Open VSX Unblocks 3 IDs Used in 77-Extension Evil-Twin Malware Campaign
Open VSX has removed three extension identifiers from its malicious-extension list after the legitimate projects they impersonated began reclaiming their nam...
GBHackers
20 articles
New SynkLoader Malware Uses Fake Windows Lock Screen to Steal Passwords and Pivot Networks
SynkLoader, a newly identified modular malware framework that combines Python, C#, C++, PowerShell, and memory-resident payloads to evade endpoint detection....
New macOS Malware Clones Your Logged-In Browser and Gives Hackers Remote Control.
AmnesiaStealer, a multi-stage macOS infostealer written in Rust that moves beyond conventional credential theft by giving attackers covert, interactive contr...
Windows 11 Update Triggers Game Crashes on Systems With RGB Lighting Drivers
Microsoft is currently investigating a compatibility issue with Windows 11, in which certain games crash, freeze, or cause unexpected system restarts on devi...
Critical WordPress Pods Flaw Lets Unauthenticated Attackers Gain Admin Access
A critical vulnerability has been identified in the widely used Pods WordPress plugin, which could allow unauthenticated attackers to take complete control o...
AWS Network Firewall Adds Rule Hit Counts to Identify Unused Security Rules
AWS has introduced a new capability for AWS Network Firewall that tracks rule hit counts, providing security teams with direct visibility into how often indi...
macOS ClickFix Crimekit Uses Polygon Smart Contracts to Deploy AMOS Stealer and XMRig Miner
A macOS-focused ClickFix campaign is abusing Polygon smart contracts to conceal its live command-and-control infrastructure while deploying an Atomic macOS S...
First Android Malware Targeting Car Head Units Uses Firmware Updates to Build Proxy Botnet
A multi-stage Android malware campaign that abuses the firmware-update mechanism of Android-based automotive head units to deploy ad-fraud tooling and enroll...
Critical isolated-vm Flaw Lets Attackers Escape Sandbox and Hijack Host Control Flow
A critical vulnerability has been discovered in the widely used Node.js sandboxing library, isolated-vm.
RedC2 Turns Compromised Linux Machines Into SOCKS5 Proxies for Internal Network Pivoting
A cluster of trojanized npm packages is delivering the RedC2 4.0 Linux implant, providing operators with a pathway from a seemingly harmless dependency impor...
Iran-Linked Hackers Shut Down UK Power Plant for Four Days in Cyberattack
A cyberattack linked to Iranian threat actors forced a British power plant offline for four consecutive days in July, reportedly marking the first successful...
Anthropic Brings Claude Mythos 5 to Cyber Defenders for Vulnerability Scanning and Patching
Anthropic has enhanced its AI-driven cyber defense offerings by integrating Claude Mythos 5 into Claude Security. This new feature enables enterprise custome...
Cybersecurity Newsletter Bulletin– Top 50 Biggest Cybersecurity Stories of the Week – Shell & Azure Mega-Breaches, Salt Typhoon Evicted, Entra ID RCE, Chinese vCenter ESXi Ransomware & More
Welcome to this week’s edition of the GBHackers cybersecurity newsletter — your weekly cybersecurity bulletin covering the 50 most important stories from Aug...
Chinese Hacker Uses DeepSeek and Hermes Agent to Launch Autonomous Cyberattacks
A Chinese-speaking threat actor has been observed using DeepSeek through the Hermes Agent framework to automate reconnaissance, vulnerability research, explo...
Apollo Global Management Data Breach Exposes Social Security Numbers and Personal Data
Apollo Global Management has disclosed a cyber incident in which attackers gained unauthorized access to cloud platforms and may have acquired highly sensiti...
Zero-Click Grok Attack Lets Hackers Steal Chat History Using Encrypted Prompt Injection
A newly disclosed prompt-injection technique could turn a routine request to summarize a webpage in xAI’s Grok web chat into a silent data-exfiltration attac...
768 Leaked AWS Keys Still Active With Full Admin Access to Corporate Accounts
A large-scale investigation has uncovered 768 publicly exposed AWS access keys that remain active and grant full administrative privileges to corporate cloud...
US Bank Investigates Alleged Data Breach After LockBit Ransomware Extortion Claim
US Bank is currently investigating claims made by the LockBit ransomware group, which alleges that it breached the bank and stole sensitive data. The group h...
Deepfake Ads Funnel Investors Into WhatsApp Groups Controlled by Fake Financial Analysts
Investment fraud is increasingly exploiting the one action banks struggle most to block: a payment the customer actively wants to make. Deepfake advertisemen...
UAT-10147 Compromises Web Servers to Deploy BadIIS for SEO Fraud and Data Theft
A Chinese-speaking cybercrime group, tracked as UAT-10147, targeting vulnerable Windows and Linux web servers worldwide to deploy BadIIS malware, steal data,...