🔴 Senator asks US government watchdog to review how feds use hacking tools
Democratic senator Ron Wyden is asking the U.S. government to review how federal law enforcement agencies use hacking tools and spyware against Americans, citing a lack of transparency into how often or for what reasons these tools are deployed.
On Friday, Wyden sent a letter to the U.S. Government Accountability Office (GAO), which audits the federal government, requesting it to launch a comprehensive inquiry into how the FBI, the Drug Enforcement Administration, ICE’s Homeland Security Investigations, and the Secret Service employ hacking and spyware in their investigations.
Democratic senator Ron Wyden is asking the U.S. government to review how federal law enforcement agencies use hacking tools and spyware against Americans, citing a lack of transparency into how often or for what reasons these tools are deployed.
On Friday, Wyden sent a letter to the U.S. Government Accountability Office (GAO), which audits the federal government, requesting it to launch a comprehensive inquiry into how the FBI, the Drug Enforcement Administration, ICE’s Homeland Security Investigations, and the Secret Service employ hacking and spyware in their investigations.
🔴 Malware Hijacks Android Car Head Units
Malware is abusing car infotainment updates to install proxy software, turning Android head units into nodes for the BADBOX network.
Kaspersky researchers found something in June 2026 that made them stop and look twice: an Android app with no interface at all, installed like any ordinary app but making zero effort to disguise itself as legitimate. Their report documents the first known malware infection targeting car head units, the Android-based infotainment and control systems built into many modern vehicles, spread through the vehicle’s own official update mechanism.
Malware is abusing car infotainment updates to install proxy software, turning Android head units into nodes for the BADBOX network.
Kaspersky researchers found something in June 2026 that made them stop and look twice: an Android app with no interface at all, installed like any ordinary app but making zero effort to disguise itself as legitimate. Their report documents the first known malware infection targeting car head units, the Android-based infotainment and control systems built into many modern vehicles, spread through the vehicle’s own official update mechanism.
Attackers Weaponize Vulnerable Websites Through Automated Malware Deployment
A Chinese-speaking cybercrime group tracked as UAT-10147 has been targeting vulnerable Windows and Linux web servers globally to deploy malware, steal sensitive information, and manipulate search engine rankings for financial gain.
🔗 Read More
A Chinese-speaking cybercrime group tracked as UAT-10147 has been targeting vulnerable Windows and Linux web servers globally to deploy malware, steal sensitive information, and manipulate search engine rankings for financial gain.
🔗 Read More
🔴 Data Leaked From Al Rahden Hotel
A newly registered account on an underground cybercrime forum has published data associated with alrahdenhotel.com.
* The post specifically identifies alrahdenhotel.com
* Rather than offering the alleged data for sale, the hacker provides a direct third-party file-hosting download link
* No description of the exposed information, database size, number of records, breach date, or method of compromise is provided
A newly registered account on an underground cybercrime forum has published data associated with alrahdenhotel.com.
* The post specifically identifies alrahdenhotel.com
* Rather than offering the alleged data for sale, the hacker provides a direct third-party file-hosting download link
* No description of the exposed information, database size, number of records, breach date, or method of compromise is provided
🔴 Named Pipes Under Attack: Securing Windows Interprocess Communication
Named pipes are a common choice for communication between applications running on the same Windows computer. They are fast, supported directly by the operating system, and work well for communication between Windows services, desktop applications, tray processes, command-line utilities, and background agents.
A typical design may include a privileged Windows service acting as the named-pipe server while a user-facing application connects as the client. Because both processes run on the same computer, developers often treat this communication as internal and therefore trusted.
Named pipes are a common choice for communication between applications running on the same Windows computer. They are fast, supported directly by the operating system, and work well for communication between Windows services, desktop applications, tray processes, command-line utilities, and background agents.
A typical design may include a privileged Windows service acting as the named-pipe server while a user-facing application connects as the client. Because both processes run on the same computer, developers often treat this communication as internal and therefore trusted.
Flaw in Credential Tool Created Path to Enterprise Secret Exposure
A critical security flaw in N-able’s PassPortal browser extension could have allowed attackers to access protected password vault data by abusing unsafe communication between the extension and web pages.
🔗 Read More
A critical security flaw in N-able’s PassPortal browser extension could have allowed attackers to access protected password vault data by abusing unsafe communication between the extension and web pages.
🔗 Read More
🔴 Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection
New Cryptographic Context Injection technique bypasses AI guardrails via AES-encrypted payloads, leaking full Grok chat histories zero-click
Adversa AI researcher Rony Utevsky devised a new attack technique, called Cryptographic Context Injection, that bypasses AI safety filters by sending instructions as AES-encrypted ciphertext and tricking the model into decrypting them inside its own code execution runtime. The technique was demonstrated against two live production systems: xAI’s Grok and Google’s Gemini.
“Cryptographic Context Injection hides malicious instructions inside AES-encrypted text so guardrails can’t read them, then tricks the AI into decrypting and trusting them as its own.” reads the report published by Adversa AI. “In Grok, an ordinary “summarize this page” steals the user’s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.”
New Cryptographic Context Injection technique bypasses AI guardrails via AES-encrypted payloads, leaking full Grok chat histories zero-click
Adversa AI researcher Rony Utevsky devised a new attack technique, called Cryptographic Context Injection, that bypasses AI safety filters by sending instructions as AES-encrypted ciphertext and tricking the model into decrypting them inside its own code execution runtime. The technique was demonstrated against two live production systems: xAI’s Grok and Google’s Gemini.
“Cryptographic Context Injection hides malicious instructions inside AES-encrypted text so guardrails can’t read them, then tricks the AI into decrypting and trusting them as its own.” reads the report published by Adversa AI. “In Grok, an ordinary “summarize this page” steals the user’s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.”
Washington Advances Controversial Voting Framework as Justices Weigh Federal Authority
The U.S. Postal Service is moving to finalize controversial regulations that could give the federal government greater authority over how mail-in ballots are handled, even as the U.S. Supreme Court considers whether the underlying policy is lawful.
🔗 Read More
The U.S. Postal Service is moving to finalize controversial regulations that could give the federal government greater authority over how mail-in ballots are handled, even as the U.S. Supreme Court considers whether the underlying policy is lawful.
🔗 Read More
🔴 Property Finder UAE Customer and Property Lead Data Offered for Sale
A hacker on an underground cybercrime forum is advertising a fresh dataset originating from Property Finder, the UAE-focused real estate platform.
- The seller claims the dataset contains contact, order and affiliate-commission information
- Exposed customer/lead information includes names, phone numbers and email addresses
- Property-related fields reportedly include property reference, title, property type, bedrooms, bathrooms, size, location and price in AED
A hacker on an underground cybercrime forum is advertising a fresh dataset originating from Property Finder, the UAE-focused real estate platform.
- The seller claims the dataset contains contact, order and affiliate-commission information
- Exposed customer/lead information includes names, phone numbers and email addresses
- Property-related fields reportedly include property reference, title, property type, bedrooms, bathrooms, size, location and price in AED
Machine-Directed Intrusions Probe Thousands of Internet-Facing Systems
A Chinese-speaking threat actor has been observed building an AI-powered offensive environment capable of performing reconnaissance, researching vulnerabilities, obtaining public exploits, evaluating targets and switching attack strategies with limited human intervention.
🔗 Read More
A Chinese-speaking threat actor has been observed building an AI-powered offensive environment capable of performing reconnaissance, researching vulnerabilities, obtaining public exploits, evaluating targets and switching attack strategies with limited human intervention.
🔗 Read More
🔴 ToxicPanda Android malware uses VPN permissions to block Google Play
The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands.
The malware now requests VPN service permissions to create a local interface that allows it to control network traffic passing through it. The feature enables ToxicPanda 2.0 to block communication from Google Play and Google Play Services.
Control at the network level permits the malware to interfere with various security checks and actions, such as app verifications, updates, Play Protect communication, or legitimate disruptions designed to protect users.
The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands.
The malware now requests VPN service permissions to create a local interface that allows it to control network traffic passing through it. The feature enables ToxicPanda 2.0 to block communication from Google Play and Google Play Services.
Control at the network level permits the malware to interfere with various security checks and actions, such as app verifications, updates, Play Protect communication, or legitimate disruptions designed to protect users.
❤1
🔴 New Malware-as-a-service Leveraging Adobe-themed Domain to Attack Windows Users Using .bat File
A criminal service is hiding behind a website that appears to offer Adobe Acrobat Reader. The site, acrobatreaderonline.com, is not a document service. Instead, it appears to expose an operator panel for building and managing attacks against Windows users.
The campaign uses a familiar trick: a trusted-looking document or payment theme leads a target toward a harmful download.
Earlier activity tied to the same infrastructure used a Windows batch, or .bat, file through a WebDAV remote folder, turning a PDF or boleto lure into a possible malware entry point.
A criminal service is hiding behind a website that appears to offer Adobe Acrobat Reader. The site, acrobatreaderonline.com, is not a document service. Instead, it appears to expose an operator panel for building and managing attacks against Windows users.
The campaign uses a familiar trick: a trusted-looking document or payment theme leads a target toward a harmful download.
Earlier activity tied to the same infrastructure used a Windows batch, or .bat, file through a WebDAV remote folder, turning a PDF or boleto lure into a possible malware entry point.
🔴 Anthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source Fund
Anthropic is broadening access to the cybersecurity capabilities of its advanced AI models through a mix of partner integrations, an updated Claude Security offering, a new open source funding program, and plans to expand its Cyber Verification Program.
The move builds on Project Glasswing, launched in April, which gave a small group of organizations early access to Claude Mythos Preview and its successor, Mythos 5. Anthropic said the goal was to give defenders time to find and fix vulnerabilities before comparable capabilities became widely available or fell into the hands of malicious actors. Claude Fable 5 followed as a broadly available model that keeps dual-use cyber work blocked.
Anthropic is broadening access to the cybersecurity capabilities of its advanced AI models through a mix of partner integrations, an updated Claude Security offering, a new open source funding program, and plans to expand its Cyber Verification Program.
The move builds on Project Glasswing, launched in April, which gave a small group of organizations early access to Claude Mythos Preview and its successor, Mythos 5. Anthropic said the goal was to give defenders time to find and fix vulnerabilities before comparable capabilities became widely available or fell into the hands of malicious actors. Claude Fable 5 followed as a broadly available model that keeps dual-use cyber work blocked.
🔴 iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset
iAuthFlow v2 phishing toolkit uses a phished Google session to enroll an attacker-controlled passkey that survives password resets.
Abnormal Security researchers have published an analysis of iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for $10,000 base price. The author also offers for sale additional capability modules separately. The headline feature is not the phishing itself. It’s what happens after the phishing succeeds.
iAuthFlow v2 phishing toolkit uses a phished Google session to enroll an attacker-controlled passkey that survives password resets.
Abnormal Security researchers have published an analysis of iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for $10,000 base price. The author also offers for sale additional capability modules separately. The headline feature is not the phishing itself. It’s what happens after the phishing succeeds.
🔴 TikTok Settles U.S. Child Privacy Case for $400 Million
TikTok will pay $400 million to settle U.S. claims that it violated child privacy laws by collecting data from users under 13.
The U.S. Department of Justice announced that TikTok will pay $400 million to settle a 2024 lawsuit over children’s privacy.
“Today, the Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated entities (TikTok) resolving litigation concerning compliance with the Children’s Online Privacy Protection Act and its implementing regulations (COPPA).” reads the press release published by DoJ. “Under the settlement, TikTok will pay $300 million immediately and an additional $100 million upon entry of an order vacating a prior consent decree entered against TikTok’s predecessor, Musical.ly. The settlement represents one of the largest recoveries ever obtained in a COPPA case.”
TikTok will pay $400 million to settle U.S. claims that it violated child privacy laws by collecting data from users under 13.
The U.S. Department of Justice announced that TikTok will pay $400 million to settle a 2024 lawsuit over children’s privacy.
“Today, the Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated entities (TikTok) resolving litigation concerning compliance with the Children’s Online Privacy Protection Act and its implementing regulations (COPPA).” reads the press release published by DoJ. “Under the settlement, TikTok will pay $300 million immediately and an additional $100 million upon entry of an order vacating a prior consent decree entered against TikTok’s predecessor, Musical.ly. The settlement represents one of the largest recoveries ever obtained in a COPPA case.”
🔴 Slovakia Warns of Cyber Risks in Road Speed Cameras
Slovakia warns that vulnerable speed cameras could expose vehicle data, enable remote access and provide attackers with a foothold into public networks.
Slovakia’s National Security Authority, NBÚ, recently issued a warning about several road speed cameras, calling them a significant cyber threat. The alert is not about someone deleting a speeding ticket. It is about connected devices that collect vehicle data, communicate with other systems, and may contain remote-access functions that the operator cannot fully control.
Slovakia warns that vulnerable speed cameras could expose vehicle data, enable remote access and provide attackers with a foothold into public networks.
Slovakia’s National Security Authority, NBÚ, recently issued a warning about several road speed cameras, calling them a significant cyber threat. The alert is not about someone deleting a speeding ticket. It is about connected devices that collect vehicle data, communicate with other systems, and may contain remote-access functions that the operator cannot fully control.
🔴 Microsoft shares temporary fix for Windows 11 gaming issues
Microsoft has shared a temporary fix for ongoing gaming issues caused by Windows 11 updates released during the August 2026 Patch Tuesday.
On impacted PCs, users reported games crashing or failing to launch, as well as game freezes, "EXCEPTION_ACCESS_VIOLATION" errors, and even unexpected system restarts.
When it confirmed it was investigating this known issue on Wednesday, Microsoft said it affects games like ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals on systems running Windows 11 24H2 and 25H2.
Microsoft has shared a temporary fix for ongoing gaming issues caused by Windows 11 updates released during the August 2026 Patch Tuesday.
On impacted PCs, users reported games crashing or failing to launch, as well as game freezes, "EXCEPTION_ACCESS_VIOLATION" errors, and even unexpected system restarts.
When it confirmed it was investigating this known issue on Wednesday, Microsoft said it affects games like ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals on systems running Windows 11 24H2 and 25H2.
🔴 Personal Information Exposed in Apollo Global Data Breach
Private equity giant Apollo Global Management has disclosed a data breach that exposed sensitive personal information.
According to a data breach notice sent to affected individuals, a social engineering attack enabled threat actors to access some of the company’s cloud platforms between July 6 and 10.
An investigation is ongoing, but Apollo determined recently that personal information may have been compromised, including names, contact information, and SSNs.
The company has not shared any information about who is behind the attack, but noted that it found no evidence that the compromised personal information was made public or used for fraud. Nevertheless, impacted individuals are being offered identity protection and credit monitoring services.
Private equity giant Apollo Global Management has disclosed a data breach that exposed sensitive personal information.
According to a data breach notice sent to affected individuals, a social engineering attack enabled threat actors to access some of the company’s cloud platforms between July 6 and 10.
An investigation is ongoing, but Apollo determined recently that personal information may have been compromised, including names, contact information, and SSNs.
The company has not shared any information about who is behind the attack, but noted that it found no evidence that the compromised personal information was made public or used for fraud. Nevertheless, impacted individuals are being offered identity protection and credit monitoring services.
🔴 Venezuelan Gets Record Federal Prison Term for ATM Jackpotting
A Venezuelan national has been sentenced to 8 years in prison for his role in an ATM jackpotting scheme that caused millions of dollars in losses, the US Justice Department announced on Friday.
According to the DOJ, 27-year-old Juan Manuel Gouveia-Aguilera has been sentenced to 96 months in prison, 5 years of supervised release, and ordered to pay restitution after pleading guilty to bank fraud, bank burglary, and cyber-enabled fraud charges.
“The Court found Gouveia-Aguilera to be responsible for more than $3.5 million in losses and this sentence is believed to be the longest federal sentence imposed for an individual’s role in ATM jackpotting,” the DOJ said.
A Venezuelan national has been sentenced to 8 years in prison for his role in an ATM jackpotting scheme that caused millions of dollars in losses, the US Justice Department announced on Friday.
According to the DOJ, 27-year-old Juan Manuel Gouveia-Aguilera has been sentenced to 96 months in prison, 5 years of supervised release, and ordered to pay restitution after pleading guilty to bank fraud, bank burglary, and cyber-enabled fraud charges.
“The Court found Gouveia-Aguilera to be responsible for more than $3.5 million in losses and this sentence is believed to be the longest federal sentence imposed for an individual’s role in ATM jackpotting,” the DOJ said.
🔴 91 Vulnerabilities Patched in Spring Application Framework
The developers of Broadcom’s Spring application development framework last week announced the release of updates that patch 91 vulnerabilities.
Spring is an open source application framework for the Java platform that simplifies the creation of enterprise applications through features such as dependency injection, aspect-oriented programming, and modular support for web, data, and messaging architectures. After years under VMware’s stewardship, it transitioned to Broadcom following its acquisition of VMware.
The developers of Broadcom’s Spring application development framework last week announced the release of updates that patch 91 vulnerabilities.
Spring is an open source application framework for the Java platform that simplifies the creation of enterprise applications through features such as dependency injection, aspect-oriented programming, and modular support for web, data, and messaging architectures. After years under VMware’s stewardship, it transitioned to Broadcom following its acquisition of VMware.
Malicious npm Packages Hide Linux Implant for Stealthy Network Intrusions
Cybersecurity researchers have uncovered a supply-chain campaign involving trojanized npm packages that secretly install the RedShell Linux implant, allowing attackers to transform compromised systems into SOCKS5 proxies for internal network access.
🔗 Read More
Cybersecurity researchers have uncovered a supply-chain campaign involving trojanized npm packages that secretly install the RedShell Linux implant, allowing attackers to transform compromised systems into SOCKS5 proxies for internal network access.
🔗 Read More