Enterprise AI workflows can be vulnerable to misuse that exposes sensitive information without prompt injection, account compromise, or jailbreaking a large language model.

This vulnerability, termed Workflow Identity Hijacking, exploits authorization gaps between external requesters and the privileged identities used by AI automation.

Workflows linked to public-facing email inboxes, web forms, GitHub issues, shared documents, customer support systems, and chat platforms can be at risk.

An attacker might only need to submit an innocuous-looking request for an AI workflow to retrieve and disclose information, leveraging permissions that the attacker does not possess.

For instance, imagine an attacker emailing a company’s public support address, requesting the latest quarterly sales figures mentioned in an executive’s email.

Hackers Turn AI Workflows Into Data-Stealing Proxies

If an AI workflow is designed to read incoming messages, search internal mailboxes or data sources, and respond automatically, it may comply.

The danger lies not in malicious phrasing but in the workflow’s ability to access internal data using a privileged service account or the creator’s credentials. Noma Labs highlights that this creates a covert path for data exfiltration.

The AI model does not need to disregard instructions, bypass safeguards, or engage in unintended actions. Instead, it follows its assigned tasks, while the automation performs downstream actions with excessive privileges.

This issue highlights the distinction between Workflow Identity Hijacking and traditional prompt injection attacks. In a prompt injection attack, the aim is to manipulate the model’s behavior through direct or indirect manipulation.

However, Workflow Identity Hijacking focuses on the legitimacy of the request itself: a chief financial officer may rightfully request sales data, while an anonymous external sender asking the same question is not authorized.

Traditional AI safeguards often fail to differentiate between such requests, as both appear harmless from a language-model perspective.

Input filters and model guardrails detect attempts to alter model behavior but do not necessarily verify whether the requester has the proper permissions.

The core security flaw emerges when the requester’s identity is disconnected from the identity executing the workflow. This allows unauthenticated external users to influence workflows while accessing data through privileged developer API keys, service accounts, or admin-controlled integrations.

AI workflows, unlike agentic workflows which can adaptively select tools and actions to meet goals, are generally predictable. They follow a predetermined process where input enters, an LLM analyzes it, and fixed actions execute afterward.

This deterministic design can create a false sense of security, leading teams to focus on restricting tool use while neglecting static automations linked directly to internal systems.

Even scheduled workflows remain susceptible. If only administrators can configure or launch them, workflows still process inputs from untrusted sources, such as inboxes or ticket queues.

To enhance security, organizations should evaluate AI workflows by identifying the least-trusted party influencing their inputs. Security teams must pinpoint every untrusted content source and specify permissions at each step.

Effective defenses include ensuring the authenticated requester’s identity propagates through the workflow, replacing persistent administrative API keys with short-lived scoped tokens, and enforcing authorization checks before any sensitive actions are taken.

Moreover, companies should treat large language model outputs as untrusted data. Any workflow step that uses model output for actions should involve separate policies and access-control checks.

Sensitive data retrieval should also be distinct from automated external responses to prevent workflows that can access finance records or private emails from sending results to unauthenticated users.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Can Turn AI Workflows Into Privileged Data-Stealing Proxies Without Jailbreaking Models appeared first on Cyber Security News.

Check Point Software has disclosed and patched two critical VPN-related vulnerabilities, CVE-2026-85102 and CVE-2026-85103, both carrying a maximum CVSS score of 9.8 and both capable of allowing unauthenticated remote code execution under specific conditions.

Check Point’s own research team uncovered the flaws, and the company says it has found no evidence of active exploitation or public proof-of-concept code as of this writing.

Check Point VPN Vulnerabilities

CVE-2026-85102 is rooted in improper certificate trust validation during VPN negotiation, tracked under CWE-295. According to Check Point’s advisory sk1000117, the flaw fails to properly validate the trust of a presented certificate, letting an unauthenticated attacker push VPN negotiation far enough to execute arbitrary code on the Security Gateway. This affects both Remote Access VPN and Site-to-Site VPN configurations.

CVE-2026-85103, by contrast, is a heap-based buffer overflow (CWE-122) that occurs while the product parses the ASN.1 structure of a VPN certificate. Detailed in advisory sk1000118, this bug lets a remote attacker trigger the overflow simply by sending a malicious certificate, potentially achieving code execution on both Quantum Security Gateway and Quantum Security Management systems.

The vulnerabilities affect Check Point Security Gateway, Security Management Server, and Spark Firewall deployments across multiple release branches, including R81.20, R82, and R82.10 with Jumbo Hotfix Takes below the newly patched builds, along with several end-of-support versions such as R80.40 and R81. Check Point has confirmed that R82.20 is not affected.

Notably, CVE-2026-85102 primarily impacts Security Gateways engaged in VPN connections, while CVE-2026-85103 spans both gateway and management infrastructure.

Organizations using Check Point Live Patch benefit automatically, since the protective rollout began on September 9, 2026. Administrators without Live Patch enabled must manually install the latest Jumbo Hotfix Accumulator for their branch, specifically R82.10 Take 44 or higher, R82 Take 126 or higher, or R81.20 Take 166 or higher, along with dedicated Spark Firewall builds.

For Site-to-Site VPN deployments that cannot patch immediately, Check Point recommends disabling implied VPN rules and restricting UDP ports 500 and 4500 to known peer IP addresses, though this workaround does not extend to Remote Access VPN, and no interim mitigation exists for locally managed Spark Firewalls.

These newly patched bugs are unrelated to the actively exploited CVE-2026-50751, an IKEv1 authentication bypass tied to Qilin ransomware activity disclosed earlier this year.

Given the critical severity and network-exploitable nature of both new flaws, security teams running Check Point infrastructure should prioritize patching immediately rather than waiting for confirmed in-the-wild exploitation.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks appeared first on Cyber Security News.

LiteLLM deployments can expose far more than an organization’s AI spending. Newly disclosed weaknesses in the open-source gateway could let attackers run code as root inside a container, reach connected tools, and retrieve cloud credentials that open a path into a wider environment.

The risk is serious where the service is internet-facing or retains its example master key. A gateway sits between applications, model providers, internal data, and automation, so its compromise can turn one overlooked service into a central point of failure.

Researchers at Wiz.io identified the issues while examining public LiteLLM installations. Their scan of 3,074 internet-facing instances found that 294, or 9.6%, accepted a default master key or had no authentication enabled.

Wiz.io said in a report shared with Cyber Security News (CSN) that the MCP authentication bypass, tracked as CVE-2026-59822, was observed in the wild through its honeypot systems.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 2, increasing urgency for organizations with reachable instances.

LiteLLM Flaws Let Attackers Execute Code

CVE-2026-59821 affects LiteLLM’s Custom Code Guardrails feature, which lets administrators supply Python-like policies that run around model requests.

Before the fix, the endpoint used to register a guardrail did not apply the safety checks present in the testing interface, allowing supplied code to execute immediately.

The result could be root-level command execution in the LiteLLM container when an attacker had administrative access.

That access may be available where authentication is absent, the default master key remains, or another administrative weakness is abused. Readers can compare it with the earlier LiteLLM admin API flaw, which affected configuration controls.

The RCE requires an authenticated administrator and cannot be reached solely through the MCP bypass. Yet weak deployment settings can remove that barrier.

In releases before version 1.82.0, an unchanged default credential could make the code-execution path effectively available before normal authentication.

The MCP issue creates a different entry point. A meaningless Bearer token could establish a valid session with a connected MCP server, potentially allowing an intruder to use available database, repository, file-system, or workflow tools.

This differs from the LiteLLM RCE exploitation in the wild, which involved another vulnerability chain. LiteLLM corrected the guardrail weaknesses in release 1.82.0 by enforcing an administrator role and applying sandbox protections during registration.

It later fixed the MCP authentication bypass in version 1.84.0. Organizations should identify their version, patch promptly, and check for exposed older containers or test instances.

Cloud Keys at Risk

The findings show why AI gateways require the protection given to other privileged cloud services. LiteLLM may hold provider API keys and communicate with internal systems, while its workload identity can carry permissions to invoke models, read secrets, or interact with other cloud services.

A pass-through feature can forward requests to an administrator-defined destination without checking whether it is an internal address or cloud metadata service. With administrator access, an attacker could use it to obtain temporary AWS IAM credentials.

It is not a standalone vulnerability, but it becomes hazardous when access controls fail. The configuration-update route controlling pass-through settings also lacked an administrator check before version 1.83.0, a separate issue tracked as CVE-2026-35029.

The pattern is reflected in AI infrastructure credential theft, where exposed gateways can bridge attackers to secrets, persistence, and costly resource misuse.

Administrators should replace example credentials with a strong, unique master key and review guardrails for unexpected entries. Restarting the process can clear code retained in memory.

They should audit pass-through settings, restrict container outbound traffic, and apply least-privilege IAM permissions to workload identities.

Remove management interfaces from the public internet and limit access to trusted networks and authenticated administrators.

Rotate provider keys and cloud credentials if an exposed vulnerable instance might have been accessed, then review logs for suspicious administrative activity and unusual outbound requests.

The LiteLLM supply chain exposure likewise shows why gateways need careful configuration, identity, and update control.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials appeared first on Cyber Security News.

Threat actors are increasingly abusing Active Directory replication to impersonate domain controllers and steal password hashes from enterprise networks.

This technique, known as a DCSync attack, can let attackers obtain credential data for privileged accounts without deploying malware directly on a legitimate domain controller.

Active Directory domain controllers manage authentication across Windows enterprise environments. They store account information, password hashes, group memberships, and other identity data.

In organizations with multiple domain controllers, this information is replicated between servers so users can authenticate from different offices and network locations.

Attackers exploit this normal replication process by impersonating a legitimate domain controller. After compromising an account with Domain Admin privileges or replication-related permissions, they can send replication requests to a real domain controller.

Hackers Impersonate Domain Controllers to Steal AD Hashes

The target server may then provide password hash data, believing it is synchronizing information with another authorized server. The attack is commonly associated with the Microsoft Directory Replication Service Remote Protocol, also known as DRSUAPI.

Threat actors can use this protocol to request credential information from Active Directory, including NTLM password hashes. Attackers can crack these hashes offline, reuse them in pass-the-hash attacks, or use them to support further identity compromise.

DCSync activity is especially dangerous because it does not require attackers to dump credentials from the domain controller’s memory. Traditional credential theft often involves tools that access the Local Security Authority Subsystem Service process, or LSASS.

According to Trellix reports, a DCSync attack abuses a built-in Active Directory function, making it harder to distinguish malicious activity from legitimate domain replication traffic.

Once attackers obtain the KRBTGT password hash, the risk becomes significantly more severe. KRBTGT is the account the Kerberos Key Distribution Center uses to sign ticket-granting tickets.

With its hash, attackers may generate forged Kerberos tickets known as Golden Tickets. A Golden Ticket can provide long-term access to an Active Directory environment.

Attackers can forge tickets for highly privileged accounts, access sensitive systems, impersonate users, and maintain persistence even after some passwords are reset.

If an incident is not properly handled, the KRBTGT account may not be reset twice, leaving forged Kerberos tickets valid. Security teams should monitor for Directory Replication Service requests originating from systems that are not approved domain controllers.

Treat a workstation, application server, or user device requesting large volumes of replication data as a high-priority alert. Network Detection and Response platforms can help identify these abnormal communications by analyzing behavior rather than relying only on known malware signatures.

Organizations should also restrict replication rights to required accounts only, review privileged group memberships, and regularly audit accounts assigned replication permissions.

Multi-factor authentication, tiered administrative access, and dedicated privileged access workstations can reduce the chance that attackers obtain domain-level credentials.

DCSync attacks demonstrate why identity infrastructure remains a primary target for cybercriminals. By posing as trusted domain controllers, attackers can turn legitimate Active Directory functions into a pathway for enterprise-wide credential theft and long-term compromise.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes appeared first on Cyber Security News.

The U.S. Cybersecurity and Infrastructure Security Agency has added a critical Fortinet vulnerability, tracked as CVE-2025-25249, to its Known Exploited Vulnerabilities catalog after confirming evidence of active exploitation.

The flaw affects FortiOS, FortiSwitchManager, and FortiSASE products. It could allow attackers to execute unauthorized code or commands by sending specially crafted packets.

CVE-2025-25249 is a heap-based buffer overflow vulnerability. A heap overflow occurs when an application writes more data into a memory area than it was designed to hold.

This can corrupt adjacent memory and potentially let an attacker alter program behavior, crash a device, or run malicious code with the privileges of the affected service. The issue is associated with CWE-122, heap-based buffer overflow, and CWE-787, out-of-bounds write.

Fortinet security appliances are commonly deployed at enterprise network boundaries, making FortiOS vulnerabilities especially significant.

A successful compromise of an internet-facing firewall, secure access service edge platform, or network-management tool could provide attackers with a foothold for further intrusion activity.

Fortinet Heap-based Buffer Overflow Flaw Exploited

Depending on the deployment, threat actors may attempt to steal credentials, change configurations, establish persistence, or move deeper into internal networks. CISA added the vulnerability to the KEV catalog on September 9, 2026, and set a remediation due date of September 12, 2026.

Federal civilian executive branch agencies must apply vendor-provided mitigations under Binding Operational Directive 26-04, which prioritizes security updates according to exploitation risk.

The agency also requires forensic triage for affected environments, indicating that organizations should investigate for possible compromise rather than treating the issue as a routine patching event.

CISA stated that organizations should follow Fortinet’s mitigation guidance and assess every affected asset for internet exposure. Where a cloud service is involved, stakeholders should follow applicable BOD 26-04 cloud-service guidance.

If no mitigation is available, CISA advises organizations to stop using the affected product. Security teams should identify all FortiOS, FortiSwitchManager, and FortiSASE deployments, prioritizing systems exposed to the public internet.

Administrators should apply the relevant Fortinet fixes or mitigations, review logs for suspicious traffic involving crafted packets, and check for unexpected configuration changes, administrative accounts, VPN activity, or outbound connections.

While CISA has confirmed exploitation, the agency currently lists ransomware use as unknown. Organizations should nevertheless treat the vulnerability as an active intrusion risk and conduct incident-response triage after remediation.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks appeared first on Cyber Security News.

The OpenSSL Project has released OpenSSL 4.1.0 Alpha1, an early preview of its forthcoming feature release. This update adds support for Datagram Transport Layer Security (DTLS) 1.3, GREASE for more resilient TLS deployments, and architecture-specific performance enhancements for post-quantum cryptography operations.

As an alpha release, it is intended for testing and development, not production deployment. Organizations should carefully evaluate application compatibility and performance before upgrading.

A notable addition in OpenSSL 4.1.0 Alpha1 is support for DTLS 1.3, which secures UDP-based communications that are critical for real-time applications like video calls, online gaming, and IoT devices.

This implementation adheres to RFC 9147 and provides TLS-like security while addressing UDP characteristics such as packet loss and reordering. Additionally, DTLS support has been integrated into the SSL listener API, streamlining development for applications managing DTLS connections.

OpenSSL 4.1.0 Alpha1 Released

The release optimizes two post-quantum cryptographic algorithms: ML-DSA (a digital signature algorithm) and ML-KEM (a key-encapsulation mechanism), both designed to resist quantum computing attacks.

With enhancements for Number Theoretic Transform operations on specific architectures, this update is crucial for enterprises engaging in post-quantum TLS, certificate workflows, and high-volume cryptographic services.

Optimizations for x86_64 systems include AVX-512 for SHAKE x4 operations, boosting signature generation and verification throughput. OpenSSL 4.1.0 Alpha1 delivers performance improvements for AES-CBC decryption on x86_64 systems through AVX-512 and VAES optimizations.

The release introduces build targets for Microsoft Visual C++ 2013, enhancing support in older compiler environments. However, it removes support for Windows-on-Itanium and Windows CE build targets.

This release also incorporates GREASE (RFC 8701), which helps identify and address compatibility issues with network devices and TLS implementations that reject unknown protocol values.

By using reserved values in protocol exchanges, GREASE fosters better long-term compatibility in the TLS ecosystem. It also supports the IKEv2 key derivation function (KDF), which is relevant for IPsec VPNs. The updated tsget utility now uses Net::Curl::Easy instead of the abandoned WWW::Curl::Easy to avoid dependency failures.

Additionally, the no-ecdsa and no-ecdh Configure options have been removed, directing administrators to use the no-ec option instead for disabling elliptic-curve cryptography. The release also introduces initial support for the Elbrus2000 (e2k) processor architecture.

Security teams should view this release as a testing opportunity for future OpenSSL compatibility rather than an immediate production upgrade. Recommended actions include testing DTLS 1.3 interoperability and evaluating the impact of these updates on existing systems.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post OpenSSL 4.1.0 Alpha1 Released With DTLS 1.3 and Faster Post-Quantum Cryptography appeared first on Cyber Security News.

Palo Alto Networks has disclosed a high-severity PAN-OS vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on affected PA-Series hardware firewalls.

Tracked as CVE-2026-0310, the flaw exists in XML processing, and the vendor has assigned it the highest suggested urgency. The vulnerability is a buffer overflow, classified as CWE-787 (out-of-bounds write).

An attacker with network access to a vulnerable management web interface or dataplane interface could send specially crafted XML data to trigger the issue.

On PA-Series appliances, successful exploitation may lead to arbitrary code execution as the root user, giving an attacker complete control over the firewall operating environment. Root-level code execution on an enterprise perimeter firewall presents a serious security risk.

A threat actor could potentially alter security policies, inspect or redirect network traffic, deploy persistence mechanisms, steal configuration data, or use the compromised device as a foothold for attacks against internal systems.

Palo Alto PAN-OS Vulnerability

The issue does not require authentication or user interaction, although exploitation has been rated as high complexity. Palo Alto Networks assigned CVE-2026-0310 a CVSS-BT score of 7.2 and a CVSS-B base score of 9.2 for affected PA-Series firewalls.

The vendor noted that the practical risk is greatest for physical firewall appliances because the flaw can result in root-level remote code execution. The impact differs across Palo Alto Networks products. On vulnerable VM-Series firewalls, exploitation is limited to a denial-of-service condition rather than code execution.

A successful attack could crash or disrupt the affected virtual firewall, affecting traffic inspection and availability. Prisma Access and Cloud NGFW environments are also affected.

However, Palo Alto Networks considers the risk lower because exploitation requires an authenticated user and external network access is more restricted.

Affected PAN-OS releases include versions before 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10, depending on the release branch. Numerous maintenance builds across the 10.2, 11.1, 11.2, and 12.1 branches are also vulnerable.

Organizations should upgrade immediately to the appropriate fixed release. Palo Alto Networks recommends PAN-OS 12.2.3 or later for the 12.2 branch.

No workaround is available. However, organizations can reduce exposure by ensuring that firewall management interfaces are not reachable from untrusted networks.

Palo Alto Networks recommends restricting management access to trusted internal IP addresses and, where possible, allowing administration only through a dedicated jump box. The vendor said it discovered CVE-2026-0310 internally and, as of September 9, 2026, is not aware of malicious exploitation in the wild.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Palo Alto PAN-OS Vulnerability Enables Arbitrary Code Execution as Root User appeared first on Cyber Security News.

OpenAI has introduced a “Defense Factory,” an automated, agent-first cybersecurity operation that continuously discovers, validates, and remediates vulnerabilities.

The company says traditional defenses may no longer be sufficient as long-running AI agents can chain exploits and scale attacks using increasingly available open-weight models.

Modern AI agents can operate for extended periods, retain knowledge across sessions, and build a detailed understanding of target systems.

This capability allows them to connect separate weaknesses into complex attack chains that previously required significant human expertise and time.

Attackers could also deploy fleets of agents to scan systems, test vulnerabilities, and pursue exploitation at machine speed. This creates a widening gap between automated attacks and traditional security processes that depend on manual triage, ownership assignment, and remediation.

OpenAI Builds AI Defense Factory

OpenAI says defenders currently possess two structural advantages. Organizations can provide authorized agents with direct access to source code and internal system context, while also using frontier models that are more capable than widely available open-weight alternatives.

This temporary lead represents the “defender’s window.” Organizations must use it to build continuous security operations before autonomous offensive capabilities become more broadly accessible.

A Defense Factory connects AI agents to existing developer and security tools through APIs, command-line interfaces, and Model Context Protocol integrations. These systems can include GitHub, GitLab, Snyk, Semgrep, Tenable, Jira, Linear, and ServiceNow.

Agents follow reusable security workflows to scan, triage, and fix vulnerabilities. They run in isolated, reproducible, ephemeral development environments with the required code, dependencies, services, and configurations.

A control plane manages workload orchestration, policies, and credentials. A separate data plane provides temporary environments where agents reproduce vulnerabilities and test patches. Monitoring, audit logging, and access controls help protect sensitive code and infrastructure.

OpenAI’s defensive loop covers asset inventory, vulnerability discovery, dynamic validation, ownership assignment, and verified remediation.

Shared SECURITY.md files preserve system knowledge, investigation evidence, and testing procedures so agents do not restart every assessment without context.

During an internal security sprint, OpenAI mobilized more than 250 people across more than 100 service areas. Teams closed 53 urgent or high-priority issues on the first day and achieved a 90.6% accepted ownership-assignment rate.

OpenAI said agent-assisted deduplication identified 37% of findings as duplicates, while runtime validation reproduced 19.5% and cut the false-positive rate to 0.81%. Codex generated all remediation patches, with only 0.53% rolled back

OpenAI built autonomy incrementally, beginning with small batches and human review. As workflows became reliable, agents took on more responsibility for routine investigation and remediation.

At the same time, people continued to set boundaries, review consequential changes, and handle exceptions. The company recommends that organizations begin with one workflow rather than automate everything immediately.

Reproducible environments, controlled credentials, strong auditing, and independent verification are essential because a merged patch does not guarantee a fix was deployed correctly across production systems.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post OpenAI Builds ‘Defense Factory’ Where AI Agents Continuously Find and Fix Vulnerabilities appeared first on Cyber Security News.

Mac users seeking AI tools face a malware trap. Attackers are using fake Claude and ChatGPT installers and sponsored search results to push MacSync, a macOS password stealer.

The campaign relies on persuasion instead of a software flaw. A visitor is told that a download, connection, or verification step has failed, then instructed to copy a command into Terminal. That single action gives the attacker a route into the device.

MacSync is a malware-as-a-service operation, meaning its developers supply the tool and infrastructure to other criminal groups. Researchers said the threat emerged in 2025.

The risk goes beyond a stolen password. MacSync is designed to gather browser logins, session cookies, Mac Keychain data, SSH keys, cloud credentials, messaging sessions, and cryptocurrency wallet information.

SEQRITE said in a report shared with Cyber Security News (CSN) that it can also establish lasting access, leaving personal accounts and workplace systems exposed.

Hackers Use Fake Claude and ChatGPT Installers

The first stage often begins with a search for a desktop AI app. Criminals buy or manipulate search placements and send people to pages that imitate Claude AI, ChatGPT, developer tools, or other trusted services.

A previous report on malicious macOS Google ads shows how paid results can steer high-intent users toward a fraudulent AI download page. Instead of providing a normal application package, the page displays a ClickFix prompt.

These prompts may claim a WebSockets connection needs repair, a CAPTCHA must be completed, or an audio problem requires attention. Victims are asked to paste a helpful-looking command into Terminal, starting the infection themselves.

That technique is effective because it turns the user into the final delivery step. Traditional warning signs, such as an unsolicited attachment, may be absent.

The wider pattern was documented in coverage of macOS ClickFix credential theft, where fake verification pages similarly pushed commands to Mac users. After execution, a shell script launches a background component and unpacks the native MacSync stager.

The stager detaches from the Terminal session, suppresses visible output, and retrieves further instructions from attacker-controlled infrastructure. This layered design lets operators change later payloads.

Stealer Collects Data Quietly

MacSync downloads an AppleScript directly into memory and runs it through a built-in macOS automation utility, rather than saving the script as an obvious file.

The script can display a password request that resembles a system dialog, then collect credentials and other data from the compromised Mac.

The malware packages information, including browser vaults and wallet databases, before sending it to its operators in fixed-size pieces.

If a transfer fails, it retries with increasing delays. After a successful upload, it removes temporary material to reduce evidence for users or incident responders.

It can then deploy a remote-access component that uses the macOS launch mechanism to start after login. A helper program may also request screen-recording permission, giving criminals another opportunity to watch activity or capture sensitive content.

The result is a campaign that can move from a fake installer to account takeover and surveillance. The findings fit a broader rise in AI-themed malware delivery.

In another case, a weaponized ChatGPT download site used sponsored results and fake download choices to target both Mac and Windows users. Familiar branding lowers suspicion when people are looking for new tools or quick fixes.

Users should avoid sponsored links when downloading software and go to a vendor’s official website by typing the address or using a trusted bookmark.

They should never paste a command from a web page, chat, ad, or support message into Terminal unless they fully understand it and have independently verified its source.

Security teams should block the listed infrastructure, investigate unexpected command-line activity launched from browsers, and check Macs for unfamiliar launch items and permission requests.

Resetting passwords alone may not be enough after an infection; affected users should revoke active sessions, rotate exposed keys, and have the device examined for persistence.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware appeared first on Cyber Security News.

Bottom line up front: servers are not big laptops. They run Linux as often as Windows, can’t tolerate agent-induced latency, host the data ransomware actually wants, and increasingly live as VMs, containers, or cloud instances.

Deploying dedicated endpoint detection and response (EDR) on servers requires balancing performance overhead with deep telemetry.

Trend Micro’s server heritage still leads for hybrid estates, CrowdStrike and SentinelOne bring the strongest detection, Defender for Servers wins on Azure-centric economics and the quiet failure mode everywhere is the hypervisor nobody’s agent covers.

Stage 1 — Inventory What “Server” Means for You

*Kaspersky: prohibited for US sale/updates; check national guidance elsewhere.

The planning fact most miss: server security is licensed differently per server, per core, or per cloud-hour and the same vendor may offer all three. The wrong model can double your bill at renewal.

Stage 2 — The Ten, by Fit

Trend Micro (Deep Security → Server & Workload Protection) — best hybrid breadth

Two decades of server-specific engineering: virtual patching via IPS (shielding unpatched systems decisive for legacy OS), anti-malware, integrity monitoring, and log inspection, spanning data centre to cloud while bridging endpoint security EDR vs XDR architectures.

Watch: console lineage shows; product naming has shifted into Vision One confirm current SKUs.

Best for: hybrid estates with legacy and modern side by side.

Image ALT: Trend Micro server workload protection virtual patching

CrowdStrike — best detection on servers

The same elite detection and hunting, with Linux parity that’s genuinely strong, leveraging proactive threat hunting methodologies and cloud-hour licensing options for elastic estates.

Watch: premium cost; update-staging questions apply to servers doubly.

Best for: SOC-led organizations standardizing one platform across endpoint and server.

Image ALT: CrowdStrike Falcon server and Linux detection

Microsoft Defender for Servers — best Azure-centric economics

Per-server (or per-hour via Azure Arc) plans bring EDR, vulnerability management, and file integrity monitoring to Windows and Linux, managed through Defender for Cloud with capabilities that automatically isolate compromised devices and workloads covering AWS and GCP VMs via Arc too.

Watch: plan tiers (P1/P2) differ materially; Linux features trail Windows in places.

Best for: Azure-heavy and Arc-managed hybrid estates.

Image ALT: Defender for Servers plans in Defender for Cloud

Palo Alto Networks — best alongside network controls

Cortex agents on servers plus the option of VM-Series inspection in front of them; provides robust defense tested across Palo Alto Cortex XDR platforms and is strongest when server, network, and cloud policy converge in one vendor.

Best for: Palo Alto-standardized estates.

Image ALT: Palo Alto server protection with network enforcement

SentinelOne — best autonomous response on servers

Autonomous containment matters more where no one’s watching at 3am, utilizing high-efficacy autonomous malware protection solutions where Linux/Kubernetes agents are first-class. Rollback is Windows-only plan accordingly.

Best for: lean teams with big server estates.

Image ALT: SentinelOne server and Kubernetes protection

Sophos — best for generalist-run server rooms

Server-specific policy (file integrity, application allowlisting for servers) in the same console a small team already runs, with a clear escalation path into managed detection and response (MDR) services.

Best for: mid-market Windows-majority server rooms.

Image ALT: Sophos server protection policy in Sophos Central

Bitdefender — best value with strong engines

GravityZone’s server and virtualization support (including agentless options in some hypervisor environments) brings enterprise-grade ransomware protection solutions at mid-market pricing.

Watch: confirm current agentless support matrix.

Best for: virtualization-heavy value buyers.

Image ALT: Bitdefender GravityZone virtualized server protection

Kaspersky — capable where lawful

Strong engines and legacy-OS support breadth adhering to advanced endpoint threat detection standards but prohibited for sale/updates in the US, with public-sector restrictions elsewhere.

Best for: non-US estates after a jurisdiction check.

Image ALT: Kaspersky hybrid server security console

Trellix — best in an ePO-managed legacy estate

Deep policy control and long legacy-OS support under ePO management, routing server event logs directly into enterprise SOC tools.

Watch: roadmap conversation warranted post-consolidation.

Best for: existing Trellix estates with old iron.

Image ALT: Trellix server security via ePO

Wiz CNAPP — best for multi-cloud and cloud-native platforms

Cloud-native security across cloud infrastructure, workloads, containers, and Kubernetes, providing unified visibility into vulnerabilities, configuration posture, and runtime risk alongside modern cloud security tools.

If your “servers” are mostly cloud workloads and containers, Wiz provides broader cloud context than a traditional server-security agent.

Best for: multi-cloud and cloud-native platforms.

Image ALT: Wiz CNAPP cloud workload, container, and Kubernetes security platform

Stage 3 — Handle the Two Gaps Everyone Has

The hypervisor gap. Guest agents don’t protect ESXi or Hyper-V hosts themselves, and ransomware crews now encrypt at the hypervisor to take fifty VMs down in one action. Mitigate deliberately: strict host patching, isolated management interfaces, MFA on vCenter, lockdown mode, and monitoring of host-level logs. No agent on this list absolves you.

The legacy gap. Unsupported Windows and old Linux hold the business hostage everywhere. Virtual patching (Trend Micro’s signature move) shields them at the network/IPS layer while you plan migrations segment them tightly regardless via microsegmentation.

Stage 4 — Deploy Without Breaking Production

Test agent overhead on your loads, not the datasheet’s. Database, file-server, and hypervisor-dense hosts expose I/O costs that laptops never show. Pilot on the noisy servers.

Stage updates with rings on servers especially. The July 2024 content-update outage taught the whole industry: production servers get the last ring, always, with a documented rollback.

Turn on integrity monitoring where it counts. FIM on domain controllers, payment paths, and web roots is high signal; fleet-wide FIM is noise. Scope it.

Exclusions with discipline. Vendor-documented exclusions for databases and hypervisors, reviewed quarterly not the accumulated folklore of a decade of tickets.

Common mistakes: protecting Windows servers and leaving Linux “for later”; agents on guests, nothing for hosts; per-server licences on autoscaling cloud fleets (use per-hour); and no EDR-tier retention on the machines attackers actually camp on.

Situational FAQ

What is the best server security solution in 2026?

Trend Micro leads hybrid estates with legacy systems thanks to virtual patching; CrowdStrike and SentinelOne bring the strongest detection with true Linux parity; Microsoft Defender for Servers wins Azure-centric economics; Aqua leads when containers dominate.

Match to your OS mix, hypervisor reality, and licensing model.

Do Linux servers need antivirus?

They need protection behavioural EDR more than signature antivirus. Linux hosts are prime ransomware and cryptomining targets precisely because they’re often unmonitored, and agent quality varies more on Linux than anywhere else. Test on your distributions.

How is server security licensed?

Per server, per core, or per cloud-hour, sometimes all three from one vendor. Elastic cloud fleets should use consumption models; static data centres usually do better per-server. Model your renewal before signing.

Does my endpoint EDR cover servers?

The agent usually installs, but server plans differ: FIM, virtual patching, container context, and per-hour licensing live in server SKUs. Running a laptop SKU on a domain controller leaves capability and compliance gaps.

What protects the hypervisor itself?

Hardening, not guest agents: patched hosts, isolated management networks, MFA on management planes, lockdown modes, and host log monitoring. Hypervisor-level encryption events are among the most damaging current ransomware patterns treat hosts as crown jewels.

What about unsupported legacy servers?

Shield them with IPS-based virtual patching (Trend Micro is the reference), segment them aggressively, and monitor them closely while migration happens. “We’ll retire it next year” has been the plan for five years; protect it like it’s staying.

The Short Version

Buy server security as its own decision: Trend Micro for hybrid-with-legacy, CrowdStrike/SentinelOne for detection-led estates, Defender for Servers for Azure economics, Aqua when Kubernetes is the estate.

Then close the two gaps no agent closes hypervisor hardening and legacy segmentation and stage every update like production depends on it, because it does.

Related reading on Cyber Security News:

• Top 10 Best Cloud Workload Protection (CWPP) Solutions

• Top 10 Best CSPM Tools

• Top 10 Best Endpoint Detection & Response (EDR) Solutions

• Top 10 Best Ransomware Protection Solutions

• Top 10 Best Microsegmentation Tools

• Top 10 Best Application Control & Allowlisting Tools

• Top 10 Best Patch Management Software

• Top 10 Best Antivirus (Endpoint Protection) Software for Business

• 10 Best Cloud Security Tools

• Top 10 Best Network Detection & Response (NDR) Tools

• Top 10 Best Endpoint Encryption Software

The post Top 10 Best Server Security Solutions in 2026 appeared first on Cyber Security News.

Android banking fraud is entering a deceptive phase. Attackers are using malware that copies targeted banking apps into a concealed Android work profile, separating a fraudulent session from warning signs seen on the phone.

The operation begins with Gigabud, an Android remote-access trojan active since 2022. Victims are lured through phishing sites, messaging apps, or social-media posts into sideloading fake airline, tax, or government applications, while fake banking app downloads can turn a brand into a trap.

Group-IB analysts identified Vwork, a modified version of the open-source Shelter app cloner, appearing minutes after Gigabud infections alongside tampered banking applications.

The researchers link the activity to GoldFactory and found compatible samples targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and a Gulf Cooperation Council member state.

Group-IB said in a report shared with Cyber Security News (CSN) that from February through July 2026, researchers observed about 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia, with estimated losses of roughly $960,939.

Those figures reflect observed activity rather than the full scope, but show why Android banking trojan campaigns remain a concern.

Hackers Clone Banking Apps Into Hidden Android Work Profiles

Gigabud first asks for Accessibility access, permission to draw over other apps, and battery-saving exemption. If a victim agrees, operators can remotely control the device, list installed apps, place fake login screens over real banking apps, and capture the device lock-screen code.

The next stage is simple but effective. The operator installs Vwork, which creates an isolated work profile and clones a banking app into it. In a confirmed Indonesian case, the cloned app was a fake version of a bank application.

Android keeps applications in separate profiles isolated. That boundary is intended to protect work and personal data, but attackers use it to make the banking session look new.

A security signal tied to malware in the personal profile may not follow the cloned application into the work profile. The operator can then conduct transactions through the clean-looking profile while hiding activity behind a black screen.

The bank may see a new environment rather than the already-flagged personal profile, weakening the connection between device risk and a fraudulent transfer. Similar hidden remote-control Android attacks demonstrate how control features can be concealed from victims.

Vwork reduces visible clues. Its launcher icon is hidden and cloning functions can be controlled by another app. Gigabud includes commands to initialize Vwork, clone an application, and upload the clone list, showing the tools were designed to work together.

Phishing Delivery and Defensive Signals

An early warning is a consumer phone unexpectedly creating an isolated work profile. A banking app installed across profiles, a nearly empty profile, or a second suspicious installation shortly afterward should raise risk.

For users, the advice is simple: install applications only from official stores, reject Accessibility requests from apps that are not genuine accessibility tools, and use a banking second factor that does not depend on SMS. A raw app file sent through a chat is not a legitimate bank distribution channel.

Banks and wallet providers should bind logins to trusted devices, examine unusual session actions, and block high-risk transactions when an unrecognized app has active Accessibility access. Detection should combine signatures with behavior, rather than assuming one malware alert is enough.

This case underlines a broader shift in mobile fraud. Attackers combine social engineering, overlays, remote access, and Android features meant for legitimate separation. banking PIN theft malware shows how overlays and device control can scale financial theft.

The key lesson is that a clean-looking banking session is not always a clean device. Security teams should treat unexpected work-profile creation, cross-profile application duplication, and accessibility abuse as linked warning signs.

That approach can expose the fraud path before a transfer is completed. It also helps teams distinguish ordinary work use from coordinated account takeover before funds leave an account during urgent financial fraud investigations.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection appeared first on Cyber Security News.

Cybercriminals are using autonomous AI agents to turn compromised cloud systems into fast-moving credential theft platforms.

In one recent case, attackers planned, built, and launched a large-scale campaign in less than six hours, stealing thousands of third-party credentials.

The operation shows how attackers can combine AI coding tools, automated scanning, and cloud resources to work at a speed that previously required a larger team and far more time.

Rather than manually checking systems and fixing errors, the agents handled much of the work themselves. Analysts from Google Cloud identified the activity while tracking the growing use of AI-driven automation in real-world intrusions. 

Google Cloud said in a report shared with Cyber Security News (CSN) that the attackers used an AI coding chatbot, a prompt, and preconfigured instructions to carry out the campaign.

The incident is part of a broader shift in cybercrime. Attackers are increasingly using AI to scan for weaknesses, create phishing content, write malicious code, steal secrets, and maintain access after an initial break-in. This trend makes rapid detection and strong cloud security more important than ever.

Hackers Use Autonomous AI Agents

The financially motivated attackers first compromised an organization’s cloud infrastructure, then used it as the launch point for their operation.

Working from a trusted cloud environment helped their traffic appear more legitimate and made it harder for defenders to quickly separate malicious activity from normal services.

The AI-driven framework used written instruction files as operating playbooks. These instructions guided the agents through vulnerability scanning, credential collection, troubleshooting, and IP address rotation without requiring constant human decisions.

The result was a campaign that harvested credentials at a scale normally associated with much larger criminal groups.

This differs from traditional information stealers, which usually wait for a victim to run malicious software and then collect data from that device.

In this case, the agents actively searched server-side systems, identified weaknesses, and carried out targeted actions against online infrastructure.

The campaign highlights the risks outlined in recent reporting on AI agents breach company networks, where automated agents can map services, locate exposed tokens, and move toward valuable administrative access.

Once valid credentials are collected, criminals can reuse them for cloud access, fraud, espionage, extortion, or additional attacks.

Researchers also found an exposed command-and-control server hosting a separate automated reconnaissance and credential management framework called Recon.

Its dashboard was designed to organize, validate, and manage more than 23,800 stolen secrets in real time, including API keys connected to cloud and AI services.

The source report illustrates how attackers combined compromised cloud resources, AI-generated instructions, automated scanning, and credential harvesting into a single accelerated operation.

Cloud and Developer Systems Face Growing Risk

The attack demonstrates why cloud credentials and developer environments have become high-value targets. A single exposed access token can give attackers a trusted path into cloud services, source code repositories, automation pipelines, and sensitive business data.

The risks are similar to those described in stolen cloud credentials attacks, where valid keys can let intruders enter as approved users.

AI coding environments can create additional openings when developers download unsafe packages, clone altered repositories, or allow tools to process untrusted workspace files.

In related activity, the UNC6780 group used compromised developer accounts to distribute trojanized resources and targeted CI/CD environments for authentication tokens.

The DUSTMAKER credential stealer was also observed hiding files inside common AI coding workspace directories.

It could use malicious configuration files to influence an assistant into running scripts during routine development work, while fake pipeline tasks disguised as AI utilities searched for extra tokens and keys.

Organizations should treat AI tool configurations, developer tokens, and cloud API keys as sensitive credentials.

Security teams should rotate exposed keys quickly, apply least-privilege permissions, protect CI/CD runners, review third-party dependencies, and investigate unexpected automation tasks or workspace configuration changes.

Teams should also monitor cloud activity for unusual API calls, unfamiliar service accounts, unexpected public services, and suspicious outbound scanning.

Guidance from coverage of typosquatted npm package theft shows why dependency checks and secret scanning remain essential for development teams.

The findings do not mean autonomous exploitation is now common across every intrusion. However, they show that AI agents can reduce the delay between compromise and credential theft.

Defenders need controls that can detect abuse at the same pace, especially as attackers continue combining AI automation with familiar methods such as stolen credentials, exposed services, and malicious packages.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Autonomous AI Agents to Launch Mass Credential Theft Attacks in Under 6 Hours appeared first on Cyber Security News.

Cybercriminals are widening the reach of information-stealing malware by targeting the local data created by AI coding agents.

The shift puts access tokens, saved connections, prompt histories, and project records at risk on already infected computers. The activity does not point to a newly discovered flaw in Claude, Cursor, or Codex.

Instead, it shows criminals adapting established stealers to collect valuable files stored in predictable local folders, a concern echoed in reporting on Claude session theft involving browser-based account access. Analysts at Gen Digital identified the expanding collection rules after examining recent malware activity.

Gen Digital said in a report shared with Cyber Security News (CSN) that the findings concern locally installed development agents, not a direct compromise of an AI model or agent.

The impact can extend well beyond a single paid account. A stolen archive may give criminals both a reusable way into an account and the context needed to identify sensitive projects, connected services, and people worth targeting with follow-on fraud or phishing.

Hackers Target Claude, Cursor and Codex AI Agents

Over a three-month period, Gen Digital recorded Amatera and Remus detections among tens of thousands of protected Windows users.

Amatera focused on data linked to Cline and Continue, while Remus targeted Claude, Cursor, and OpenCode, indicating that agent data has entered the broader infostealer economy.

CallbackBeaver has also added Cursor and Claude to its collection scope, with more than 5,000 samples seen in a 30-day period.

BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer illustrate how quickly the technique is spreading, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo.

Criminals do not necessarily need to rebuild a payload to add a newly popular tool. Many stealers use remotely managed rules that specify folders, file names, databases, extensions, and search limits, so adding another target may amount to a configuration update delivered to machines that are already compromised.

That low barrier matters because a local agent directory can contain far more than settings. Security teams investigating AI agent artifacts should consider authentication files, conversation databases, recent-project data, and connected-service settings as high-value endpoint material, alongside browser profiles and cloud command-line credentials.

Stolen Tokens Expose Work Context

Some agents keep access tokens or refresh tokens locally to avoid requiring a fresh login every session. A stolen access token may let an attacker use an account until it expires, and a refresh token can sometimes extend that window, enabling paid API abuse or resale of working access.

MCP configurations can raise the stakes further. These files may hold endpoints, headers, environment variables, API keys, or other authentication details for external tools, meaning reusable secrets could expose source control, ticketing, databases, cloud resources, or collaboration services connected to the agent.

Prompt histories and transcripts are equally useful to intruders. Developers often use assistants to examine code, analyze logs, and solve incidents, and their chats may reveal source code, internal hostnames, repository names, deployment details, or secrets pasted during troubleshooting.

Related MCP security weaknesses show why connected tools need careful oversight. Organizations should inventory the agents in use, review what they store locally, and use operating-system-protected credential storage where available.

They should keep passwords, private keys, API secrets, and customer data out of prompts, give connected tools only necessary permissions, and favor short-lived, narrowly scoped tokens.

After a suspected stealer infection, responders should work from a clean device to revoke AI sessions, rotate API keys and other connected credentials, review account activity, and determine whether local conversations exposed company information.

Multi-factor authentication remains important, but it may not prevent replay of a token that malware has already copied. Users should also keep endpoints and applications updated and avoid ClickFix or FakeCaptcha instructions, cracked software, and unofficial installers, which are common delivery routes for stealers.

Teams deploying coding agents at scale can apply lessons from AI agent approval flaws by reviewing trusted projects, connections, and access boundaries before they become an attacker’s shortcut. The targeting will likely grow as workplace adoption expands.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories appeared first on Cyber Security News.

Hackers are using Google Sheets as an unlikely control channel in a cryptocurrency theft campaign. The operation turns a familiar browser session into a place where malicious code runs, rather than placing a conventional program on a victim’s computer.

The attackers promote a fake report claiming to expose profitable flaws at cryptocurrency swap services. Victims are told to paste JavaScript into Chrome’s address bar or add it to a browser extension, allowing the code to run on the trading site they are visiting.

The campaign began with ClickFix-style lures in October 2025 and adopted Google’s Visualization API in March 2026.

The researchers found messages on Telegram, DarkForums, email, and paste sites, targeting people interested in trading, coding, hacking, and quick financial gains. The result is a wallet-address swap at the moment a user expects to make a deposit.

Cisco Talos said in a report shared with Cyber Security News (CSN) that they identified 49 Bitcoin addresses used by the operation; 24 received a combined 0.159 BTC, valued at about $10,000 in early August 2026, although the actual total may be higher.

Hackers Abuse Google Sheets

This campaign changes the familiar ClickFix formula. Instead of asking a user to open Run or a terminal, the lure asks them to alter their browser. Requests for the next attack stage can therefore look like normal traffic to a trusted Google service.

The first lure described a fabricated API flaw that supposedly delivered around 38 percent higher payouts on SwapZone. A later version claimed a SimpleSwap loyalty feature could provide a 25 percent bonus, then instructed users to install Tampermonkey and paste in a loader script.

That evolution echoes how recent ClickFix delivery campaigns rely on a person to complete the dangerous action.

Here, the loader retrieves hidden, scrambled JavaScript from cells in a publicly published Google Sheet using the Visualization API, joins the code together, and injects it into the active page.

The malicious code behaves like a web skimmer. It watches the transaction page, changes displayed deposit addresses, intercepts web responses that contain wallet data, and replaces copied addresses in the clipboard with an attacker-controlled alternative.

It also adds false bonus information to make a transaction seem more attractive. The extension-based version gives the attackers an added advantage: persistence. Each time the target returns to the selected trading site, the loader can reconstruct and insert the payload again.

The operators also changed their Sheet and hosting setup after takedown efforts, making simple disruption short lived. The danger extends beyond cryptocurrency trading.

A compromised extension, web dependency, or customer-facing application could use similar browser-side tricks to quietly modify forms or information.

The abuse of recognized online services resembles trusted mirror ClickFix abuse, where a credible host can make a harmful page appear less suspicious.

Defending Against Browser-Based Lures

Users should treat any online claim of a secret trading bonus, exploit, or special API access as a warning sign. No website should require visitors to paste code into the address bar, developer console, terminal, or browser extension to unlock a legitimate feature.

This case also reinforces lessons from fake verification page attacks, in which a convincing prompt shifts execution to the victim. Before sending funds, users should compare the address shown on screen with the address copied to the clipboard and verify it through a trusted channel.

Organizations should control browser extensions by role and limit developer-level browser functions where they are not required.

Security teams should investigate unusual requests to Google Docs from browser sessions without normal document activity, especially after an employee visits untrusted forums or links.

Web application owners should test third-party code and remove unexplained, heavily obfuscated JavaScript. The campaign’s methods overlap with browser-based ClickFix techniques, but its public spreadsheet use shows why network trust alone is not enough to judge whether a web request is safe.

Training should focus on behavior, not just blocked domains. Employees and customers need clear guidance that copying code from a document, message, or trading “research” page can hand an attacker control of the browser session, even when the destination appears to be a well-known service.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks appeared first on Cyber Security News.

Microsoft has released security updates for CVE-2026-69485, an Important-rated remote code execution vulnerability affecting the Windows Remote Desktop Client.

The flaw could allow an authenticated attacker with low privileges to execute code on an affected server by sending a specially crafted network request.

The vulnerability was disclosed on September 8, 2026, and is tracked as CVE-2026-69485. Microsoft assigned it a CVSS 3.1 base score of 8.8, while the temporal score is 7.7.

The issue has a network attack vector, low attack complexity, requires low privileges, and does not need user interaction. Microsoft said the flaw stems from the Remote Desktop Client using an uninitialized resource.

Uninitialized resources can cause software to use memory, handles, or other system objects before they are properly prepared. In this case, an attacker may trigger the faulty condition through a crafted network request and gain the ability to run code.

Windows Remote Desktop Client Vulnerability

Remote code execution flaws are highly significant because they can give attackers control over vulnerable systems. Successful exploitation could affect the targeted device’s confidentiality, integrity, and availability.

Depending on the permissions available to the compromised account, an attacker could access sensitive data, modify files or system settings, install additional tools, or disrupt services.

According to Microsoft’s advisory, exploitation requires an attacker to first authenticate with low-level access to an affected server. The attacker could then send a specially crafted request to execute code on that server.

The attack does not require a user to click a link, open a file, or approve a prompt, reducing opportunities for defenders to stop it through user awareness controls alone.

Microsoft’s initial assessment states that the vulnerability was not publicly disclosed before the security update and has not been detected in active exploitation.

The company rates exploitation as “Exploitation Less Likely” at the time of publication. However, organizations should treat the finding as a priority because public patch releases can help threat actors study the vulnerability and develop working exploit techniques.

The affected products include Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations.

Microsoft also listed several Windows client editions, including Windows 10 versions 1607, 1809, 21H2, and 22H2, along with Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for supported x64 and ARM64 systems.

Administrators should deploy Microsoft’s September security updates as soon as possible.

Security teams should also review Remote Desktop exposure, restrict RDP access to trusted networks, enforce least-privilege access, and monitor authentication and Remote Desktop logs for unusual activity. Microsoft credited security researchers yhw and txz for reporting the vulnerability through coordinated disclosure.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Windows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code appeared first on Cyber Security News.

A newly published ShieldCrash proof of concept from researcher MSNightmare claims that Microsoft Defender remains vulnerable to an arbitrary file-read flaw, despite Microsoft’s earlier fix for ShieldBreak, tracked as CVE-2026-69414.

The researcher says the issue could let a local attacker make Defender read files with SYSTEM-level privileges on fully updated, supported Windows systems.

According to the MSNightmare, Microsoft addressed several parts of the original ShieldBreak issue but left a specific attack path available. Under certain conditions, that remaining path allegedly recreates the core security impact of the prior vulnerability.

The reported impact is significant because the SYSTEM account has broader permissions than normal users and most administrator accounts. Windows services, security software components, and protected operating system processes often run under SYSTEM.

If an attacker can force a Defender component to access a protected file and expose its contents, they may obtain sensitive data that their existing account should not access.

Windows Defender ShieldCrash 0-Day Flaw

Potentially exposed data could include application configuration files, credential-related material, security product settings, private keys, browser or service secrets, or files belonging to other Windows users.

The exact impact depends on which files the attacker can target, whether they can reliably recover their contents, and what permissions the attacker already has before launching the attack.

The available proof of concept is described as a structure implementation rather than a complete SYSTEM privilege-escalation exploit.

The researcher says it demonstrates arbitrary file reading as SYSTEM after the September 2026 Windows security updates, while noting that a more complete proof of concept could be released later. Reading a file does not mean you can run code or system commands, but it can still weaken Windows security.

The ShieldCrash repository includes C++ project files, a DLL named Warden.dll, resource files, and an EICAR test archive. The EICAR file suggests the research may involve Defender’s malware-detection or file-handling workflow.

However, organizations should avoid running untrusted public proof-of-concept code on production endpoints, especially code that interacts with antivirus services or privileged Windows components.

The GitHub ShieldCrash PoC claims Microsoft’s fix for ShieldBreak (CVE-2026-69414) failed to fully address the underlying issue, allowing arbitrary file reads as SYSTEM on patched Windows systems.

Microsoft has not publicly confirmed the newer bypass, which remains a researcher-reported claim pending independent reproduction or a Microsoft security advisory. The earlier issue is tracked as CVE-2026-69414, while the new bypass has not yet received a separate CVE assignment.

Defenders should monitor endpoints for suspicious local tools that interact with Microsoft Defender scanning paths, unexpected creation or loading of unsigned DLLs, abnormal access attempts involving protected files, and child processes or file operations associated with Defender services.

Security teams should also keep the Microsoft Defender platform and intelligence updates current, apply future Microsoft patches promptly, and restrict untrusted code execution through application control policies.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post New Windows Defender ShieldCrash 0-Day Bypasses Microsoft Patch to Read Files as SYSTEM appeared first on Cyber Security News.

Microsoft has disclosed a new security flaw in Windows BitLocker, the operating system’s built-in disk encryption feature, that could let an attacker execute malicious code on a vulnerable device.

Tracked as CVE-2026-69449 and published on September 8, 2026, the vulnerability stems from a heap-based buffer overflow in BitLocker’s code and has been rated “Important” in severity, with Microsoft acting as the assigning CNA.

Windows BitLocker Vulnerability

According to Microsoft’s advisory, as detailed in the technical disclosure published by Microsoft, an authorized attacker who successfully exploits the flaw could gain the ability to execute arbitrary code locally, and the company’s FAQ notes that exploitation may also be achieved by an in-network attacker calling arbitrary endpoints, effectively broadening the risk beyond a purely local attack surface.

Independent tracking from Tenable corroborates the core description, characterizing the bug as a heap overflow that allows code execution once triggered, while assigning it a CVSS v2 base score of 6.5 under a vector requiring low attack complexity and medium-level authorization.

Despite the code execution impact, Microsoft’s Exploitability Index currently rates CVE-2026-69449 as “Exploitation Less Likely.” The vulnerability has not been publicly disclosed prior to this advisory, and there is no evidence of active exploitation in the wild as of the September 8 release date.

This places it in a lower-urgency bracket compared to fully unauthenticated, wormable remote code execution bugs, though enterprises relying on BitLocker for data-at-rest protection should not treat that classification as a reason to delay patching.

Microsoft credited security researchers Thanatos Tian of the Hong Kong Polytechnic University, wgg, and the individual known as @2st__ working with Diffract, alongside Zhiniang Peng of the Huazhong University of Science and Technology, for responsibly reporting the flaw through coordinated disclosure.

The vulnerability affects an unusually broad swath of the Windows ecosystem, spanning both client and server platforms.

Impacted systems include Windows 10 across versions 1607, 1809, 21H2, and 22H2 for both x64 and 32-bit builds; Windows 11 versions 23H2, 24H2, 25H2, and the newer 26H1 for x64 and ARM64 architectures; and Windows Server releases from 2012 and 2012 R2 through Server 2016, 2019, 2022, and the latest Server 2025, including their Server Core installation variants.

Microsoft has already shipped cumulative security updates addressing each affected build as part of its September 2026 Patch Tuesday cycle.

Fixes are distributed through distinct KB packages depending on platform, such as KB5124012 for Windows 11 26H1 systems, KB5122871 for Windows Server 2025, KB5122882 for Windows Server 2022, KB5122876 for Windows Server 2019, and KB5123099 covering Windows Server 2016 and legacy Windows 10 1607 builds, among others listed in the official update catalog.

Given BitLocker’s role in protecting sensitive data across enterprise fleets, laptops, and servers, IT administrators are strongly advised to prioritize deployment of the relevant September 2026 cumulative updates without delay.

Verifying the post-update build number against Microsoft’s published fixed versions for each product line remains the most reliable way to confirm remediation and reduce exposure to this newly documented BitLocker weakness.

The post Windows BitLocker Vulnerability Allows Attackers to Execute Malicious Code Remotely appeared first on Cyber Security News.

A new U.S. government advisory has raised concerns over large-scale attempts to copy the capabilities of leading artificial intelligence systems.

The activity did not involve conventional malware, but instead focused on harvesting model outputs at a scale that could accelerate rival AI development.

The alleged campaigns relied on huge volumes of automated requests sent through application programming interfaces, cloud services, aggregators, and proxy networks.

CISA said in a report shared with Cyber Security News (CSN) that by collecting responses from advanced AI models, operators could create synthetic datasets designed to teach other systems how to perform similar tasks.

Analysts from the Cybersecurity and Infrastructure Security Agency, alongside the NSA and FBI, said China-based AI companies likely extracted billions of tokens across millions of exchanges from U.S. frontier models since late 2024.

The advisory describes the activity as malicious industrial-scale knowledge distillation rather than routine AI research. The reported impact reaches beyond unauthorized access to a single platform.

CISA warned that extracting reasoning, coding, agentic, and domain-specific capabilities can cut both the cost and time required to develop competitive models, creating economic and national-security concerns for the wider AI ecosystem.

CISA Warns Chinese AI Firms Extract Billions of Tokens

CISA named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as companies involved in campaigns targeting variants of Claude, GPT, Gemini, and Grok.

The agency said the operations appeared likely to have occurred with Chinese government awareness, although the advisory did not claim direct government control. Knowledge distillation is normally a legitimate method in which a smaller model learns from a larger one.

The concern arises when companies allegedly obtain restricted outputs from competitors at scale, then use those results to imitate protected capabilities without authorization, as seen in previous reporting on large-scale AI distillation attacks.

DeepSeek allegedly ran organized collection activity from at least late 2024 through mid-2025, seeking reasoning abilities, specialized optimization, legal functions, and writing support for its R1 and V3 models.

CISA said its public training-cost claims did not reflect the full value of data gained through alleged distillation. Moonshot AI was linked to widespread activity from at least mid-2025, including the alleged extraction of Claude Fable 5 data for Kimi-K3 and GPT-4o data for Kimi-K2.

Other reported targets included programming, mathematics, reinforcement-learning, and software-engineering functions. The advisory also said Alibaba used distillation to improve software engineering, customer service, character creation, and training workflows.

Separate reporting had already examined allegations of unauthorized Claude model extraction, illustrating how model-output collection has become a major concern for AI providers.

Proxies and Prompt Attacks

According to CISA, the operations used “transfer stations,” a gray market of API proxies that can mask user metadata and help users bypass geographic restrictions.

These intermediaries can also obscure the organization making requests, making isolated accounts look less connected than they really are.

The advisory described account pools, bulk premium subscriptions, and automated routing systems that could switch among providers when access controls changed.

It also highlighted behavior such as sustained activity around the clock, repeated use from multiple locations, immediate maximum use by new accounts, and coordinated timing across separate pathways.

Some operators allegedly used prompt injection and jailbreak-style requests to force models to disclose hidden chain-of-thought reasoning.

This is distinct from ordinary prompts because the goal is to manipulate a model into exposing protected internal processes, a risk also explored in coverage of prompt injection attack techniques.

CISA urged AI providers to strengthen identity checks, monitor unusual subscription-to-usage ratios, apply rate limits, and log requests for investigation.

Providers should also share infrastructure and behavioral signals with cloud platforms and API aggregators, since a distributed campaign may not be visible from one service alone.

The agencies further recommended targeted response changes for high-confidence malicious requests, such as reducing response fidelity or varying outputs, without alerting suspected operators.

Differential privacy, adversarial testing, stricter API controls, and measures to limit prompt injection can add layers of protection against extraction attempts.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post CISA Warns Chinese AI Firms Extract Billions of Tokens From Claude, GPT, Gemini and Grok appeared first on Cyber Security News.

cPanel has disclosed CVE-2026-67401, a critical SQL injection flaw in EmailTrack that could let authenticated attackers gain root-level control of vulnerable servers.

cPanel disclosed the security issue on September 8, 2026. According to cPanel, an attacker must already possess a valid cPanel account with mail-related privileges to exploit the vulnerability.

While this requirement limits unauthenticated internet-wide exploitation, the potential impact remains severe for shared-hosting providers, managed servers, and organizations with multiple cPanel users.

CVE-2026-67401 is an SQL injection vulnerability in cPanel’s EmailTrack functionality. EmailTrack monitors and reviews email delivery activity, including message routing and delivery information.

A malicious authenticated user can abuse the vulnerable functionality to create arbitrary files on the underlying server. Arbitrary file creation is especially dangerous in a hosting environment because it can let attackers place controlled content in sensitive locations.

Cpanel Vulnerability

cPanel said successful exploitation can result in code execution as the root user. Root access provides unrestricted control over the operating system, allowing attackers to access hosted websites, databases, email accounts, backups, configuration files, and credentials stored on the server.

An attacker with root-level access could also install persistence mechanisms, deploy malware, alter website content, steal customer data, turn off security tools, or use the compromised server to launch further attacks.

In multi-tenant hosting environments, compromising one privileged cPanel account could put other customers hosted on the same server at risk.

Security researcher Ali Mustafa, also known as (nd abe)1526, reported the vulnerability. The vulnerability affects all supported cPanel/WHM versions before the following patched builds:

Server administrators should verify their installed cPanel/WHM version immediately and upgrade to a patched release. Organizations using managed hosting should also confirm with their provider that the update has been applied across all affected systems.

The primary mitigation is to update cPanel/WHM to the latest available patched version. Administrators should not rely only on restricting public access, because exploitation requires a legitimate authenticated account rather than anonymous access.

Security teams should review cPanel accounts with email-related permissions and remove unnecessary privileges. Enable passwords and multi-factor authentication for accounts that may have been exposed or are no longer required.

Administrators should also investigate for suspicious files, unexpected changes to web directories, modified configuration files, unusual root-level processes, and unexplained outbound network connections. Reviewing cPanel, web-server, authentication, and system logs may help identify exploitation attempts.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post New cPanel Vulnerability Allows Attacker to Gain Full Control of the Server appeared first on Cyber Security News.

Claude Mythos is the first model reported to complete a cyber kill chain without step-by-step human direction. The finding does not describe malware or a confirmed victim breach. It is a controlled test, but shows how quickly autonomous attack capability is advancing.

The concern is speed. The model found weaknesses, entered a defended enterprise network, collected credentials, raised privileges, moved between systems and reached domain administrator control.

Those are stages defenders try to interrupt during an intrusion. GitHub hosts projects and discussions using the Claude Mythos name, but did not identify a malware campaign.

The finding comes from Booz Allen’s assessment of autonomous models. It is a benchmark result, not evidence of a named program independently attacking organizations.

Booz Allen said in a report shared with Cyber Security News (CSN) that it tested 18 U.S. and Chinese models as autonomous attackers against a production-grade enterprise network. Researchers used network and host telemetry to measure actions, rather than accept model claims.

Claude Mythos AI Autonomously Executes Full Cyber Kill Chain

The Cyber Weapon Index gave Claude Mythos an 80 score, combining 74 for vulnerability research and 86 for kill-chain attainment.

It was the only model assessed as reaching the final objective. Researchers said it moved from a stolen employee credential to administrator-level control in every credentialed attempt.

The harder scenario began with no credentials. The report says Claude Mythos penetrated from outside and worked out how to raise its access, instead of following a fixed plan.

The reported autonomous AI agent breach illustrates why this development has drawn attention. The test examined whether models could spot weaknesses in compiled software without source code.

Only frontier Anthropic models identified the previously unseen flaw used in testing, and only Claude Mythos reportedly exploited it. The result is from a defined setting, not proof of universal performance.

Other models showed progress without matching the full outcome. Four reached domain access and control, four achieved lateral movement, and two reached credential access.

All but one penetrated the network autonomously. An attacker need not finish every stage alone to cause disruption or give a human operator a head start.

Defenders face a speed problem

The report argues that risk lies in the entire AI system, not only its model. An attack harness can link a model with tools, memory, feedback and an execution environment.

This helps an agent retain context, recover from errors and connect tasks, as seen in agents breaching company networks.

A model that stops short alone can become more effective with automation, tailored prompts and operational tools. The report found that a harness paired with Claude Sonnet could rival Claude Mythos. A public model score, therefore, can leave serious blind spots.

The likely entry routes are familiar: exposed services, unpatched flaws, stolen credentials and weak access controls.

AI reduces the time and expertise needed to test options, analyze results and adapt. AI agents rebuilding attack tools illustrate how persistence after failure can amplify this advantage. The recommended response is to assume an initial foothold and restrict what happens next.

Organizations should connect vulnerability management, detection, containment and response; enforce least privilege, strong identity checks, segmentation and isolation of high-value systems; and test containment while keeping services running.

Teams should test safeguards in deployed configurations, including tool permissions and autonomy levels. The report recommends continuous measurement of models and surrounding systems, plus controlled access for vetted defenders to reproduce threatening behavior.

This exceeds paper compliance when attack methods change quickly. The headline is not that an AI model has become a criminal actor. A controlled assessment found one system capable of completing a realistic sequence of offensive tasks.

The gap between early access and full compromise may be narrowing, making patching, identity protection and segmentation urgent. Related AI-driven government system breaches show why coordinated automation needs preparation.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Claude Mythos AI Autonomously Executes Full Cyber Kill Chain Without Human Guidance appeared first on Cyber Security News.