ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Americans lost $14 billion to AI-enhanced cryptocurrency scams in 2023-24, with the FBI warning of explosive growth. AI amplifies fraud through deepfakes, personalized targeting, and automation, making scams more convincing and scalable while dramatically lowering barriers to entry for criminals.
OpenAI's new $100/month ChatGPT Pro matches Anthropic's Claude Pro, intensifying premium AI competition. It adds advanced reasoning, higher usage limits, priority access, and extended context windows.
Hims' breach exposed sensitive PHI for hundreds of thousands—prescriptions, diagnoses, payment data, genetic info—creating major fraud and identity theft risks.
Modern breaches hide in plain sight by mimicking routine business activity. Attackers now prioritize stealth and long-term access (averaging 204 days undetected) over dramatic exploits, using legitimate credentials to evade traditional security defenses.
FINRA launched the Financial Intelligence Fusion Center to centralize threat intelligence collection from member firms, regulators, and law enforcement. The center aggregates data to identify attack patterns, issues real-time alerts, and coordinates defenses against evolving cyber and fraud threats
CPUID was compromised, redirecting CPU-Z and HWMonitor downloads to serve malware. This supply chain attack impacted millions of users relying on official software sources.
Iranian state-linked threat actors have mapped ~4,000 Internet-exposed Rockwell Automation industrial controllers controlling US critical infrastructure like power grids and water systems. The systematic targeting suggests strategic staging for future large-scale cyberattacks on essential services.
Iran-attributed groups escalate ICS attacks on critical infrastructure. They've shifted from random scanning to highly targeted intrusions with sophisticated multi-stage operations.
Anthropic's Claude can write working exploits for known vulnerabilities, making it valuable for security researchers but risky if accessed by threat actors. The company faces a classic dual-use dilemma: restrict access to enhance safety or enable broader use for legitimate defensive research.
MITRE released the Fight Fraud Framework, cataloging tactics to defend against identity theft and payment fraud. It provides ATT&CK-style methodology for fraud prevention.
Chrome 147 patches 60 vulnerabilities including 2 critical flaws worth $86,000 in bounties. The critical issues pose severe risks like remote code execution but no public exploits are confirmed yet.
Juniper patched 40+ vulnerabilities in Junos OS including critical RCE flaws affecting enterprise routers and switches. Enterprise networks must balance urgent patching with the high cost of downtime.
Industrial control systems face unprecedented state-sponsored cyber threats. Organizations operate outdated SCADA with inadequate security, threatening global critical infrastructure.
CPUID's distribution was compromised, injecting malware into official CPU-Z and HWMonitor packages. Users downloading these widely-trusted system tools unknowingly received malicious versions.
CISA's analysis of a billion records shows actively exploited vulnerabilities now outpace human patching capacity. Organizations can't defend manually anymore—the velocity of new exploits exceeds any team's ability to respond.
Attackers target Canadian employees with phishing and social engineering to compromise payroll accounts. Once inside, they access financial systems and sensitive employee data for direct profit.
A critical, pre-authentication RCE in Marimo (CVSS 9.3) was actively exploited hours after disclosure, enabling arbitrary code execution without credentials. Immediate patching is mandatory for all Marimo deployments, especially those accessible from untrusted networks.
AI browser extensions let employees bypass IT controls to send sensitive corporate data to external AI services. Most organizations have no visibility into which extensions employees use or where data flows.
Gmail's new mobile encryption (iOS/Android) lets enterprises send secure emails natively without external tools. This closes the security gap that previously exposed mobile communications to interception attacks and regulatory violations.
Nextend's update servers were compromised, distributing backdoored Smart Slider 3 Pro to thousands of WordPress sites. Attackers exploited the trusted update mechanism to inject malware undetected.
Microsoft discovered a critical Android crypto wallet vulnerability affecting millions of users that bypasses authentication and enables account takeover. The flaw stems from insecure token storage and improper Android security API implementation, allowing attackers to steal digital assets remotely.
A critical unauthenticated RCE in Marimo, a popular Python notebook framework, was weaponized by attackers within 9 hours of public disclosure. This rapid exploitation highlights the dangerously shrinking window organizations have to patch critical vulnerabilities before active attacks begin.
Google released Device Bound Session Credentials in Chrome 146 to prevent session hijacking. The feature binds credentials to devices, blocking theft from malware and network attacks.
Google is launching cookie theft protections in Chrome to prevent session hijacking. Stolen cookies enable attackers to bypass authentication and access user accounts without passwords.