Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
14 / 50 results
highperson_alertThreat ActorTeamUpdraft Breach Exposes 400K WordPress Sites to Backdoor Campaign
The threat actor behind this campaign remains unidentified. The actor successfully breached TeamUpdraft's website infrastructure over the weekend of October 17-18, 2026, gaining unauthorized access to customer databases containing UpdraftCentral conn…
highperson_alertThreat ActorConnectWise App Identity Compromise Enables M365 Tenant Takeovers
The threat actor behind this campaign remains unattributed. Motivation appears to be espionage or persistent access establishment, evidenced by targeting of policy, national security, trade, and critical mineral sectors in a secondary wave.
highperson_alertThreat ActorCompromised ConnectWise M365 Credential Exposes 173 Tenants
The threat actor behind this campaign remains unattributed. The adversary demonstrated operational sophistication by compromising a Microsoft 365 application credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a cloud-based backup se…
criticalbug_reportVulnerabilityNextcloud Collabora CODE app RCE exploited in wild since September 10
Collabora Online - Built-in CODE Server (richdocumentscode) versions before 26.4.303, used with Nextcloud. Standalone Collabora Online servers not affected. Nextcloud instances using only richdocuments app (external Collabora server) not affected.
highperson_alertThreat ActorGhostAction Campaign Injects Credential-Stealing Workflows into 340+ Repos
GhostAction is a large-scale supply chain attack campaign first identified in September 2025, focused on compromising GitHub maintainer accounts to inject malicious GitHub Actions workflows.
highperson_alertThreat ActorASOS Data Breach: Social Engineering and Credential Theft Campaign
The threat actor behind this incident identifies themselves as "Xuanye Group." No attribution to known APT groups or established cybercrime syndicates has been made.
highperson_alertThreat ActorMicrosoft X Account Hijacked in Cryptocurrency Pump-and-Dump Scheme
The threat actors behind this incident remain unidentified. Their motivation appears to be financial gain through a cryptocurrency pump-and-dump scheme, leveraging the compromise of Microsoft's official X (formerly Twitter) account with over 13 milli…
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772 exploited for root access, web shells
Citrix NetScaler ADC and NetScaler Gateway appliances. CVE-2026-88772 (CVSS 9.5) is a memory overflow in DTLS protocol handling in the NetScaler Packet Processing Engine (NSPPE). CVE-2026-88771 also mentioned as exploited.
highbug_reportVulnerabilityMemTensor npm and PyPI packages compromised to deliver sckit credential stealer
MemTensor packages: npm package @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, 0.1.25; PyPI package MemoryOS version 2.0.34 (now quarantined). Malicious Go-based credential stealer targets Windows, Linux, and macOS systems.
highperson_alertThreat Actor155x surge in password spraying exploits MFA gaps and legacy OAuth flows
The threat actor behind the LSHIY campaign remains unattributed. Motivation appears financially driven, likely focused on credential validation for resale on dark web markets rather than immediate post-compromise exploitation.
highperson_alertThreat ActorFraudulent Sparrow Wallet App on Apple App Store Steals $1.8M in Bitcoin
The threat actor behind this campaign remains unidentified. The operation involved publishing fraudulent cryptocurrency wallet applications on Apple's App Store that impersonated the legitimate Sparrow Wallet.
highperson_alertThreat ActorHermes AI Agent Used for Post-Exploitation at Thai Finance Ministry
The threat actor behind this intrusion remains unattributed. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking or fluent in Chinese, based on linguistic artifacts (password containing "Leishen," meaning thunder god)…
highperson_alertThreat ActorMassive SEO-Poisoned Campaign Distributes AsyncRAT via ScreenConnect
The threat actor behind this campaign remains unattributed. Motivation appears to be financially driven, consistent with commodity RAT deployment for access brokering, credential theft, or follow-on ransomware operations.
criticalbug_reportVulnerabilitySimpleHelp OpenID auth bypass (CVE-2026-48558) exploited in wild
SimpleHelp remote support software, all versions using OpenID Connect authentication. CVE-2026-48558 is a critical authentication bypass (CVSS 10.0) in the OpenID Connect flow.