GBHackers Security | #1 Globally Trusted Cyber Security News Platform

Misconfigured Microsoft Power Pages Likely Exposed 27 Million Records to ExfilSquad

Mayura Kathir — Mon, 17 Aug 2026 09:33:55 +0000

A suspected Microsoft Power Pages configuration failure has been linked to the exposure of roughly 27 million records across 13 organizations, after the data-extortion group ExfilSquad published 382.64 GB of alleged victim data via torrent distribution. Researchers assessing the released material say the evidence points to publicly readable Microsoft Dataverse tables not a zero-day exploit, […]

The post Misconfigured Microsoft Power Pages Likely Exposed 27 Million Records to ExfilSquad appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

HoneyMyte Upgrades CoolClient With Windows Kernel Rootkit to Hide Malware and C2 Connections

Mayura Kathir — Mon, 17 Aug 2026 09:03:51 +0000

HoneyMyte, the China-aligned espionage group also tracked as Mustang Panda, has upgraded its CoolClient backdoor with a signed Windows kernel-mode rootkit that can conceal malware artifacts and command-and-control infrastructure from security tools. The development marks a notable escalation in the group’s post-compromise tradecraft, moving protection and evasion below the user-mode layer where many endpoint inspection […]

The post HoneyMyte Upgrades CoolClient With Windows Kernel Rootkit to Hide Malware and C2 Connections appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Malicious Google Apps Script Profiles Crypto Victims Before Delivering Signed Windows Malware

Mayura Kathir — Mon, 17 Aug 2026 07:56:42 +0000

A targeted cryptocurrency intrusion has exposed how Google-hosted Apps Script pages can be weaponized to profile prospective victims before delivering signed Windows malware. The campaign used a fake Web3 recruitment process to deploy a three-payload stack: NeedleStealer, an unclassified Rust infostealer, and a custom Go RAT with hidden VNC capabilities. A fake recruiter initiated contact […]

The post Malicious Google Apps Script Profiles Crypto Victims Before Delivering Signed Windows Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

GeoServer Pre-Auth SQL Injection Flaw Lets Attackers Gain Remote Code Execution

Divya — Mon, 17 Aug 2026 07:29:32 +0000

A newly disclosed SQL injection vulnerability in GeoServer allows remote attackers to execute operating system commands on backend PostgreSQL hosts under high-risk configurations. This flaw, detailed on August 14, 2026, affects the GeoTools code used by GeoServer to translate Common Query Language (CQL) filters into SQL queries for PostGIS-backed data stores. Reports indicate that exploitation […]

The post GeoServer Pre-Auth SQL Injection Flaw Lets Attackers Gain Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

ChainDrop Publishes Initial Malware Without Stealing a Long-Lived npm Token

Mayura Kathir — Mon, 17 Aug 2026 07:13:40 +0000

The ChainDrop campaign has exposed a gap in modern software supply-chain defenses: malware no longer needs a durable npm publishing token or even an npm install event to spread through developer environments. The self-propagating npm worm, also tracked as a Mini Shai-Hulud variant, turned compromised publisher and CI identities into a distribution mechanism while establishing […]

The post ChainDrop Publishes Initial Malware Without Stealing a Long-Lived npm Token appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Weekly Recap! – Top 50 Biggest Cybersecurity Stories of the Week: Apple Spyware, Zoom Zero-Click RCE, VMware vCenter Exploits, Microsoft Patch Day & More

Balaji — Mon, 17 Aug 2026 06:38:45 +0000

Welcome to this week’s edition of the GBHackers cybersecurity newsletter — your weekly cybersecurity bulletin covering the 50 most important stories from August 10–14, 2026. Zero-days set the tone: a Zoom ‘Zoomsday’ zero-click flaw could run code on other participants’ devices, the ShieldBreak zero-day bypassed a Windows Defender patch, and Microsoft’s Patch Tuesday fixed an […]

The post Weekly Recap! – Top 50 Biggest Cybersecurity Stories of the Week: Apple Spyware, Zoom Zero-Click RCE, VMware vCenter Exploits, Microsoft Patch Day & More appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Evooo1Bot Turns Compromised Routers Into DDoS Bots and Anonymous Proxy Nodes

Mayura Kathir — Mon, 17 Aug 2026 06:24:49 +0000

A newly identified Linux botnet dubbed Evooo1Bot is targeting vulnerable internet-facing routers, edge appliances, cameras, and enterprise systems, combining Mirai-derived DDoS capabilities with proxy relaying, credential theft, SSH brute forcing, and exploit-driven propagation. FortiGuard Labs observed activity beginning in July 2026, with operators using a modular toolset that elevates compromised devices from disposable DDoS nodes […]

The post Evooo1Bot Turns Compromised Routers Into DDoS Bots and Anonymous Proxy Nodes appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

MessiahGPT Unrestricted AI Model Lets Hackers Generate Ransomware and Phishing Kits

Divya — Mon, 17 Aug 2026 05:41:48 +0000

A newly surfaced criminal AI service named MessiahGPT is being marketed on BreachForums as an unrestricted offensive model capable of generating ransomware, phishing kits, stealers, crypters, rootkits, and social-engineering content on demand. The Trellix Advanced Research Center has reported that this service operates through the domain messiahgpt[.]de and promotes an associated Telegram community, marking a […]

The post MessiahGPT Unrestricted AI Model Lets Hackers Generate Ransomware and Phishing Kits appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

12 KB Backdoor Masquerades as Realtek Software and Hides C2 in Windows Whitespace

Mayura Kathir — Mon, 17 Aug 2026 05:33:19 +0000

A compact, custom-built Windows backdoor that impersonates Realtek software, persists through WMI, and conceals its command-and-control address inside what appears to be an almost empty desktop.ini file. At just 12,288 bytes, the x64 implant was observed on a single domain-joined Windows 7 SP1 workstation, a low-prevalence footprint that researchers assess may indicate selective targeting rather […]

The post 12 KB Backdoor Masquerades as Realtek Software and Hides C2 in Windows Whitespace appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Shell Investigates Data Breach After Cl0p Ransomware Claims Theft of 89GB Corporate Data

Divya — Mon, 17 Aug 2026 05:22:54 +0000

Shell has launched a cybersecurity investigation following claims by the Cl0p ransomware operation that it stole 89GB of corporate information from the multinational energy company. This alleged breach was published on Cl0p’s dark web leak portal, prompting scrutiny from security researchers and enterprise defenders as Shell’s forensic teams assess the authenticity of the files and […]

The post Shell Investigates Data Breach After Cl0p Ransomware Claims Theft of 89GB Corporate Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.