Threats Tagged 'hacked'

The StopAndProtect operation is a cybercrime campaign that has compromised nearly 2,000 WordPress websites, turning them into a criminal network used for malware delivery, data theft, surveillance, and ransomware activities. The campaign uses social engineering via fake CAPTCHAs to trick victims into executing PowerShell commands that initiate multi-stage malware infections. The malware toolkit includes ransomware, credential stealers, screen lockers, and chat utilities, enabling attackers to selectively steal files and monitor victims before potentially encrypting data. Compromised WordPress sites serve multiple roles, including hosting malware, delivering commands, and storing stolen data. The operation exploits outdated WordPress versions and plugins with known vulnerabilities. The campaign has collected extensive victim data, including screenshots, passwords, and wallet information, indicating a sophisticated surveillance component alongside ransomware. The infection chain and infrastructure management tools were uncovered by Check Point Research in mid-2026.

Research by Peyton Kennedy reveals that several AI orchestration platforms, including NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow, ship with remote code execution (RCE) capabilities by design. These platforms assume that anyone who can modify a workflow is trusted to execute code on the host, an assumption that is unsafe for multi-tenant HTTP services exposed to unauthenticated webhooks. The research documents 14 findings showing that unauthenticated requests can lead to RCE through prompt injection and bypassing of regex-based filters. Some vendors consider this behavior intentional, reflecting a mismatch between developer tool threat models and production deployment risks. The full research was presented at DEFCON 34 and is publicly available.

A data breach occurred at ShipMonk, a shipping provider for Trezor, exposing personal details of approximately 13,689 customers who placed orders between May and August 2026. Exposed data includes full names, email addresses, phone numbers, and shipping addresses. Trezor's own systems and hardware wallets were not compromised. The breach increases the risk of phishing attacks targeting affected customers. Trezor has notified impacted individuals and is working with ShipMonk to investigate and secure systems. Customers are advised to be vigilant against phishing and not to share wallet backups or sensitive information.

HighBreachUnited StatesUnited KingdomSweden+4#cybersecurity#reddit#high-priority