Search — “dd”

Attackers using stolen CI credentials (bee-worker account) published bee-js 13.3.0 to npm and Swarm Desktop 0.56.2 via the project's signed build workflows. A loader fetches code from api.frameworkmetrics[.]xyz that exfiltrates config.yaml and swarm.key, installs a Go remote shell (evjawbreaker) on Linux/macOS under ~/.solidity with systemd/LaunchAgent persistence, and on Windows uses a UAC bypass, adds a Defender exclusion and installs a ScreenConnect client. No infection count or fund theft reported; hunt for npm postinstall network calls, ~/.solidity, the persistence units, and unexpected ScreenConnect services.

SEGA disclosed that its third-party newsletter provider ARARA suffered a breach exposing email addresses of 2.2 million SEGA newsletter subscribers across 11 newsletters, plus 92,300 records with further data still under review. ARARA reported a web server vulnerability and environment problems contributed, but the intrusion method and timing remain under investigation, and the attackers abused access to send over 7 million impersonation emails in late October. SEGA says it has no confirmed evidence of misuse, and the source provides no technical indicators or hunting guidance.

CISA added four vulnerabilities to the KEV catalog on 2026-11-09 with a 2026-11-12 due date: OpenSSH CVE-2026-123158 (authentication bypass on Linux builds, with Alpine/musl hosts named for update), GPUStack CVE-2026-102895 (unauthenticated admin access and secret disclosure), SignalWire FreeSwitch CVE-2026-116779 (code injection), and IBM Aspera Faspex CVE-2026-123218 (authenticated privilege escalation). The brief states GreyNoise observed a first confirmed successful exploitation of the OpenSSH flaw on Nov 7, but the CISA entries themselves print no exploitation details. Hunters should prioritize patch verification and review of OpenSSH authentication logs and GPUStack API activity.

Between Oct 14-26, 2026, an unknown actor used IAM credentials from Qubole's AWS account 805246085872 to assume trusted cross-account integration roles (with valid External IDs) in multiple customer AWS accounts, then enumerated resources, harvested secrets from Lambda env vars, Secrets Manager and SSM, validated found AWS/Entra ID/Okta credentials with TruffleHog, and exfiltrated S3 data. Wiz, Sentra and Mandiant confirm compromise of multiple victim environments. Hunt CloudTrail from Oct 1 for AssumeRole from 805246085872 with non-AWS sourceIPAddress, principal AIDA3W7DIFLYOLTK63SFS, session names starting quiam-, and TruffleHog user agents on GetCallerIdentity and IdP sign-ins.

Apple released security updates fixing two iMessage flaws (CVE-2026-113961 lets a remote attacker join a group chat and receive messages; CVE-2026-113960 exposes earlier messages to someone added to a group) and nine Bluetooth/AirPlay issues, with iOS/iPadOS 27.2.1 describing all three flaws. The sources state neither iMessage flaw has been confirmed exploited, and the notes do not say which devices are affected or offer workarounds. The updates also include a Google Brotli decoder fix (CVE-2026-111497) that is on CISA's KEV catalog, though the notes mention no attacks using it. No behavioral telemetry or hunting guidance is published, so the main action is patching.

Layer3 Intel reported six IP addresses on AS2650 (reserved for the Executive Office of the President) were used as residential proxy exit nodes by 28 proxy services between October 5 and November 3. Synthient attributes the traffic to Windows 11 machines running the InfaticaSDK, implying end-user devices on the network are infected with a proxy SDK. Hunters can look for InfaticaSDK-related network activity from Windows endpoints and unexpected residential proxy egress from enterprise address space.

LNbits, an open-source Bitcoin Lightning wallet system, told operators to shut down their servers after a wave of attacks, and its developers say patches are expected within 24-48 hours. One operator reports that new accounts used an exploit to withdraw about 2,285,545 satoshis from his server, and the exploited component is reported to be an unnamed extension, with the project not yet naming it, and a first warning pointed to the Paywall add-on as a possible source. Hunters should check LNbits deployments for extension activity and unexpected withdrawals, but the sources do not print any specific detection artifacts.

Connecticut, New Jersey, New York and Michigan AGs announced a $300,000 settlement with Perry Johnson Companies' medical transcription, coding and imaging subsidiaries over a March 2023 breach affecting more than 13 million people. According to the AGs, the intruder used an employee's credentials, the company lacked MFA, and the attacker harvested passwords and unencrypted patient files over roughly two months while monitoring software recorded but did not flag the activity. The firm was allegedly notified of the breach only by the hackers; the settlement requires MFA, encryption, password management and a formal security program, with an additional $9.7M payable on non-compliance. The source gives no technical IoCs or detection details.

D-Link disclosed multiple unpatched security flaws in DGS-3130-30TS managed switches, found by researcher Giresh Kumar Enugu in the D-Link Discovery Protocol (DDP) authentication, access control, and information handling. Per the source, exploitation could expose device data, allow unauthorized credential or configuration changes, leak SNMP communities, or cause resets; the sources report no confirmed exploitation. Hunters should watch switch logs for unexpected configuration changes, unprompted reboots, or factory resets, and DDP-related traffic.

Google DeepMind, with UC San Diego and Inria cryptographers, reports AI-agent-driven research lowering the cost of two attacks on 1024-bit RSA: a PKCS#1 v1.5 signature forgery (about 3.5x CPU reduction in a sandboxed test) and a multi-key factoring method (theoretically about 30x cheaper per additional key, not implemented). The sources state the keys were not factored and the signature attack requires roughly 4 billion signing queries in advance; they describe no in-the-wild activity. Relevance for defenders is inventory of legacy 1024-bit RSA keys and PKCS#11/HSM signing configurations, not hunting for adversary behavior.

Dr. Web reports a two-year campaign using malicious GitHub repositories (now posing as security tools such as an Fscan output parser, earlier as crypto and game tools) with code hidden behind whitespace in Visual Studio pre-build events, Python and Go files. PowerShell retrieves an encrypted link to an Electron loader 'Microsoft.exe' that persists, elevates, disables Smart App Control, unhooks ntdll, patches ETW and AMSI, adds Defender exclusions and injects into RegAsm.exe. Payloads are AsyncRAT, a crypto clipper and an infostealer that exfiltrates via a Telegram bot; Dr. Web says more than 2,000 Windows systems were compromised. Hunt for MSBuild or Visual Studio pre-build events spawning PowerShell, Microsoft.exe running outside system paths, RegAsm.exe making network connections, Defender exclusion changes and AV uninstall attempts.

Keplr wallets created with Google or Apple sign-in via Web3Auth had funds stolen after an attacker abused an undisclosed security flaw in Web3Auth's infrastructure, which both companies acknowledged. Neither company has disclosed how the flaw worked, when first used, or whether it is closed; Web3Auth paused its login and embedded wallet services. GoPlus estimated at least about $1 million stolen, while Bitquery counted $6.01 million moved into Web3Auth recovery wallets, which Web3Auth says were rescue transfers. Hunting guidance is limited to user-side guidance: avoid re-importing or recreating affected accounts and move funds to seed-phrase or hardware wallets.

Japanese manufacturer Iris Ohyama, operator of the Iris Plaza online store, disclosed that unauthorized third-party access to an external cloud service it uses may have exposed personal data of up to about 7.7 million people, including names, addresses, contact details, dates of birth, and account passwords for some members. The company said it suspended the store and related systems, reported to Japan's Personal Information Protection Commission and police, and as of November 5 had received no reports of misuse; no attacker communications or perpetrators were identified. The sources give no technical details of the intrusion, so hunters have no published behaviors or indicators to act on.

QNAP reports customer NAS devices appear compromised through the Plex2Shell vulnerability chain in Plex Media Server, with QNAP Technical Support assisting affected users. The chain comprises CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, and CISA added all four to KEV on October 20, 2026. Hunters should review Plex Media Server exposure on QNAP NAS devices and look for signs of compromise listed in QNAP's bulletin, which the source does not print inline; updating does not remove existing payloads.

CISA added CVE-2026-19868 to the KEV catalog on 2026-11-06 with a 2026-11-20 due date. The catalog describes SonicWall SonicOS SSLVPN as contains a use of single-factor authentication vulnerability allowing a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, which may also bypass SAML-enforced MFA. The sources provided do not describe observed attacker behavior or detection content, so hunters should focus on SSLVPN authentication logs for SAML bypass patterns and apply the vendor fix.

Chainalysis said an agentic cyber attack led to an on-path attack that exposed a subset of customer passwords, and that its investigation also exposed names, usernames, password hashes and live tokens for all users. The company removed access to Reactor and Data Solutions, took KYT offline, locked impacted accounts, and said it has no evidence investigation data was accessed or attribution data manipulated. Customers should reset passwords, rotate API keys, and reuse trusted-IP allowlisting for access restoration; hunters should watch for reuse of stolen credentials against Chainalysis services and related cloud tenants.

Apiiro reports that when users approve an exact shell command with "Yes, and don't ask again," Claude Code saves the command word-for-word, including any embedded password or token, in .claude/settings.local.json. Its search of public GitHub found 1,122 copies holding at least one secret, though the researchers did not test whether the secrets still work and do not say whether anyone has used them. Hunters should look for secrets inside Bash allow rules in .claude/settings.local.json and .claude/settings.json in repositories and developer endpoints, and rotate any exposed credentials.

Microsoft reports ~7.3B email phishing threats in Q3 2026, dominated by credential theft, with SVG-driven CAPTCHA-gated phishing rebounding and spoofed business-service domains often delivered due to tenant/user overrides. Two campaigns are detailed: an Aug 19 'Salary Review' DOCX QR-code lure leading to device code phishing against US legal organizations, and a Sep 21 Spanish-language purchase order/payroll campaign attempting to deliver Agent Tesla via RAR archives with double extensions (.pdf.js downloader fetching Lincoln.ps1 from Firebase Storage, or .xml.exe). Microsoft does not report confirmed compromises from these campaigns; hunt for device code sign-ins following email delivery, script hosts spawning PowerShell, and the listed sender addresses.

MetaMask (developed by Consensys) disclosed an infrastructure security incident in which a threat actor gained access to systems used to store recipient addresses and diverted some execution-layer staking rewards, about 0.385 ETH. The company says the staked principal, withdrawal keys, Secret Recovery Phrases, and private keys were not compromised, and it exited affected validators as a precaution, causing some withdrawal delays. The sources describe no technical indicators, so hunters have no concrete behaviors to target from this item.

Scammers call victims with spoofed numbers impersonating a mobile provider (Rogers is cited), collect personal information for credit checks, and order a new phone in the victim's name. A follow-up call claims a shipping mistake and instructs the victim to return the device using a label or QR code supplied by the caller, which routes the package to an address chosen by criminals rather than the provider. Victims are left owing for devices the provider never received; hunting value is limited to customer-facing fraud reporting, as the source describes no technical intrusion.

DigiCert disclosed that a February 2025 server migration exposed an internal business system, previously reachable only via VPN, to the internet. An unauthorized external account created through a self-registration feature had read-only access to archived customer data from June 27 to July 2, 2026, per the company's investigation confirmed October 19. Exposed data included names, business emails, phone numbers, addresses, and in some cases identification documents; DigiCert states CertCentral, DigiCert ONE, and issued certificates were not compromised. Hunters should watch for phishing that uses validation details, as the brief advises.

Attackers modified four JavaScript files on Level Infinite's official CDN (from Sept 27, 2026) used by the Goddess of Victory: NIKKE PC launcher, injecting an obfuscated loader that pulled code from insightjs[.]com / insightjs[.]org. Per researcher MotherSphere, the code abused launcher functionality to run a LuaJIT payload (insight.bundle) that installed the K2F remote-access agent. K2F could execute commands, steal files, screenshots, browser data and credentials, and optionally drop platform_experience_helper.dll with crypto-wallet theft code; whether the DLL was deployed or crypto stolen is unknown. Hunt for DNS/proxy traffic to the insightjs domains, the k2f_chan string in Launcher/intl_service/debug.log, and platform_experience_helper.dll on endpoints.

Check Point Research disclosed a Codex jailbreak bundle called Haiou that persistently modifies the Codex agent's global instruction and configuration files so that greetings or activation words trigger advertisements for a third-party OpenAI-compatible LLM gateway. The bundle is distributed via a GitHub repository 'haiou-codex' and bundled within the open-source Codex-X tool. The sources describe configuration-level changes rather than a traditional executable payload and do not report any confirmed compromises; hunters could look for unexpected edits to Codex global instruction files and references to the advertised domain.

CISA added CVE-2024-27834, a medium-severity Apple improper authentication (Pointer Authentication bypass) flaw, to its KEV catalog after reports of active exploitation. Sekoia reported that possibly Russia-linked actors, attributed by the source to APT29 with moderate to high confidence, used the flaw alongside previously patched Safari and Chrome vulnerabilities to serve JavaScript that profiles visitors and deploys browser-cookie-stealing malware. Access came via compromised legitimate websites, fake lookalike sites, and a supply-chain attack on Plerdy SEO Tracker. The source does not print specific hunting artifacts, so defenders should focus on patch status for listed Apple builds and on web-based delivery and browser cookie theft behavior.

CERT-In reports an active AI-assisted actor, Crafty Falcon, using offensive AI tools (ARTEX, PentAGI, Cairn, CyberStrikeAI) against Indian BFSI, fintech and crypto firms, stealing payment gateway/partner-bank API credentials and invoking fund-transfer APIs from victims' allow-listed infrastructure, with theft of keys and funds reported. Tactics include web shells via file-upload/deserialization chains in PHP and Node.js apps, stolen static API tokens, plaintext creds in configs, micro-value test transactions, log deletion and endpoint security tampering. Separately, a copycat ARTEX GitHub repo pulls the backdoored Docker image tomicdd/artex, whose login handler runs a CAPTCHA field beginning with a secret marker through sh -c as root; 62 internet consoles served it. Hunt for web shells, anomalous fund-transfer/settlement API calls and Rs.1 test transactions, log clearing, and any deployment of artex images.

DreamHost says an unauthorized third party accessed the server running its web-based File Manager at files.dreamhost.com between August 2026 and October 23, 2026, exploiting a vulnerability in that software. The intruder obtained FTP/SFTP usernames and passwords of users who logged into File Manager during that window and may have accessed webmail session information for a limited number of users. The sources report no confirmed access to control panel logins or billing data, and DreamHost says the access was blocked and the vulnerability addressed; hunters should review File Manager server logs, FTP/SFTP auth logs, and webmail forwarding rules.

Krebs on Security, citing Layer3 Intel and Synthient, reports that residential proxy nodes beaconed from the Executive Office of the President network (AS2650) and exited from it 236 times between October 5 and November 3. Layer3 Intel says 28 residential proxy services could exit through this network, and Synthient links the activity to Windows 11 installations of Infatica, an SDK-embedded proxy program. The sources describe a proxy-abuse exposure rather than an intrusion, so hunters should look for unexpected residential proxy software and SDK-bundled applications on government endpoints.

Meta disclosed roughly $1.2 million in bug bounty payouts for its Muse personal AI agent, including $300,000 for a pre-launch authentication bypass. The flaw treated a header added by a local HTTPS proxy as proof of a trusted source, and a later system migration added a second proxy layer so outside requests could carry the trusted header; the researcher demonstrated access to conversations and tokens on pre-release VMs used by Meta staff. Meta says it took the service offline, fixed the bug, and stopped treating the local machine as trusted, so hunters on this story have no public detection content to act on.

Google's November 2026 Android security bulletins fix more than 200 flaws across two patch levels (2026-11-01 and 2026-11-05). The most severe is CVE-2026-58868, a critical Framework component issue that the vendor says could lead to remote code execution without user interaction or additional execution privileges. The sources describe no observed exploitation and print no detection artifacts, so hunting guidance is limited to confirming devices are at patch level 2026-11-05 or later.

BTCPay Server, a self-hosted cryptocurrency payment processor, says attackers stole Bitcoin and Litecoin from hot wallets on servers running 2.4.1 or earlier, and Bitquery reports about $1.62M (18.38 BTC and 3,405 LTC) across 682 sweeps. The sources do not name the exploited vulnerability or describe the attacker's on-host actions; they say the earlier August issue exposed .macaroon files, but it is unclear if the new attacks are related. Hunters should look for unexpected outbound wallet sweeps from hot wallets on BTCPay instances and treat older servers as compromised, using the published wallet addresses for matching.