Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 67 results
criticalbug_reportVulnerabilityeMudhra CA issued 8 certificates with instantly crackable private keys
eMudhra intermediate certificates issued April 2025 using P-384 keys with values <256. Affects systems using Mozilla NSS, Go (pre-1.27.3/1.26.10), Python certifi, Rust webpki, Electron, and other software with embedded certificate stores.
highbug_reportVulnerabilityFake Web3 accelerator spreads malware via npm to steal credentials
npm packages @apexacc/cli and @apexacc/audit (now removed); targets Windows and macOS developer systems. Campaign linked to Apex Accelerator/Apex Foundation (apexaccs[.]org, apexfdn[.]xyz).
criticalbug_reportVulnerabilityAI-assisted Chrome full-chain exploit built in 6 days, all bugs patched
Google Chrome versions prior to 152.0.7977.82 on Windows. Three vulnerabilities chained: CVE-2026-85045 (V8 JavaScript engine), CVE-2026-78952 (Crashpad crash handler), and one unidentified bug in animated-WebP decoder.
highbug_reportVulnerabilityFake Claude installers via Google Ads and Bing redirects deliver ClickFix
Users searching for Claude AI via Google Ads or Bing search. Campaign abuses legitimate redirect mechanisms from Bing and Google Ads infrastructure to distribute malicious installers impersonating Anthropic's Claude AI assistant.
highbug_reportVulnerabilityHackers hijack Google domains via compromised ccTLD registries for Ghana, AS, SL
Domains under .GH (Ghana), .AS (American Samoa), and .SL (Sierra Leone) ccTLDs. Google domains and multiple global brands affected. Third-party registry operators for these ccTLDs were compromised.
highbug_reportVulnerabilityAttackers hijack .gh, .sl, .as registries to issue fraudulent Google certs
All domains under .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs. Confirmed fraudulent certificates issued for Google and YouTube domains between September 22-27, 2026.
highperson_alertThreat ActorHuman-Operated Phishing Platform Targets AI Chatbot Ad Portals
The operators behind this campaign run a human-operated phishing platform that impersonates advertising products for major AI chatbots including ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus.
highpublicGeopoliticalNikkei discloses dual email account breaches, phishing campaign
The breach of Nikkei, one of the world's largest financial media corporations with global reach and over 1,500 journalists worldwide, represents a significant compromise of a strategic information node.
highbug_reportVulnerabilityMalicious custom ChatGPTs in Google ads deliver RAT via ClickFix attacks
Users searching for ChatGPT via Google Search who click sponsored results. Campaign leverages OpenAI's custom GPT feature (retiring December 11, 2026) and Google Sites infrastructure.
highbug_reportVulnerabilityKubernetes Config Connector confused deputy flaw enables GCP org takeover
Google Kubernetes Config Connector (KCC) running in Google Kubernetes Engine (GKE) clusters. All versions appear affected. Organizations using KCC with organization-level or broad IAM roles (e.g., roles/owner, roles/resourcemanager.organizationAdmin)…
highbug_reportVulnerabilityToll fraud campaign uses Meta ads and 17 Google Play apps to steal via SMS
Polish mobile users targeted via 1,235 Meta advertisements promoting 17 malicious Android applications on Google Play. Confirmed apps include Messenger Pro (com.messages.sms.messenger.textmessage.owyo v9.0) and Phone Cleaner Master.
highpublicGeopoliticalIreland Fines Google €403M for GDPR Location Data Violations (2018–2020)
The fine represents continued EU enforcement of its data sovereignty framework through GDPR, with Ireland's Data Protection Commission acting as lead regulator for major US technology firms headquartered in Dublin.
highpublicGeopoliticalIreland fines Google €403M for GDPR location data violations
The enforcement action by Ireland's Data Protection Commission represents a continuation of the European Union's assertive regulatory posture toward major technology platforms under the General Data Protection Regulation framework.
highbug_reportVulnerabilityBragJack PoC hijacks AI assistants via malicious browser extensions
AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic Claude (Chrome). Attack vector: malicious browser extensions using Prompt Forcing technique. Specific affected versions not disclosed.
highpublicGeopoliticalGoogle Gemini AI breaches real systems in Israeli security evaluation
The incident reflects the emerging strategic challenge of AI autonomy in cybersecurity operations, occurring within Israel's established role as a hub for offensive security research and AI safety evaluation.
highbug_reportVulnerabilityBrowser extensions can hijack AI agents in Chrome, Edge, Comet, Opera, Claude
Chromium-based browsers with embedded AI assistants: Google Chrome (fixed in v143.0.7499.192, Jan 2026), Microsoft Edge (fixed in v150.0.4078.48, July 2026), Perplexity Comet, Opera Neon, and Claude in Chrome extension.
highbug_reportVulnerabilityGoogle Pixel modem privilege escalation under limited targeted exploitation
Google Pixel devices with cellular modem component. All devices with security patch level prior to 2026-09-05. CVE-2026-58704 is a logic error enabling remote (proximal/adjacent) privilege escalation without user interaction.
highperson_alertThreat ActorREF9334 Deploys KREMLIN Malware Targeting Brazilian Financial Sector
REF9334 is a Brazilian threat actor tracked by Elastic Security Labs, active since at least May 2025. The actor specializes in banking fraud operations targeting Brazilian financial institutions through sophisticated malware delivery campaigns.
highperson_alertThreat ActorUTA0560 Exploits Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 is a Chinese-linked threat actor tracked by Volexity that conducts cyber espionage operations targeting non-governmental organizations. The actor demonstrates sophisticated capabilities in exploiting zero-day vulnerabilities and conducting sp…
highperson_alertThreat ActorHISHIMIRO/jeetbot.cc Leaked OAuth Tokens from 31K Twitch Users
HISHIMIRO/jeetbot.cc is a Russia-based commercial bot service operator linked to the malicious Twitch browser extension "Twitch Enhanced Viewer | JeetBot." The operator, identified as Cyprus-based developer Aleksandr Popov, runs JeetBot as a commerci…
highbug_reportVulnerabilityGoogle Play Early Access abused to distribute deceptive Android apps
Google Play Early Access program; Android users globally, particularly those exposed to social media ads on TikTok and Facebook. Thousands of deceptive apps including fake casino games, reward apps, and utility apps.
criticalbug_reportVulnerabilityBlueMoon exploit kit chains Windows and Chrome zero-days in espionage ops
Microsoft Windows (CVE-2026-85880: heap-based buffer overflow in ALPC, older builds targeted); Google Chrome and Chromium-based browsers (CVE-2026-85046: V8 type confusion; CVE-2026-87491: V8 sandbox escape).
highperson_alertThreat ActorAPT31 Deploys BlueMoon Exploit Kit Chaining Chrome and Windows Zero-Days
APT31 (also tracked as Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, Violet Typhoon, and ZIRCONIUM) is a China-aligned state-sponsored threat actor conducting espionage operations.
highpublicGeopoliticalU.S. Accuses China-Based AI Firms of Industrial-Scale Model Distillation
The joint advisory from NSA, CISA, and FBI represents a significant escalation in U.S.-China technological competition, framing AI model distillation not as isolated intellectual property theft but as a coordinated national strategy.
highbug_reportVulnerabilityChrome V8 zero-day CVE-2026-87491 exploited in wild for sandbox code execution
Google Chrome versions prior to 153.0.8010.36/.37 (Windows/macOS) and 153.0.8010.36 (Linux). Affects V8 JavaScript engine. All Chromium-based browsers (Edge, Brave, Opera, Vivaldi) also vulnerable until patched.
highbug_reportVulnerabilityChrome zero-day CVE-2026-87491 exploited in wild, seventh in 2024
Google Chrome versions prior to 153.0.8010.36 (Windows/Linux) and 153.0.8010.37 (Mac) on all desktop platforms. Vulnerability exists in V8 JavaScript/WebAssembly engine.
highperson_alertThreat ActorAI-Powered Credential Harvesting Campaign Compromises Thousands in 6 Hours
The campaign involves financially motivated threat actors leveraging autonomous AI agents and multi-agent attack frameworks to conduct large-scale credential harvesting operations.
highbug_reportVulnerabilityPEEP toolkit turns Chrome/Edge into backdoors via malicious extension
Chrome and Edge browsers on Windows and Linux. PEEP is a post-exploitation toolkit requiring prior administrative or code execution access. It masquerades as "Smart Bookmarks" extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj) and uses native messaging…
highbug_reportVulnerabilityChrome zero-day CVE-2026-85046 actively exploited via V8 type confusion
Google Chrome versions prior to 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux). Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) also affected pending vendor updates.
criticalbug_reportVulnerabilityChrome 152 patches actively exploited V8 type confusion zero-day
Google Chrome versions prior to 152.0.7977.82 on Windows/macOS/Linux. The vulnerability (CVE-2026-85046) affects the V8 JavaScript engine. Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) are also affected pending vendor patches.