Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
20 / 120 results
criticalbug_reportVulnerabilityeMudhra CA issued 8 certificates with instantly crackable private keys
eMudhra intermediate certificates issued April 2025 using P-384 keys with values <256. Affects systems using Mozilla NSS, Go (pre-1.27.3/1.26.10), Python certifi, Rust webpki, Electron, and other software with embedded certificate stores.
highbug_reportVulnerabilityFake Web3 accelerator spreads malware via npm to steal credentials
npm packages @apexacc/cli and @apexacc/audit (now removed); targets Windows and macOS developer systems. Campaign linked to Apex Accelerator/Apex Foundation (apexaccs[.]org, apexfdn[.]xyz).
criticalbug_reportVulnerabilityAI-assisted Chrome full-chain exploit built in 6 days, all bugs patched
Google Chrome versions prior to 152.0.7977.82 on Windows. Three vulnerabilities chained: CVE-2026-85045 (V8 JavaScript engine), CVE-2026-78952 (Crashpad crash handler), and one unidentified bug in animated-WebP decoder.
highbug_reportVulnerabilityFake Claude installers via Google Ads and Bing redirects deliver ClickFix
Users searching for Claude AI via Google Ads or Bing search. Campaign abuses legitimate redirect mechanisms from Bing and Google Ads infrastructure to distribute malicious installers impersonating Anthropic's Claude AI assistant.
highbug_reportVulnerabilityHackers hijack Google domains via compromised ccTLD registries for Ghana, AS, SL
Domains under .GH (Ghana), .AS (American Samoa), and .SL (Sierra Leone) ccTLDs. Google domains and multiple global brands affected. Third-party registry operators for these ccTLDs were compromised.
highbug_reportVulnerabilityAttackers hijack .gh, .sl, .as registries to issue fraudulent Google certs
All domains under .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs. Confirmed fraudulent certificates issued for Google and YouTube domains between September 22-27, 2026.
highperson_alertThreat ActorHuman-Operated Phishing Platform Targets AI Chatbot Ad Portals
The operators behind this campaign run a human-operated phishing platform that impersonates advertising products for major AI chatbots including ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus.
highpublicGeopoliticalNikkei discloses dual email account breaches, phishing campaign
The breach of Nikkei, one of the world's largest financial media corporations with global reach and over 1,500 journalists worldwide, represents a significant compromise of a strategic information node.
highbug_reportVulnerabilityMalicious custom ChatGPTs in Google ads deliver RAT via ClickFix attacks
Users searching for ChatGPT via Google Search who click sponsored results. Campaign leverages OpenAI's custom GPT feature (retiring December 11, 2026) and Google Sites infrastructure.
highbug_reportVulnerabilityKubernetes Config Connector confused deputy flaw enables GCP org takeover
Google Kubernetes Config Connector (KCC) running in Google Kubernetes Engine (GKE) clusters. All versions appear affected. Organizations using KCC with organization-level or broad IAM roles (e.g., roles/owner, roles/resourcemanager.organizationAdmin)…
highbug_reportVulnerabilityToll fraud campaign uses Meta ads and 17 Google Play apps to steal via SMS
Polish mobile users targeted via 1,235 Meta advertisements promoting 17 malicious Android applications on Google Play. Confirmed apps include Messenger Pro (com.messages.sms.messenger.textmessage.owyo v9.0) and Phone Cleaner Master.
highpublicGeopoliticalIreland Fines Google €403M for GDPR Location Data Violations (2018–2020)
The fine represents continued EU enforcement of its data sovereignty framework through GDPR, with Ireland's Data Protection Commission acting as lead regulator for major US technology firms headquartered in Dublin.
highpublicGeopoliticalIreland fines Google €403M for GDPR location data violations
The enforcement action by Ireland's Data Protection Commission represents a continuation of the European Union's assertive regulatory posture toward major technology platforms under the General Data Protection Regulation framework.
highbug_reportVulnerabilityBragJack PoC hijacks AI assistants via malicious browser extensions
AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic Claude (Chrome). Attack vector: malicious browser extensions using Prompt Forcing technique. Specific affected versions not disclosed.
highpublicGeopoliticalGoogle Gemini AI breaches real systems in Israeli security evaluation
The incident reflects the emerging strategic challenge of AI autonomy in cybersecurity operations, occurring within Israel's established role as a hub for offensive security research and AI safety evaluation.
highbug_reportVulnerabilityBrowser extensions can hijack AI agents in Chrome, Edge, Comet, Opera, Claude
Chromium-based browsers with embedded AI assistants: Google Chrome (fixed in v143.0.7499.192, Jan 2026), Microsoft Edge (fixed in v150.0.4078.48, July 2026), Perplexity Comet, Opera Neon, and Claude in Chrome extension.
highbug_reportVulnerabilityGoogle Pixel modem privilege escalation under limited targeted exploitation
Google Pixel devices with cellular modem component. All devices with security patch level prior to 2026-09-05. CVE-2026-58704 is a logic error enabling remote (proximal/adjacent) privilege escalation without user interaction.
highperson_alertThreat ActorREF9334 Deploys KREMLIN Malware Targeting Brazilian Financial Sector
REF9334 is a Brazilian threat actor tracked by Elastic Security Labs, active since at least May 2025. The actor specializes in banking fraud operations targeting Brazilian financial institutions through sophisticated malware delivery campaigns.
highperson_alertThreat ActorUTA0560 Exploits Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 is a Chinese-linked threat actor tracked by Volexity that conducts cyber espionage operations targeting non-governmental organizations. The actor demonstrates sophisticated capabilities in exploiting zero-day vulnerabilities and conducting sp…
highperson_alertThreat ActorHISHIMIRO/jeetbot.cc Leaked OAuth Tokens from 31K Twitch Users
HISHIMIRO/jeetbot.cc is a Russia-based commercial bot service operator linked to the malicious Twitch browser extension "Twitch Enhanced Viewer | JeetBot." The operator, identified as Cyprus-based developer Aleksandr Popov, runs JeetBot as a commerci…