Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 1067 results
highbug_reportVulnerabilityMicrosoft September 2026 updates break RDS on Windows Server and clients
Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10/11 all versions that applied September 2026 Patch Tuesday updates. Impacts Remote Desktop Services (RDS), RDP connections, MMC, RDS Licensing Diagnoser, and File Explorer.
highperson_alertThreat ActorHISHIMIRO/jeetbot.cc Leaked OAuth Tokens from 31K Twitch Users
HISHIMIRO/jeetbot.cc is a Russia-based commercial bot service operator linked to the malicious Twitch browser extension "Twitch Enhanced Viewer | JeetBot." The operator, identified as Cyprus-based developer Aleksandr Popov, runs JeetBot as a commerci…
highbug_reportVulnerabilityMicrosoft warns of passkey phishing and CEO fraud campaigns targeting cloud
Microsoft cloud environments (Azure AD/Entra ID, Microsoft 365, SharePoint, OneDrive). Campaign 1: U.S. enterprise users in IT services, consumer goods, real estate, and manufacturing (August 2026).
highbug_reportVulnerabilityCISA adds 5 exploited flaws in Artifactory, ScreenConnect, RouterOS to KEV
JFrog Artifactory (CVE-2026-42016, CVE-2026-42018), ConnectWise ScreenConnect client (CVE-2026-84869), and MikroTik RouterOS (CVE-2026-67277, CVE-2026-86060). All vulnerabilities are actively exploited in the wild.
highperson_alertThreat ActorMultiple APT and Cybercrime Groups Abuse Claude AI to Extract Android Secrets
This activity involves multiple distinct threat actor categories operating independently: state-sponsored espionage groups linked to Russia and China, and financially motivated cybercrime actors.
highpublicGeopoliticalFlorida State Driver Database Breached via Stolen Police Credentials
The breach of Florida's DAVID driver database represents a compromise of critical state-level identity infrastructure in the United States. Driver databases contain personally identifiable information (PII) for millions of residents and serve as foun…
highperson_alertThreat ActorShinyHunters and Helix Linked to Passkey-Themed M365 Phishing Campaign
ShinyHunters and Helix are cybercrime actors linked to data extortion operations. Both groups have established reputations in the underground economy for compromising corporate environments and exfiltrating sensitive data for extortion or sale.
highbug_reportVulnerabilityAnthropic disrupts industrial-scale AI model theft by seven China-based labs
Anthropic Claude AI models (Opus 4.6, 4.7, and others). Organizations and individuals using Claude API services globally. Seven China-based AI labs identified: Alibaba, Moonshot AI, DeepSeek, Zhipu (Z.ai), MiniMax, Xiaomi, and SenseTime.
highperson_alertThreat ActorGenerative Threat Groups Weaponize Claude AI for Cyber Operations
Generative Threat Groups (GTGs) is a collective term coined by Anthropic to describe diverse threat actors leveraging Claude AI models for offensive cyber operations between December 2025 and August 2026.
highperson_alertThreat ActorGTG-20006 (Midnight Blizzard) Uses Claude AI for Malware Evasion
GTG-20006 is a Russian state-sponsored cyber espionage group attributed by Anthropic, aligning with Midnight Blizzard (APT29, Cozy Bear). The actor demonstrates advanced operational sophistication by integrating generative AI into their entire attack…
highperson_alertThreat ActorThreat Actors Abuse Claude AI Platform to Distribute ClickFix Malware
Unattributed threat actors conducting opportunistic campaigns that exploit the trust and visibility of AI platforms for malware distribution. Motivation appears to be financially driven, leveraging the growing adoption of AI tools and the inherent tr…
highbug_reportVulnerabilityJFrog Artifactory flaws actively exploited to create admin backdoors
JFrog Artifactory self-hosted instances: CVE-2026-42018 and CVE-2026-42016 (chained, versions below 7.146.8 on multiple branches); CVE-2026-82329 (standalone critical bypass, CVSS 9.8, versions below 7.161.20 across six branches).
highperson_alertThreat ActorUNC3569 Exploits Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
UNC3569 is a China-linked threat actor attributed by Google Threat Intelligence to the country's hacker-for-hire ecosystem. Active since at least 2021, the group targets government, education, technology, and finance sectors primarily in East and Sou…
highperson_alertThreat ActorUkrainian National Sentenced to Four Years for Conti Ransomware Role
Conti is a prolific ransomware-as-a-service (RaaS) operation that emerged in 2020 and became one of the most active and damaging cybercrime groups globally.
highperson_alertThreat ActorMantax Otax: Android malware blends ransomware and spyware features
Mantax Otax is a newly identified Android malware family that exhibits hybrid functionality, combining ransomware encryption capabilities with spyware data exfiltration and victim harassment features.
highbug_reportVulnerabilityAI-enhanced BEC campaign targets finance teams with CEO impersonation
Over 1 million emails sent August 3-5 targeting enterprise finance/accounts payable departments, primarily in United States (87.7%). Campaign used third-party email delivery infrastructure to impersonate C-level executives (CEO, CFO, President) with…
highperson_alertThreat ActorRussian-speaking actor uses AI agents to exploit PaperCut flaws
A likely Russian-speaking threat actor leveraged hundreds of AI agents to orchestrate a large-scale exploitation campaign targeting PaperCut NG/MF servers globally.
highbug_reportVulnerabilityGoogle Play Early Access abused to distribute deceptive Android apps
Google Play Early Access program; Android users globally, particularly those exposed to social media ads on TikTok and Facebook. Thousands of deceptive apps including fake casino games, reward apps, and utility apps.
highbug_reportVulnerabilityHard-coded API credentials in drEryk Gabinet allow ticket system access
drEryk Gabinet software, all versions before 11.5.0. Affects the ticket reporting component with hard-coded API credentials that authenticate directly to the ticket system API.
highbug_reportVulnerability10% of LiteLLM gateways accept default "sk-1234" admin key from docs
LiteLLM open-source AI gateway: 294 of 3,074 internet-facing instances scanned in February 2026 accepted the example admin key "sk-1234" from setup documentation. 191 had no key set at all; remainder used the documented default.
highperson_alertThreat ActorShinyHunters Breaches AdaptHealth, Exposing 4.1M Patient Records
ShinyHunters is a financially motivated cybercrime group known for large-scale data theft and extortion operations. The group typically targets organizations to steal sensitive data, then demands ransom payments in exchange for not publicly leaking t…
highperson_alertThreat ActorU.S. Disrupts Chinese Organized Crime Scam Marketplace, Freezes $52.8M
Chinese organized crime syndicates operating the Xinbi Guarantee illicit marketplace, a Telegram-based platform facilitating pig butchering romance scams, wire fraud, and money laundering.
highbug_reportVulnerabilityPasskey-themed phishing campaign targets cloud identities via AiTM
Microsoft 365 / Entra ID users across multiple organizations. Campaign active since May 2024 (likely typo in source stating "May 2026"). Targets include SharePoint, OneDrive, Exchange, and Microsoft Graph API access.
highperson_alertThreat ActorChinese AI Firms Conduct Industrial-Scale Distillation on U.S. Models
Six Chinese AI companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—are attributed by CISA, NSA, and FBI as conducting coordinated, industrial-scale AI model distillation attacks against U.S. frontier AI providers since late 2024.
highperson_alertThreat ActorAPT31 Deploys BlueMoon Exploit Kit Chaining Chrome and Windows Zero-Days
APT31 (also tracked as Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, Violet Typhoon, and ZIRCONIUM) is a China-aligned state-sponsored threat actor conducting espionage operations.
highperson_alertThreat ActorGentlemen Ransomware Gang Breaches Veradigm via Third-Party Vendor
The Gentlemen is a double-extortion ransomware gang that emerged around mid-2025. The group operates opportunistically across multiple sectors and geographies, targeting organizations based on access availability rather than strategic selection.
highbug_reportVulnerabilityDeepSeek Harness agents can escape file sandbox via unauthenticated API
DeepSeek Harness versions 0.1.1-rc.2 and earlier. The tool runs AI coding agents on developer machines. Fixed in version 0.1.2-alpha.2 (npm) and later. Third-party desktop wrappers may ship vulnerable versions independently.
highbug_reportVulnerability36,000 Plex Media Servers remain unpatched against undisclosed flaws
Plex Media Server v1.43.2 and earlier, Plex Desktop prior to v1.115.0. Over 36,000 internet-exposed instances confirmed vulnerable as of September 2026. Affects self-hosted and NAS-based deployments.
highbug_reportVulnerabilityYouTube gaming lures and SEO poisoning deliver multi-payload malware via PPI
Enterprise networks, critical infrastructure, and government entities. Campaign CL-CRI-1171 active since at least 2024, delivering payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner, and Socks5Systemz via custom loader.
highpublicGeopoliticalU.S. Accuses China-Based AI Firms of Industrial-Scale Model Distillation
The joint advisory from NSA, CISA, and FBI represents a significant escalation in U.S.-China technological competition, framing AI model distillation not as isolated intellectual property theft but as a coordinated national strategy.