4+ day, 10+ hour ago   (532+ words) KnowBe4 found hackers abusing trusted Google services to hide phishing pages that steal Microsoft credentials and enable persistent ScreenConnect remote access. A familiar Google address in a suspicious email may be exactly what attackers want you to trust. KnowBe4 Threat Lab uncovered…...

4+ day, 22+ hour ago   (610+ words) Researchers used AI to build WeWorm, a zero-click WeChat exploit that could hijack accounts through unanswered calls before Tencent mitigated the flaw. Security company Calif said it created a proof-of-concept worm that could hijack WeChat accounts on iPhones and Android…...

5+ day, 14+ hour ago   (646+ words) Samsung’s September 2026 security update lists fixes tied to 90 vulnerabilities, including critical Android and Galaxy flaws. Samsung is starting September with another major security cleanup for Galaxy users. Samsung’s September 2026 security bulletin lists fixes tied to 90 vulnerabilities across Google, Samsung Semiconductor,…...

6+ day, 23+ min ago   (404+ words) Fake Minecraft sites continue distributing WeedHack malware through SEO poisoning and trusted hosting platforms despite disruption of its original C2 infrastructure. Disrupting WeedHack’s command-and-control infrastructure did not stop its distribution. Fake Minecraft client sites and trusted hosting services continued serving the…...

1+ week, 3+ day ago   (623+ words) Coder’s compromised module registry served malicious Terraform modules that stole cloud, CI/CD, AI, and SSH credentials during a 14-hour attack window. Coder confirmed that an unidentified attacker compromised infrastructure supporting its module registry and served modified Terraform modules designed…...

1+ week, 2+ day ago   (710+ words) Google patched CVE-2026-85046, the sixth Chrome zero-day exploited in the wild in 2026. Here’s how to update your browser and stay protected. Chrome users have another actively exploited zero-day to worry about, and this one sits inside the engine that powers…...

1+ week, 2+ day ago   (748+ words) A high-severity flaw in All-in-One WP Migration leaves 3.25 million WordPress sites exposed, with vulnerable versions potentially leading to site compromise. A WordPress backup tool designed to help sites recover from trouble can instead become the trigger for an attack. Researchers…...

1+ week, 6+ day ago   (546+ words) Infostealer malware is stealing authenticated Claude browser sessions, letting attackers access paid AI accounts and consume victims’ usage allowances. Anthropic is alerting users that threat actors are deploying commodity infostealer malware to hijack active, authenticated browser sessions, giving hackers unauthorized…...

2+ week, 3+ day ago   (389+ words) A global RMM phishing campaign is abusing trusted remote access tools across 46 countries, with US activity accounting for about 45%. Attackers are turning legitimate IT support software into a route for remote access. Because RMM tools are widely used by administrators…...

2+ week, 5+ day ago   (613+ words) Trust is becoming the attack surface. Today’s threats are exploiting everything from forgotten cloud credentials and convincing phishing lures to trusted software and nearby devices. Read past newsletters here. Thousands of Leaked AWS Keys Still Work Thousands of publicly exposed…...