GBHackers Security | #1 Globally Trusted Cyber Security News Platform

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Eswar — Sat, 17 Oct 2026 12:27:27 +0000

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise to shut off application access and interrupt backup services. Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16, exposing risks associated with privileged vendor applications. ConnectWise said in its October 17 update, supplied for […]

The post Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Eswar — Sat, 17 Oct 2026 09:07:04 +0000

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds for five NIST elliptic curves in under 30 minutes, addressing a cryptographic mystery spanning roughly 25 years. Its October 16 report attributes the seeds to a standard C pseudorandom number generator initialized with Unix timestamps, rather than secret passphrases. Despite […]

The post Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Eswar — Sat, 17 Oct 2026 08:47:31 +0000

Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to analysis by Seqrite researcher Amruta Wagh. Dubbed WP2Shell, the exploit chain reportedly emerged in July 2026 and combines REST API route confusion with SQL injection, allowing attackers to progress from public endpoints to server compromise without possessing valid WordPress credentials. […]

The post Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

Eswar — Sat, 17 Oct 2026 08:34:43 +0000

A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a separate out-of-bounds write to obtain root privileges. Calif researcher Andrew Griffiths published the “Big Fish” research on October 16, 2026, alongside public proof-of-concept code demonstrating exploitation with multiple kernel security protections enabled. The oldest vulnerability traces to a shared memory […]

The post OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

Eswar — Sat, 17 Oct 2026 08:26:30 +0000

GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises malicious JavaScript as a font file and targets developer workstations through Visual Studio Code tasks. Jenn Gile identified 94 compromised repositories belonging to 66 owners, confirming the payload in all 79 repositories available for analysis. The remaining 15 were inaccessible. […]

The post GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Eswar — Sat, 17 Oct 2026 08:06:13 +0000

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with spear-phishing attacks that deploy ReverseRAT on Windows systems. The October 15, 2026, advisory classifies the threat as medium severity and highlights malware that can steal passwords, capture screenshots, and collect sensitive information. The campaign combines deceptive attachments, malicious Windows shortcuts, […]

The post SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs

Mayura Kathir — Sat, 17 Oct 2026 07:14:15 +0000

A new GhostBat RAT variant targets 60 Android financial application packages used in India, combining accessibility-based PIN capture with a transparent overlay that intercepts interactions inside legitimate Google Pay and MobiKwik interfaces. The findings extend Cyble’s October 2025 investigation, which documented GhostBat spreading through fraudulent mParivahan applications, harvesting banking messages, and stealing UPI PINs through […]

The post New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads

Mayura Kathir — Sat, 17 Oct 2026 06:54:51 +0000

ROMULUS, a shared ClickFix delivery platform operating across six identified servers, with confirmed routes distributing a trojanized Stardock package and LegionLoader. The discovery connects infrastructure from a recently documented ChatGPT Custom GPT abuse campaign to an independently investigated incident, exposing a reusable backend capable of delivering different malicious payloads. The investigation began after researchers found […]

The post New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure

Mayura Kathir — Sat, 17 Oct 2026 06:26:17 +0000

A server linked to a malware campaign attributed to a Midnight Blizzard-associated cluster was still delivering malicious files on October 5, 2026. The server returned HTTP 200 responses for multiple payload paths, including one used by simple Windows Internet Shortcut files to launch a PowerShell stager. The finding shows that public disclosure and low reputation […]

The post Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data

Mayura Kathir — Sat, 17 Oct 2026 05:57:36 +0000

An Android remote-access Trojan, YuanKong, whose weakly protected dropper reveals more than its hidden payload: it exposes the operator account identifiers embedded in each build. Analysis of 110 droppers uncovered 57 distinct child payloads, 42 operator accounts and 44 rotating build brands, all tied together by a shared signing certificate and command-and-control (C2) infrastructure. Its […]

The post Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.