🚨 ACTIVE EXPLOITATION
-
BINDCLOAK Windows Backdoor Steals Tokens to Escalate Privileges in Espionage Campaign BINDCLOAK backdoor steals Windows tokens to run malware with elevated privileges.
- Targets government entities in the Middle East, focusing on the energy sector
- BINDCLOAK is a 64-bit modular Windows backdoor that steals user and process tokens
- Uses stolen tokens to escalate privileges and run malware modules with higher access
- Delivered via multi-stage chain starting with ISO files and legitimate Windows components
- Communicates with C2 servers over encrypted TLS with custom message routing and evasion 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
-
Midnight Blizzard hijacks hotel Wi-Fi to steal travelers' cloud credentials Midnight Blizzard exploits hotel Wi-Fi captive portals to deliver malware and steal cloud credentials.
- Targets travelers using hotel, conference, and shared Wi-Fi networks worldwide
- Compromises hotel Wi-Fi gateway infrastructure and poisons DNS responses to redirect users
- Delivers fake login pages, software update prompts, and malware via captive portal manipulation
- Exploits WPAD automatic proxy discovery to intercept authentication traffic
- Aims to steal cloud account credentials, session tokens, and device authorization for broader access 📎 Coverage: cybersecuritynews.com · 📄 Original: cybersecuritynews.com · 👁 via Cyber Security News
-
Fake AI Tool Malware Campaign Uses Cloned GitHub Repos for Enterprise Access Attackers use cloned GitHub AI tool projects to deliver multi-stage malware for enterprise intrusion.
- Targets developers and AI users seeking AI tools, coding assistants, Python and Rust guides, Claude tools, and ComfyUI projects
- Impacts financial services, banking, and technology sectors in North America, Asia, and Southern Europe
- Attackers clone trusted GitHub repos and embed malicious files in ZIP archives with lua51.dll, compiler.exe, Application.bat, and gc.txt
- Malware uses a two-stage SmartLoader chain with Prometheus and MoonSec V3 obfuscation to evade detection
- Command-and-control server address is dynamically resolved via a Polygon blockchain smart contract
- Second stage downloads additional Lua scripts and NodeJS-based information stealers from attacker-controlled GitHub accounts 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
💥 BREACHES & INCIDENTS
- 150,000 Impacted in Madera Community Hospital Data Breach Involving Extortion Group
An extortion group stole personal, financial, and medical data from Madera Community Hospital.
- Applies to patients and individuals served by Madera Community Hospital in California
- Personal, financial, medical, and limited biometric information was compromised
- Attack occurred in May 2025 with hackers accessing the network for two days
- Data exfiltration identified after forensic analysis and data review
- Extortion group demanded ransom but withdrew it, citing no intent to harm patients 📎 Coverage: securityweek.com · 👁 via SecurityWeek
🔓 CVEs & KEV
- Other: 20 CVEs (worst 9.8)
🕵️ RESEARCH & DEEP DIVES
-
Malicious GitHub Issue Can Exploit Google AI Agent to Breach CI/CD Pipeline A GitHub issue can manipulate Google's AI agents to compromise its CI/CD pipeline.
- Applies to Google’s Agent Development Kit for Python (google/adk-python) used by developers
- Low-privileged AI agent handling public GitHub interactions can trigger high-privileged agent actions
- Attack uses prompt injection via crafted pull request comments to invoke privileged workflows
- Exploits include editing comments, impersonating maintainers, and faking code review approvals
- New vulnerability allows bypassing command allowlists to execute remote code on CI runner
- Attackers can exfiltrate sensitive tokens and Google Cloud credentials by opening a GitHub issue 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
-
Deep dive series explores modern Windows 11 kernel exploitation via pool grooming A detailed four-part series demonstrates advanced Windows 11 kernel exploitation techniques.
- Applies to Windows 11 x64, specifically version 26200.8328 with HackSys Extreme Vulnerable Driver (HEVD)
- Explores evolution from stack buffer overflows to arbitrary writes and modern kernel pool grooming
- Demonstrates bypassing SMEP, exploiting out-of-bounds pool reads, and data-only local privilege escalation
- Uses techniques like CR4-flipping ROP chains, kernel stack reconstruction, and double-pipe grooming
- Avoids common crashes by dodging IoCompleteRequest and leverages Named Pipes and npfs.sys for exploitation 📎 Coverage: sibouzitoun.tech · 📄 Original: sibouzitoun.tech · 👁 via r/netsec
📋 ADVISORIES
- Apache NiFi 1.5.0-2.10.0 Vulnerable to Authorization Bypass and DoS Flaws
Apache NiFi versions 1.5.0 through 2.10.0 contain multiple authorization bypass and denial-of-service vulnerabilities.
- Affects Apache NiFi versions 1.5.0 to 2.10.0, including Web API and Parameter Context authorization controls
- High-severity flaws allow read-only users to bypass authorization and submit altered Parameter Context validations
- Medium-severity issue permits unauthorized configuration changes and potential code execution via manipulated Parameters
- Low-severity flaw enables unauthorized deletion of Assets linked to other Parameter Contexts
- Denial-of-service risk from gzip-compressed REST API requests causing excessive memory use due to decompression handling 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News