TECHZONE™

Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone https://thehackernews.com/2026/09/pegasus-zero-click-spyware-exploit.html The iPhone belonging to a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware, according to new findings from the Citizen Lab in collaboration with the SHARE Foundation. "Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group's Pegasus spyware," the Citizen Lab said. "We found high-confidence indicators of

I’ve been deepfaked: What do I do? https://www.welivesecurity.com/en/how-to/ive-been-deepfaked-what-do/ Don’t panic if you spot an illegally created image or video of you online – there are ways to request its removal

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages https://thehackernews.com/2026/09/malicious-apache-modules-hijack.html A Chinese-speaking cybercrime cluster known as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-controlled pages promoting online gambling and sports betting. Check Point Research said it has tracked the campaign since mid-2025. The modules

BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access https://thehackernews.com/2026/09/bgp-hijack-delivers-malicious.html Virtualizor said hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic. The hackers then used the diverted update traffic to deliver a malicious Virtualizor package to some installations. A hosting-provider account separately said 5 of its 34 checked Virtualizor hypervisors sustained root-level compromise. The incident window ran from approximately August 28 at 20:57

Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected devices. ThreatFabric said the campaign's advertisement focused on Spain and reached an estimated 570,950 Meta accounts in the European Union

How to Secure Enterprise AI: From Adoption to Incident Readiness https://thehackernews.com/2026/09/how-to-secure-enterprise-ai-from.html The debate about whether AI delivers business value is over. The challenge now is implementing it at scale and securely across every function while meeting board-level pressure to move fast. Organizations must focus on adopting AI at business speed without losing control of cyber risk. Download the full eBook here.  The Business Reality  In Sygnia’s 2026 CISO Survey Report, which

Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html The U.S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as part of a coordinated law enforcement operation. The effort was undertaken on August 31, 2026, by authorities from the U.S., Bulgaria, Hungary, and Romania, in collaboration with private industry partners CrowdStrike and the Shadowserver Foundation. To that

Attackers Steal METR API Key and Consume AI Credits Worth About $600,000 https://thehackernews.com/2026/09/attackers-steal-metr-api-key-and.html METR (short for Model Evaluation and Threat Research and pronounced "Meter"), a research non-profit that evaluates frontier artificial intelligence (AI) models for their ability to carry out long-horizon, agentic tasks, disclosed that it suffered "two notable security incidents" where external actors attempted to gain unauthorized access to its systems. No sensitive information is believed to

Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis https://thehackernews.com/2026/09/russia-aligned-uac-0099-plants-nuclear.html Cybersecurity researchers have disclosed a new technique dubbed GuardBreaker that's been put to use by a Russia-aligned threat actor known as UAC-0099 against a target in Ukraine with an aim to interfere with artificial intelligence (AI)-assisted analysis. The idea, ESET said in a series of posts on X, is to deliberately trip a large language model's (LLM) safety mechanisms and prevent its

Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user. CVE-2026-66066 aka

This month in security with Tony Anscombe – August 2026 edition https://www.welivesecurity.com/en/videos/month-security-tony-anscombe-august-2026/ Details about the Hugging Face hack, critical infrastructure under attack, a spoofed in-flight Wi-Fi network, and more of this month's cybersecurity news

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales https://thehackernews.com/2026/08/north-korean-job-fraud-expands-beyond.html Threat actors with ties to the Democratic People's Republic of Korea (aka DPRK or North Korea) have been observed seeking job opportunities beyond the information technology (IT) sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical profession. The ongoing insider threat is part of what has been described as the IT worker scheme,

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More https://thehackernews.com/2026/08/weekly-recap-chinese-spy-proxy-ai.html The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional. Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions https://thehackernews.com/2026/08/valleyrat-backdoor-hides-in-signed.html The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions. Russian cybersecurity vendor Kaspersky said the attackers built the disguise around QN Wallpaper, a genuine Chinese desktop-wallpaper tool

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets https://thehackernews.com/2026/08/aurora-ransomware-operators-use-cursor.html Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its

Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance https://thehackernews.com/2026/08/securing-claude-code-new-compliance-api.html Claude Code reads files, runs shell commands, invokes MCP tools, and acts through the credentials available on a developer’s machine. Anthropic’s new Compliance API endpoints give security teams their clearest view yet into that activity. They also expose a larger problem: activity logs alone cannot tell you whether an agent’s access is legitimate. AI has moved from the browser tab to the

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs https://thehackernews.com/2026/08/china-linked-fire-ant-hijacks-cisco.html A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks. Sygnia, the incident response firm that investigated the intrusion, said the actor

DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims https://thehackernews.com/2026/08/doj-corrects-china-hacking-claim-says.html The U.S. Department of Justice (DoJ) on Friday corrected a previously issued press statement that several of its agencies were victims of attacks carried out by Chinese threat actors, instead now pointing out that they were among those targeted. Last week, the DoJ said the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor https://thehackernews.com/2026/08/terminalfix-uses-fake-cloudflare.html Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below - CVE-2026-76581 (CVSS score: 9.8) - An authentication bypass flaw in