And another XWorm[1] wave in the wild! This malware family is not new and heavily spread but delivery techniques always evolve and deserve to be described to show you how threat actors can be imaginative! This time, we are facing another piece of multi-technology malware.
Multiple phishing campaigns were identified using workplace meeting lures, PDF attachments, and abuse of legitimate binaries to deliver signed malware. The attacks used digitally signed executables masquerading as legitimate software to install remote monitoring and management (RMM) tools like ScreenConnect, Tactical RMM, and Mesh Agent. These tools enabled attackers to establish persistence and move laterally within compromised environments. The malware was signed using an Extended Validation certificate issued to TrustConnect Software PTY LTD. The campaigns demonstrate how familiar branding and trusted digital signatures can be exploited to bypass user suspicion and gain an initial foothold in enterprise networks.
A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in multiple targets. The attacker, an autonomous bot called hackerbot-claw, used five different exploitation techniques and successfully exfiltrated a GitHub token with write permissions from one of the most popular repositories on GitHub. The campaign targeted repositories belonging to Microsoft, DataDog, CNCF, and other popular open source projects. The attacks included token theft via poisoned Go scripts, direct script injection, branch name injection, filename injection, and AI prompt injection. The most severe attack resulted in a full repository compromise of Aqua Security's Trivy project. The campaign highlights the growing threat of AI-powered bots targeting software supply chains and the need for automated security controls in CI/CD pipelines.
This article analyzes real-world instances of indirect prompt injection (IDPI) attacks targeting AI agents and large language models integrated into web systems. The researchers identify 22 distinct techniques used by attackers to embed malicious prompts in webpages, including visual concealment, obfuscation, and dynamic execution methods. They categorize attacker intents ranging from low-severity disruptions to critical data destruction attempts. Notable findings include the first observed case of AI-based ad review evasion and attempts at search engine optimization manipulation. The article presents a taxonomy of web-based IDPI attacks and provides insights into attack trends based on telemetry data. The researchers emphasize the need for proactive, web-scale defenses to detect IDPI and distinguish between benign and malicious prompts.
A newly announced quantum algorithm suggests that the practical decryption of RSA encryption using quantum computers could occur much sooner than previously anticipated. Traditionally, the threat to RSA and ECC encryption from quantum computing was linked to Shor’s algorithm, which requires million-qubit quantum computers, a technology not expected in the near term. This new development challenges that assumption, indicating that the quantum breaking point for widely used public key cryptography may be closer. Although no known exploits exist in the wild yet, this advancement raises significant concerns for the security of current cryptographic systems. Organizations relying on RSA and ECC for confidentiality and integrity should begin preparing for a post-quantum cryptographic transition. The threat impacts global communications, financial transactions, and data protection mechanisms. Immediate mitigation involves accelerating the adoption of quantum-resistant algorithms and increasing cryptographic agility. Countries with advanced technological infrastructure and heavy reliance on RSA/ECC encryption are at higher risk. The overall severity is assessed as high due to the potential widespread impact and the fundamental nature of the cryptographic break, despite the current lack of active exploitation.
Researchers have uncovered a Wi-Fi vulnerability that allows nearby attackers to intercept sensitive data and execute machine-in-the-middle attacks against connected devices. The post New ‘AirSnitch’ Attack Shows Wi-Fi Client Isolation Could Be a False Sense of Security appeared first on SecurityWeek .
Hackers stole names, Social Security numbers, driver’s license information, voter registration records, and health-related information. The post 1.2 Million Affected by University of Hawaii Cancer Center Data Breach appeared first on SecurityWeek .
Using low-cost receivers deployed along roads, academic researchers tracked drivers and their movement patterns. The post Researchers Uncover Method to Track Cars via Tire Sensors appeared first on SecurityWeek .
CVE-2026-0025 is a high-severity information disclosure vulnerability in Google Android affecting versions 14 through 16-qpr2. It arises from a permissions bypass in the hasImage method of Notification.java, allowing local attackers to access information across user boundaries without requiring any user interaction or additional execution privileges. This flaw can lead to local privilege escalation, compromising confidentiality, integrity, and availability of affected devices. Although no known exploits are currently in the wild, the vulnerability's ease of exploitation and broad impact make it a significant risk. Organizations using affected Android versions should prioritize patching once available and implement strict access controls to mitigate potential abuse. Countries with large Android user bases and high mobile device usage, such as the United States, India, Brazil, Germany, Japan, and South Korea, are particularly at risk. Defenders must monitor for updates from Google and apply security best practices to reduce exposure.
CVE-2026-0023 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14 through 16-qpr2. The flaw exists in the createSessionInternal method of PackageInstallerService.java, where a missing permission check allows a local app to update its ownership improperly. Exploitation requires only low privileges and no user interaction, enabling an attacker to escalate privileges locally. This vulnerability impacts confidentiality, integrity, and availability, as it allows unauthorized privilege escalation. No known exploits are currently reported in the wild. Android devices running affected versions are at risk, especially those with apps installed from untrusted sources. Mitigation involves applying patches once available and restricting app installation sources. Countries with large Android user bases and significant mobile ecosystems, such as the United States, India, Brazil, Germany, Japan, and South Korea, are most likely to be affected. Organizations should prioritize patching and monitoring for suspicious local privilege escalation attempts to reduce risk.
The report details the resurgence of the Funnull cybercriminal group, now utilizing a new arsenal called RingH23. It exposes their tactics, including compromising GoEdge CDN nodes, poisoning the MacCMS supply chain, and deploying sophisticated malware components like Badredis2s, Badnginx2s, and Badhide2s. The group has expanded its operations to inject malicious JavaScript, hijack cryptocurrency transactions, and redirect traffic to fraudulent sites. The campaign's impact is estimated to affect millions of users daily. The report also highlights Funnull's use of a suspicious new CDN infrastructure, CDN1.AI, likely created to evade detection.
A new malicious campaign involving seventeen npm packages has been identified, utilizing Pastebin and text steganography as a dead-drop resolver. The attackers employ a complex decoding mechanism to extract C2 URLs from seemingly benign text on Pastebin. The malware targets multiple platforms, including Windows, macOS, and Linux, downloading and executing platform-specific payloads. The infection chain involves multiple fallback domains hosted on Vercel, demonstrating a sophisticated approach to maintain persistence. This novel technique, along with other recent developments, indicates an accelerated pace of testing and development by the threat actor, suggesting continued iterations in their infection methodologies.
For the latest discoveries in cyber research for the week of 2nd March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Wynn Resorts, a United States-based casino and hotel operator, has confirmed that employee data was accessed following an extortion threat linked to ShinyHunters. The company said operations were not disrupted. Reports indicate […] The post 2nd March – Threat Intelligence Report appeared first on Check Point Research .
The company is one of the many victims of the 2025 Oracle E-Business Suite (EBS) hacking campaign. The post Madison Square Garden Data Breach Confirmed Months After Hacker Attack appeared first on SecurityWeek .
Using Windows shortcut files, the APT deployed a new implant, a loader, a propagation tool, and two backdoors. The post North Korean APT Targets Air-Gapped Systems in Recent Campaign appeared first on SecurityWeek .
