Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 340 results
highbug_reportVulnerabilityMass-scanning campaign exploits Vite dev servers to steal AWS/Azure creds
Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5. Internet-exposed Vite development servers (typically port 5173) running with --host flag, server.host configuration, or misconfigured Docker port mappings.
highbug_reportVulnerabilityCompromised IP cameras exploited for espionage and DDoS attacks
IP cameras across multiple vendors and models. Organizations with internet-exposed camera infrastructure are at risk. Specific affected vendors and firmware versions not disclosed in CERT.BE advisory.
highbug_reportVulnerabilityMicrosoft warns of passkey phishing and CEO fraud campaigns targeting cloud
Microsoft cloud environments (Azure AD/Entra ID, Microsoft 365, SharePoint, OneDrive). Campaign 1: U.S. enterprise users in IT services, consumer goods, real estate, and manufacturing (August 2026).
highperson_alertThreat ActorMultiple APT and Cybercrime Groups Abuse Claude AI to Extract Android Secrets
This activity involves multiple distinct threat actor categories operating independently: state-sponsored espionage groups linked to Russia and China, and financially motivated cybercrime actors.
highperson_alertThreat ActorShinyHunters and Helix Linked to Passkey-Themed M365 Phishing Campaign
ShinyHunters and Helix are cybercrime actors linked to data extortion operations. Both groups have established reputations in the underground economy for compromising corporate environments and exfiltrating sensitive data for extortion or sale.
highperson_alertThreat ActorGenerative Threat Groups Weaponize Claude AI for Cyber Operations
Generative Threat Groups (GTGs) is a collective term coined by Anthropic to describe diverse threat actors leveraging Claude AI models for offensive cyber operations between December 2025 and August 2026.
highperson_alertThreat ActorThreat Actors Abuse Claude AI Platform to Distribute ClickFix Malware
Unattributed threat actors conducting opportunistic campaigns that exploit the trust and visibility of AI platforms for malware distribution. Motivation appears to be financially driven, leveraging the growing adoption of AI tools and the inherent tr…
highbug_reportVulnerabilityAI-enhanced BEC campaign targets finance teams with CEO impersonation
Over 1 million emails sent August 3-5 targeting enterprise finance/accounts payable departments, primarily in United States (87.7%). Campaign used third-party email delivery infrastructure to impersonate C-level executives (CEO, CFO, President) with…
highperson_alertThreat ActorRussian-speaking actor uses AI agents to exploit PaperCut flaws
A likely Russian-speaking threat actor leveraged hundreds of AI agents to orchestrate a large-scale exploitation campaign targeting PaperCut NG/MF servers globally.
highbug_reportVulnerabilityGoogle Play Early Access abused to distribute deceptive Android apps
Google Play Early Access program; Android users globally, particularly those exposed to social media ads on TikTok and Facebook. Thousands of deceptive apps including fake casino games, reward apps, and utility apps.
highbug_reportVulnerabilityPasskey-themed phishing campaign targets cloud identities via AiTM
Microsoft 365 / Entra ID users across multiple organizations. Campaign active since May 2024 (likely typo in source stating "May 2026"). Targets include SharePoint, OneDrive, Exchange, and Microsoft Graph API access.
highbug_reportVulnerabilityYouTube gaming lures and SEO poisoning deliver multi-payload malware via PPI
Enterprise networks, critical infrastructure, and government entities. Campaign CL-CRI-1171 active since at least 2024, delivering payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner, and Socks5Systemz via custom loader.
highperson_alertThreat ActorDoppelCart: 119,000+ Fake E-Commerce Domains Used for Card Theft
DoppelCart is a large-scale fraud operation attributed to coordinated threat actors conducting payment card theft through fraudulent e-commerce infrastructure.
highperson_alertThreat ActorAI-Powered Credential Harvesting Campaign Compromises Thousands in 6 Hours
The campaign involves financially motivated threat actors leveraging autonomous AI agents and multi-agent attack frameworks to conduct large-scale credential harvesting operations.
highperson_alertThreat ActorBengalSEO Campaign Exploits Bing SEO to Deploy MayaBot Malware
BengalSEO is a financially motivated campaign operating from Rajasthan, India since at least 2015. The operation is driven by IT service providers WeConnect Solutions LLC (formerly iConnect Soft Solutions LLC) and Garage2Global.
highbug_reportVulnerabilityPEEP toolkit turns Chrome/Edge into backdoors via malicious extension
Chrome and Edge browsers on Windows and Linux. PEEP is a post-exploitation toolkit requiring prior administrative or code execution access. It masquerades as "Smart Bookmarks" extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj) and uses native messaging…
highbug_reportVulnerabilityVishing campaign steals M365 tokens via AitM phishing, targets executives
Microsoft 365, SharePoint, OneDrive, Exchange, and Box SaaS platforms. Primarily targets executive-level staff (directors, VPs) in U.S. organizations across construction, engineering, healthcare, pharmaceuticals, real estate, finance, and professiona…
highbug_reportVulnerabilityBigBear 2.0 PhaaS bypasses MFA, steals 5,000+ Microsoft 365 credentials
Microsoft 365 users across 258 organizations in 40+ countries. All authentication methods except FIDO2/WebAuthn hardware tokens are vulnerable. Campaign leverages Evilginx2-based adversary-in-the-middle (AiTM) framework with geo-matched residential p…
highbug_reportVulnerabilityWorm-like malware abuses ConnectWise ScreenConnect for lateral spread
ConnectWise ScreenConnect clients (all versions). Attackers deploy rogue ScreenConnect instances via phishing, tech support scams, and fake refund forms.
highbug_reportVulnerabilityREVSTEALER Deploys Four Persistent Modules Including Crypto Miner
Windows systems infected with REVSTEALER infostealer (active since February 2026). Four persistent modules (ProManager, WinUpdate, SoftManager, LockAppHost) remain after core stealer self-deletes.
highbug_reportVulnerability5,400+ compromised sites deliver ClickFix via BNB Smart Chain contracts
Over 5,400 compromised small-business websites used as distribution infrastructure. Targets are end users visiting these sites. ClickFix social engineering payloads hosted on BNB Smart Chain (BSC) smart contracts to evade takedown.
highbug_reportVulnerabilityPhishing campaign uses invisible Unicode to bypass email filters
Organizations using email security systems that rely on keyword matching and literal string detection. Campaign targets Small Business Administration (SBA) loan applicants and businesses seeking financing.
highbug_reportVulnerability5,000 Dropbox accounts compromised; OAuth and Teams phishing campaigns active
Multiple attack vectors affecting organizations using Microsoft Teams, Dropbox (5,000+ accounts compromised), OAuth-enabled applications, and remote management tools.
highbug_reportVulnerabilityBraZetsu malware framework enables Initial Access Broker marketplace
Windows systems in Iberian Peninsula and Latin America, particularly Brazil. Targeted sectors include e-commerce, corporate, financial, industrial, and law enforcement. Browsers affected: Google Chrome, Microsoft Edge, Brave, Vivaldi, Opera.
highbug_reportVulnerabilityRMM phishing campaign spans 46 countries, US accounts for 45% of activity
Organizations across 46 countries, primarily United States (45% of activity), Canada, and others. Top targeted sectors: education, technology, government, banking, finance, and manufacturing.
highbug_reportVulnerabilityAttackers abuse legitimate Node.js runtime to deploy malware via ClickFix
Organizations using Node.js in their environments, particularly government departments, technology companies, hotels, fintech, e-commerce, professional services, and retail logistics.
highbug_reportVulnerabilityShai-Hulud infostealer now scans 469 credential locations in dev environments
Developer workstations, CI/CD pipelines, cloud configurations, AI tool configs, package registries (npm, GitHub, Docker), and any environment storing long-lived credentials or tokens.
highbug_reportVulnerabilityAI-assisted campaigns target Latin American orgs with data exfiltration
Organizations in Latin America, specifically: Mexican transportation, federal government ministries, municipal water utilities (Mexico/Ecuador) in CL-CRI-1131; Brazilian financial sector in CL-CRI-1163. Campaign active February–June 2026.
highbug_reportVulnerabilityAttackers abuse Microsoft Teams external chat to impersonate IT support
Microsoft Teams users in enterprise environments with external collaboration enabled. All organizations using Teams for business communication are at risk if users accept external contact requests and grant remote access via RMM tools or Quick Assist…
highbug_reportVulnerabilitySilver Fox campaign uses fake installers to disable Windows Update
Windows systems globally, primarily China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.