Threat Intel

Wed, 02 Sep 2026 14:19:13 -0400

Hackers Target US and EU Firms With Microsoft 365 Session Hijacking and RMM Abuse

Hackers are exploiting Microsoft 365 sessions, RMM software, and phishing-as-a-service kits like Mirage2FA to hijack corporate accounts across the US and Europe. To mitigate these threats, organizations must revoke active tokens, implement phishing-resistant MFA, and utilize behavioral threat intelligence to detect malicious activity disguised as routine administrative tasks.

Wed, 02 Sep 2026 14:17:10 -0400

GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor and Grok

GitSpawn vulnerabilities allow malicious repositories to silently execute arbitrary code on a developer’s machine by exploiting background git commands that trigger unauthorized configuration hooks. To prevent this, developers should inspect .git/config files in unverified repositories, while vendors are urged to sanitize background context-gathering operations.

Wed, 02 Sep 2026 14:15:19 -0400

Berlin Rejects Rhysida Ransomware Blackmail - GovInfoSecurity

The Berlin Senate has officially rejected a 30-bitcoin ransomware demand from the Rhysida hacking group following a major data breach. City officials are currently scanning thousands of systems to assess the extent of the stolen information while refusing to pay the extortionists.

Wed, 02 Sep 2026 14:14:04 -0400

Threat Gang ‘Springs’ Vishing Attacks on Microsoft Teams Users

The Spring Ring campaign uses vishing on Microsoft Teams to trick employees into installing malware or granting unauthorized remote access. These social engineering attacks aim to compromise organizational infrastructure by impersonating internal support staff to gain control over domain controllers.

Wed, 02 Sep 2026 14:12:38 -0400

Iran’s shadow banking network extends beyond US sanctions, investigation reveals

Iran maintains access to the global financial system by utilizing a shadow banking network of shell companies and exchange houses in the UAE and China to bypass US sanctions. Investigations reveal this infrastructure moved approximately $9 billion in 2024, prompting intensified US regulatory efforts to disrupt these illicit financial channels.

Wed, 02 Sep 2026 14:11:43 -0400

Google Launches Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Vulnerabilities

Google has introduced Gemini 3.8 Flash Cyber, a specialized AI model designed to autonomously identify and generate patches for software vulnerabilities. Available exclusively to vetted teams through the Fairwind Program, the model significantly enhances cybersecurity defense by outperforming larger competitors in vulnerability discovery and remediation.

Wed, 02 Sep 2026 14:09:49 -0400

Health data of more than 9.5 million people leaked from Aesto record system | The Record from Recorded Future News

The healthcare data company Aesto confirmed a cyberattack resulted in the data breach of sensitive information belonging to more than 9.5 million people. Hackers accessed Amazon Web Services infrastructure last December, exposing Social Security numbers, medical records, and financial data across 30 affected organizations.

Wed, 02 Sep 2026 14:08:06 -0400

Kimi K3 outperforms rival open-weight models in finding Bitcoin vulnerabilities

The Kimi K3 open-weight AI model successfully identified nearly 8,000 potential security issues across 501 Bitcoin projects within two weeks. It outperformed rival models in vulnerability detection benchmarks, though it remains significantly less capable than leading closed-source alternatives.

Wed, 02 Sep 2026 14:06:46 -0400

WhatsApp Video Call Flaw Lets Anyone Bypass Your Android Lock Screen and View Your Photos

A WhatsApp vulnerability on Android allows attackers to bypass the lock screen and view private photos by answering an incoming video call. Users can protect their devices by restricting app permissions for photo and video access in the system settings.

Tue, 01 Sep 2026 19:16:44 -0400

Rhysida Claims Berlin Hack: 5.79 TB, 30 BTC Demand [2026]

The Rhysida ransomware group has claimed a 5.79 TB data breach against the Berlin state government, demanding 30 Bitcoin to prevent publication. In line with official no-payment policies, the Governing Mayor has confirmed a major cyber incident but refused to meet the extortion demands.

Tue, 01 Sep 2026 19:15:48 -0400

Hackers claim millions of patient records stolen during data breach at healthcare giant McKesson | TechCrunch

The hacking group ShinyHunters has claimed responsibility for a data breach at the healthcare giant McKesson, allegedly stealing millions of patient and employee records via phishing and social engineering. The attackers are reportedly demanding a $55 million ransom after compromising sensitive information from the company’s cloud-hosted environments.

Tue, 01 Sep 2026 19:14:52 -0400

Hackers leak sensitive law enforcement files stolen from the DOJ | CNN Politics

A Russian-speaking cybercriminal gang known as Qilin has leaked sensitive law enforcement files stolen from the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). The stolen data includes information on ATF investigations and investigative agents, prompting an ongoing cybersecurity assessment by federal agencies.

Mon, 31 Aug 2026 15:37:59 -0400

Microsoft warns of TerminalFix attacks deploying reverse tunnels

Microsoft warns that TerminalFix attacks use fake CAPTCHA prompts to trick users into running malicious PowerShell commands that establish a reverse tunnel for network infiltration. This multi-stage campaign enables attackers to perform reconnaissance, move laterally, and deploy further threats within compromised systems.

Mon, 31 Aug 2026 15:36:48 -0400

WatchGuard security advisory (AV26-865) - Canadian Centre for Cyber Security

The WatchGuard security advisory (AV26-865) identifies critical vulnerabilities affecting Dimension and Fireware OS products. Administrators should apply the latest software updates to mitigate these security risks.

Mon, 31 Aug 2026 15:35:54 -0400

North Korean hackers move $30 million in bitcoin via Hyperliquid, data reveals

Recent data reveals that North Korean hackers have moved over $30 million in bitcoin through the decentralized derivatives platform Hyperliquid. These ongoing transactions have prompted increased scrutiny regarding the platform’s security and regulatory standing.

Mon, 31 Aug 2026 15:35:05 -0400

Grok Bot transforms coding tasks as a16z investor calls it a ChatGPT moment

Grok Bot is an xAI coding agent that utilizes parallel processing and cloud-based architecture to outperform Claude Code in speed and practical automation tasks. An a16z investor has labeled this technical advancement a ChatGPT moment due to its significant impact on developer workflows and industry expectations.

Mon, 31 Aug 2026 15:33:44 -0400

S&P 500 set to announce rebalancing changes this Friday, putting $27 trillion in motion

The S&P 500 quarterly rebalancing announcement this Friday will trigger mandatory portfolio adjustments across nearly $27 trillion in passive assets. These shifts, which force buying and selling of index components, typically create significant market movement for companies added to or removed from the benchmark.

Mon, 31 Aug 2026 15:31:29 -0400

Hidden Attack Slips Past Claude Code Auto Mode

A security researcher demonstrated that prompt injection attacks can bypass Claude Code Auto Mode, tricking the AI into executing unauthorized malicious code. Anthropic maintains that the feature is a convenience tool rather than a security guarantee and recommends human oversight for sensitive tasks.

A side project: BagCheck

Mon, 31 Aug 2026 13:39:36 -0400

I recently launched BagCheck, a free tool for answering a practical travel question:

Will this bag work for this trip?

BagCheck lets you check backpacks, carry-ons and personal items against published airline size limits, compare bags side by side and plan multi-airline trips.

I built it as a personal learning project to sharpen newer technical skills by solving a problem I actually have. I travel frequently, like bags and was tired of repeatedly comparing manufacturer dimensions with airline baggage rules by hand.

What started as an experiment became a project of love.

One of the biggest lessons was that data quality matters more than database size. During the research, I found large public bag datasets with enough inconsistent, outdated or difficult-to-substantiate records to convince me that quantity alone is a poor benchmark.

BagCheck takes a more conservative approach. It emphasizes source-backed data, keeps uncertainty visible and separates physical fit from ticket allowance rather than turning incomplete information into a confident answer.

It is also independent and non-commercial. There are no affiliate commissions, paid placements or advertising influencing results. Core features do not require an account, and the site’s privacy approach is intentionally minimal.

BagCheck is not a review site and does not try to replace resources such as Pack Hacker, Carryology or One Bag Travel. Its focus is narrower:

I have this bag. Will it work?

I am flying these airlines. Which bags should I consider?

Will one bag work across my whole itinerary?

If that sounds useful, try BagCheck.

You can also read the methodology and privacy notice.

Disclaimer

BagCheck is provided for informational and travel-planning purposes only. Airline baggage policies, fare conditions and enforcement practices can change. Always confirm current baggage rules with the operating airline before travel.

Sun, 30 Aug 2026 12:32:25 -0400

Berlin Cyberattack | Hackers Demand $2.5 Million Ransom, Threaten To Leak Stolen City Data

A cyberattack in Berlin has left government services disrupted while hackers demand a $2.5 million ransom in bitcoins. If the payment is not made within a week, the perpetrators threaten to leak stolen personal data.

Sun, 30 Aug 2026 12:30:59 -0400

FulcrumSec claims Manchester Airports hack, theft of 86 GB of data

The extortion group FulcrumSec has claimed responsibility for a data breach at the Manchester Airports Group (MAG), alleging that they exfiltrated approximately 86 GB of customer information via exposed API credentials. While MAG confirmed a security incident affecting customer bookings, they declined to address specific claims regarding the extent of the stolen data.

Sun, 30 Aug 2026 12:30:15 -0400

Abbott Vishing Hack: ShinyHunters Leak 10.9M Emails

The Abbott Laboratories breach, which exposed 10.9 million email addresses in 2026, was caused by a vishing attack where ShinyHunters impersonated a trusted contact to gain credentials from an employee. This incident highlights a growing trend where cybercriminals bypass security perimeters by targeting IT help desks via social engineering.

Sun, 30 Aug 2026 12:29:04 -0400

12 TB of Valve Data Leaked, Possibly Including Half-Life 2 Episode 3

A massive 12 TB Valve data leak has surfaced online, containing internal game builds and assets for titles like Portal 2, Left 4 Dead, and F-Stop. While researchers identified a potential connection to Half-Life 2: Episode 3 through a shared weapon model, no definitive evidence confirms an included build for the game.

Fri, 28 Aug 2026 13:23:01 -0400

Tech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense Pledge - SecurityWeek

Nearly 130 organizations have joined an OpenAI-led initiative to launch a global cyber defense effort aimed at countering the rising sophistication of AI-enabled attacks. The coalition emphasizes coordinated security improvements, shared threat intelligence, and increased support for critical infrastructure to mitigate evolving risks.

Fri, 28 Aug 2026 12:43:01 -0400

Morocco denies DGSN and DGST data breach after Jabaroot leaks

Moroccan security authorities have categorically denied a data breach of their systems, dismissing claims by the hacker group Jabaroot as fabricated and derived from outdated third-party databases. Officials emphasized that no cyberattack occurred on their infrastructure and have launched investigations to identify those responsible for spreading false information.