productivity tool. That gap between the access an agent holds and the accountability behind it is the focus of an expert webinar from The Hacker News, which examines how these unmanaged agents become an organization's newest insider threat. Key points to consider about the risk: AI agents can hold credentials such as API keys and database passwords They may have access to internal systems with little or no oversight Often no one has formally reviewed their permissions In many cases, no single person or team is accountable for them If you want the full expert breakdown, the webinar is available through the source link below. Source: The Hacker News Does your organization know which AI agents are running on employee machines and what credentials they hold?

ConnectWise has disabled seven application identities as it investigates an incident where unknown threat actors gained unauthorized access to those identities and compromised Microsoft 365 tenants. The company disclosed the update on Saturday, confirming the investigation is ongoing. The disabled application identities include: ConnectWise Cloud Backup — 506e08f9-6e9a-4da4-942b-a099a03644ae Additional ConnectWise application identities, based on the list published by the company The company has not publicly detailed how the identities were obtained or the full scope of the affected tenants. The suspension of Cloud Backup appears to be a containment measure while the investigation proceeds. Organizations using ConnectWise products — particularly those integrated with Microsoft 365 — should review their tenant configurations and monitor for any unauthorized application access or activity tied to the listed identity. Source: The Hacker News Are any members running ConnectWise Cloud Backup in their environments, and have you taken steps to audit your M365 application identities since this disclosure?

The U.S. Department of Justice has charged 14 individuals and seized roughly 187 computers and KVM devices as it moves to disrupt a North Korean remote IT worker scheme. The defendants include a mix of U.S. citizens and Chinese nationals, accused of participating in an IT worker conspiracy that affected more than 70 U.S. companies. The charges filed include wire fraud. Authorities also shut down more than 40 laptop farms tied to the operation, which used the machines and KVM hardware to make overseas workers appear as though they were connecting from within the United States. The action is part of the DoJ's broader effort to counter North Korea's use of fraudulent remote IT employment to generate revenue. Affected organizations should review their remote hiring and identity verification processes, with particular attention to: Device and IP geolocation inconsistencies during onboarding and day-to-day work Contractors or remote staff routed through third-party intermediaries Shared or proxied access to corporate systems via KVM setups Source: [email protected] (The Hacker News) Has your organization reviewed its remote contractor verification process in light of these laptop farm takedowns?

Microsoft, working alongside Health-ISAC, the Japan Cybercrime Control Center (JC3), and a coalition of private sector partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, has announced the disruption of three phishing kits. The kits are tracked as CoGUI (also known as NX or FA), Haozi (also known as Phoenix), and Iron Man System. According to the announcement, the threat actors behind these kits have been responsible for a massive volume of scam messages since January 2026 — collectively linked to over 1 billion fraudulent messages. Key details from the disclosure: Three phishing kits disrupted: CoGUI (aka NX / FA), Haozi (aka Phoenix), and Iron Man System Operation involved Microsoft, Health-ISAC, JC3, and private partners Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs The actors behind these kits have driven scam message campaigns since January 2026 The kits are tied to more than 1 billion scam messages The disruption highlights the ongoing value of cross-industry collaboration between technology vendors, threat intelligence firms, and regional cybercrime authorities in dismantling phishing infrastructure at scale. Source: The Hacker News Has your organization seen any activity tied to these phishing kits, and what detection or mitigation steps are you taking?

The credential-theft campaign tracked as GhostAction has intensified, with activity targeting more than 30,000 repositories belonging to roughly 3,000 users and organizations. According to GitGuardian, the spike in malicious activity was observed on October 8 and 9, 2026. The surge stemmed from the compromise of approximately 1,900 GitHub accounts. From there, the attackers attempted to extract 3,174 secrets from continuous integration (CI) workflows in public repositories. The campaign highlights the growing risk posed by abused CI pipelines, where stolen credentials can be harvested at scale from exposed repository automation. Key points: Roughly 1,900 GitHub accounts compromised Over 30,000 repositories targeted About 3,000 users and organizations affected 3,174 secrets targeted for extraction from public repository CI Developers and organizations should review their GitHub account security, audit CI workflow permissions, and rotate any credentials that may have been exposed through repository automation. Source: The Hacker News Has your organization reviewed its CI workflow permissions and secret exposure in response to this campaign?

Cybersecurity researchers have uncovered a malicious npm package tied to a recently disclosed software supply chain attack campaign tracked as MALFEX. The package, named imgdecode, was uploaded to the npm registry on September 30, 2026, by a user operating under the name malfexteste8. According to the researchers, the package conceals a shellcode loader within a Windows native addon, allowing malicious code to be loaded through what appears to be a legitimate library component. At the time of reporting, imgdecode had been downloaded 979 times and remained available on npm. The report does not specify a CVE identifier for this package. Key details: Package name: imgdecode Registry: npm Upload date: September 30, 2026 Publisher account: malfexteste8 Download count: 979 as of writing Status: still available on npm as of writing Technique: shellcode loader hidden in a Windows native addon If your organization relies on npm dependencies, it is worth checking whether imgdecode appears in your lockfiles or dependency trees, and reviewing any installs tied to the malfexteste8 publisher account while the package remains live. Source: The Hacker News Has your team audited its npm dependencies for this package or other artifacts linked to the MALFEX campaign?

Researchers are tracking an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 credential tied to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customer M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs). According to the reporting, the stolen credential was used to sign in to 173 Microsoft 365 tenants. Because the service is designed for MSPs, a single compromised credential can potentially expose the environments of many downstream customers at once, which is what makes this campaign notable. Key points from the report: The credential belongs to ConnectWise Cloud Backup, previously known as SkyKick. Attackers used it to authenticate into customer Microsoft 365 environments. Sign-ins were recorded across 173 tenants. The actors behind the campaign remain unknown. No specific CVE ID or advisory identifier was provided in the source report. If your organization uses ConnectWise Cloud Backup or works with an MSP that does, it is worth reviewing tenant sign-in logs and auditing access associated with the service. No formal mitigation guidance beyond that was included in the reporting. Source: The Hacker News Does your organization rely on ConnectWise Cloud Backup or an MSP that does, and have you checked your tenant logs since this report?

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign targeting individuals affiliated with Taiwan research organizations. The operation, tracked as UAT-11985, uses fake event invitations to lure victims toward an adversary-in-the-middle (AitM) phishing framework built to harvest Google account credentials and multi-factor authentication (MFA) codes. The campaign relies on social engineering rather than software exploits. Targets receive what appear to be legitimate event invites, and clicking through redirects them to a phishing page that proxies the real Google login flow. Because the victim interacts with a live, proxied session, the attackers can capture both passwords and the MFA codes entered during authentication — a technique that defeats many forms of MFA, including one-time passcodes and push-based prompts. Key points from the disclosure: The threat actor is tracked as UAT-11985. The targeting focuses on people affiliated with Taiwan research organizations. Initial contact comes via fake event invitations. The credential harvesting is performed through an AitM phishing framework impersonating Google. Both account credentials and MFA codes are at risk of being captured. Additional technical details, including any specific indicators of compromise or mitigation guidance, were not included in the available reporting. Organizations and individuals in research-focused roles should treat unexpected event invitations — especially those leading to login pages — with heightened suspicion, and should verify links before authenticating with any account. Source: The Hacker News Has anyone in your organization received similar fake event invites, and how are you handling verification of external links?

A new class of AI model has emerged almost overnight, and it is already reshaping how AI-driven security operations center platforms are built. These models are designed for rapid decision-making rather than long-form reasoning, a distinction drawn from Kahneman's concept of fast, intuitive thinking. TypeSafe AI released a model called Jev on September 15, describing it as a System One model. Shortly after, OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl also published cribl-decision, an open LoRA adapter that can be run locally. Other players, such as Laya, are entering the same space. The article does not provide specific CVE identifiers, affected version numbers, indicators of compromise, or mitigation steps, so none are listed here. Key developments at a glance: TypeSafe AI launched Jev on September 15, positioned as a System One model. OpenAI introduced a Decisions API, with a public beta starting October 6. Cribl released cribl-decision, an open LoRA adapter for local deployment. Laya and other vendors are also pursuing this category. Source: The Hacker News How do you see fast decision models changing the way SOC platforms triage and respond to alerts?

A newly detailed proxyjacking campaign has compromised D-Link and Ubiquiti devices across 34 countries, quietly monetizing victims' internet connections by routing traffic through a commercial residential proxy network. Rather than stealing data or demanding a ransom, the operators sell access to the hijacked bandwidth, turning infected routers and similar hardware into an illicit revenue stream. The campaign abuses known weaknesses in these devices to gain a foothold, after which the equipment is enrolled into the proxy network without the owners' knowledge. Because the activity blends into normal outbound traffic, affected organizations may not notice anything unusual until they investigate unexplained bandwidth consumption or suspicious connections. Security teams should consider the following precautions: Review D-Link and Ubiquiti devices for unauthorized configuration changes or unexpected outbound traffic. Apply the latest firmware updates and replace hardware that no longer receives vendor support. Disable remote management and default credentials where possible, and restrict administrative access to trusted networks. Monitor network egress for connections to residential proxy infrastructure and investigate anomalies promptly. Source: BleepingComputer Has your organization audited its edge devices for signs of proxyjacking, or do you rely on vendor firmware updates alone?

The U.S. Department of Justice has disrupted the Famous Chollima threat group's operations, arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops tied to North Korean remote IT worker schemes. The raids targeted laptop farms in Texas, where U.S. nationals were arrested for allegedly facilitating the infrastructure that let DPRK operatives pose as legitimate remote employees. These operations typically involve North Korean IT workers infiltrating Western companies under false identities, often using stolen credentials and proxy networks to appear as domestic hires. The seized laptops were reportedly used to route traffic and maintain persistent access to employer systems, generating revenue for the regime while potentially enabling espionage or extortion. Arrests: 2 suspects taken into custody Charges: 14 individuals charged Seizures: Nearly 187 laptops confiscated Location: Laptop farms raided in Texas Group: Famous Chollima (DPRK-linked) Mitigation for organizations includes stricter identity verification during hiring, monitoring for unusual remote access patterns, and auditing device compliance for contractor and remote staff. Source: BleepingComputer Does your organization have controls in place to detect fraudulent remote IT workers, or is this a gap you are still addressing?

Cybersecurity researchers have disclosed details of a two-pronged, AI-augmented initial access campaign attributed to a threat actor tracked as CyberXero. The operation targeted WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine, and resulted in the theft of more than 628,000 Ukrainian records. What sets this campaign apart is its use of an AI orchestration layer built on Anthropic's Claude Code, combined with commodity offensive tooling such as Cobalt Strike. Rather than relying solely on conventional tradecraft, the attackers appear to have used the AI component to coordinate and scale their initial access efforts across multiple victim types. Key points from the disclosure: The campaign is described as two-pronged, meaning it pursued more than one infection or intrusion path. Targeted sectors include WordPress installations, e-commerce platforms, and critical infrastructure organizations in Ukraine. The toolset blends widely available offensive tools (Cobalt Strike) with an AI orchestration layer powered by Claude Code. More than 628,000 Ukrainian records were stolen over the course of the activity. The researchers have attributed the campaign to CyberXero. As with any initial access operation of this kind, organizations in the affected sectors should review their exposure, particularly internet-facing WordPress and e-commerce systems, and monitor for signs of Cobalt Strike activity in their environments. Source: The Hacker News Has your organization reviewed its WordPress and e-commerce attack surface in light of this campaign?

An active supply-chain campaign is targeting GitHub Actions workflows, and researchers at StepSecurity have published details on an operation that has already reached a significant scale. According to the disclosure, two high-profile open-source maintainer accounts were compromised and used to inject a malicious workflow into more than 340 repositories. The attack unfolded through trusted maintainer identities. Using the account of Takashi Kitao, the author of the pyxel game engine, which has around 18,400 stars on GitHub, the attacker pushed a malicious workflow into 27 repositories beginning at 13:20 UTC. The campaign is characterized as ongoing, with the goal of stealing credentials from systems that execute the tampered workflows. Key points from the disclosure: The campaign targets GitHub Actions workflows in open-source projects. Two high-profile maintainer accounts were compromised. More than 340 repositories have been affected. The pyxel project, a game engine with roughly 18,400 stars, was among those used as a vector. 27 repositories received the malicious workflow starting at 13:20 UTC. The activity is described as an ongoing credential-theft operation. For maintainers and organizations relying on CI/CD pipelines, this is a reminder that compromise of a single trusted account can propagate quickly across many downstream repositories. Anyone with workflows tied to affected projects should review recent workflow changes and treat credentials accessible to those runners as potentially exposed. Source: The Hacker News Has your organization audited its GitHub Actions workflows and maintainer account security in light of this campaign?

Cybersecurity researchers have disclosed details of a human-operated phishing platform that impersonates advertising products for AI chatbots including Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. The fake products claim to offer campaign optimization, spend audits, and business-account connections, but are designed with a single purpose: capturing credentials and multi-factor authentication (MFA) codes from unsuspecting users. Because the operation is human-operated rather than fully automated, attackers can adapt in real time to victims' responses, making the deception harder to detect than static phishing pages. Key points to be aware of: The campaign targets users of Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus Lures revolve around advertising features such as campaign optimization, spend audits, and business-account connections The platform is described as human-operated, meaning live attackers likely guide victims through the process The primary objective is theft of login credentials and MFA codes At this stage, no specific CVE IDs, KB numbers, or advisory identifiers have been provided in the source reporting, so defenders should focus on user awareness and monitoring rather than signature-based detection. Anyone managing accounts tied to these AI platforms should verify advertising or business-related communications through official channels only, and treat unsolicited requests to "connect" an ad account or review ad spend as suspicious by default. Source: The Hacker News Has your organization seen any suspicious ad-related outreach impersonating AI chatbot vendors, and how are you handling verification?

A newly observed campaign is targeting advertising account managers by impersonating popular AI platforms. The operation uses fake ChatGPT, Gemini, Claude, and Perplexity sites to harvest login credentials and multi-factor authentication (MFA) codes, relying on browser-in-browser attack techniques to make the fraudulent pages appear legitimate. According to the reporting, victims are lured to the spoofed sites and prompted to sign in, at which point the stolen credentials and MFA codes are captured. The attackers appear to be focused specifically on advertising accounts, which can be abused for malicious ad campaigns or resold. Key points: The campaign impersonates ChatGPT, Gemini, Claude, and Perplexity. It targets advertising account managers. Browser-in-browser attacks are used to make fake login windows look genuine. Both login credentials and MFA codes are stolen. There is no specific CVE or advisory identifier cited in the source for this campaign, so none is included here. Users managing ad accounts should treat unsolicited links to AI login pages with caution and verify they are on the legitimate domain before entering credentials or MFA codes. Source: Publication Name Has anyone in the community seen similar browser-in-browser lures targeting ad account teams, and what steps are you taking to verify login pages?

Cybersecurity researchers have uncovered a supply chain campaign involving 101 malicious npm packages designed to silently enroll developers into WhatsApp groups. The operation has been dubbed PhantomSub by OX Security, whose researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko detailed the findings in a technical report. According to the researchers, the packages abuse the Baileys WhatsApp open source project to add victims to groups without their consent, effectively turning compromised developer environments into a subscriber funnel for the campaign. Key points from the report: 101 packages were identified as part of the PhantomSub cluster The packages leverage the Baileys WhatsApp library to perform unauthorized group additions Victims are added to WhatsApp groups without any consent or interaction The activity was attributed to a coordinated subscriber campaign rather than an isolated incident Developers who maintain npm dependencies should review their installed packages for anything matching this cluster and remove or replace suspicious modules. Since the malicious functionality centers on the WhatsApp integration provided by Baileys, any project that unexpectedly pulls in that library as a dependency warrants closer inspection. Source: The Hacker News Has anyone audited their project dependencies for packages tied to this PhantomSub cluster, and if so, what did you find?

A China-nexus cyber espionage group tracked as TA419 has been linked to a series of credential phishing campaigns aimed at artificial intelligence experts at U.S. think tanks, universities, and legal sector organizations. The activity impersonated prominent economists, AI policymakers, and a well-known Anthropic employee in order to single out an AI policy expert, according to reporting from The Hacker News. The campaigns reportedly rely on Microsoft adversary-in-the-middle (AitM) phishing techniques, a method that lets attackers capture credentials and session tokens by positioning themselves between the victim and the legitimate authentication service. This approach can allow threat actors to bypass standard multi-factor authentication protections, making it especially dangerous for high-value targets in policy and research roles. Key points from the reporting: TA419 is assessed as a China-aligned espionage actor. Targets include AI experts at U.S. think tanks, universities, and legal organizations. The group impersonated prominent economists, AI policymakers, and an Anthropic employee. The campaigns used Microsoft AitM phishing to harvest credentials. Organizations with staff involved in AI policy, research, or related legal work should treat unsolicited messages purporting to come from well-known figures in the AI space with heightened suspicion. Verifying sender identities through out-of-band channels and enforcing phishing-resistant authentication where possible remain important defenses against AitM-style attacks. Source: The Hacker News Does your organization have visibility into AitM phishing attempts targeting your identity provider, and are you using phishing-resistant MFA to mitigate them?

Researchers at ANY.RUN have published findings on a US-focused phishing campaign tracked as CSuite, after analyzing 351 sandbox submissions, 51% of which originated from the United States. Organizations in technology, manufacturing, government, and consulting recorded the highest exposure. The campaign is notable for chaining two techniques: stealing Microsoft 365 sessions and deploying remote monitoring and management (RMM) tooling to establish remote access. That combination allows attackers to escalate a single phishing incident into broader account compromise and fraud rather than a one-off credential grab. Key points from the research: 351 sandbox analyses were reviewed to trace the campaign. 51% of submissions came from the United States, confirming the US-focused targeting. Most exposed sectors: technology, manufacturing, government, and consulting. Attack chain combines Microsoft 365 session theft with RMM tool deployment for persistent remote access. Defenders should treat unusual RMM installations and anomalous Microsoft 365 session activity as high-priority signals, particularly in the sectors listed above. Session tokens can bypass password-based controls, so revoking active sessions and enforcing conditional access matter as much as credential resets. Source: [email protected] (The Hacker News) Has your organization seen unexpected RMM tool installs or suspicious Microsoft 365 session activity that could match this pattern?

Microsoft has issued a warning about phishing campaigns that deliver a legitimate installer for MSP360 Remote Monitoring and Management (RMM) software. The attacks rely on social-engineering lures such as fake meeting invitations, PDF-themed decoys, and software update prompts to trick users into running the installer. According to the report, once executed, the legitimate MSP360 installer — distributed under a deceptive file name — established remote management access on the affected system. The campaign is notable for its dual-RMM approach: after gaining a foothold via MSP360, the attackers were observed deploying ScreenConnect as a second remote access tool. Key points from the reporting: Attackers distribute a genuine, signed MSP360 RMM installer rather than custom malware, which can help evade detection. Lures include meeting invitations, PDF-themed content, and software update prompts. The installer is given a deceptive file name to appear benign. Successful execution grants remote management access to the victim machine. ScreenConnect is then deployed as an additional RMM tool, creating a dual-RMM foothold. Because the tooling involved is legitimate software, defenders should focus on monitoring for unauthorized RMM installations, unusual remote-management traffic, and installer executions that do not match approved software deployment processes. Source: The Hacker News Has your organization seen unexpected RMM installers like MSP360 or ScreenConnect appearing outside of approved deployment channels?