A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.
AnonyMousKIT is an AI-powered Phishing-as-a-Service platform engineered to disable Apple's Activation Lock on stolen devices. Operating as a credit-metered system, it automates credential harvesting through email, SMS, WhatsApp, and AI-driven voice phishing calls. The investigation exposed a reseller supply chain spanning 506 domains and 168 storefront brands active since early 2024. The platform targets owners of stolen Apple devices using device-specific lures with internal model identifiers and real-time Find My statuses. Conversational AI agents impersonating Apple Support conduct vishing operations, with over 200 calls placed primarily to Brazil at minimal cost. Coding vulnerabilities exposed 120,242 lines of operational logs, revealing 689 distinct WhatsApp operator accounts and detailed attack infrastructure. The ecosystem operates through a decentralized enterprise structure with developers, resellers, and hundreds of subscriber-operators monetizing stolen iPhone hardware through industrialized soc...
We explain how vulnerabilities in DeckMate 2 shuffling machines allowed criminals to gain insights into opponents’ hands and win massive sums at poker.
The reported threat involves rigged online poker games, as discussed on Schneier on Security and shared via Reddit InfoSec News. This issue highlights the manipulation or cheating in online poker platforms, potentially through software vulnerabilities or fraudulent practices by operators. While no specific technical details or affected versions are provided, the concern centers on the integrity and fairness of online gambling systems. The threat is categorized as medium severity due to its impact on trust and financial loss rather than direct system compromise. European organizations involved in online gambling or payment processing could face reputational damage and financial risks. Mitigation requires enhanced auditing, transparency, and regulatory oversight of online poker platforms. Countries with significant online gambling markets and regulatory frameworks, such as the UK, Germany, and Malta, are more likely to be affected. Given the lack of detailed exploit information and no direct system compromise, the suggested severity is medium. Defenders should focus on verifying platform integrity, monitoring for fraudulent activity, and ensuring compliance with gambling regulations.
A medium-severity security news report details a hacking incident involving the World Poker Tour's ClubWPT Gold back office. The information originates from a Reddit NetSec post linking to an external blog by a known author, but technical details are minimal and no specific vulnerabilities or exploits are disclosed. There is no evidence of known exploits in the wild or affected software versions. The threat appears to be a targeted compromise of a gaming platform's administrative backend, potentially risking data confidentiality and integrity. European organizations involved in online gaming or gambling platforms may face indirect risks if similar vulnerabilities exist. Mitigation should focus on securing back-office systems, enforcing strong access controls, and monitoring for unusual activity. Countries with significant online gambling markets and regulatory scrutiny, such as the UK, Germany, and Malta, are more likely to be affected. Given the limited technical details and lack of active exploitation, the suggested severity is medium. Defenders should prioritize investigation and enhanced monitoring while awaiting further technical disclosures.
