🟣MalwareCRITICAL
Popa Botnet Linked to Publicly-Traded Israeli Firm
Popa botnet infected millions of TV boxes via NetNut proxy service (NASDAQ: Alarum Technologies). The link blurs the boundary between legitimate proxies and botnets.
All Stories
The full HackWire archive — 3,892 stories, newest first.
🔴BreachesHIGH
ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories
Trusted platforms became prime attack vectors this week—23 fake Chrome extensions hit 758K users, Claude chat weaponized for malware, and macOS systems compromised via phishing lures. Attackers now exploit vendor credibility as their primary delivery mechanism instead of breaking systems directly.
🟣MalwareMEDIUM
USB worm spreads crypto-stealing malware via Windows shortcut files
A worm spreads crypto malware via USB drives and Windows shortcuts, targeting Bitcoin, Ethereum, Tron, and Monero wallets since February 2026. It seeks seed phrases for long-term theft.
🟡VulnerabilitiesMEDIUM
Accenture to Acquire Majority Stake in Dragos, All of runZero, NetRise in $4.1 Billion OT Cybersecurity Push
Accenture acquires Dragos, runZero, and NetRise for $4.1B to consolidate industrial cybersecurity, merging OT threat detection, asset discovery, and firmware analysis under the Dragos banner by Q3 2026.
🟡VulnerabilitiesHIGH
Get Out of Security Debt by Tackling the Exposure Problem
Organizations carry year-old vulnerabilities but focus on backlog. Real threat: exposed flaws exploited instantly. Shift to assessing exposure and exploitability, not just inventory reduction.
⚫RansomwareHIGH
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023
INC ransomware, with 830+ victims since August 2023, ranks as the 4th most active RaaS threat. The US-focused group strategically targets legal, manufacturing, and healthcare sectors.
🟣MalwareMEDIUM
Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2
Microsoft uncovered a sophisticated crypto clipper campaign using USB worms and embedded Tor infrastructure to hijack cryptocurrency transactions. The malware self-propagates via malicious shortcuts on USB drives, representing a significant evolution in clipper tactics with remote code execution cap
🔴BreachesHIGH
Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks
Klue's OAuth breach allowed the 'Icarus' extortion gang to steal Salesforce data from enterprises using compromised tokens. Salesforce disabled the integration; affected companies now face extortion demands.
🟡VulnerabilitiesMEDIUM
Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network
Orphaned AI agents—autonomous systems left behind by departing employees with persistent credentials and undocumented access—pose a hidden security risk, operating unmonitored across enterprise infrastructure.
🔴BreachesHIGH
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
Backdoor.Turn tunnels C2 traffic via Microsoft Teams to hide from detection. The DragonForce gang's Go-based RAT provides persistent access while blending with legitimate enterprise traffic.
🔴BreachesHIGH
ShapedPlugin update flow hacked to infect WordPress sites
Attackers compromised ShapedPlugin WordPress plugins via supply chain attack, distributing malicious code through official updates to paying customers. The breach exploited how premium plugins lack WordPress.org's security oversight.
⚫RansomwareHIGH
Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp
Authorities shut down SocGholish, JavaScript malware infecting 15,000 WordPress sites. The operation seized 100+ servers linked to Evil Corp's ransomware campaigns in one of the largest takedowns.
⚫RansomwareHIGH
5 reasons Microsoft 365 backup isnt enough for business data protection
Microsoft 365's native protection prioritizes service continuity over data security, leaving organizations vulnerable to ransomware. Additional backup strategies beyond recycle bins are essential.
🔴BreachesMEDIUM
The Scripts on Your Checkout Page Are Now a PCI DSS Problem
PCI DSS v4.0.1 now mandates merchants audit all third-party checkout scripts after Magecart supply-chain attacks exposed cardholder data at British Airways, Ticketmaster, and other major retailers.
🟡VulnerabilitiesMEDIUM
Microsoft fixes Windows Server 2016 security update failures
Microsoft fixed a Windows Server 2016 update failure caused by missing the May 2026 prerequisite patch. The issue highlights a recurring pattern of deployment problems plaguing multiple Windows versions.
🟡VulnerabilitiesCRITICAL
F5 issues out-of-band patches for critical NGINX vulnerabilities
F5 released emergency patches for critical NGINX vulnerabilities (CVE-2026-42530, CVE-2026-42055) enabling unauthenticated remote code execution and denial-of-service attacks. The flaws affect thousands of enterprise deployments globally; immediate patching is essential.
🔴BreachesMEDIUM
Telegram admits it couldn't police exam-leak channels, India tells court
India blocked Telegram to prevent medical exam leaks and fraud after Telegram admitted inability to detect such abuse. A BGP misconfiguration extended the outage beyond India's borders.
🟡VulnerabilitiesCRITICAL
Apple fixes Beats Studio Buds flaw that let hackers spy on conversations
Apple patched critical Bluetooth flaw CVE-2025-20701 in Beats Studio Buds allowing eavesdropping without pairing. Auto-deployed firmware 1B211 fixes vulnerability affecting nearby attackers.
🟡VulnerabilitiesMEDIUM
SailPoint to Acquire Entro in Reported $200 Million Deal
SailPoint acquired Israeli security startup Entro for $200M, expanding into non-human identity and AI agent security. The deal addresses enterprise demand for machine identity protection as automated agents and service accounts proliferate across infrastructure.
🔴BreachesHIGH
Kodak Admits Data Breach After ShinyHunters Hack Claims
Kodak confirmed a breach by ShinyHunters, claiming stolen corporate records. Though Kodak denies immediate operational threats, the incident reveals persistent security gaps among Fortune 500 firms and corporate transparency issues.
🟡VulnerabilitiesMEDIUM
EU Gets a Head Start in Developing 6G Network Security
EU launches Shield-6G to secure 6G networks with AI threat detection and digital twins, proactively addressing quantum computing and supply chain threats before 2030s deployment.
🔴BreachesMEDIUM
Leak confirms OpenAI is testing a ChatGPT for Science subscription
OpenAI is developing ChatGPT for Science, a specialized subscription targeting researchers and academic institutions. This marks a strategic shift from general-purpose AI toward vertical-specific products for professional markets, positioning OpenAI to dominate specialized domains like scientific re
🔴BreachesMEDIUM
Leak confirms OpenAI is testing a ChatGPT for Science subscription
OpenAI is testing ChatGPT for Science, a subscription tier for researchers featuring enhanced scientific document handling, citation management, and collaborative tools. Expected pricing: $20–$50/month, positioned between ChatGPT Plus and enterprise offerings.
🔴BreachesHIGH
Smashing Security podcast #472: AI gets hacked, and BitLocker gets bypassed
Attackers exploit AI coding assistants via malicious bug reports to extract sensitive data. Organizations adopting AI without proper security are creating new breach vectors for attackers to easily exploit.