🚨 ACTIVE EXPLOITATION
- SEO-Poisoned Minecraft Client Sites Distribute WeedHack Malware
McAfee found WeedHack malware being distributed through fake Minecraft client websites.- Minecraft players searching for Xenon, Glazed, Radium, SeedCrackerX, Nova, Meteor and other clients are targeted.
- Fake client sites deliver WeedHack through malicious Java files, JARs, mods and ZIP archives.
- Attackers use SEO poisoning, copied branding and links to legitimate GitHub projects to make download pages appear credible.
- McAfee WebAdvisor blocked more than 6,300 attempts to reach malicious sites; observed delivery channels included Discord (49.6%), MediaFire (23.4%) and GitHub (8.2%).
- Reported IOCs include xenonclient.com, xenoclient.lol, glazed-client.com, radium-client.com, seedcrackerx.github.io and meteorclients.com.
📄 Source: mcafee.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🕵️ RESEARCH & DEEP DIVES
- Compass Security Details JavaScript Hooks for Passkey Penetration Tests
Compass Security developed browser hooks to test passkey implementations.- Web applications using passkey authentication are affected.
- The passkey configuration and implementation can be inspected and manipulated during testing.
- Two JavaScript helper functions hook browser APIs involved in passkey operations.
📎 Coverage: blog.compass-security.com · 👁 via Compass Security
📋 ADVISORIES
- Anthropic Makes Enterprise-Managed Auth Available for Claude MCP Connectors
Anthropic has made enterprise-managed authorization generally available for Claude MCP connectors.- Claude Team and Enterprise customers using Claude MCP connectors are affected.
- Supported connectors include Asana, Atlassian, Canva, Datadog, Figma, Granola, Linear, Notion, Slack, and Supabase.
- Admins authorize connectors once through organizational identity-provider groups and roles.
- Employees no longer complete separate per-tool OAuth flows or manage individual connector credentials.
- Okta is the launch identity provider; Exa, Miro, and Zoom are slated for support.
📄 Source: support.claude.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)