CVE-2026-0023 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14 through 16-qpr2. The flaw exists in the createSessionInternal method of PackageInstallerService.java, where a missing permission check allows a local app to update its ownership improperly. Exploitation requires only low privileges and no user interaction, enabling an attacker to escalate privileges locally. This vulnerability impacts confidentiality, integrity, and availability, as it allows unauthorized privilege escalation. No known exploits are currently reported in the wild. Android devices running affected versions are at risk, especially those with apps installed from untrusted sources. Mitigation involves applying patches once available and restricting app installation sources. Countries with large Android user bases and significant mobile ecosystems, such as the United States, India, Brazil, Germany, Japan, and South Korea, are most likely to be affected. Organizations should prioritize patching and monitoring for suspicious local privilege escalation attempts to reduce risk.
The report details the resurgence of the Funnull cybercriminal group, now utilizing a new arsenal called RingH23. It exposes their tactics, including compromising GoEdge CDN nodes, poisoning the MacCMS supply chain, and deploying sophisticated malware components like Badredis2s, Badnginx2s, and Badhide2s. The group has expanded its operations to inject malicious JavaScript, hijack cryptocurrency transactions, and redirect traffic to fraudulent sites. The campaign's impact is estimated to affect millions of users daily. The report also highlights Funnull's use of a suspicious new CDN infrastructure, CDN1.AI, likely created to evade detection.
The company is one of the many victims of the 2025 Oracle E-Business Suite (EBS) hacking campaign. The post Madison Square Garden Data Breach Confirmed Months After Hacker Attack appeared first on SecurityWeek .
A sophisticated scam campaign is targeting users with a fake Zoom meeting website that automatically downloads and installs an unauthorized version of Teramind, a legitimate workforce monitoring solution. The attackers create a convincing imitation of a Zoom video call, complete with fake participants and audio, to lure victims. After a short delay, an 'Update Available' prompt appears, leading to the silent installation of the monitoring software. The altered Teramind installer is configured to run stealthily and avoid detection by security tools. This campaign is particularly dangerous as it misuses legitimate commercial software, making it difficult for traditional antivirus tools to detect. The attackers gain full surveillance capabilities over the victim's device, including keylogging, screen capture, and file monitoring.
The 24-year-old suspect has been accused of trafficking over 26,000 cards from a single brand. The post Chilean Carding Shop Operator Extradited to US appeared first on SecurityWeek .
A sophisticated phishing campaign impersonating Tesseract OCR was discovered, utilizing typosquatting and ClickFix techniques. The attack chain, named OCRFix, employed multi-stage malware deployments with heavy obfuscation and defense evasion techniques, including EtherHiding. The campaign used BNB Smart Chain TestNet to hide C2 domains through smart contracts. The malware delivery process involved three stages: a loader, a secondary loader for persistence, and a bot listener. The final payload connected to a bot control panel, allowing attackers to manage infected hosts and deploy additional malware. The campaign demonstrated a combination of simple initial access methods with complex delivery chains, highlighting the ongoing effectiveness of techniques like ClickFix and the importance of robust phishing defenses.
A global espionage campaign targeting telecommunications and government organizations across four continents has been disrupted. The threat actor, UNC2814, is suspected to be linked to China and has been active since 2017. The campaign utilized a sophisticated backdoor called GRIDTIDE, which leveraged Google Sheets API for command and control. The attackers compromised 53 victims in 42 countries, with suspected infections in 20 more. GRIDTIDE's capabilities include executing shell commands, file transfers, and evading detection by disguising traffic as legitimate cloud API requests. The disruption involved terminating attacker-controlled cloud projects, disabling infrastructure, and revoking API access.
This analysis examines a sophisticated multi-stage infection chain utilizing Agent Tesla malware. The attack begins with a phishing email containing a RAR file, which includes an obfuscated JSE file. This initial stage triggers a series of script-based evasions, leading to the download and decryption of a PowerShell script. The malware then employs process hollowing to inject its payload into a legitimate Windows process, evading detection. Before exfiltrating data, the malware performs anti-analysis checks to avoid security software and virtual environments. Finally, Agent Tesla harvests sensitive information, including browser cookies and contacts, exfiltrating the data via SMTP to a command-and-control server.
The UNC2814 threat actor, active since at least 2017, has been conducting a Chinese cyberespionage campaign targeting telecommunications companies and government organizations across 42 countries. Google recently disrupted this campaign, which focused on espionage activities rather than destructive attacks. The threat actor's operations involve sophisticated techniques to infiltrate and maintain persistence within targeted networks. Although no specific vulnerabilities or exploits have been publicly disclosed, the campaign's longevity and broad geographic scope highlight its strategic nature. The medium severity rating reflects the espionage focus, limited public exploit details, and absence of widespread destructive impact. Organizations in telecommunications and government sectors worldwide should remain vigilant against such advanced persistent threats. Mitigation requires enhanced threat detection, network segmentation, and intelligence sharing. Countries with significant telecom infrastructure and geopolitical interest in China are at higher risk. Overall, this campaign underscores the ongoing cyberespionage risks posed by state-sponsored actors targeting critical sectors globally.
A data breach at CarGurus has reportedly impacted over 12 million users, with hackers claiming to have stolen personally identifiable information (PII) and internal corporate data. The breach potentially exposes sensitive customer data and proprietary company information, raising concerns about privacy and corporate security. Although no specific vulnerability details or exploited vectors have been disclosed, the breach highlights risks to automotive marketplace platforms. There is no evidence of known exploits in the wild at this time. The medium severity rating reflects the significant volume of affected users and the sensitivity of the data involved, balanced against the lack of detailed technical information. Organizations relying on CarGurus services or handling similar automotive data should review their security posture and monitor for related threats. The breach underscores the importance of robust data protection and incident response capabilities in consumer-facing platforms. Countries with large automotive markets and significant CarGurus user bases are at higher risk of impact. Immediate mitigation should focus on enhanced monitoring, user notification, and strengthening internal data security controls.
A deceptive campaign is using a fake Zoom meeting website to covertly install Teramind, a commercial monitoring tool, on unsuspecting users' Windows machines. The operation begins with a convincing imitation of a Zoom video call, complete with scripted participants and artificial technical issues. An automatic 'Update Available' prompt then initiates the download of a malicious installer without user consent. The installed software is a covert build of Teramind, designed to run invisibly and avoid detection by security tools. This campaign is particularly dangerous due to its use of legitimate commercial software, which may evade traditional antivirus detection. The attackers exploit users' trust in Zoom and Microsoft to execute their plan, highlighting the importance of verifying meeting links and being cautious with unexpected software updates.
A new Go-based remote access trojan named Moonrise has been discovered, operating without early static detection and establishing active C2 communication before vendor alerts. The RAT supports credential theft, remote command execution, persistence, and user monitoring, enabling full remote control of infected endpoints. Its capabilities include stealing passwords, executing remote commands, uploading files, capturing screens, and accessing webcams and microphones. The malware's silent operation increases business exposure, extending dwell time and raising risks of data loss and operational disruption. The attack chain involves session registration, host environment visibility, direct system interaction, credential access, active user monitoring, and privilege manipulation. Early detection strategies involve monitoring for weak signals, rapid triage with behavior confirmation, and threat hunting to prevent repeat incidents.
Written in C++ and Python, the malware exfiltrates system information, browser data, and steals files. The post ‘Arkanix Stealer’ Malware Disappears Shortly After Debut appeared first on SecurityWeek .
Attackers can inject malicious instructions in a GitHub Issue that are automatically processed by Copilot when launching a Codespace from that issue. The post GitHub Issues Abused in Copilot Attack Leading to Repository Takeover appeared first on SecurityWeek .
A NuGet supply chain attack involving four malicious packages targeting ASP.NET web application developers has been discovered. The campaign deploys a multi-stage payload where NCryptYo acts as a dropper, establishing a local proxy, while companion packages exfiltrate ASP.NET Identity data and accept threat actor-controlled authorization rules, creating backdoors in victim applications. The packages, published between August 12-21, 2024, have accumulated over 4,500 downloads. The attack uses obfuscation, JIT compiler manipulation, and a two-stage architecture to evade detection. The campaign's objective is to compromise applications during development, gaining access to deployed production instances by controlling the authorization layer.
