Blahalla

BoryptGrab Malware Abuses GitHub to Steal Browser and Crypto Wallet Data

gbhackers.com · 7 months ago

A new malware campaign, BoryptGrab, is using fake GitHub repositories disguised as free tools and utilities to infect Windows systems. The malware steals browser data, cryptocurrency wallet information, system details, Telegram data, and Discord tokens. Attackers use layered downloaders and multiple techniques, including DLL side-loading, VBS/PowerShell scripts, and Golang-based downloaders, to deliver the payload, which can also include Vidar stealer variants and a backdoor called TunnesshClient. The campaign is ongoing and actively evolving, with evidence suggesting a Russian-speaking threat actor is behind the operation.

Internet Infrastructure TLD .arpa Abused in Phishing Attacks

www.securityweek.com · 7 months ago

Cybercriminals are exploiting the internet’s infrastructure TLD.arpa to conduct phishing attacks. Attackers are gaining control of.arpa domains and creating A records to serve malicious content, impersonating major brands and hiding the true domain names from victims. The attacks have involved hijacking Canonical Name records from legitimate organizations and using them in phishing emails. Cloudflare and Hurricane Electric were among the DNS providers where this vulnerability was exploited, with the activity observed since September 2025.

Chinese Cyber Threat Lurks In Critical Asian Sectors for Years

www.darkreading.com · 7 months ago

A Chinese-speaking threat actor, identified as CL-UNK-1068, has been conducting cyberespionage attacks against critical infrastructure sectors across Asia since 2020. The group uses a combination of custom malware, open-source tools, and living-off-the-land techniques on both Windows and Linux systems to steal credentials and exfiltrate sensitive data. Their tactics include deploying Web shells like GodZilla and AntSword, along with tools like Mimikatz and ScanPortPlus. Security experts recommend monitoring for behavioral anomalies, misuse of legitimate Python binaries, and unauthorized tunneling tools to detect and defend against this threat.

Iran-Linked Hackers Target U.S. Critical Infrastructure Amid Rising Cyber Threats

gbhackers.com · 7 months ago

Iran-linked hackers, specifically the group Seedworm, are intensifying cyber operations against U.S. and Israeli networks amid regional conflict. They've compromised a U.S. bank, an airport, non-profits, and a software supplier, deploying new backdoors like Dindoor, which uses the Deno runtime, and Fakeset. The attackers attempted data exfiltration using Rclone to Wasabi cloud storage and have used certificates associated with "Amy Cherne" and "Donald Gay" to sign malicious code. Security experts advise heightened vigilance for DDoS attacks, web exploitation attempts, and unusual activity involving tools like Rclone and Deno.

Cyber Espionage Group CL-UNK-1068 Linked to China Targets Asian Infrastructure

gbhackers.com · 7 months ago

A sophisticated cyber espionage group, CL-UNK-1068, originating from China, has been targeting critical infrastructure in Asia since 2020. The group utilizes a mix of web shells like GodZilla and AntSword, custom tools like ScanPortPlus, and living-off-the-land techniques, including DLL side-loading with Python executables, to compromise Windows and Linux systems. They employ a modified Fast Reverse Proxy with Chinese identifiers and the Xnote backdoor for DDoS attacks, focusing on credential theft and data exfiltration. Mitigation strategies include behavioral monitoring, network defense, endpoint security, firewall protection, and vulnerability management.

OpenAI says Codex Security found 11,000 high-impact bugs in a month

www.csoonline.com · 7 months ago

OpenAI has developed a new AI-powered AppSec tool called Codex Security. During initial testing, it identified over 11,000 high-severity and critical flaws across more than a million code commits. The tool operates like a security researcher, mapping attack paths and suggesting fixes to reduce alert fatigue for security teams. Vulnerabilities were found in both proprietary and open-source projects like OpenSSH, GnuTLS, and Chromium, resulting in 14 assigned CVEs. OpenAI plans to expand access to Codex Security and support open-source maintainers through a new initiative.

Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign

www.securityweek.com · 7 months ago

A new malware campaign called InstallFix is using cloned webpages of popular development tools to distribute information-stealing malware. Threat actors are using malvertising and Google Ads to direct victims to these fake installation pages, which contain malicious code disguised as legitimate installers. The cloned pages are designed to be nearly identical to the real ones, making them difficult to distinguish. Once executed, the malicious code installs an Amatera Stealer, and threat actors are leveraging legitimate services like Cloudflare Pages to host their content.

Vaultwarden Vulnerabilities Enable Privilege Escalation and Data Exposure

gbhackers.com · 7 months ago

Two high-severity vulnerabilities have been identified in Vaultwarden, affecting version 1.35.3 and requiring immediate patching to version 1.35.4. The first vulnerability, CVE-2026-27803, allows Manager accounts to bypass authorization controls and manipulate password collections. The second vulnerability, CVE-2026-27802, enables privilege escalation through the bulk-access API, granting unauthorized access to restricted collections. Both flaws are network-based, require no user interaction, and pose significant risks to data confidentiality, integrity, and availability.

Apache ZooKeeper Flaw Exposes Sensitive Data to Attackers

gbhackers.com · 7 months ago

Apache ZooKeeper users should immediately update their software to address two critical security vulnerabilities. CVE-2026-24308 involves the unintentional logging of sensitive configuration data in plain text, while CVE-2026-24281 allows attackers to bypass hostname verification through reverse DNS spoofing. Both vulnerabilities affect versions 3.8.0 through 3.8.5 and 3.9.0 through 3.9.4, and updates to versions 3.8.6 or 3.9.5 are now available to resolve the issues. Security teams should also review existing logs for any potential data exposure.

MaaS VIP Keylogger Campaign Uses Steganography to Steal Credentials at Scale

gbhackers.com · 7 months ago

A large-scale spear-phishing campaign is distributing the VIP Keylogger malware as a Malware-as-a-Service. The attackers use steganography, in-memory execution, and modular payloads to evade detection while stealing credentials from over 40 Chromium-based browsers, email clients, and collaboration tools. The keylogger harvests data such as browser cookies, stored payment information, and Discord tokens, exfiltrating the stolen data via FTP, Telegram, Discord, web POST requests, and SMTP. This campaign highlights the effectiveness of social engineering combined with stealthy malware techniques.

New Attack Against Wi-Fi

www.schneier.com · 7 months ago

A new Wi-Fi attack called AirSnitch exploits flaws in network layers to allow an attacker to intercept and modify data. This enables a full, bidirectional man-in-the-middle attack, potentially compromising sensitive information like passwords and payment details, even on networks using HTTPS. The attacker can operate on the same or different networks, targeting both home and enterprise environments. AirSnitch can also be used to corrupt DNS tables and expose external IP addresses.

NIS-2: Tausende reißen BSI-Frist und riskieren Strafen

www.csoonline.com · 7 months ago

A new law in Germany, implementing the NIS-2 directive, requires over 29,000 businesses to protect against cyberattacks and significant IT incidents. Recent cyberattacks, such as one impacting European airports and disrupting operations at Berlin Brandenburg Airport, highlight the importance of these measures. Thousands of companies registered just before a deadline, indicating a positive trend toward compliance with the regulations. Businesses must now report security incidents within 24 hours and face potential fines for non-compliance.

ClipXDaemon Malware Targets Crypto Users in Linux X11 Sessions

gbhackers.com · 7 months ago

A new Linux malware family called ClipXDaemon is targeting cryptocurrency users. This malware operates entirely offline, without any command-and-control infrastructure, and hijacks cryptocurrency clipboard data during X11 sessions. It uses a publicly available obfuscation framework, similar to ShadowHS, to deliver its payload and establishes persistence through the user's profile. The malware monitors the clipboard for cryptocurrency wallet addresses and replaces them with attacker-controlled addresses, with observed attacker wallets for Ethereum, Monero, Bitcoin, Dogecoin, Litecoin, Tron, and Ripple. Indicators of compromise include SHA-256 hashes for the bincrypter loader script, dropper script, and ClipXDaemon ELF binary.

Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft

thehackernews.com · 7 months ago

Multiple Google Chrome extensions have been compromised, enabling attackers to inject code, steal data, and control user browsers. QuickLens and ShotBird, originally developed by [email protected], were taken over by new developers and subsequently updated with malicious code, including capabilities to bypass security protections and deliver fake browser update prompts. The malware captures sensitive data like credentials and browsing history and harvests cryptocurrency seed phrases. Researchers suspect a single threat actor is behind the attacks, highlighting the risks of extension supply chain vulnerabilities. Users are advised to remove suspicious extensions and exercise caution when installing browser add-ons.

Cybercrime Group in Vietnam Enables Massive Fraudulent Signups

gbhackers.com · 7 months ago

A cybercrime group based in Vietnam is enabling large-scale fraudulent account registrations to facilitate financial fraud, phishing, and interpersonal scams. Attackers use botnets and disposable email addresses to create "puppet" accounts and trigger SMS messages to premium-rate numbers, monetizing the telecom charges. Several online marketplaces, like Via17.com, resell compromised or automatically created accounts, along with session tokens, lowering the barrier to entry for fraudsters. These fraudulent accounts are then used for spam, phishing, and review manipulation, degrading the user experience on targeted platforms.

Rogues gallery: 15 worst ransomware groups active today

www.csoonline.com · 7 months ago

Ransomware-as-a-service models, double extortion tactics, and growing use of artificial intelligence are reshaping the ransomware threat landscape, which has become more fragmented after law enforcement takedowns and the rise of many emergent players. Attackers range from nation state actors to lone operators and affiliate-run RaaS operations that increasingly use stealth and living off the land techniques, and researchers recorded well over seven thousand victims publicly posted last year with some operations such as Akira allegedly collecting about forty five million dollars in illicit payments in two thousand twenty five. A not exhaustive roster of high impact active groups includes Akira, Black Basta, BlackCat also known as ALPHV, BlackLock, Clop, DragonForce, FunkSec, The Gentlemen, LockBit, Lynx, Medusa, Play, Qilin, RansomHub, and Scattered Lapsus Hunters. These groups commonly exploit unsecured remote access, phishing, initial access brokers, zero day and known vulnerabilities, and custom malware to exfiltrate data, encrypt systems, demand ransoms, and in some cases add distributed denial of service or triple extortion tactics as further leverage.

1-Click ZITADEL Vulnerability Could Allow Full System Takeover

gbhackers.com · 7 months ago

A critical Cross-Site Scripting vulnerability, tracked as CVE-2026-29191, has been identified in the ZITADEL identity and access management platform. This flaw in the /saml-post endpoint allows unauthenticated attackers to execute malicious JavaScript with a single click, potentially enabling account takeover through password resets. Versions 4.0.0 through 4.11.1 are affected and the vulnerability exists in the default configuration. ZITADEL has released version 4.12.0 to address the issue, which removes the vulnerable endpoint and enhances password change security.

Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure

thehackernews.com · 7 months ago

A Chinese threat actor, identified as CL-UNK-1068, has targeted critical infrastructure organizations across Asia for years. The group uses a mix of custom malware like Godzilla, ANTSWORD, Xnote, and Fast Reverse Proxy, alongside living-off-the-land binaries, to maintain a persistent presence and steal data. Attackers employ techniques like Base64 encoding to exfiltrate files and utilize tools such as Mimikatz, LsaRecorder, DumpItForLinux, Volatility Framework, and a SQL Server Management Studio Password Export Tool to steal credentials. The campaign’s primary objective appears to be cyber espionage, with the adversary demonstrating versatility across both Windows and Linux environments.

Nginx UI Vulnerabilities Let Attackers Download Full System Backups

gbhackers.com · 7 months ago

A critical security vulnerability, tracked as CVE-2026-27944, has been identified in Nginx UI versions before 2.3.2. The flaw allows unauthenticated attackers to download and decrypt full system backups, exposing sensitive data like user credentials, SSL private keys, and Nginx configurations. This is due to a lack of authentication on the backup endpoint and a failure to properly protect decryption keys, transmitting them in plain text via an HTTP header. Organizations are urged to immediately update to version 2.3.3, reset credentials, rotate certificates, and restrict network access.

ExifTool Vulnerability Lets Malicious Images Trigger macOS Code Execution

gbhackers.com · 7 months ago

A critical vulnerability, CVE-2026-3102, has been identified in ExifTool, a widely used open-source utility for managing image metadata. This flaw allows malicious image files to execute code on macOS systems if the -n or --printConv flag is used. Attackers can exploit this to install malware by embedding shell commands within the DateTimeOriginal metadata field. Users are advised to update to ExifTool version 13.50 or later and to isolate workflows involving untrusted images.

Hikvision Multiple Product Vulnerability Could Let Attackers Escalate Privileges

gbhackers.com · 7 months ago

Federal authorities have added a critical vulnerability affecting multiple Hikvision products to the Known Exploited Vulnerabilities catalog due to active exploitation in real-world attacks. The vulnerability, tracked as CVE-2017-7921, allows attackers to bypass security checks, escalate privileges, and gain unauthorized access to surveillance information. CISA has issued a mandatory directive for Federal agencies to resolve the issue by March 26, 2026, and strongly urges private organizations to prioritize remediation. Network isolation and device decommissioning are recommended as additional defensive measures.

PQC roadmap remains hazy as vendors race for early advantage

www.csoonline.com · 7 months ago

false

Critical ExifTool Vulnerability Allows Malicious Images to Execute Code on macOS

gbhackers.com · 7 months ago

Researchers have identified a critical vulnerability, CVE-2026-3102, in the ExifTool software impacting macOS systems. Attackers can embed malicious code within image metadata, specifically the DateTimeOriginal field, to execute commands when ExifTool is used with the -n flag. This allows for the silent download of secondary payloads, such as Trojans, without the user’s knowledge. The vulnerability poses a significant risk to organizations utilizing ExifTool for digital forensics, media processing, and automated workflows.

Transparent Tribe’s ‘Vibeware’ Move Points to AI-Made Malware at Scale

gbhackers.com · 7 months ago

A group known as Transparent Tribe, or APT36, is using artificial intelligence to generate a large volume of malware, dubbed "vibeware." This vibeware consists of syntactically correct but often flawed code quickly ported across various programming languages like Nim, Zig, Crystal, Rust, Go.NET, and C. The group is also leveraging legitimate cloud services such as Google Sheets, Supabase, Firebase, Discord, and Slack for covert command-and-control channels. This strategy, called Distributed Denial of Detection, aims to overwhelm defenders through sheer volume rather than sophisticated evasion techniques.

**MCP Security Checklist - 40 controls for securing AI agent tool infrastructure**

checklist.helixar.ai · 7 months ago

false

WiFi Signals Can Track Human Activity Through Walls by Mapping Body Keypoints

gbhackers.com · 7 months ago

New technology called RuView, formerly WiFi DensePose, can track human movement, estimate body poses, and monitor vital signs through walls using everyday WiFi signals. The system utilizes inexpensive ESP32-S3 microchips and analyzes Channel State Information to map body keypoints, operating locally without internet access. This capability poses significant physical surveillance threats, bypassing traditional security measures like encryption and physical barriers. Potential mitigation strategies include CSI randomization, physical RF shielding, and RF noise injection.

Microsoft: Fake AI Extensions Breached Chat Histories in 20,000+ Enterprise Tenants

gbhackers.com · 7 months ago

Malicious browser extensions disguised as AI assistant tools have compromised the data of over 20,000 enterprise tenants worldwide. These extensions, available in the Chrome Web Store and compatible with both Google Chrome and Microsoft Edge, secretly collected sensitive data including URLs, internal site details, and AI chat content. Attackers mimicked legitimate brands like “AITOPIA” and leveraged permissive extension policies to install the extensions nearly 900,000 times. Microsoft recommends monitoring network traffic, auditing browser extensions, and enabling Defender SmartScreen and Network Protection to mitigate the risk.

CISA Alerts Users to Actively Exploited Vulnerabilities Impacting macOS and iOS

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has issued an alert concerning three actively exploited vulnerabilities impacting Apple devices. These flaws, CVE-2023-43000, CVE-2021-30952, and CVE-2023-41974, affect iOS, iPadOS, macOS, tvOS, watchOS, and the Safari web browser. One vulnerability allows for memory corruption through malicious web pages, another enables arbitrary code execution, and the third allows malicious applications to gain kernel privileges. Federal agencies must patch these vulnerabilities by March 26, 2026, and all users are strongly encouraged to update their devices immediately.

Tarnung als Taktik: Warum Ransomware-Angriffe raffinierter werden

www.csoonline.com · 7 months ago

Ransomware attacks are shifting from disruptive tactics to more persistent operations emphasizing data theft. Cybercriminals are concealing malicious activities within normal network traffic and exploiting numerous vulnerabilities. Groups like Akira and Qilin are becoming increasingly prominent in the threat landscape. Experts recommend bolstering identity controls and data exfiltration detection to address this evolving risk.

How AI Assistants are Moving the Security Goalposts

krebsonsecurity.com · 7 months ago

The emergence of AI assistants is creating new cybersecurity concerns. These tools can be exploited through techniques like prompt injection, allowing attackers to access private data and move within networks. Security experts warn that AI assistants’ broad access and communication capabilities create a significant vulnerability. Recent incidents demonstrate the urgent need for better security controls around AI agents.

AirSnitch: Demystifying and Breaking Client Isolation in Wi-Fi Networks

www.ndss-symposium.org · 7 months ago

false

Fake Claude Code Install Guides Spread Amatera Infostealer in New “InstallFix” Malvertising Campaign

www.neuracybintel.com · 7 months ago

NULL

Tracking the Top 10 exploited CVEs of the week (updated daily)

leakycreds.com · 7 months ago

This week's most exploited vulnerabilities include several critical issues. CVE-2026-1306 affects the midi-Synth plugin for WordPress, allowing arbitrary file uploads due to insufficient validation. Unauthenticated attackers can also exploit CVE-2026-1670 to alter password recovery emails and CVE-2026-2439 to generate insecure session IDs. Additionally, vulnerabilities exist in VMware Aria Operations, Juniper Networks Junos OS, EFM iptime devices, and Unidocs ezPDF Reader, with varying levels of severity and potential impact. These vulnerabilities are ranked based on social media discussion volume and security intelligence feeds.

EU court adviser says banks must immediately refund phishing victims

www.bleepingcomputer.com · 7 months ago

An advocate general of the Court of Justice of the EU has issued an opinion stating banks must immediately refund customers for unauthorized transactions, even if the customer’s negligence contributed to the fraud. This ruling stems from a case involving a customer who fell victim to phishing, entering their credentials on a fraudulent website resembling their bank’s login page. Banks can seek to recover losses from customers if gross negligence or intent is proven, requiring them to take legal action. The opinion is not a final ruling but serves as a recommendation for the court.

Hackers abuse .arpa DNS and ipv6 to evade phishing defenses

www.bleepingcomputer.com · 7 months ago

Cybercriminals are exploiting the.arpa domain and IPv6 reverse DNS systems to create more effective phishing campaigns. Attackers are reserving IPv6 address space and then configuring DNS records within those ranges to point to phishing sites, bypassing traditional domain reputation checks. This technique involves using seemingly legitimate DNS providers like Hurricane Electric and Cloudflare, and the.arpa domain’s lack of typical registration data further hinders detection. The phishing emails use images linked to these attacker-controlled reverse DNS names, redirecting victims to phishing sites after a validation process.

Recent Cisco Catalyst SD-WAN Vulnerability Now Widely Exploited

www.securityweek.com · 7 months ago

Threat actors are increasingly exploiting vulnerabilities in Cisco Catalyst SD-WAN devices. The exploitation of CVE-2026-20127, initially a zero-day, is now widespread and involves webshell deployment. A sophisticated threat actor known as UAT-8616 is linked to these attacks, and other vulnerabilities, CVE-2026-20128 and CVE-2026-20122, are also being exploited. Security experts advise that any exposed systems should be considered compromised until verified otherwise.

Anthropic’s and OpenAI’s Dance With the Pentagon: What to Know

www.nytimes.com · 7 months ago

false

‘Designed to Wreak Havoc’: The Cheap Drones Shaping the War With Iran

www.nytimes.com · 7 months ago

false

For OpenAI and Anthropic, the Competition Is Deeply Personal

www.nytimes.com · 7 months ago

false

OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues

thehackernews.com · 7 months ago

OpenAI has introduced Codex Security, an AI-powered agent designed to find and fix software vulnerabilities. The tool, which builds on previous work like Aardvark, has scanned over 1.2 million code commits, identifying thousands of high-severity issues. Recent scans have uncovered vulnerabilities in projects like GnuPG, GnuTLS, and Chromium, with associated CVEs including CVE-2026-24881, CVE-2026-24882, CVE-2025-32988, CVE-2025-32989, CVE-2025-64175, CVE-2026-25242, CVE-2025-35430, and CVE-2025-35431. Codex Security works by analyzing code, building a threat model, validating vulnerabilities in a sandbox, and proposing fixes.

Termite ransomware breaches linked to ClickFix CastleRAT attacks

www.bleepingcomputer.com · 7 months ago

Cybersecurity researchers have observed the threat group Velvet Tempest, also known as DEV-0504, using the ClickFix technique and legitimate Windows utilities to deploy malware. The group, known for ransomware affiliation including Ryuk, REvil, Conti, BlackCat/ALPHV, LockBit and RansomHub, gained access to a replica network through a malvertising campaign. Their activities included credential harvesting and staging DonutLoader and the CastleRAT backdoor, which is linked to the CastleLoader malware loader. This intrusion did not involve the deployment of Termite ransomware, despite the tool staging being linked to previous Termite attacks against victims like Blue Yonder and Genea.

US Cyber Strategy Targets Adversaries, Critical Infrastructure, and Emerging Technologies

www.securityweek.com · 7 months ago

false

Microsoft: Hackers abusing AI at every stage of cyberattacks

www.bleepingcomputer.com · 7 months ago

Microsoft reports that cyber threat actors are increasingly leveraging artificial intelligence across all stages of attacks, accelerating malicious activity and reducing technical skill requirements. Attackers are using generative AI for tasks like phishing, malware creation, infrastructure development, and data summarization, with groups like Jasper Sleet and Coral Sleet utilizing AI to create fake identities and tailor attacks. Threat actors are also employing jailbreaking techniques to bypass AI safeguards and experimenting with agentic AI for autonomous task completion. Microsoft advises organizations to focus on detecting abnormal credential use and securing AI systems to counter these evolving threats.

Over 100 GitHub Repositories Distributing BoryptGrab Stealer

www.securityweek.com · 7 months ago

Security researchers have discovered a new information stealer called BoryptGrab distributed through over 100 GitHub repositories. This malware harvests sensitive data like browser information, cryptocurrency wallet details, system information, and user files, including Telegram files, browser passwords, and Discord tokens. Some versions of BoryptGrab also deploy a backdoor, TunnesshClient, which uses an SSH tunnel for command and control. The operation demonstrates a high level of engineering sophistication, using techniques like DLL sideloading and various downloaders to execute.

Pentagon’s Chief Tech Officer Says He Clashed With AI Company Anthropic Over Autonomous Warfare

www.securityweek.com · 7 months ago

A dispute between the Pentagon and AI company Anthropic has escalated after a top Pentagon official publicly criticized Anthropic's restrictions on AI usage. The disagreement stems from the Pentagon's desire to use AI in autonomous weapons systems, including a potential space-based missile defense program called Golden Dome, while Anthropic has sought to limit its technology's use for mass surveillance or fully autonomous weapons. The Pentagon has now designated Anthropic as a supply chain risk, effectively cutting off its defense work, and Anthropic intends to pursue legal action. The Pentagon official stated needing a reliable partner to develop AI capabilities, expressing frustration with what he perceived as unreasonable restrictions from Anthropic.

OpenAI’s Codex Security Built to Automate Vulnerability Discovery and Remediation

gbhackers.com · 7 months ago

OpenAI has introduced Codex Security, a new AI-powered application security agent designed to automate vulnerability discovery and remediation. The tool analyzes code repositories to create project-specific threat models, prioritizing vulnerabilities based on real-world impact and using sandboxed validation to confirm findings. During a recent scan, Codex Security identified 792 critical and 10,561 high-severity findings across external repositories. The agent has discovered vulnerabilities in OpenSSH, GnuTLS, GOGS, Thorium CVE-2025-35430, PHP, libssh, and Chromium and is now available in research preview for select OpenAI customers. OpenAI is also launching Codex for OSS, a program to support open-source maintainers.

Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model

thehackernews.com · 7 months ago

Anthropic has discovered 22 security vulnerabilities in the Firefox web browser through a partnership with Mozilla, utilizing their Claude Opus 4.6 AI model. Fourteen of these vulnerabilities were classified as high severity, seven as moderate, and one as low. The AI model identified a use-after-free bug within 20 minutes, and while it successfully developed exploits for only two vulnerabilities, this demonstrates the potential for AI to uncover browser security flaws. One of the successful exploits was for CVE-2026-2796, a JavaScript WebAssembly miscompilation.

Malicious Browser Add‑on Targets imToken Users’ Private Keys

gbhackers.com · 7 months ago

A malicious Google Chrome extension, disguised as a hex color visualizer and named “lmΤoken Chromophore,” is targeting imToken cryptocurrency users to steal private keys and seed phrases. The extension redirects users to a phishing website that mimics the imToken wallet interface to trick victims into entering their sensitive wallet information. Attackers use deceptive techniques, including Unicode homoglyphs and fake user reviews, to bypass security measures and maintain a convincing facade. Users who suspect they may have entered their credentials on a suspicious page should immediately transfer their funds to a new wallet.

38 researchers red-teamed AI agents for 2 weeks. Here's what broke. (Agents of Chaos, Feb 2026) AI Security

arxiv.org · 7 months ago

A recent study examined autonomous language model agents in a live laboratory setting, observing concerning behaviors during a two-week period. Researchers documented eleven case studies highlighting vulnerabilities related to security, privacy, and governance. Issues included unauthorized compliance, information disclosure, destructive actions, denial-of-service, and partial system takeover, sometimes accompanied by inaccurate task completion reports. The findings underscore the need for attention from legal experts, policymakers, and researchers regarding accountability and potential harms.

Claude AI Exposes 22 Firefox Vulnerabilities in Just Two Weeks

gbhackers.com · 7 months ago

A collaboration between Anthropic and Mozilla resulted in the discovery of 22 security flaws in Firefox using the Claude Opus 4.6 AI model. The AI focused on the JavaScript engine and identified a critical Use After Free vulnerability within twenty minutes. While the AI successfully developed primitive exploits in a testing environment, real-world protections would likely mitigate them, and the process of exploiting vulnerabilities remains significantly more costly than identifying them. The discovered vulnerabilities included 14 high-severity flaws, and Mozilla quickly patched them in Firefox 148.0.