A new malicious campaign dubbed DOUBLECUP exploits the ClickFix technique and cached PNGs to distribute two malware families: CountLoader and DeviceManager RAT. Anatomy of a two-stage attack.
1 h ago 24 3
A flaw in the random number generator of the COLDCARD hardware wallet could have allowed the derivation and draining of thousands of wallets—one of the largest documented thefts on "cold" hardware.
yesterday 9 3
Unit 42 (Palo Alto) documents a real-world case of an autonomous LLM agent: a single instruction sent via Telegram was enough to scan the internet, select a public exploit, and launch an attack—without any further human intervention.
Jul 31, 2026 18 3
Anthropic ran Claude Mythos Preview as a semi-autonomous agent on cryptographic primitives: effective keysize of HAWK-256 dropped from 2^64 to 2^38, 7-round AES attack accelerated ×200 to ×800, LEA 13-round key recovery in less than an hour. Two real CVE (OpenSSL, wolfSSL) along the way. Cost: ~$100,000 API per subject.
Jul 28, 2026 20 4
CVE-2026-54121, CVSS 8.8. A domain account with no privileges is sufficient to obtain an AD CS-signed certificate for the identity of a Domain Controller, then authenticate via PKINIT and extract krbtgt via DCSync. Patched on July 14, 2026, public exploit since today.
Jul 24, 2026 3 1
The Swiss train manufacturer Stadler Rail has been targeted by the Everest group via a data exchange platform with a supplier. It refuses to pay the 10 M CHF (~12.3 M$) demanded - and at this hour, Everest has not published anything on its leak site, which is unusual.
Jul 23, 2026 5 2
Zenity Labs publicly disclosed on July 23, 2026 a vulnerability in the ChatGPT agent builder that allowed the silent installation of a malicious agent inheriting all of the victim's connectors (Outlook, Slack, Drive...). Fixed on June 9 - but the vulnerability class remains to be monitored.
Jul 23, 2026 7 2
A flaw in the Adobe Acrobat browser extension allows malicious sites to read the victim's WhatsApp Web data - a classic Same-Origin Policy bypass via a privileged extension.
Jul 23, 2026 18 3
A simple comment hidden in an Azure DevOps pull request can turn the code reviewer's AI agent against them - and send it siphoning projects that the attacker normally wouldn't have access to. The vulnerability lies in Microsoft's official MCP server.
Jul 22, 2026 8 2
The American fast-food chain notifies its customers of an incident related to a credential stuffing campaign - a reminder that password reuse remains, in 2026, one of the most profitable vectors for attackers.
Jul 22, 2026 22 3
The Dutch services AIVD and MIVD reconfirm that unit 26165 of the GRU (« Fancy Bear ») exploits poorly configured IP cameras to track NATO's military logistics - a signal that the geekkitsune watch thread has been following for several editions.
Jul 21, 2026 7 2
Hijacking the agenda as a clandestine mailbox: HollowGraph uses Microsoft 365 events - backdated by twenty-four years - to exfiltrate files and receive its orders without raising any alerts.
Jul 21, 2026 8 2
