Enterprise AI workflows can be vulnerable to misuse that exposes sensitive information without prompt injection, account compromise, or jailbreaking a large language model.

This vulnerability, termed Workflow Identity Hijacking, exploits authorization gaps between external requesters and the privileged identities used by AI automation.

Workflows linked to public-facing email inboxes, web forms, GitHub issues, shared documents, customer support systems, and chat platforms can be at risk.

An attacker might only need to submit an innocuous-looking request for an AI workflow to retrieve and disclose information, leveraging permissions that the attacker does not possess.

For instance, imagine an attacker emailing a company’s public support address, requesting the latest quarterly sales figures mentioned in an executive’s email.

Hackers Turn AI Workflows Into Data-Stealing Proxies

If an AI workflow is designed to read incoming messages, search internal mailboxes or data sources, and respond automatically, it may comply.

The danger lies not in malicious phrasing but in the workflow’s ability to access internal data using a privileged service account or the creator’s credentials. Noma Labs highlights that this creates a covert path for data exfiltration.

The AI model does not need to disregard instructions, bypass safeguards, or engage in unintended actions. Instead, it follows its assigned tasks, while the automation performs downstream actions with excessive privileges.

This issue highlights the distinction between Workflow Identity Hijacking and traditional prompt injection attacks. In a prompt injection attack, the aim is to manipulate the model’s behavior through direct or indirect manipulation.

However, Workflow Identity Hijacking focuses on the legitimacy of the request itself: a chief financial officer may rightfully request sales data, while an anonymous external sender asking the same question is not authorized.

Traditional AI safeguards often fail to differentiate between such requests, as both appear harmless from a language-model perspective.

Input filters and model guardrails detect attempts to alter model behavior but do not necessarily verify whether the requester has the proper permissions.

The core security flaw emerges when the requester’s identity is disconnected from the identity executing the workflow. This allows unauthenticated external users to influence workflows while accessing data through privileged developer API keys, service accounts, or admin-controlled integrations.

AI workflows, unlike agentic workflows which can adaptively select tools and actions to meet goals, are generally predictable. They follow a predetermined process where input enters, an LLM analyzes it, and fixed actions execute afterward.

This deterministic design can create a false sense of security, leading teams to focus on restricting tool use while neglecting static automations linked directly to internal systems.

Even scheduled workflows remain susceptible. If only administrators can configure or launch them, workflows still process inputs from untrusted sources, such as inboxes or ticket queues.

To enhance security, organizations should evaluate AI workflows by identifying the least-trusted party influencing their inputs. Security teams must pinpoint every untrusted content source and specify permissions at each step.

Effective defenses include ensuring the authenticated requester’s identity propagates through the workflow, replacing persistent administrative API keys with short-lived scoped tokens, and enforcing authorization checks before any sensitive actions are taken.

Moreover, companies should treat large language model outputs as untrusted data. Any workflow step that uses model output for actions should involve separate policies and access-control checks.

Sensitive data retrieval should also be distinct from automated external responses to prevent workflows that can access finance records or private emails from sending results to unauthenticated users.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Can Turn AI Workflows Into Privileged Data-Stealing Proxies Without Jailbreaking Models appeared first on Cyber Security News.

Check Point Software has disclosed and patched two critical VPN-related vulnerabilities, CVE-2026-85102 and CVE-2026-85103, both carrying a maximum CVSS score of 9.8 and both capable of allowing unauthenticated remote code execution under specific conditions.

Check Point’s own research team uncovered the flaws, and the company says it has found no evidence of active exploitation or public proof-of-concept code as of this writing.

Check Point VPN Vulnerabilities

CVE-2026-85102 is rooted in improper certificate trust validation during VPN negotiation, tracked under CWE-295. According to Check Point’s advisory sk1000117, the flaw fails to properly validate the trust of a presented certificate, letting an unauthenticated attacker push VPN negotiation far enough to execute arbitrary code on the Security Gateway. This affects both Remote Access VPN and Site-to-Site VPN configurations.

CVE-2026-85103, by contrast, is a heap-based buffer overflow (CWE-122) that occurs while the product parses the ASN.1 structure of a VPN certificate. Detailed in advisory sk1000118, this bug lets a remote attacker trigger the overflow simply by sending a malicious certificate, potentially achieving code execution on both Quantum Security Gateway and Quantum Security Management systems.

The vulnerabilities affect Check Point Security Gateway, Security Management Server, and Spark Firewall deployments across multiple release branches, including R81.20, R82, and R82.10 with Jumbo Hotfix Takes below the newly patched builds, along with several end-of-support versions such as R80.40 and R81. Check Point has confirmed that R82.20 is not affected.

Notably, CVE-2026-85102 primarily impacts Security Gateways engaged in VPN connections, while CVE-2026-85103 spans both gateway and management infrastructure.

Organizations using Check Point Live Patch benefit automatically, since the protective rollout began on September 9, 2026. Administrators without Live Patch enabled must manually install the latest Jumbo Hotfix Accumulator for their branch, specifically R82.10 Take 44 or higher, R82 Take 126 or higher, or R81.20 Take 166 or higher, along with dedicated Spark Firewall builds.

For Site-to-Site VPN deployments that cannot patch immediately, Check Point recommends disabling implied VPN rules and restricting UDP ports 500 and 4500 to known peer IP addresses, though this workaround does not extend to Remote Access VPN, and no interim mitigation exists for locally managed Spark Firewalls.

These newly patched bugs are unrelated to the actively exploited CVE-2026-50751, an IKEv1 authentication bypass tied to Qilin ransomware activity disclosed earlier this year.

Given the critical severity and network-exploitable nature of both new flaws, security teams running Check Point infrastructure should prioritize patching immediately rather than waiting for confirmed in-the-wild exploitation.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks appeared first on Cyber Security News.

LiteLLM deployments can expose far more than an organization’s AI spending. Newly disclosed weaknesses in the open-source gateway could let attackers run code as root inside a container, reach connected tools, and retrieve cloud credentials that open a path into a wider environment.

The risk is serious where the service is internet-facing or retains its example master key. A gateway sits between applications, model providers, internal data, and automation, so its compromise can turn one overlooked service into a central point of failure.

Researchers at Wiz.io identified the issues while examining public LiteLLM installations. Their scan of 3,074 internet-facing instances found that 294, or 9.6%, accepted a default master key or had no authentication enabled.

Wiz.io said in a report shared with Cyber Security News (CSN) that the MCP authentication bypass, tracked as CVE-2026-59822, was observed in the wild through its honeypot systems.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 2, increasing urgency for organizations with reachable instances.

LiteLLM Flaws Let Attackers Execute Code

CVE-2026-59821 affects LiteLLM’s Custom Code Guardrails feature, which lets administrators supply Python-like policies that run around model requests.

Before the fix, the endpoint used to register a guardrail did not apply the safety checks present in the testing interface, allowing supplied code to execute immediately.

The result could be root-level command execution in the LiteLLM container when an attacker had administrative access.

That access may be available where authentication is absent, the default master key remains, or another administrative weakness is abused. Readers can compare it with the earlier LiteLLM admin API flaw, which affected configuration controls.

The RCE requires an authenticated administrator and cannot be reached solely through the MCP bypass. Yet weak deployment settings can remove that barrier.

In releases before version 1.82.0, an unchanged default credential could make the code-execution path effectively available before normal authentication.

The MCP issue creates a different entry point. A meaningless Bearer token could establish a valid session with a connected MCP server, potentially allowing an intruder to use available database, repository, file-system, or workflow tools.

This differs from the LiteLLM RCE exploitation in the wild, which involved another vulnerability chain. LiteLLM corrected the guardrail weaknesses in release 1.82.0 by enforcing an administrator role and applying sandbox protections during registration.

It later fixed the MCP authentication bypass in version 1.84.0. Organizations should identify their version, patch promptly, and check for exposed older containers or test instances.

Cloud Keys at Risk

The findings show why AI gateways require the protection given to other privileged cloud services. LiteLLM may hold provider API keys and communicate with internal systems, while its workload identity can carry permissions to invoke models, read secrets, or interact with other cloud services.

A pass-through feature can forward requests to an administrator-defined destination without checking whether it is an internal address or cloud metadata service. With administrator access, an attacker could use it to obtain temporary AWS IAM credentials.

It is not a standalone vulnerability, but it becomes hazardous when access controls fail. The configuration-update route controlling pass-through settings also lacked an administrator check before version 1.83.0, a separate issue tracked as CVE-2026-35029.

The pattern is reflected in AI infrastructure credential theft, where exposed gateways can bridge attackers to secrets, persistence, and costly resource misuse.

Administrators should replace example credentials with a strong, unique master key and review guardrails for unexpected entries. Restarting the process can clear code retained in memory.

They should audit pass-through settings, restrict container outbound traffic, and apply least-privilege IAM permissions to workload identities.

Remove management interfaces from the public internet and limit access to trusted networks and authenticated administrators.

Rotate provider keys and cloud credentials if an exposed vulnerable instance might have been accessed, then review logs for suspicious administrative activity and unusual outbound requests.

The LiteLLM supply chain exposure likewise shows why gateways need careful configuration, identity, and update control.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials appeared first on Cyber Security News.

Threat actors are increasingly abusing Active Directory replication to impersonate domain controllers and steal password hashes from enterprise networks.

This technique, known as a DCSync attack, can let attackers obtain credential data for privileged accounts without deploying malware directly on a legitimate domain controller.

Active Directory domain controllers manage authentication across Windows enterprise environments. They store account information, password hashes, group memberships, and other identity data.

In organizations with multiple domain controllers, this information is replicated between servers so users can authenticate from different offices and network locations.

Attackers exploit this normal replication process by impersonating a legitimate domain controller. After compromising an account with Domain Admin privileges or replication-related permissions, they can send replication requests to a real domain controller.

Hackers Impersonate Domain Controllers to Steal AD Hashes

The target server may then provide password hash data, believing it is synchronizing information with another authorized server. The attack is commonly associated with the Microsoft Directory Replication Service Remote Protocol, also known as DRSUAPI.

Threat actors can use this protocol to request credential information from Active Directory, including NTLM password hashes. Attackers can crack these hashes offline, reuse them in pass-the-hash attacks, or use them to support further identity compromise.

DCSync activity is especially dangerous because it does not require attackers to dump credentials from the domain controller’s memory. Traditional credential theft often involves tools that access the Local Security Authority Subsystem Service process, or LSASS.

According to Trellix reports, a DCSync attack abuses a built-in Active Directory function, making it harder to distinguish malicious activity from legitimate domain replication traffic.

Once attackers obtain the KRBTGT password hash, the risk becomes significantly more severe. KRBTGT is the account the Kerberos Key Distribution Center uses to sign ticket-granting tickets.

With its hash, attackers may generate forged Kerberos tickets known as Golden Tickets. A Golden Ticket can provide long-term access to an Active Directory environment.

Attackers can forge tickets for highly privileged accounts, access sensitive systems, impersonate users, and maintain persistence even after some passwords are reset.

If an incident is not properly handled, the KRBTGT account may not be reset twice, leaving forged Kerberos tickets valid. Security teams should monitor for Directory Replication Service requests originating from systems that are not approved domain controllers.

Treat a workstation, application server, or user device requesting large volumes of replication data as a high-priority alert. Network Detection and Response platforms can help identify these abnormal communications by analyzing behavior rather than relying only on known malware signatures.

Organizations should also restrict replication rights to required accounts only, review privileged group memberships, and regularly audit accounts assigned replication permissions.

Multi-factor authentication, tiered administrative access, and dedicated privileged access workstations can reduce the chance that attackers obtain domain-level credentials.

DCSync attacks demonstrate why identity infrastructure remains a primary target for cybercriminals. By posing as trusted domain controllers, attackers can turn legitimate Active Directory functions into a pathway for enterprise-wide credential theft and long-term compromise.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency has added a critical Fortinet vulnerability, tracked as CVE-2025-25249, to its Known Exploited Vulnerabilities catalog after confirming evidence of active exploitation.

The flaw affects FortiOS, FortiSwitchManager, and FortiSASE products. It could allow attackers to execute unauthorized code or commands by sending specially crafted packets.

CVE-2025-25249 is a heap-based buffer overflow vulnerability. A heap overflow occurs when an application writes more data into a memory area than it was designed to hold.

This can corrupt adjacent memory and potentially let an attacker alter program behavior, crash a device, or run malicious code with the privileges of the affected service. The issue is associated with CWE-122, heap-based buffer overflow, and CWE-787, out-of-bounds write.

Fortinet security appliances are commonly deployed at enterprise network boundaries, making FortiOS vulnerabilities especially significant.

A successful compromise of an internet-facing firewall, secure access service edge platform, or network-management tool could provide attackers with a foothold for further intrusion activity.

Fortinet Heap-based Buffer Overflow Flaw Exploited

Depending on the deployment, threat actors may attempt to steal credentials, change configurations, establish persistence, or move deeper into internal networks. CISA added the vulnerability to the KEV catalog on September 9, 2026, and set a remediation due date of September 12, 2026.

Federal civilian executive branch agencies must apply vendor-provided mitigations under Binding Operational Directive 26-04, which prioritizes security updates according to exploitation risk.

The agency also requires forensic triage for affected environments, indicating that organizations should investigate for possible compromise rather than treating the issue as a routine patching event.

CISA stated that organizations should follow Fortinet’s mitigation guidance and assess every affected asset for internet exposure. Where a cloud service is involved, stakeholders should follow applicable BOD 26-04 cloud-service guidance.

If no mitigation is available, CISA advises organizations to stop using the affected product. Security teams should identify all FortiOS, FortiSwitchManager, and FortiSASE deployments, prioritizing systems exposed to the public internet.

Administrators should apply the relevant Fortinet fixes or mitigations, review logs for suspicious traffic involving crafted packets, and check for unexpected configuration changes, administrative accounts, VPN activity, or outbound connections.

While CISA has confirmed exploitation, the agency currently lists ransomware use as unknown. Organizations should nevertheless treat the vulnerability as an active intrusion risk and conduct incident-response triage after remediation.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks appeared first on Cyber Security News.

The OpenSSL Project has released OpenSSL 4.1.0 Alpha1, an early preview of its forthcoming feature release. This update adds support for Datagram Transport Layer Security (DTLS) 1.3, GREASE for more resilient TLS deployments, and architecture-specific performance enhancements for post-quantum cryptography operations.

As an alpha release, it is intended for testing and development, not production deployment. Organizations should carefully evaluate application compatibility and performance before upgrading.

A notable addition in OpenSSL 4.1.0 Alpha1 is support for DTLS 1.3, which secures UDP-based communications that are critical for real-time applications like video calls, online gaming, and IoT devices.

This implementation adheres to RFC 9147 and provides TLS-like security while addressing UDP characteristics such as packet loss and reordering. Additionally, DTLS support has been integrated into the SSL listener API, streamlining development for applications managing DTLS connections.

OpenSSL 4.1.0 Alpha1 Released

The release optimizes two post-quantum cryptographic algorithms: ML-DSA (a digital signature algorithm) and ML-KEM (a key-encapsulation mechanism), both designed to resist quantum computing attacks.

With enhancements for Number Theoretic Transform operations on specific architectures, this update is crucial for enterprises engaging in post-quantum TLS, certificate workflows, and high-volume cryptographic services.

Optimizations for x86_64 systems include AVX-512 for SHAKE x4 operations, boosting signature generation and verification throughput. OpenSSL 4.1.0 Alpha1 delivers performance improvements for AES-CBC decryption on x86_64 systems through AVX-512 and VAES optimizations.

The release introduces build targets for Microsoft Visual C++ 2013, enhancing support in older compiler environments. However, it removes support for Windows-on-Itanium and Windows CE build targets.

This release also incorporates GREASE (RFC 8701), which helps identify and address compatibility issues with network devices and TLS implementations that reject unknown protocol values.

By using reserved values in protocol exchanges, GREASE fosters better long-term compatibility in the TLS ecosystem. It also supports the IKEv2 key derivation function (KDF), which is relevant for IPsec VPNs. The updated tsget utility now uses Net::Curl::Easy instead of the abandoned WWW::Curl::Easy to avoid dependency failures.

Additionally, the no-ecdsa and no-ecdh Configure options have been removed, directing administrators to use the no-ec option instead for disabling elliptic-curve cryptography. The release also introduces initial support for the Elbrus2000 (e2k) processor architecture.

Security teams should view this release as a testing opportunity for future OpenSSL compatibility rather than an immediate production upgrade. Recommended actions include testing DTLS 1.3 interoperability and evaluating the impact of these updates on existing systems.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post OpenSSL 4.1.0 Alpha1 Released With DTLS 1.3 and Faster Post-Quantum Cryptography appeared first on Cyber Security News.

Palo Alto Networks has disclosed a high-severity PAN-OS vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on affected PA-Series hardware firewalls.

Tracked as CVE-2026-0310, the flaw exists in XML processing, and the vendor has assigned it the highest suggested urgency. The vulnerability is a buffer overflow, classified as CWE-787 (out-of-bounds write).

An attacker with network access to a vulnerable management web interface or dataplane interface could send specially crafted XML data to trigger the issue.

On PA-Series appliances, successful exploitation may lead to arbitrary code execution as the root user, giving an attacker complete control over the firewall operating environment. Root-level code execution on an enterprise perimeter firewall presents a serious security risk.

A threat actor could potentially alter security policies, inspect or redirect network traffic, deploy persistence mechanisms, steal configuration data, or use the compromised device as a foothold for attacks against internal systems.

Palo Alto PAN-OS Vulnerability

The issue does not require authentication or user interaction, although exploitation has been rated as high complexity. Palo Alto Networks assigned CVE-2026-0310 a CVSS-BT score of 7.2 and a CVSS-B base score of 9.2 for affected PA-Series firewalls.

The vendor noted that the practical risk is greatest for physical firewall appliances because the flaw can result in root-level remote code execution. The impact differs across Palo Alto Networks products. On vulnerable VM-Series firewalls, exploitation is limited to a denial-of-service condition rather than code execution.

A successful attack could crash or disrupt the affected virtual firewall, affecting traffic inspection and availability. Prisma Access and Cloud NGFW environments are also affected.

However, Palo Alto Networks considers the risk lower because exploitation requires an authenticated user and external network access is more restricted.

Affected PAN-OS releases include versions before 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10, depending on the release branch. Numerous maintenance builds across the 10.2, 11.1, 11.2, and 12.1 branches are also vulnerable.

Organizations should upgrade immediately to the appropriate fixed release. Palo Alto Networks recommends PAN-OS 12.2.3 or later for the 12.2 branch.

No workaround is available. However, organizations can reduce exposure by ensuring that firewall management interfaces are not reachable from untrusted networks.

Palo Alto Networks recommends restricting management access to trusted internal IP addresses and, where possible, allowing administration only through a dedicated jump box. The vendor said it discovered CVE-2026-0310 internally and, as of September 9, 2026, is not aware of malicious exploitation in the wild.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Palo Alto PAN-OS Vulnerability Enables Arbitrary Code Execution as Root User appeared first on Cyber Security News.

OpenAI has introduced a “Defense Factory,” an automated, agent-first cybersecurity operation that continuously discovers, validates, and remediates vulnerabilities.

The company says traditional defenses may no longer be sufficient as long-running AI agents can chain exploits and scale attacks using increasingly available open-weight models.

Modern AI agents can operate for extended periods, retain knowledge across sessions, and build a detailed understanding of target systems.

This capability allows them to connect separate weaknesses into complex attack chains that previously required significant human expertise and time.

Attackers could also deploy fleets of agents to scan systems, test vulnerabilities, and pursue exploitation at machine speed. This creates a widening gap between automated attacks and traditional security processes that depend on manual triage, ownership assignment, and remediation.

OpenAI Builds AI Defense Factory

OpenAI says defenders currently possess two structural advantages. Organizations can provide authorized agents with direct access to source code and internal system context, while also using frontier models that are more capable than widely available open-weight alternatives.

This temporary lead represents the “defender’s window.” Organizations must use it to build continuous security operations before autonomous offensive capabilities become more broadly accessible.

A Defense Factory connects AI agents to existing developer and security tools through APIs, command-line interfaces, and Model Context Protocol integrations. These systems can include GitHub, GitLab, Snyk, Semgrep, Tenable, Jira, Linear, and ServiceNow.

Agents follow reusable security workflows to scan, triage, and fix vulnerabilities. They run in isolated, reproducible, ephemeral development environments with the required code, dependencies, services, and configurations.

A control plane manages workload orchestration, policies, and credentials. A separate data plane provides temporary environments where agents reproduce vulnerabilities and test patches. Monitoring, audit logging, and access controls help protect sensitive code and infrastructure.

OpenAI’s defensive loop covers asset inventory, vulnerability discovery, dynamic validation, ownership assignment, and verified remediation.

Shared SECURITY.md files preserve system knowledge, investigation evidence, and testing procedures so agents do not restart every assessment without context.

During an internal security sprint, OpenAI mobilized more than 250 people across more than 100 service areas. Teams closed 53 urgent or high-priority issues on the first day and achieved a 90.6% accepted ownership-assignment rate.

OpenAI said agent-assisted deduplication identified 37% of findings as duplicates, while runtime validation reproduced 19.5% and cut the false-positive rate to 0.81%. Codex generated all remediation patches, with only 0.53% rolled back

OpenAI built autonomy incrementally, beginning with small batches and human review. As workflows became reliable, agents took on more responsibility for routine investigation and remediation.

At the same time, people continued to set boundaries, review consequential changes, and handle exceptions. The company recommends that organizations begin with one workflow rather than automate everything immediately.

Reproducible environments, controlled credentials, strong auditing, and independent verification are essential because a merged patch does not guarantee a fix was deployed correctly across production systems.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post OpenAI Builds ‘Defense Factory’ Where AI Agents Continuously Find and Fix Vulnerabilities appeared first on Cyber Security News.

Mac users seeking AI tools face a malware trap. Attackers are using fake Claude and ChatGPT installers and sponsored search results to push MacSync, a macOS password stealer.

The campaign relies on persuasion instead of a software flaw. A visitor is told that a download, connection, or verification step has failed, then instructed to copy a command into Terminal. That single action gives the attacker a route into the device.

MacSync is a malware-as-a-service operation, meaning its developers supply the tool and infrastructure to other criminal groups. Researchers said the threat emerged in 2025.

The risk goes beyond a stolen password. MacSync is designed to gather browser logins, session cookies, Mac Keychain data, SSH keys, cloud credentials, messaging sessions, and cryptocurrency wallet information.

SEQRITE said in a report shared with Cyber Security News (CSN) that it can also establish lasting access, leaving personal accounts and workplace systems exposed.

Hackers Use Fake Claude and ChatGPT Installers

The first stage often begins with a search for a desktop AI app. Criminals buy or manipulate search placements and send people to pages that imitate Claude AI, ChatGPT, developer tools, or other trusted services.

A previous report on malicious macOS Google ads shows how paid results can steer high-intent users toward a fraudulent AI download page. Instead of providing a normal application package, the page displays a ClickFix prompt.

These prompts may claim a WebSockets connection needs repair, a CAPTCHA must be completed, or an audio problem requires attention. Victims are asked to paste a helpful-looking command into Terminal, starting the infection themselves.

That technique is effective because it turns the user into the final delivery step. Traditional warning signs, such as an unsolicited attachment, may be absent.

The wider pattern was documented in coverage of macOS ClickFix credential theft, where fake verification pages similarly pushed commands to Mac users. After execution, a shell script launches a background component and unpacks the native MacSync stager.

The stager detaches from the Terminal session, suppresses visible output, and retrieves further instructions from attacker-controlled infrastructure. This layered design lets operators change later payloads.

Stealer Collects Data Quietly

MacSync downloads an AppleScript directly into memory and runs it through a built-in macOS automation utility, rather than saving the script as an obvious file.

The script can display a password request that resembles a system dialog, then collect credentials and other data from the compromised Mac.

The malware packages information, including browser vaults and wallet databases, before sending it to its operators in fixed-size pieces.

If a transfer fails, it retries with increasing delays. After a successful upload, it removes temporary material to reduce evidence for users or incident responders.

It can then deploy a remote-access component that uses the macOS launch mechanism to start after login. A helper program may also request screen-recording permission, giving criminals another opportunity to watch activity or capture sensitive content.

The result is a campaign that can move from a fake installer to account takeover and surveillance. The findings fit a broader rise in AI-themed malware delivery.

In another case, a weaponized ChatGPT download site used sponsored results and fake download choices to target both Mac and Windows users. Familiar branding lowers suspicion when people are looking for new tools or quick fixes.

Users should avoid sponsored links when downloading software and go to a vendor’s official website by typing the address or using a trusted bookmark.

They should never paste a command from a web page, chat, ad, or support message into Terminal unless they fully understand it and have independently verified its source.

Security teams should block the listed infrastructure, investigate unexpected command-line activity launched from browsers, and check Macs for unfamiliar launch items and permission requests.

Resetting passwords alone may not be enough after an infection; affected users should revoke active sessions, rotate exposed keys, and have the device examined for persistence.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware appeared first on Cyber Security News.

Nearly one in 10 internet-exposed LiteLLM AI gateways accepted the widely documented default master key, sk-1234, or required no authentication, creating a direct path to LLMjacking, sensitive credential exposure, and in vulnerable versions root-level code execution inside the gateway container. Their internet scan of 3,074 publicly reachable instances found that 294 systems, or 9.6%, accepted […]

The post Hackers Can Turn Vulnerable LiteLLM AI Gateways Into Root Access and Cloud Credential Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Skullcandy Dime 3 wireless earbuds have a serious vulnerability related to unauthenticated Bluetooth pairing. This flaw allows nearby attackers to silently pair with the earbuds, disrupt legitimate audio sessions, and potentially capture microphone audio. This issue, tracked as VU#859658 by the CERT Coordination Center, affects the Skullcandy Dime 3 earbuds (model S2DCW) running firmware version […]

The post Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Microphone appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Threat actors are increasingly exploiting Active Directory replication mechanisms to steal password hashes without directly compromising a domain controller. This technique, known as DCSync, allows attackers with privileged domain credentials to impersonate a legitimate domain controller and request sensitive directory replication data. Unlike noisy attacks that use malware on servers or attempt to extract credentials […]

The post Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Threat actors are exploiting anticipation around Grand Theft Auto VI by pushing fraudulent “leaked” game downloads that install a layered malware bundle that steals browser credentials, Discord tokens, gaming-session data, and cryptocurrency-related information. A Chaos ransomware variant used as a wiper, and an unexpected Yandex Browser installer. The campaign demonstrates how cybercriminals are turning one […]

The post Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A recently disclosed integer-underflow vulnerability in Apple’s modern Mach-O archive parser could allow a malicious static library to crash Xcode build processes or expose process memory through build logs. This flaw affects the parser used by Apple’s newer linker, ld-prime, as well as related developer tools, including libtool, ranlib, and potentially dyld_info. Apple Xcode Integer […]

The post Apple Xcode Integer Underflow Flaw Lets Crafted Archives Leak Memory and Crash Builds appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Palo Alto Networks has announced a high-severity buffer overflow vulnerability in PAN-OS that may allow unauthenticated, network-based attackers to execute arbitrary code with root privileges on affected PA-Series hardware firewalls. This vulnerability is tracked as CVE-2026-0310 and stems from PAN-OS XML processing. It impacts both the firewall management web interfaces and the dataplane interfaces. The […]

The post Palo Alto PAN-OS Buffer Overflow Lets Attackers Execute Arbitrary Code as Root appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A phishing campaign that moves the credential-harvesting page out of attacker-controlled web infrastructure and into the victim’s browser. Unlike ordinary phishing kits, which host cloned login portals on domains that can eventually be detected and disrupted, this campaign delivers malicious content assembled only after a user follows the attack chain. A blob URL is a […]

The post New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

OpenAI has announced its plans for a “Defense Factory,” a cybersecurity operation that prioritizes agent-driven actions. This initiative is designed to continuously discover, validate, remediate, and verify vulnerabilities as AI systems develop the ability to conduct increasingly complex cyber operations. The initiative addresses growing concerns that long-running autonomous agents, especially those powered by widely accessible […]

The post OpenAI Builds ‘Defense Factory’ as AI Agents Gain Ability to Chain Cyber Exploits appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Threat actors are impersonating corporate IT helpdesk staff in an active social-engineering campaign that hijacks Microsoft 365 identities, establishes MFA persistence, and systematically collects data from SharePoint, OneDrive, and Exchange Online. Microsoft Security Research said it has observed the cloud-focused intrusions since May 2026. The activity is marked by unusual sign-ins, attacker-added authentication methods, extensive […]

The post Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Android banking fraud is entering a deceptive phase. Attackers are using malware that copies targeted banking apps into a concealed Android work profile, separating a fraudulent session from warning signs seen on the phone.

The operation begins with Gigabud, an Android remote-access trojan active since 2022. Victims are lured through phishing sites, messaging apps, or social-media posts into sideloading fake airline, tax, or government applications, while fake banking app downloads can turn a brand into a trap.

Group-IB analysts identified Vwork, a modified version of the open-source Shelter app cloner, appearing minutes after Gigabud infections alongside tampered banking applications.

The researchers link the activity to GoldFactory and found compatible samples targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and a Gulf Cooperation Council member state.

Group-IB said in a report shared with Cyber Security News (CSN) that from February through July 2026, researchers observed about 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia, with estimated losses of roughly $960,939.

Those figures reflect observed activity rather than the full scope, but show why Android banking trojan campaigns remain a concern.

Hackers Clone Banking Apps Into Hidden Android Work Profiles

Gigabud first asks for Accessibility access, permission to draw over other apps, and battery-saving exemption. If a victim agrees, operators can remotely control the device, list installed apps, place fake login screens over real banking apps, and capture the device lock-screen code.

The next stage is simple but effective. The operator installs Vwork, which creates an isolated work profile and clones a banking app into it. In a confirmed Indonesian case, the cloned app was a fake version of a bank application.

Android keeps applications in separate profiles isolated. That boundary is intended to protect work and personal data, but attackers use it to make the banking session look new.

A security signal tied to malware in the personal profile may not follow the cloned application into the work profile. The operator can then conduct transactions through the clean-looking profile while hiding activity behind a black screen.

The bank may see a new environment rather than the already-flagged personal profile, weakening the connection between device risk and a fraudulent transfer. Similar hidden remote-control Android attacks demonstrate how control features can be concealed from victims.

Vwork reduces visible clues. Its launcher icon is hidden and cloning functions can be controlled by another app. Gigabud includes commands to initialize Vwork, clone an application, and upload the clone list, showing the tools were designed to work together.

Phishing Delivery and Defensive Signals

An early warning is a consumer phone unexpectedly creating an isolated work profile. A banking app installed across profiles, a nearly empty profile, or a second suspicious installation shortly afterward should raise risk.

For users, the advice is simple: install applications only from official stores, reject Accessibility requests from apps that are not genuine accessibility tools, and use a banking second factor that does not depend on SMS. A raw app file sent through a chat is not a legitimate bank distribution channel.

Banks and wallet providers should bind logins to trusted devices, examine unusual session actions, and block high-risk transactions when an unrecognized app has active Accessibility access. Detection should combine signatures with behavior, rather than assuming one malware alert is enough.

This case underlines a broader shift in mobile fraud. Attackers combine social engineering, overlays, remote access, and Android features meant for legitimate separation. banking PIN theft malware shows how overlays and device control can scale financial theft.

The key lesson is that a clean-looking banking session is not always a clean device. Security teams should treat unexpected work-profile creation, cross-profile application duplication, and accessibility abuse as linked warning signs.

That approach can expose the fraud path before a transfer is completed. It also helps teams distinguish ordinary work use from coordinated account takeover before funds leave an account during urgent financial fraud investigations.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection appeared first on Cyber Security News.

Cybercriminals are using autonomous AI agents to turn compromised cloud systems into fast-moving credential theft platforms.

In one recent case, attackers planned, built, and launched a large-scale campaign in less than six hours, stealing thousands of third-party credentials.

The operation shows how attackers can combine AI coding tools, automated scanning, and cloud resources to work at a speed that previously required a larger team and far more time.

Rather than manually checking systems and fixing errors, the agents handled much of the work themselves. Analysts from Google Cloud identified the activity while tracking the growing use of AI-driven automation in real-world intrusions. 

Google Cloud said in a report shared with Cyber Security News (CSN) that the attackers used an AI coding chatbot, a prompt, and preconfigured instructions to carry out the campaign.

The incident is part of a broader shift in cybercrime. Attackers are increasingly using AI to scan for weaknesses, create phishing content, write malicious code, steal secrets, and maintain access after an initial break-in. This trend makes rapid detection and strong cloud security more important than ever.

Hackers Use Autonomous AI Agents

The financially motivated attackers first compromised an organization’s cloud infrastructure, then used it as the launch point for their operation.

Working from a trusted cloud environment helped their traffic appear more legitimate and made it harder for defenders to quickly separate malicious activity from normal services.

The AI-driven framework used written instruction files as operating playbooks. These instructions guided the agents through vulnerability scanning, credential collection, troubleshooting, and IP address rotation without requiring constant human decisions.

The result was a campaign that harvested credentials at a scale normally associated with much larger criminal groups.

This differs from traditional information stealers, which usually wait for a victim to run malicious software and then collect data from that device.

In this case, the agents actively searched server-side systems, identified weaknesses, and carried out targeted actions against online infrastructure.

The campaign highlights the risks outlined in recent reporting on AI agents breach company networks, where automated agents can map services, locate exposed tokens, and move toward valuable administrative access.

Once valid credentials are collected, criminals can reuse them for cloud access, fraud, espionage, extortion, or additional attacks.

Researchers also found an exposed command-and-control server hosting a separate automated reconnaissance and credential management framework called Recon.

Its dashboard was designed to organize, validate, and manage more than 23,800 stolen secrets in real time, including API keys connected to cloud and AI services.

The source report illustrates how attackers combined compromised cloud resources, AI-generated instructions, automated scanning, and credential harvesting into a single accelerated operation.

Cloud and Developer Systems Face Growing Risk

The attack demonstrates why cloud credentials and developer environments have become high-value targets. A single exposed access token can give attackers a trusted path into cloud services, source code repositories, automation pipelines, and sensitive business data.

The risks are similar to those described in stolen cloud credentials attacks, where valid keys can let intruders enter as approved users.

AI coding environments can create additional openings when developers download unsafe packages, clone altered repositories, or allow tools to process untrusted workspace files.

In related activity, the UNC6780 group used compromised developer accounts to distribute trojanized resources and targeted CI/CD environments for authentication tokens.

The DUSTMAKER credential stealer was also observed hiding files inside common AI coding workspace directories.

It could use malicious configuration files to influence an assistant into running scripts during routine development work, while fake pipeline tasks disguised as AI utilities searched for extra tokens and keys.

Organizations should treat AI tool configurations, developer tokens, and cloud API keys as sensitive credentials.

Security teams should rotate exposed keys quickly, apply least-privilege permissions, protect CI/CD runners, review third-party dependencies, and investigate unexpected automation tasks or workspace configuration changes.

Teams should also monitor cloud activity for unusual API calls, unfamiliar service accounts, unexpected public services, and suspicious outbound scanning.

Guidance from coverage of typosquatted npm package theft shows why dependency checks and secret scanning remain essential for development teams.

The findings do not mean autonomous exploitation is now common across every intrusion. However, they show that AI agents can reduce the delay between compromise and credential theft.

Defenders need controls that can detect abuse at the same pace, especially as attackers continue combining AI automation with familiar methods such as stolen credentials, exposed services, and malicious packages.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Autonomous AI Agents to Launch Mass Credential Theft Attacks in Under 6 Hours appeared first on Cyber Security News.