Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 361 results
highperson_alertThreat Actor953 E-Commerce Stores Compromised in Long-Running Magento Campaign
An unknown threat actor has been conducting a sustained campaign since July 2025 targeting e-commerce platforms, primarily Magento-based online stores. The actor demonstrates sophisticated operational security through scanner-evasion techniques and i…
highperson_alertThreat ActorMicrosoft Teams External Chat Exploited for IT Support Impersonation
Unknown threat actors conducting a recurring social engineering campaign across hundreds of incidents. The activity shows overlap with STAC4749, a tracked cluster known for creating IT-themed cloud domains under the ".top" TLD and using plausible emp…
highperson_alertThreat ActorOvi Exposes uCreator Android Spyware Targeting Telegram and WeChat
Ovi is a security researcher who discovered and analyzed the uCreator Android spyware kit in October 2026. Ovi is not a threat actor but rather the researcher who exposed this rentable spyware operation.
highbug_reportVulnerabilityMicrosoft 365 AitM campaign compromises 97 accounts via token replay
Microsoft 365 / Entra ID users across 79 organizations. Campaign active July 14 - September 22, 2026. 497 successful sign-ins from 200,000+ attempts originating from 193.26.115.0/24 IP range. 48 rogue Entra devices registered.
highperson_alertThreat ActorGheist Campaign Steals GitHub Secrets via Automated Workflow Injection
Gheist is an automated campaign tracked since September 15, 2026, named after the user agent "gheist" observed in GitHub API requests. The campaign leverages stolen GitHub tokens to inject malicious workflows into private repositories and GitHub Ente…
highbug_reportVulnerabilityAI coding agents tricked into installing malware via planted instruction files
AI coding agents including OpenAI Codex and Anthropic Claude Code. Developers running agents in ~/Downloads folder are at risk. Attack leverages AGENTS.md/CLAUDE.md instruction files to install malicious npm package function-color (part of MALFEX cam…
highbug_reportVulnerabilityThreat actor k0t exploits Fortinet and Palo Alto firewalls, exposes 70K creds
Fortinet FortiGate and FortiWeb firewalls, Palo Alto Networks GlobalProtect, PAN-OS, and Prisma Access. Exploited vulnerabilities: CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS/Prisma Access authentication bypass).
highbug_reportVulnerabilityPHP2Shell RCE flaws exploited to deploy Mirai botnet, attacks unsuccessful
PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) enable unauthenticated remote code execution via crafted HTTP requests.
highbug_reportVulnerabilityINTERPOL disrupts 10,909 cybercrime networks, arrests 1,462 in 21 countries
Global cybercrime infrastructure across 21 African and international countries. Targeted networks include phishing operations, business email compromise (BEC), investment fraud schemes, illegal cryptocurrency mining, and botnet infrastructure.
highbug_reportVulnerabilityOperation Serengeti III disrupts 10,909 networks, arrests 1,462 in Africa
Cybercriminal infrastructure across 21 African countries, including business email compromise operations, ransomware networks, phishing infrastructure, fraudulent mobile lending apps, illegal cryptocurrency mining operations, and online investment sc…
highperson_alertThreat ActorAI-Enabled Cybercrime Campaign Targets Indian Orgs via Jailbroken LLMs
The campaign is attributed to an actor operating under the handle "BUGSTER." The actor demonstrates limited technical sophistication, relying heavily on AI-generated scripts, reconnaissance reports, and step-by-step guidance from jailbroken AI assist…
highbug_reportVulnerabilityClickFix attacks surge via fake AI installers and malicious search ads
Organizations using AI tools (Claude, ChatGPT, Codex, NotebookLM). All platforms (Windows, macOS). Users accessing AI tools via search engines or shared chatbot links. ClickFix now represents 52-67% of browser-based attacks detected in Q2-Q3 2026.
highbug_reportVulnerabilityAttackers hijacked 300+ Tor exit relays to intercept SSH credentials
Over 300 Tor exit relays compromised October 1-5, 2026. Affected users who connected to SSH servers via Tor during this window, accepted unfamiliar host keys, and used password authentication. Attack peaked at 7.46% of Tor's total exit capacity.
highperson_alertThreat ActorChinese-speaking group deploys autonomous AI agents in mass intrusion
A Chinese-speaking criminal group leveraging autonomous AI agents for large-scale website intrusions. The operation, designated AIA0001 by researchers, targeted over 1,200 sites and successfully compromised websites of more than 100 companies across…
highbug_reportVulnerabilityCandiru spyware deployed via zero-click malicious ads at Al Jazeera
Al Jazeera Media Network devices (Windows confirmed, likely mobile); 45+ devices compromised 2024-2025. Broader campaign placed 3.77 billion ad bids across 75,373 Android/iOS apps and 120,768 websites (March-June 2026).
highbug_reportVulnerabilityProxyjacking campaign exploits D-Link, Ubiquiti devices in 34 countries
D-Link ShareCenter NAS (CVE-2024-3272, CVE-2024-3273), Ubiquiti UniFi Video NVR (CVE-2021-44228), SAP NetWeaver Visual Composer (CVE-2025-31324), and Hikvision/Dahua DVR/NVR devices.
highperson_alertThreat ActorHotejka TDS Operates 20,000+ Cloudflare Scam Domains Since 2017
Hotejka is a Russian-language cybercrime affiliate program operating the Help TDS (Traffic Distribution System) since at least 2017. Assessed to be a rebrand of ROI777, a traffic monetization operation exposed in 2018 following a data leak from its s…
highbug_reportVulnerabilityFake AI product campaigns deliver infostealers to US businesses via malicious sites
US businesses (16% of attributed targets); employees using or seeking AI tools (Claude, ChatGPT, GitHub Copilot, Gemini). 1,258 sandbox analyses linked to campaigns April–October 2026.
highperson_alertThreat ActorCoGUI, Haozi, and Iron Man System Phishing Kits Disrupted
CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System are three interconnected phishing-as-a-service (PhaaS) kits operated within the Chinese-language cybercriminal ecosystem.
highbug_reportVulnerabilityGlobal takedown disrupts phishing ecosystem behind 1B+ messages
Microsoft 365 and Google Workspace customers globally; 75,000+ organizations across 150 countries targeted by YAM Store (Storm-3119) marketplace and associated phishing kits (CoGUI, Haozi, Iron Man System/Storm-2990).
highperson_alertThreat ActorStorm-2990 & Storm-3119: Chinese phishing kit ecosystem disrupted
Storm-2990 and Storm-3119 represent two interconnected Chinese-language cybercriminal entities operating a large-scale phishing ecosystem. Storm-2990 is a cluster of phishing kit developers responsible for three major kits: CoGUI (NX/FA), Haozi (Phoe…
highbug_reportVulnerabilityCyberattack on Danfoss refrigeration controllers disrupts French retail
Danfoss refrigeration controllers deployed at multiple French supermarket chains. Specific product models and firmware versions not disclosed. Attack scope limited to France retail sector.
highbug_reportVulnerabilityAvisLoader malware uses encrypted P2P to evade C2 takedowns
Windows systems targeted via ClickFix social engineering lures. AvisLoader is a 64-bit Windows executable (3.4 MB) delivered through Cloudflare Workers and Quick Tunnels. No specific Windows version restrictions identified.
highperson_alertThreat ActorCyberXero: AI-Augmented IAB Targets Ukraine with Claude Code
CyberXero is a Russian-speaking, financially motivated initial access broker (IAB) active since at least July 2026. The actor operates a sophisticated dual-pipeline operation: a global automated campaign against WordPress and e-commerce platforms for…
highperson_alertThreat ActorChinese Hacker Targets South Korean Banks with AI-Powered Tools
The threat actor is identified as a Chinese hacker who conducted targeted cyberattacks against South Korean financial institutions. Motivation appears to be focused on the financial services sector, potentially for financial gain, espionage, or disru…
highbug_reportVulnerabilityFake Claude installers via Google Ads and Bing redirects deliver ClickFix
Users searching for Claude AI via Google Ads or Bing search. Campaign abuses legitimate redirect mechanisms from Bing and Google Ads infrastructure to distribute malicious installers impersonating Anthropic's Claude AI assistant.
highperson_alertThreat ActorGhostAction Campaign Injects Credential-Stealing Workflows into 340+ Repos
GhostAction is a large-scale supply chain attack campaign first identified in September 2025, focused on compromising GitHub maintainer accounts to inject malicious GitHub Actions workflows.
highbug_reportVulnerabilityP7 DarkSword iOS exploit kit adds crypto theft and remote command execution
Apple iOS devices running versions 18.4 through 18.7. Active campaigns observed targeting Saudi Arabia, Turkey, Malaysia, Ukraine, and Chinese-speaking regions.
highperson_alertThreat ActorFakeGit Campaign Reactivates with 17,610 Malicious GitHub Repositories
FakeGit is a coordinated malware distribution campaign that leverages fake GitHub repositories to deliver multiple malware families. The operation uses a combination of throwaway accounts and approximately 700 compromised legitimate developer account…
highbug_reportVulnerabilityARTEX AI pentesting tool used in data theft attacks on South Korean banks
South Korean financial organizations targeted between late September and early October 2026. ARTEX open-source AI pentesting tool (now closed-source) leveraged with DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 LLMs.