GBHackers Security | #1 Globally Trusted Cyber Security News Platform

Malicious AI Agents Attempt Reverse Shells, Credential Theft, and Persistent SSH Access

Mayura Kathir — Thu, 16 Jul 2026 07:44:30 +0000

AI agents are increasingly crossing the line from generating content to executing actions inside developer workstations, cloud environments, and enterprise systems. New telemetry from Gen’s H1 2026 Threat Report shows that agent runtime controls detected attempts involving reverse shells, credential-file access, API-key discovery, destructive commands, and SSH persistence mechanisms. The activity does not necessarily mean […]

The post Malicious AI Agents Attempt Reverse Shells, Credential Theft, and Persistent SSH Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

F5 Fixes 3 NGINX Flaws Enabling Potential Remote Code Execution, Memory Disclosure, and DoS Attacks

Divya — Thu, 16 Jul 2026 06:53:08 +0000

F5 has issued security advisories for three vulnerabilities affecting NGINX Plus and NGINX Open Source. These flaws could allow unauthenticated attackers to trigger crashes in worker processes, disclose limited memory contents, or potentially execute code under specific conditions. The vulnerabilities, identified as CVE-2026-56434, CVE-2026-42533, and CVE-2026-60005, impact the data-plane request processing of NGINX rather than […]

The post F5 Fixes 3 NGINX Flaws Enabling Potential Remote Code Execution, Memory Disclosure, and DoS Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Kratos PhaaS Targets Microsoft 365 Users With SharePoint Links and Cloudflare Anti-Bot Checks

Mayura Kathir — Thu, 16 Jul 2026 06:36:15 +0000

Kratos, a subscription-based phishing-as-a-service platform, is targeting Microsoft 365 users in the United States, Europe, and other regions through campaigns designed to blend into ordinary document-sharing workflows. The operation abuses trusted services, including Microsoft SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and systeme.io, to deliver links that ultimately redirect recipients to credential-harvesting pages. Only 156 sessions […]

The post Kratos PhaaS Targets Microsoft 365 Users With SharePoint Links and Cloudflare Anti-Bot Checks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

GPT-5.6 Sol Ultra Writes Complete Chrome Exploit With V8 Sandbox Escape

Divya — Thu, 16 Jul 2026 06:26:46 +0000

A security researcher reported that the GPT-5.6 Sol Ultra model successfully produced a working renderer exploit for Chrome version 149.0.7827.201. This exploit utilized V8 version 14.9.207.35. The model reportedly combined multiple patched issues in the JavaScript engine and WebAssembly infrastructure, ultimately launching the macOS Calculator application from within a sandboxed Chrome renderer process. GPT-5.6 Sol […]

The post GPT-5.6 Sol Ultra Writes Complete Chrome Exploit With V8 Sandbox Escape appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

LLM-Assisted TuxBot Botnet Targets IoT Devices Across 17 Processor Architectures

Mayura Kathir — Thu, 16 Jul 2026 06:11:24 +0000

TuxBot v3 Evolution, a modular IoT botnet framework capable of infecting devices running architectures ranging from ARM and MIPS to x86_64, PowerPC and RISC-V. The platform appears designed for mass compromise, persistence and distributed denial-of-service operations, with a C-based bot agent and a Go-based command-and-control server. Palo Alto Networks Unit 42 said it recovered the […]

The post LLM-Assisted TuxBot Botnet Targets IoT Devices Across 17 Processor Architectures appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers Use Google Ads and Claude AI Chats to Steal macOS Credentials and Crypto Wallets

Divya — Thu, 16 Jul 2026 05:45:33 +0000

Threat actors have exploited Google Ads and Anthropic’s Claude shared-chat feature to distribute the MacSync Stealer to macOS users. They used a social engineering technique called ClickFix, designed to steal credentials, browser data, cloud keys, sensitive files, and cryptocurrency wallets. According to Zscaler Threat Hunting, this campaign took place between June 12 and June 19, […]

The post Hackers Use Google Ads and Claude AI Chats to Steal macOS Credentials and Crypto Wallets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cursor 0-Day Flaw Executes Malicious git.exe From Repositories Without User Interaction

Divya — Thu, 16 Jul 2026 05:12:17 +0000

Cursor users on Windows may be at risk of arbitrary code execution following Mindgard’s disclosure of a zero-day vulnerability. This flaw allows the AI-powered integrated development environment (IDE) to automatically execute a malicious git.exe file located at the root of an open repository. According to research published by Aaron Portnoy on July 14, 2026, this […]

The post Cursor 0-Day Flaw Executes Malicious git.exe From Repositories Without User Interaction appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

China-Linked Daxin Backdoor Resurfaces in Taiwan Alongside New STUPIG SYSTEM-Level Malware

Mayura Kathir — Thu, 16 Jul 2026 05:10:25 +0000

The China-linked Daxin backdoor has resurfaced in an active intrusion targeting a Taiwan-based subsidiary of a multinational high-tech manufacturer, exposing the enduring reach of an espionage operation first publicly detailed in 2022. Daxin’s return is significant because the malware was already regarded as an unusually sophisticated implant built for stealthy, long-term access to hardened networks. […]

The post China-Linked Daxin Backdoor Resurfaces in Taiwan Alongside New STUPIG SYSTEM-Level Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Russian-Speaking Hacker Uses Gemini CLI to Deploy C2 Botnet in Six Minutes

Mayura Kathir — Wed, 15 Jul 2026 13:16:00 +0000

A Russian-speaking threat actor tracked as “bandcampro” used Google Gemini CLI as an end-to-end operational assistant to migrate a command-and-control server, deploy a replacement VPS, configure Cloudflare tunnels, and restore control of compromised endpoints within six minutes. The findings are based on an analysis of Gemini CLI session logs spanning March 19 through April 21, […]

The post Russian-Speaking Hacker Uses Gemini CLI to Deploy C2 Botnet in Six Minutes appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

OkoBot Malware Uses ClickFix and SeedHunter to Steal Ledger and Trezor Seed Phrases

Mayura Kathir — Wed, 15 Jul 2026 12:46:03 +0000

A newly documented malware framework dubbed OkoBot is targeting cryptocurrency users with a multi-stage intrusion chain designed to capture Ledger and Trezor recovery phrases, browser credentials, wallet files, keystrokes, screenshots, and application video recordings. Researchers first observed the activity in January 2026, although the campaign’s TookPS downloader component has been active since March 2025. The […]

The post OkoBot Malware Uses ClickFix and SeedHunter to Steal Ledger and Trezor Seed Phrases appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.