TECHZONE™

Ransom Cartel Creator Gets 16 Years in Prison for Operating Ransomware-as-a-Service https://thehackernews.com/2026/08/ransom-cartel-creator-gets-16-years-in.html A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel, the ransomware-as-a-service operation he stood up in 2021. Between 2021 and 2023, Ransom Cartel conspirators attacked at least 18 companies, including firms in California, New York and Nebraska, and others abroad, according to the Justice Department.

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild https://thehackernews.com/2026/08/cisa-flags-teamcity-cve-2026-63077-rce.html A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability in question is CVE-2026-63077 (CVSS score: 9.8), a case of deserialization of untrusted data that could allow an unauthenticated attacker with access to a TeamCity server

Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People https://thehackernews.com/2026/08/snowflake-hacker-pleads-guilty-over.html Connor Riley Moucka pleaded guilty in Seattle federal court on Wednesday to computer fraud, wire fraud, aggravated identity theft and a related conspiracy over the 2024 breaches of Snowflake customer accounts. The intrusions reached at least 165 organizations and exposed records belonging to at least 100 million people. Moucka, 26, of Kitchener, Ontario, personally took at least $495,000 from

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures https://thehackernews.com/2026/08/over-250-clickfix-domains-use-browser.html A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. Microsoft

OpenAI Disrupts Poipet Scam Network Using ChatGPT Across Multiple Fraud Schemes https://thehackernews.com/2026/08/openai-disrupts-poipet-scam-network.html OpenAI said it disrupted a Cambodia-based scam operation that used its generative artificial intelligence (AI) chatbot ChatGPT to facilitate a wide range of investment, romance, gambling, and law enforcement impersonation schemes. To that end, it banned a coordinated network of ChatGPT accounts likely originating from Southeast Asia and operating from the city of Poipet, a region with extensive

Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt https://thehackernews.com/2026/08/poison-claude-sells-discounted-claude.html Cybersecurity researchers have discovered more than half-a-dozen services advertisements for illegal access to artificial intelligence (AI) models on underground cybercrime forums and messaging platforms. One such service, Poison Claude, claims to offer access to Anthropic's large language models (LLMs), including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6. "Advertisements for Poison Claude

Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports https://thehackernews.com/2026/08/paperclip-ai-flaws-let-attackers-run.html Two security flaws in Paperclip could let attackers execute commands on a network server or a developer's computer. Paperclip is an open-source control plane for teams of artificial intelligence (AI) agents, and both paths rely on importing a malicious agent and starting it. A third flaw could expose sensitive data and control-plane details through application programming interface (API) routes

Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The three most serious: An unauthenticated flaw in Veeam's console that hands over a managed agent's credentials, rated 9.5 A cross-tenant flaw in HashiCorp's MCP server that lets one user's Terraform token be reused for later users'

Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses https://thehackernews.com/2026/08/trojanized-npm-packages-decode-c2-ip.html Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two trojanized npm package "bianira-ui" and "fluid-type-ui," has been codenamed NullReceiver by

Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself https://thehackernews.com/2026/08/claude-mythos-5-tried-to-backdoor-real.html An agent running Anthropic's Claude Mythos 5 spent 34 hours trying to get a malware dropper merged into a real open-source project during a cyber evaluation by the UK's AI Security Institute. When a bystander publicly warned that the code was malicious, the agent denied it, force-pushed a rewritten branch history to erase the evidence, and posted from a second account it controlled to vouch for

CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2026-9198 (CVSS score: 9.8) - A code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote

QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer https://thehackernews.com/2026/08/quickfox-supply-chain-attack-delivers.html Cybersecurity researchers have disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network (VPN) and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply chain attack has been ongoing since at least August 2025 and involves a trojanized version of the application to deliver FDMTP, a

Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens https://thehackernews.com/2026/08/greatness-phaas-adds-device-code.html The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authentication (MFA) and seize control of user accounts. "Greatness supports AiTM [adversary-in-the-middle] credential and

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026. SafeDep verified 353 poisoned versions across 79 package names in the npm registry. Its monitoring put the wider footprint at 442 versions across 353 names, while Aikido later reported at least 868 packages

Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect. The campaign has been codenamed SMOKE#SCREEN by Securonix Threat

When Vibe Hacking Turns AI into the Junior Hacker Every Adversary Always Wanted https://thehackernews.com/2026/08/when-vibe-hacking-turns-ai-into-junior.html The cybersecurity industry has spent decades assuming that offensive capability scales with technical expertise. That assumption is starting to break. Security teams have long estimated risk by ranking attacker sophistication. Nation-state actors sat at one end. Organized criminal groups followed. Inexperienced attackers, dismissed as "script kiddies," sat at the other end, running public

Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The researchers said the public agent could be prompt-injected into posting /adk-issue-fix as adk-bot. They identified the bot as a collaborator, so that comment satisfied

New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root https://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.html cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database's root context, crossing the privilege boundary between a cPanel account and the server's administrative database identity. It shipped in a targeted security release that closes two other routes past account boundaries. The database bug is tracked as CVE-2026-58048 (CVSS 4.0 score: 9.4) and affects

DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager. "The first stage drops a steganographic PNG image into the browser's cache, retrieves its hidden content, and executes the second

CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2026-18577 (CVSS score: 8.2), is a case of incomplete patching for CVE-2026-18556 (CVSS score: 8.2) that allows