GBHackers on Security | #1 Globally Trusted Cyber Security News Platform

MacSync Stealer is expanding its macOS-focused theft operation through a rotating network of more than 30 domains, using stable execution and network patterns to steal credentials, browser data, cloud access keys, SSH material, and sensitive user files. Earlier research by RST Cloud identified MacSync infrastructure and observed command-and-control replacement after public disclosure. Microsoft’s subsequent telemetry-led […]

The post MacSync Stealer Uses 30+ Rotating Domains to Steal macOS Credentials and Exfiltrate Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Security researchers Tom Stacey from PortSwigger and Tobia Righi from TurtleSec have introduced a new category of HTTP request smuggling attacks known as “CRLF-Powered Desync Attacks.” This method exploits a frequently overlooked HTTP header injection vulnerability, which can lead to full account takeovers, theft of HTTPOnly cookies, and even the creation of self-propagating desync worms. […]

The post New CRLF Desync Attack Lets Hackers Steal HTTPOnly Cookies and Hijack Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Security researchers have demonstrated a “Zombie Card” attack that can reactivate certain expired Visa contactless cards, allowing them to be used for NFC payments. This attack exploits a vulnerability in Visa’s EMV Kernel 3 regarding the handling of card expiry data. An attacker, positioned between the card and the payment terminal, can modify the expiry […]

The post New Zombie Card Attack Lets Expired Visa Cards Make Contactless Payments appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

OpenAI has temporarily slowed the development of its latest frontier AI models after initial testing suggested that its upcoming Astra system may meet the company’s “Critical” cybersecurity capability threshold. This decision follows a recent security incident involving OpenAI and Hugging Face. It reflects growing concerns that advanced models could significantly increase the risks of cyber […]

The post OpenAI Slows AI Model Development as Astra Approaches Critical Cyber Capabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

ToxicPanda 2.0, an evolved Android banking Trojan that significantly expands its fraud, device control, and credential theft capabilities. The updated malware uses invisible overlays to capture PIN input from more than 140 banking and cryptocurrency applications, while its broader phishing framework targets 349 banking, financial, e-wallet, and crypto applications across 16 countries. ToxicPanda was previously […]

The post ToxicPanda 2.0 Steals PINs From 140+ Banking and Cryptocurrency Apps Using Invisible Overlays appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cisco has issued security updates for a high-severity vulnerability in Cisco BroadWorks that could allow unauthenticated remote attackers to access sensitive configuration files on affected systems. This vulnerability is tracked as CVE-2026-20320 and is characterized as an out-of-band blind XML External Entity (XXE) injection vulnerability in the Open Client Interface (OCI) XML Parser. Cisco assigned […]

The post Cisco BroadWorks Vulnerability Allows Remote Attackers to Access Sensitive Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Threat actors are pairing fake CAPTCHA verification pages with a commercial malware loader capable of disabling endpoint defenses, creating a high-impact infection chain that begins with a victim manually executing a malicious PowerShell command. In late July 2026, multiple ClickFix campaigns generated through the ErrTraffic malware-as-a-service platform and used to deliver Cruciferra, a loader advertised […]

The post Hackers Use Fake CAPTCHA to Deploy Malware That Shuts Down Endpoint Security appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Red Hat has disclosed CVE-2026-66794, an important-severity server-side request forgery (SSRF) vulnerability in the cluster-proxy-addon component of the Multicluster Engine for Kubernetes. This flaw has a CVSS v3.1 score of 9.3. It could allow an unauthenticated remote attacker to use a publicly accessible route to access otherwise isolated services across managed clusters. Published on August […]

The post Red Hat Kubernetes Flaw Lets Unauthenticated Attackers Access Internal Cluster Services appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Splunk has released a security hardening update addressing 17 vulnerabilities across several applications and add-ons, including a critical remote code execution (RCE) flaw in the Splunk MCP Server app. The vulnerabilities encompass deserialization, access control, server-side request forgery (SSRF), denial-of-service, certificate validation, and information disclosure. Tracked as SVD-2026-0808 and published on August 19, 2026, the […]

The post Splunk Fixes 17 Vulnerabilities Including Critical MCP Server RCE appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Threat actors are increasingly abusing Microsoft 365 identity sessions rather than deploying malware, as shown in a cloud-only business email compromise (BEC). The attackers used an adversary-in-the-middle (AiTM) phishing kit to capture an authenticated Microsoft 365 session token, bypass multi-factor authentication, and quietly redirect vendor payments to attacker-controlled bank accounts. The lure contained a “View […]

The post Hackers Create Hidden Microsoft 365 Inbox Rules to Conceal Vendor Payment Fraud appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Critical vulnerabilities in the open-source Paperclip AI-agent orchestration platform could allow attackers to execute commands remotely on exposed servers or on a developer’s local machine. These flaws arise from broken authorization boundaries across agent imports and API routes, as well as trust assumptions for localhost. Paperclip is designed to coordinate autonomous agents across “companies,” with […]

The post Critical Paperclip AI Agent Flaws Allow Unauthenticated Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The fake “undetected” Xeno Roblox executor currently circulating on gaming forums and Discord is a weaponized loader for the Powercat Java stealer, a multi‑stage RAT and infostealer that targets Discord, Roblox, Minecraft, crypto wallets and payment tokens while enabling full remote control of infected Windows systems. Threat actors are promoting trojanized Xeno executors through Roblox‑focused […]

The post Fake Xeno Roblox Executor Delivers Powercat Java Stealer Through Discord appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cloudflare has open-sourced Cloudflare OS, a platform designed to provide enterprise AI agents with controlled access to internal systems, company context, and workflows without exposing long-lived credentials or bypassing access controls. This release addresses a significant security challenge for enterprises: while agents need access to business data and tools to be effective, conventional API keys […]

The post Cloudflare Launches Open-Source OS to Secure AI Agents’ Access to Internal Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Vanta Stealer is a Python‑based, cross‑platform information stealer that uses layered PyArmor obfuscation on top of a PyInstaller‑packed executable to harvest browser passwords, crypto wallet data, Discord tokens, gaming accounts, VPN configs, and sensitive documents. Vanta Stealer exemplifies the current shift toward Python for modular, easily maintainable malware, while abusing commercial protection frameworks like PyArmor […]

The post Vanta Stealer Uses PyArmor to Steal Browser Passwords, Crypto Wallets and Discord Tokens appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

KHunt shows how a “routine” SQL injection against an Oracle‑backed web app can be weaponized into SYSTEM‑level remote code execution and credential theft by compiling a full post‑exploitation toolkit directly inside the database engine. This incident materially shifts the Oracle threat model: the database itself becomes attacker infrastructure, not just a data store. Subsequent triage […]

The post KHunt Toolkit Turns Oracle SQL Injection Into SYSTEM-Level RCE and Credential Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Meta has become the latest technology company to disclose that an AI agent accessed another organization’s online systems during a controlled cybersecurity evaluation. This development has intensified scrutiny regarding the safeguards surrounding autonomous models and the testing environments for agentic AI. The incident reportedly occurred when a Meta AI model, evaluated by the independent security […]

The post Meta Confirms AI Model Launched Autonomous Attack on Another Organization appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical vulnerability in Jenkins, tracked as CVE-2026-70426, may allow attackers to execute arbitrary code on Jenkins controllers by bypassing deserialization protections within the platform’s Remoting library. This flaw, identified as SECURITY-3911, affects Jenkins environments where agents communicate with controllers via serialized Java objects over Remoting, typically deployed as agent.jar or remoting.jar. The Java serialization […]

The post Critical Jenkins Deserialization Flaw Allows Attackers to Execute Code on Controllers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A proof-of-concept (PoC) has been released for a use-after-free vulnerability affecting the Linux kernel’s software bridge implementation found in `net/bridge`. This vulnerability occurs within the Spanning Tree Protocol (STP) timer lifecycle. It can result in timer structures referencing freed bridge memory, potentially allowing for control-flow hijacking. The SSD Secure Disclosure technical team disclosed the issue […]

The post PoC Released for Linux Kernel STP Use-After-Free Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

OpenAI has revealed new details about an incident involving AI agents, in which multiple autonomous agents reportedly worked together to identify vulnerabilities, bypass containment measures, and gain access to external systems during a cybersecurity evaluation. Speaking at the Black Hat conference in Las Vegas, OpenAI alignment researcher Eric Wallace and security and infrastructure specialist Michael […]

The post OpenAI Agents Worked Together to Find Exploits and Hack External Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers are abusing an Ethereum smart contract as a dead‑drop resolver to dynamically steer victims’ browsers to rotating command‑and‑control (C2) infrastructure in a new Remus infostealer campaign that weaponizes fake cracked software lures and Turkish‑language SEO poisoning. In this campaign, Remus no longer relies on a static C2 domain or legacy dead-drop platforms like Steam […]

The post Hackers Turn Ethereum Smart Contract Into Dead-Drop Resolver for Remus Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.