GBHackers Security | #1 Globally Trusted Cyber Security News Platform

Hackers Abuse Ethereum Smart Contracts to Hide Amatera Stealer C2 Servers

Mayura Kathir — Tue, 21 Jul 2026 13:51:16 +0000

Hackers are increasingly abusing decentralized infrastructure and legitimate development frameworks to evade detection, with a newly observed campaign leveraging Ethereum smart contracts to conceal command-and-control (C2) endpoints for the Amatera Stealer infostealer. These lures are propagated عبر malicious websites, file-sharing platforms such as Google Drive, MEGA, GoFile, and Wormhole, and spoofed download portals designed to […]

The post Hackers Abuse Ethereum Smart Contracts to Hide Amatera Stealer C2 Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

New CAV3RN Module Replaces WebSocket C2 With Outlook Calendar Dead Drops

Mayura Kathir — Tue, 21 Jul 2026 13:27:54 +0000

In a significant evolution of the Project CAV3RN tooling, a new .NET Native AOT communication module dubbed AzureCommunication.dll has been deployed to replace the framework’s earlier HTTP/WebSocket C2 component. A stealthy channel that abuses Outlook calendar events over Microsoft Graph and a DNS-based recovery mechanism for Microsoft 365 credentials. This shift reinforces CAV3RN’s positioning as […]

The post New CAV3RN Module Replaces WebSocket C2 With Outlook Calendar Dead Drops appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Trump’s AI Safety Agency Chief Resigns After Just Three Months Leading CAISI

Divya — Tue, 21 Jul 2026 13:09:21 +0000

Chris Fall, the director of the U.S. Center for AI Standards and Innovation (CAISI), has resigned just three months after being appointed to lead the Commerce Department agency. This departure raises new uncertainties regarding the Trump administration’s agenda on AI safety, model evaluation, and cybersecurity oversight. The Commerce Department confirmed his resignation on July 20, […]

The post Trump’s AI Safety Agency Chief Resigns After Just Three Months Leading CAISI appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Craneware Cyberattack Exposes Employee and US Healthcare Customer Data

Divya — Tue, 21 Jul 2026 13:01:47 +0000

Craneware plc, a UK-based provider of healthcare financial performance software, has disclosed that it experienced a cyberattack in which an unauthorized party accessed and extracted data from a portion of its systems. The company revealed that the incident involved employee information and records related to certain customers and partners, including organizations in the US healthcare […]

The post Craneware Cyberattack Exposes Employee and US Healthcare Customer Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

2026 Ransomware Report Reveals 7,551 Victims, 146 Active Groups, and Qilin’s 443% Surge

Mayura Kathir — Tue, 21 Jul 2026 12:40:10 +0000

Ransomware volumes hit a new peak in 2026, with Black Kite tracking 7,551 publicly disclosed victims, 146 active groups, and a 443% year‑over‑year surge in Qilin activity that reshapes the threat landscape. The data points to a structurally higher operating tempo, a middle‑market pivot, and attacker visibility that often outpaces defenders’ own understanding of their […]

The post 2026 Ransomware Report Reveals 7,551 Victims, 146 Active Groups, and Qilin’s 443% Surge appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Microsoft Retires Copilot Podcasts and Removes Access to Previously Created Content

Divya — Tue, 21 Jul 2026 12:23:05 +0000

Microsoft has announced that it will retire the Podcasts feature in its consumer Copilot app on August 18, 2026. This decision will permanently remove the ability to generate new AI-created podcasts, as well as access to all previously created content. This change affects all Copilot customers, including both free users and paid subscribers, and raises […]

The post Microsoft Retires Copilot Podcasts and Removes Access to Previously Created Content appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Microsoft Defender XDR Blind Spot Lets Public C2 Traffic Evade Detection Queries

Divya — Tue, 21 Jul 2026 11:54:05 +0000

Microsoft Defender XDR users may inadvertently overlook command-and-control (C2) traffic when searching for Internet-bound connections due to a specific behavior in how IP addresses are classified. This issue arises from Kusto Query Language (KQL) detections that depend solely on filtering by RemoteIPType == “Public” in the DeviceNetworkEvents table. As a result, traffic destined for public […]

The post Microsoft Defender XDR Blind Spot Lets Public C2 Traffic Evade Detection Queries appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers Use Cruciferra Crypter to Disable EDR and Deploy XWorm, Remcos, and AsyncRAT

Mayura Kathir — Tue, 21 Jul 2026 11:42:40 +0000

Hackers are abusing the Cruciferra crypter-as-a-service to systematically turn off endpoint detection and response (EDR) tools and stealthily deploy XWorm, Remcos, AsyncRAT, and other commodity malware in email-driven campaigns targeting multiple sectors worldwide. By combining BYOVD-based driver abuse, indirect syscalls and a polymorphic encryption engine with more than 90 mix-and-match crypto routines, Cruciferra has rapidly […]

The post Hackers Use Cruciferra Crypter to Disable EDR and Deploy XWorm, Remcos, and AsyncRAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers Exploit ServiceNow AI Platform Flaw to Gain Unauthenticated Remote Code Execution

Divya — Tue, 21 Jul 2026 10:57:05 +0000

Threat actors are actively exploiting CVE-2026-6875, a critical pre-authentication remote code execution vulnerability in the ServiceNow AI Platform. This vulnerability allows attackers to escape a restricted server-side script sandbox and execute code without valid credentials. Reports from Defused indicate observed exploitation activity targeting this flaw. Initially, ServiceNow’s advisory stated it was not aware of any […]

The post Hackers Exploit ServiceNow AI Platform Flaw to Gain Unauthenticated Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

JADEPUFFER Deploys ENCFORGE Ransomware Built to Destroy AI Models and Training Data

Mayura Kathir — Tue, 21 Jul 2026 10:57:00 +0000

JADEPUFFER has escalated from automated database extortion to purpose-built AI model destruction, deploying a custom Go ransomware dubbed ENCFORGE to encrypt and effectively wipe high‑value AI and ML artifacts across an entire stack. A missing‑authentication bug in the /api/v1/validate/code endpoint that enables unauthenticated arbitrary Python execution on the host. That initial operation chained reconnaissance, credential […]

The post JADEPUFFER Deploys ENCFORGE Ransomware Built to Destroy AI Models and Training Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.