ACTIVE THREATS: How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface • New Android malware encrypts files, steals data, and harasses victims • Trezor: 347,000 users targeted in phishing attacks after Brevo breach • PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws • China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor ACTIVE THREATS: How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface • New Android malware encrypts files, steals data, and harasses victims • Trezor: 347,000 users targeted in phishing attacks after Brevo breach • PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws • China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
The full HackWire archive — 3,857 stories, newest first.
Lazarus Group escalated Operation Dream Job from LinkedIn phishing to kernel-level espionage, using a Windows zero-day to compromise defense contractors in France, Germany, Brazil, and India. The shift from social engineering to sophisticated nation-state tooling signals serious intelligence-gatheri
Lazarus uses fake job postings with Windows zero-days to target defense contractors. The six-year Operation Dream Job campaign now exploits kernel vulnerabilities, creating serious risks.
Plug and Pwn exploits Windows' Plug and Play to install vulnerable OEM drivers via spoofed USB devices, gaining SYSTEM privileges by abusing a design feature instead of exploiting specific bugs.
Over 737 fake VPN extensions impersonated legitimate services on the Chrome Web Store, routing users' traffic through SOCKS5 proxies controlled by a single operator. Users seeking privacy protection inadvertently exposed all their data to an unknown provider.
Adobe shipped emergency patches for three CVSS 10.0 flaws in ColdFusion and Campaign Classic, enabling unauthenticated remote code execution via OS command and eval injection. On-premise deployments require urgent updates.
Sextortion has evolved from individual shakedowns into a criminal supply chain. Hackers steal explicit content and sell victims' personal data to other criminals, creating cascading re-victimization where victims face multiple rounds of exploitation.
Security researchers discovered that cheaper AI models can reconstruct the hidden reasoning of expensive ones by analyzing their outputs, undermining privacy promises from OpenAI, Anthropic, and Google.
Strong edge defenses aren't stopping attacks—they're just redirecting them. Picus Labs found attackers now exploit the under-defended interior via lateral movement and living-off-the-land tactics.
ShieldBreak exploits Microsoft Defender to grant SYSTEM-level privileges on Windows. Released during Patch Tuesday, it enables rootkit installation and security bypass across all endpoints.
Signal automates key verification to prevent man-in-the-middle attacks, replacing its unused Safety Numbers feature with continuous background checks that ensure contacts' cryptographic keys remain legitimate.
Rapid7's SharePoint PoC was weaponized by attackers within hours of publication. The vulnerability affects authentication systems central to most enterprises, making rapid patching critical.
Fake job applicants exploit gaps between hiring and security to gain access and redirect laptops overseas. Nation-state actors and fraud rings have infiltrated hundreds of U.S. companies this way.
Kimwolf v7 disguises DDoS floods as legitimate HTTP/2 browser traffic using complete fingerprints. The botnet's protocol-level mimicry makes it harder for WAFs and DDoS platforms to detect attacks from real users.
Microsoft released 398 patches this August, headlined by a critical afd.sys zero-day actively exploited by Lazarus Group for privilege escalation. The release also addresses four unauthenticated RCEs and completes a SharePoint exploit-chain fix.
ShieldBreak published PoC code bypassing Microsoft Defender's patch, still achieving SYSTEM-level access on fully updated Windows—suggesting the original fix left the underlying flaw exploitable.
CVE-2026-20349 (CVSS 8.6) allows unauthenticated attackers to crash Cisco ASA/FTD firewalls via malformed HTTP requests. The DoS flaw is actively exploited to disable enterprise perimeter defenses.
SAP Commerce Cloud's Data Hub Adapter has a critical unauthenticated RCE (CVE-2026-58231, CVSS 10.0) allowing attackers to execute arbitrary code and pivot to backend ERP systems. Patch immediately.
Sandworm recruits sysadmins via fake job offers with trojanized WireGuard VPN clients. Compromising admins yields network-wide access to infrastructure—far more valuable than individual endpoints.
DeadLock ransomware shifts to blockchain infrastructure to evade seizures, distributing its command-and-control across thousands of nodes instead of using centralized servers vulnerable to FBI warrants. The strategy reflects lessons learned from law enforcement's successful takedowns of Hive, LockBi
Chrome blocked 7 billion unwanted notifications daily on Android in Q1 2026. The feature, intended for legitimate alerts, became an exploitation channel for malware, phishing, and spam.
Rapid7 disclosed an unauthenticated RCE in SharePoint Server that enables arbitrary code execution. The exploit chain was discovered via AI research; a public PoC was released August 11.
Russian Sandworm targets Ukrainian IT workers with fake job interviews, deploying malicious VPN configs after Zoom calls. The sophisticated campaign may use AI-generated video personas and has been active since May 2026.
Microsoft released an unusually large mandatory Patch Tuesday with 400 vulnerabilities—quadruple the typical monthly rate—alongside minor UX improvements like Voice Isolation and File Explorer fixes. The security fixes, not the new features, are what demand immediate attention from administrators.
Microsoft's August release has 400 patches—triple normal—including three zero-days, one actively exploited. Patch the active zero-day immediately; this unprecedented volume demands a hard look at your monthly cadence's actual speed.