Chinese Cyber Threat Group UTA0565 Exploits Chrome and Microsoft Vulnerabilities
Volexity observes UTA0565 exploiting Chrome and Microsoft defects with a shared exploit kit across China-aligned groups.
§The archiveMon · Wed · FriM · W · F
News.
Every dispatch we've sent. AI-curated, human-reviewed, from 50+ cybersecurity sources.
Follow on LinkedInBrowse by topic
Wednesday, September 23
SideCopy Expands Espionage Campaign to Indian Academia with ReverseRAT
SideCopy uses spear-phishing and mshta.exe to deliver ReverseRAT, targeting Indian academic institutions for espionage.
North Korean Hackers Compromise Global Devices and Steal Millions in Cryptocurrency
WaterPlum/Contagious campaign compromised ~30,000 devices and siphoned funds or credentials from 7,000 crypto wallets.
Federal Agencies Urged to Patch Critical Zyxel Vulnerability
CISA orders federal agencies to patch an actively exploited Zyxel GS1900 switch vulnerability used for data theft.
WordPress Urges Immediate Patch for Click2Shell Vulnerability
WordPress released fixes for Click2Shell CSRF allowing PHP execution and potential remote code execution; patch immediately.
AI-Driven Cyber Attacks: A New Level of Automation Threatens Online Retailers
Reports show AI agents used to steal cards, run autonomous malware, and make strategic attack decisions post-compromise.
BigDiskBuster Zero-Day Exploit Challenges Microsoft Defender Updates
Researcher Nightmare Eclipse published Defender exploits/PoC (BigDiskBuster) that block Defender updates and affect endpoint protections.
EvilTokens Service Disrupted After Massive Microsoft Account Breach
Microsoft and partners disrupted EvilTokens PhaaS that had compromised over 12,000 Microsoft accounts and automated token theft.
Monday, September 21
Google Gemini's AI Test Leads to Unintentional Company System Breach
PremiumGoogle Gemini escaped a test environment due to a domain mix-up and accessed systems of three real companies during evaluation.
CrowdSec's GitHub Breach Highlights Risks of Supply Chain Attacks
PremiumCrowdSec says TanStack npm supply-chain attack enabled theft of about 170 private GitHub repositories from CrowdSec.
Critical Click2Shell Vulnerability in WordPress Demands Immediate Update
PremiumClick2Shell allows a crafted link to force a WordPress admin to install an attacker-chosen theme, chaining to server RCE.
BragJack Exploit Threatens AI Assistants Across Major Browsers
PremiumBragJack PoC lets a malicious browser extension hijack AI assistants in Chrome, Edge, Opera Neon, Comet, and Claude-in-Chrome.
Malicious npm Packages Bypass Security by Activating at Runtime
PremiumAn npm campaign hides malicious runtime code to avoid install-script defenses, persisting by executing during normal package usage.
Ransomware Groups Shift Focus to AI Models: A New Era of Digital Extortion
PremiumAnalysis of JADEPUFFER shows ransomware groups now target AI/ML models and model recovery chains for extortion and disruption.
Critical Flaw in Cisco Identity Services Engine Poses Severe Security Risks
PremiumCVE-2026-76460 authentication bypass in Cisco ISE scored 10/10 CVSS, exposing API endpoints to unauthenticated access.
Critical Linux Kernel Vulnerabilities: Public Exploits Released
PremiumWorking public exploits released for four Linux kernel local-root flaws—patch promptly; unpatched systems remain at risk.
AI Uncovers Critical Vulnerability in Popular Software Decoder
PremiumHacktron used AI to find a widespread decoder flaw (HEIF/HEIC family) that enabled RCE affecting Meta and OpenAI repos.
Cisco's Urgent Patch for Active Exploit in Identity Services
PremiumCyberWire notes Cisco patched a maximum-severity zero-day and reports on Gyazo breach and other high-impact incidents.
Security Flaw in AI Coding Agents Exposes Risk of Malicious Plugin Swaps
PremiumPlugin4Shell allows repo owners to swap pinned plugin code, enabling supply-chain subversion of AI coding agents like Claude Code and Codex.
Critical Vulnerability in Check Point Software Exposes Systems to Root-Level Attacks
PremiumCheck Point released fixes for a critical vulnerability allowing remote code execution as root on management systems.
Get these articles delivered to your inbox.
Subscribe free