BlueNoroff, a threat actor, uses a phishing kit disguised as Zoom to identify high-value cryptocurrency wallets before delivering malware. The kit profiles wallet contents to target victims selectively, increasing the efficiency of their attacks. This highlights the growing sophistication of crypto-themed phishing campaigns.

Security researchers discovered an exploit in Certighost that enables low-privileged Active Directory users to impersonate a domain controller. This vulnerability could allow attackers to escalate privileges and compromise network security. It is critical for organizations to patch or mitigate this issue promptly to prevent unauthorized access.

A security vulnerability in ChatGPT's AgentForger feature could allow attackers to trick users into deploying malicious workspace agents through a phishing link. This flaw exploits the tool's agent creation capability, potentially leading to unauthorized access and data compromise. The discovery highlights the need for stronger security measures in AI-driven productivity tools.

A security flaw in Bing Images allows attackers to craft SVG files that can execute arbitrary commands with SYSTEM-level privileges on Microsoft's servers. The vulnerability could be exploited to compromise server integrity and access sensitive data. Microsoft has been notified and is expected to issue a patch.

A hacker deployed the Hermes AI agent to autonomously carry out post-exploitation activities at the Thai Ministry of Finance. This incident marks an advanced use of artificial intelligence in cyberattacks, allowing the attacker to operate without direct oversight. It highlights growing risks of AI-driven tools in targeted government breaches.

Security researchers report that threat actors known as Kimi K3 discovered multiple zero-day vulnerabilities in the Redis database system. They then developed a remote code execution (RCE) exploit targeting these flaws. This is significant because Redis is widely used for caching and data storage, making many systems potentially vulnerable to attack.

A security flaw in Anthropic's Claude Cowork feature could allow an AI agent to break out of its virtual machine and access files on a Mac system. The vulnerability, if exploited, could lead to unauthorized data exposure. Users should apply patches promptly.

A threat actor linked to China, known as JadeProx, has been using a new malware loader called TriBack to target government and healthcare organizations. The loader enables remote access and data theft, posing a serious risk to critical infrastructure and sensitive data. This development underscores ongoing cyber espionage efforts by state-affiliated groups.

US cybersecurity agencies, including CISA, NSA, FBI, and international partners, have issued a warning about ongoing malicious cyber activity by Russian state-supported actors targeting Zimbra Collaboration Suite users. The threat involves exploitation of vulnerabilities to gain unauthorized access to email and sensitive data. This alert underscores the persistent risk of nation-state cyber espionage against widely used collaboration platforms.