GBHackers Security | #1 Globally Trusted Cyber Security News Platform https://gbhackers.com/ GBhackers Offering Exclusive Cyber Security News Coverage, New Research papers & Technology Updates. Mon, 14 Sep 2026 09:27:45 +0000 en-US hourly 1 https://gbhackers.com/wp-content/uploads/2024/09/cropped-gbh-32x32.png GBHackers Security | #1 Globally Trusted Cyber Security News Platform https://gbhackers.com/ 32 32 236592110 Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities https://gbhackers.com/cyclops-blink-variant/ https://gbhackers.com/cyclops-blink-variant/#respond Mon, 14 Sep 2026 09:27:43 +0000 https://gbhackers.com/?p=199354 A newly identified Cyclops Blink variant has resurfaced on compromised Cisco Secure Firewall Management Center (FMC) appliances, adding active internal-network scanning and programmable packet-sniffing capabilities to an already mature modular implant. Assessed with high confidence that the activity has a Russian nexus, with a moderate-confidence link to IRON VIKING also tracked as Sandworm and Seashell […]

The post Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> https://gbhackers.com/cyclops-blink-variant/feed/ 0 199354 China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor https://gbhackers.com/grayrabbit-backdoor/ https://gbhackers.com/grayrabbit-backdoor/#respond Mon, 14 Sep 2026 08:09:26 +0000 https://gbhackers.com/?p=199335 China-linked threat actors tracked as UNC3569 have exploited a critical one-click remote code execution vulnerability in Tencent’s Sogou Input Method for Windows to deploy the GRAYRABBIT backdoor on targeted systems. Tracked as CVE-2026-51990, the vulnerability chains an insecure custom protocol handler, unrestricted embedded-browser navigation, and an obsolete Chromium build running without sandbox protections. Tencent addressed […]

The post China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> https://gbhackers.com/grayrabbit-backdoor/feed/ 0 199335 Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users https://gbhackers.com/casbaneiro-banking-trojan/ https://gbhackers.com/casbaneiro-banking-trojan/#respond Mon, 14 Sep 2026 05:56:58 +0000 https://gbhackers.com/?p=199322 A Casbaneiro banking Trojan campaign targeting users across Latin America, using phishing lures, geofenced delivery infrastructure, and distributed command-and-control (C2) servers to obscure malicious activity. The operation, observed in August 2026, primarily targets victims in Argentina, Peru, Colombia, and Mexico through fake invoice and legal-notice emails carrying links to malicious PDF files. The campaign demonstrates […]

The post Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> https://gbhackers.com/casbaneiro-banking-trojan/feed/ 0 199322 AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process https://gbhackers.com/asyncrat-in-hides-windows-process/ https://gbhackers.com/asyncrat-in-hides-windows-process/#respond Mon, 14 Sep 2026 05:24:48 +0000 https://gbhackers.com/?p=199311 A five-stage AsyncRAT campaign that chains a socially engineered batch file, hidden PowerShell execution, AutoIt abuse and process injection to conceal a .NET remote-access trojan inside Microsoft’s legitimate charmap.exe process. The infection begins with a lure named “Right-click to open Invoice Details.bat”, which relies on user interaction to trigger execution. While the precise delivery method […]

The post AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> https://gbhackers.com/asyncrat-in-hides-windows-process/feed/ 0 199311 Threat Actors Use Claude AI Agents to Automate Cyberattacks and Steal Sensitive Data https://gbhackers.com/threat-actors-use-claude-ai-agents-to-automate-cyberattacks-and-steal-sensitive-data/ https://gbhackers.com/threat-actors-use-claude-ai-agents-to-automate-cyberattacks-and-steal-sensitive-data/#respond Sat, 12 Sep 2026 08:40:16 +0000 https://gbhackers.com/?p=199295 Threat actors are increasingly using Claude-based AI workflows to automate cyberattacks, accelerate data theft, and reduce the technical expertise needed to run complex intrusions. Anthropic’s report details cyber espionage, financially motivated extortion, supply-chain compromise, and hacktivist activity disrupted between December 2025 and August 2026. Rather than using an AI chatbot only for occasional coding assistance, […]

The post Threat Actors Use Claude AI Agents to Automate Cyberattacks and Steal Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> https://gbhackers.com/threat-actors-use-claude-ai-agents-to-automate-cyberattacks-and-steal-sensitive-data/feed/ 0 199295 China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks https://gbhackers.com/china-linked-hackers-chain-chrome-zero-day/ https://gbhackers.com/china-linked-hackers-chain-chrome-zero-day/#respond Sat, 12 Sep 2026 08:04:47 +0000 https://gbhackers.com/?p=199288 China-linked threat actors UTA0560 and JungleBamboo chained a Google Chrome zero-day with a Windows kernel privilege-escalation flaw in phishing campaigns targeting NGOs and other victims. Volexity documented the operations, detected on September 1, 2026, as using identical browser-to-kernel exploit components but ultimately installing separate espionage payloads: the GRIMWEDGE JScript backdoor and the LONGTALE credential-stealing Chrome […]

The post China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> https://gbhackers.com/china-linked-hackers-chain-chrome-zero-day/feed/ 0 199288 New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets https://gbhackers.com/new-phishing-campaign-abuses-windows-mshta-exe/ https://gbhackers.com/new-phishing-campaign-abuses-windows-mshta-exe/#respond Sat, 12 Sep 2026 06:16:51 +0000 https://gbhackers.com/?p=199278 A newly identified phishing campaign is abusing the legitimate Windows utility mshta.exe to execute malicious HTML Application (HTA) files, conduct system reconnaissance, and potentially deploy payloads designed to steal credentials and local secrets. Fortra’s Intelligence and Research Experts (FIRE) said the activity began in June and remains active, with operators regularly recompiling malware samples to […]

The post New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> https://gbhackers.com/new-phishing-campaign-abuses-windows-mshta-exe/feed/ 0 199278 OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE https://gbhackers.com/openai-agents-flood-rubygems-with-2000-packages/ https://gbhackers.com/openai-agents-flood-rubygems-with-2000-packages/#respond Sat, 12 Sep 2026 06:03:55 +0000 https://gbhackers.com/?p=199273 A swarm of AI agents believed to be operated internally by OpenAI uploaded more than 2,000 malicious packages to RubyGems in May 2026, abusing the ecosystem’s documentation build process to execute code remotely and attempting to steal user API keys through a then-undisclosed server-side flaw. Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said […]

The post OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> https://gbhackers.com/openai-agents-flood-rubygems-with-2000-packages/feed/ 0 199273 CISA Warns of Critical GitLab Vulnerability Exploited in Attacks https://gbhackers.com/cisa-warns-of-critical-gitlab-vulnerability-exploited-in-attacks/ https://gbhackers.com/cisa-warns-of-critical-gitlab-vulnerability-exploited-in-attacks/#respond Sat, 12 Sep 2026 05:17:40 +0000 https://gbhackers.com/?p=199269 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical GitLab flaw, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog after confirming it was exploited in attacks. The issue affects both GitLab Community Edition and Enterprise Edition and requires urgent mitigation, particularly for internet-accessible GitLab instances. CVE-2026-85706 is a path traversal vulnerability […]

The post CISA Warns of Critical GitLab Vulnerability Exploited in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> https://gbhackers.com/cisa-warns-of-critical-gitlab-vulnerability-exploited-in-attacks/feed/ 0 199269 Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign https://gbhackers.com/10000-malware-loaders/ https://gbhackers.com/10000-malware-loaders/#respond Fri, 11 Sep 2026 12:24:51 +0000 https://gbhackers.com/?p=199254 A long-running pay-per-install (PPI) operation that used YouTube gaming channels and SEO-poisoned software downloads to distribute malware at scale. The cluster, tracked as CL-CRI-1171, is linked to more than 10,000 distinct samples of a custom loader called OfferLoader, indicating a distribution pipeline far larger than the individual intrusions initially observed. Rather than relying on a […]

The post Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

]]> https://gbhackers.com/10000-malware-loaders/feed/ 0 199254