The Hacker News

GoCaracal malware (Dark Caracal-linked) uses an Ethereum smart contract to retrieve replacement C2 addresses and maintain persistence.

GPUThor Rowhammer technique bypasses NVIDIA ECC on RTX A6000 GPUs to escalate privileges and gain host root access.

Mirage2FA phishing-as-a-service abused Microsoft 365 login flows, bypassing 2FA and compromising thousands of corporate accounts.

Trojanized npm packages install RedC2 4.0 Linux backdoor with AI-assisted command-and-control capabilities.

Check Point shows Microsoft Defender's signed BTR.sys boot-time driver can be misused for kernel-level deletion of security files at boot.

Cisco fixes nine Crosswork and Secure Workload vulnerabilities, five rated CVSS 10.0 requiring urgent updates.

Three suspected Russian espionage clusters abuse OAuth and WhatsApp linking to hijack accounts at academia, aerospace and governments.

Malicious Rust crate releases introduced build-time payloads, affecting widely used packages and prompting removals.

Campaign 'Offside Wallet Theft Factory' uses 40 Firefox extensions impersonating Web3 wallets to steal crypto wallet secrets.

Researchers demonstrate Spectre-based Cloudflare Workers side-channel leaking JWTs from co-located workers at ~12 bits/second.

Clop-associated web shell on PTC Windchill/FlexPLM decrypts credentials and maps PLM engineering vault data for extortion.

Chain of AIT-GUI flaws (GHSA-p9r8-2q67-fp86) allows unauthenticated attackers to issue arbitrary spacecraft commands (CVSS 9.4).

CoSnitch vulnerabilities in Microsoft Copilot Personal let a crafted link exfiltrate connected-app data with a single click.

Two-stage Unisoc VoLTE exploit chain achieves full Android kernel access via a specially crafted video call payload.

TWINLOOT Python implant uses SharePoint and Teams to host C2, steal credentials, and pivot inside Microsoft tenant environments.