Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 64 results
highperson_alertThreat ActorNigerian National Sentenced for $3.3M Tax Fraud via Spearphishing
Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo and So Kwan Leung), a 40-year-old Nigerian national, operated as part of a cybercrime network targeting US tax preparation businesses.
highpublicGeopoliticalUK Sanctions Cryptomus Platform Over Russia Sanctions Evasion
The UK's October 2024 sanctions against Cryptomus represent a strategic escalation in Western efforts to disrupt financial infrastructure enabling Russia's circumvention of economic restrictions imposed following its invasion of Ukraine.
criticalbug_reportVulnerabilityAI agent finds OTP delivery bypass in major insurer's production site
Major insurance company's production website with millions of users. Specific vendor and product not disclosed. Authentication flow allows attacker-controlled OTP delivery address, bypassing account ownership validation.
highperson_alertThreat ActorChinese Hacker Targets South Korean Banks with AI-Powered Tools
The threat actor is identified as a Chinese hacker who conducted targeted cyberattacks against South Korean financial institutions. Motivation appears to be focused on the financial services sector, potentially for financial gain, espionage, or disru…
highbug_reportVulnerabilityARTEX AI pentesting tool used in data theft attacks on South Korean banks
South Korean financial organizations targeted between late September and early October 2026. ARTEX open-source AI pentesting tool (now closed-source) leveraged with DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 LLMs.
highbug_reportVulnerability16 malicious Firefox extensions steal crypto wallet keys and recovery phrases
Mozilla Firefox users who installed any of 16 malicious extensions impersonating Rabby Wallet (4 extensions) and OKX Wallet (12 extensions). Extensions masqueraded as wallet portals, desktop utilities, and browser tools.
highpublicGeopoliticalSouth Korea investigates AI-assisted breaches at major banks
The coordinated cyberattacks against South Korea's financial sector—affecting Shinhan Bank, KB Kookmin Bank, and Hana Bank—represent a significant escalation in targeting critical financial infrastructure in Northeast Asia.
highpublicGeopoliticalU.S. arrests alleged Ploutus malware developer linked to Venezuelan gang
The arrest of Anibal Alexander Canelon Aguirre represents a convergence of cybercrime and transnational organized crime with state fragility dynamics. The case illustrates how criminal networks emerging from Venezuela's prolonged political and econom…
highperson_alertThreat ActorTren de Aragua sanctioned for $40M ATM jackpotting campaign
Tren de Aragua (TdA) is a Venezuelan transnational criminal organization designated by the U.S. Treasury as a Transnational Criminal Organization in July 2024 and by the State Department as a Foreign Terrorist Organization in February 2025.
criticalbug_reportVulnerabilityBitget confirms zero-day in third-party security product led to $387M theft
Bitget cryptocurrency exchange; third-party security products (Product A and Product B, vendors unnamed); 11 blockchains including Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, and Celestia.
criticalbug_reportVulnerabilityBitget crypto exchange breached via zero-day in security appliances
Bitget cryptocurrency exchange. Two unnamed third-party security appliances (referred to as "Product A" and "security appliance B") compromised via zero-day vulnerabilities.
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772 exploited for root access, web shells
Citrix NetScaler ADC and NetScaler Gateway appliances. CVE-2026-88772 (CVSS 9.5) is a memory overflow in DTLS protocol handling in the NetScaler Packet Processing Engine (NSPPE). CVE-2026-88771 also mentioned as exploited.
criticalbug_reportVulnerabilityBitget exchange loses $388M via zero-day in unnamed third-party product
Bitget cryptocurrency exchange. The unnamed third-party security product used by Bitget contained a zero-day vulnerability that allowed credential theft. Hot and warm wallets were compromised; cold wallets unaffected.
highperson_alertThreat ActorRatHat MaaS Operators Deploy AI-Powered Android Banking Trojan
RatHat operators are cybercriminals running a malware-as-a-service (MaaS) platform focused on Android banking fraud. The operators build and distribute the RatHat Android banking trojan, providing customers with web-based consoles to control infected…
criticalperson_alertThreat ActorNorth Korean Hackers Steal $387.5M from Bitget Crypto Exchange
North Korean state-sponsored threat actors are attributed to this breach based on on-chain analysis and IP behavior patterns. These groups are financially motivated, conducting large-scale cryptocurrency theft operations to generate revenue for the N…
criticalperson_alertThreat ActorLazarus Group Steals $351.6M from Bitget via Backend Compromise
Lazarus Group (G0032), also tracked as Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, and ZINC, is a North Korean state-sponsored APT group. The actor is financially motivated, conducting large-scale cryptocurrency heists to generate revenue f…
highbug_reportVulnerabilityRemControl Android MaaS targets banking users via fake TVTap IPTV app
Android users in Europe (Italy, France, Spain, Poland, Portugal), Canada, and Middle East. Targets 30+ banking applications through phishing overlays. Distributed via malvertising campaigns impersonating TVTap IPTV app on fake Google Play pages.
highbug_reportVulnerabilityKREMLIN malware force-installs malicious Chrome/Edge extensions via bypass
Google Chrome and Microsoft Edge browsers on Windows systems. Active campaign since May 2025 with 1,515+ confirmed infections, primarily in Brazil. Affects users who execute malicious JavaScript files disguised as business documents.
highperson_alertThreat ActorREF9334 Deploys KREMLIN Malware Targeting Brazilian Financial Sector
REF9334 is a Brazilian threat actor tracked by Elastic Security Labs, active since at least May 2025. The actor specializes in banking fraud operations targeting Brazilian financial institutions through sophisticated malware delivery campaigns.
highbug_reportVulnerabilitySQL Injection flaws in Alior Bank PrestaShop module expose backoffice data
Alior Bank "raty" module for PrestaShop. CVE-2026-7848 affects versions 8.0.0 to 8.1.11 (fixed in 8.1.11 and 9.0.7). CVE-2026-15600 affects versions 8.1.9 to 8.1.12 (fixed in 8.1.12 and 9.0.8).
highbug_reportVulnerabilityMicrosoft warns of passkey phishing and CEO fraud campaigns targeting cloud
Microsoft cloud environments (Azure AD/Entra ID, Microsoft 365, SharePoint, OneDrive). Campaign 1: U.S. enterprise users in IT services, consumer goods, real estate, and manufacturing (August 2026).
highperson_alertThreat ActorU.S. Disrupts Chinese Organized Crime Scam Marketplace, Freezes $52.8M
Chinese organized crime syndicates operating the Xinbi Guarantee illicit marketplace, a Telegram-based platform facilitating pig butchering romance scams, wire fraud, and money laundering.
criticalbug_reportVulnerabilityAlby Hub critical flaw enables wallet takeover on internet-exposed instances
Alby Hub versions v1.7.0 through v1.18.5 (all releases before August 2025). Only instances exposed to the internet are vulnerable. Versions v1.19.0 and later are patched. Current version is v1.24.0.
highperson_alertThreat ActorDoppelCart: 119,000+ Fake E-Commerce Domains Used for Card Theft
DoppelCart is a large-scale fraud operation attributed to coordinated threat actors conducting payment card theft through fraudulent e-commerce infrastructure.
highperson_alertThreat ActorSlim Spider Targets Brazilian Financial Institutions for Crypto Theft
Slim Spider is a previously undocumented, financially motivated threat actor attributed by CrowdStrike to Brazil-based operations targeting Brazilian financial institutions since at least March 2026.
highperson_alertThreat ActorStreamRat Android Banking Trojan Spread via Meta Ads to EU Users
ThreatFabric is the cybersecurity research firm that discovered and analyzed the StreamRat campaign. The actual threat actor behind StreamRat remains unattributed.
criticalperson_alertThreat ActorDark Web Service Sells 153M+ Driver Licenses from Identity Verification Breach
The threat actor operates "Nexus," a dark web identity theft service launched on the Russian cybercrime forum Exploit in August 2025. The operator claims to have continuously exfiltrated data for over a year from an alleged breach at a major Louisian…
highperson_alertThreat ActorBreeze Comet Targets Brazilian Financial Sector for Payment Fraud
Breeze Comet (formerly UNC5669, overlaps with Plump Spider and SHADOW-AETHER-064) is a financially motivated threat actor operating out of Brazil since September 2023.
highperson_alertThreat ActorVenezuelan ATM Jackpotting Group Targets U.S. Financial Infrastructure
This threat actor is a coordinated group of Venezuelan nationals conducting ATM jackpotting operations targeting financial institutions in the United States.
highbug_reportVulnerability19 malicious Chrome/Edge extensions drain crypto wallets via auto-updates
19 browser extensions (18 Chrome, 1 Edge) published since February 2024, with "Enable Right Click & Copy — Smart Unlock + OCR" having 80,000 installs. Extensions either created by threat actor or purchased from legitimate owners.