Hackers have been harvesting AI access tokens and have been using AI-assisted offensive tools to automate attacks.

The post AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks appeared first on SecurityWeek.

The botnet was created and operated for financial gain by Android OEM/ODM Videostrong Technology.

The post Google Dismantles XCPE Botnet of 1.3 Million Android Devices appeared first on SecurityWeek.

The extension performed host reconnaissance and attempted to create a reverse SSH tunnel.

The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek.

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.

Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.

The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network appeared first on SecurityWeek.

CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.

The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.

Running at system boot, it periodically polled the update domain to execute any code served, with full privileges.

The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek.

Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection.

The post 953 Online Stores Infected in Long-Lasting Malware Campaign appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.

The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek.

The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.

The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek.

After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.

The post Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 appeared first on SecurityWeek.

Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.

The post Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI appeared first on SecurityWeek.

At least three threat actors have been abusing Cairn for persistent access and financial theft.

The post AI Platform Cairn Abused to Hack Over 100 Organizations appeared first on SecurityWeek.

Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.

The post Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks appeared first on SecurityWeek.

The services remain unavailable as the company continues remediation and security validation.

The post ConnectWise Suspends Cloud Services in Response to Cyberattack appeared first on SecurityWeek.

Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics.

The post MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks appeared first on SecurityWeek.

Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets.

The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek.

Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities.

The post CikaBika Bot RAT Uses Discord for C&C appeared first on SecurityWeek.

The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT.

The post Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek.

Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions.

The post XWorm RAT Evolves Into Surveillance Platform appeared first on SecurityWeek.