Abbas

🇵🇸

[Cyber Security News @The_Cyber_News]

‼️ BREAKING: An AI assistant just hacked a gym... to steal someone's workout spot. This is Australia's first autonomous AI cyberattack. It wasn't a hacker. It wasn't malware. It was Claude, just trying to be helpful.

Full story: https://t.co/ni9Iuw5reQ

#cybersecuritynews

[CISA Cyber @CISACyber]

🚨Cyber threat actors are exploiting authentication-bypass & remote code execution vulnerabilities to gain unauthorized access to specific on-premises instances of Microsoft SharePoint Servers. Read our Alert for CVEs, detection & remediation 👉https://t.co/85wG77hAgg

[Cybernews @Cybernews]

Hackers claim to have breached Deutsche Bank internal systems. More info: https://t.co/RaAha432pH

[BleepingComputer @BleepinComputer]

Accenture confirms breach after hacker offers stolen data for sale
https://t.co/8JR2brbOzm

https://t.co/8JR2brbOzm

[BleepingComputer @BleepinComputer]

Insurance giant Aflac discloses data breach after subsidiary hack
https://t.co/C6lfOismbA

https://t.co/C6lfOismbA

[BleepingComputer @BleepinComputer]

DHS confirms hackers breached HSIN info-sharing platform
https://t.co/qamCOxBKTA

https://t.co/qamCOxBKTA

[Cyber Security News @The_Cyber_News]

🚨 Claude Code's GitHub Actions Vulnerability Lets Attackers Compromise Any Repository

Source: https://t.co/lb0fzVp2ox

A critical supply chain vulnerability in Claude Code's GitHub Actions that could allow attackers to compromise any repository using Anthropic's official CI/CD workflow, including Anthropic's own infrastructure.

When combined with prompt injection techniques, it could enable a fully unauthenticated external attacker to exfiltrate secrets, steal OIDC tokens, and push malicious code to any downstream repository that depends on the Claude Code GitHub Actions workflow.

Claude Code GitHub Actions restricts workflow execution to users with write or admin access. However, the checkWritePermissions function unconditionally trusted any actor ending in [bot] regardless of actual permissions.

#cybersecuritynews

[Cyber Security News @The_Cyber_News]

📢 Microsoft Clarifies It Won't Sue Security Researchers Amid Nightmare-Eclipse Controversy

Source: https://t.co/6fCnEdPSxc

Microsoft has clarified its stance, reducing perceived legal threats and reaffirming its commitment to coordinated vulnerability disclosure, following significant backlash from the security research community.

In a carefully worded statement released in late May 2026, Microsoft's Security Response Center (MSRC) moved to defuse a growing crisis over its handling of the security research community, clarifying that it has "no intention to pursue action against individuals conducting or publishing their security research."

#cybersecuritynews #microsoft #nightmareeclipse

[The Hacker News @TheHackersNews]

🚨 A legitimate-looking npm package for OpenAI Codex has been stealing developer auth tokens for over a month.

codexui-android, marketed as a remote web UI, has seen 29,000+ weekly downloads. Since version 0.1.82 it quietly sends ~/.codex/auth.json — including non-expiring refresh tokens — to an attacker server.

Read: https://t.co/rC2QYxflIG

[The Hacker News @TheHackersNews]

🚨 CVE-2026-0257, a PAN-OS and Prisma Access authentication bypass flaw, is under active exploitation.

The CVSS 7.8 bug can enable unauthorized VPN access and, in some observed cases, access to internal networks.

Patch immediately or apply mitigations.

Details: https://t.co/BlECtBGWR1

[The Hacker News @TheHackersNews]

🚨 Gitea flaw exposes private container images without authentication.

https://t.co/MzzINUkRhN

CVE-2026-27771 affects all Gitea versions before 1.26.2 and likely impacts 30,000+ deployments worldwide. Attackers can pull private images without an account or password.

Update now or enable REQUIRE_SIGNIN_VIEW as a temporary workaround.

[Hackread.com @HackRead]

Iranian #NimbusManticore is targeting US aviation and software firms with trojanized Zoom installers, AI-assisted malware, SEO poisoning and fake hiring campaigns deploying a new backdoor called #MiniFast.

Read: https://t.co/4K00MVveOO

#CyberSecurity #Malware #Iran #AI #Zoom

[Cyber Security News @The_Cyber_News]

⚠️ New BTMOB Malware Lets Attackers Remotely Control Android Devices

Source: https://t.co/RoTwZpLAny

New Android malware dubbed BTMOB is arming even low-skilled attackers with full remote control over infected phones by combining a powerful RAT engine with a no-code campaign builder toolkit.

Unlike classic banking trojans focused only on financial data, BTMOB is designed for full device surveillance and control. The malware can exfiltrate a wide range of sensitive data, capture screenshots, record on-device activity, and give operators persistent remote access to the compromised phone.

#cybersecuritynews

[The Hacker News @TheHackersNews]

⚠️ WARNING - A malicious npm package was caught stealing files from Claude AI users’ /mnt/user-data directories and uploading them to attacker-controlled GitHub repositories.

Check your installed packages: https://t.co/Ev9AKDSria

The package, “mouse5212-super-formatter,” used npm postinstall scripts, hard-coded GitHub tokens, and fake network logs to hide the theft.

Downloaded 676 times so far.

[DFIR Radar @DFIR_Radar]

"Megalodon" supply chain attack compromises numerous GitHub repositories through malicious CI/CD YAML configurations. Campaign pivots from credential theft to cryptomining, demonstrating sustained adversary infrastructure reuse.

Key technical details:
• Base64-encoded malicious scripts injected into GitHub Actions YAML files starting May 18, 2026
• Primary C2: hxxp[://]216[.]126[.]225[.]129:8443 (RouterHosting LLC, ASN 14956)
• Exfiltrated data stored in "/loot" directory on C2 server with "gh_dump" parameter indicating GitHub targeting
• Historical C2 activity traced to May 8 campaign using hxxp[://]144[.]172[.]116[.]48:8080 with "cp2[.]hostable[.]com" campaign identifier

Attack methodology:
• Compromise of CI/CD pipelines through GitHub Actions (T1195.001)
• Credential harvesting from compromised repositories
• Infrastructure reuse linking current campaign to previous cryptomining operations
• C2 response content reveals operational parameters and file structure

DFIR artifacts include base64-encoded YAML configurations in .github/workflows/, network connections to identified C2 IPs, and POST requests with specific query parameters (h=, l=, id=, t=).

Hunt for GitHub Actions with base64 content and outbound connections to RouterHosting infrastructure. Full YARA rule and IOC list provided in the analysis.

#DFIR_Radar

[Cyber Security News @The_Cyber_News]

GitHub Down – Authentication Issues Denying Access to Actions 

Source: https://t.co/ygETCygWnr

GitHub experienced a widespread service disruption on May 26, 2026, after authentication failures prevented developers from accessing critical automation services, including GitHub Actions and GitHub Pages.

The outage significantly impacted CI/CD pipelines, blocking workflow execution and halting software delivery for many organizations worldwide.

According to GitHub’s official status page, the incident began around 10:57 UTC, when users reported degraded performance affecting both Actions and Pages services.

[Cyber Security News @The_Cyber_News]

⚠️Microsoft SharePoint Server Vulnerability Enables Remote Code Execution Attacks

Source: https://t.co/vDoU4H5xkt

Microsoft has disclosed a critical security vulnerability in SharePoint Server that could allow authenticated attackers to execute arbitrary code remotely across multiple versions of the platform.

Tracked as CVE-2026-45659 and released on May 21, 2026, the flaw poses a significant risk to organizations running on-premises SharePoint deployments.

The vulnerability stems from the deserialization of untrusted data within Microsoft Office SharePoint. When exploited, it enables a network-based attacker to remotely execute code on the affected server.

#cybersecuritynews #sharepoint

[The Hacker News @TheHackersNews]

🚨 TrapDoor supply chain attack hits npm, PyPI, and Crates-io.

https://t.co/SYnR0fcJCr

34 malicious packages across 384 versions were used to steal crypto wallets, SSH keys, cloud credentials, and developer secrets from crypto, DeFi, Solana, and AI environments.

The malware abused npm hooks, Python imports, and Rust build scripts for execution and persistence.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: Another supply chain attack. 700+ GitHub repositories flagged, including PHP and Node.js projects. The malicious script was planted across all of them. When a developer installs the package, the script silently downloads a Linux file from GitHub, hides it under the name /tmp/.sshd (so it looks like a normal system file), and runs it in the background. It also skips security checks on the download and hides any error messages.

8 PHP packages on Packagist (the main PHP code library) were confirmed infected. The attacker hid the script inside a JavaScript config file (package.json) instead of the PHP one (composer.json), so PHP developers reviewing their code would not notice it. The biggest risk is to devdojo/wave (6,400 stars) and devdojo/genesis (9,100 installs), both popular Laravel project templates. Developers who use these templates run the bad script the moment they install dependencies.

The same payload was also dropped into GitHub Actions (automated build pipelines) under a fake step called "Dependency Cache Sync," meaning it could infect company build servers too. Packagist removed the bad packages, but the auto-updating versions (dev-main, dev-master, 3.x-dev) can quietly come back if the original repos stay infected.

IOCs:
GitHub account parikhpreyash4
repo systemd-network-helper-aa5c751f
drop path /tmp/.sshd
command fragments curl -skL and chmod +x /tmp/.sshd.

[The Hacker News @TheHackersNews]

⚡ Megalodon pushed malicious CI/CD workflows to 5,561 #GitHub repos in 6 hours.

https://t.co/klLAxgDtox

Attackers used throwaway accounts and forged CI bot names to inject GitHub Actions payloads designed to steal CI secrets, cloud credentials, SSH keys, OIDC tokens, and source code secrets.

Check recent workflow changes, audit PATs/deploy keys, and review unexpected CI bot commits.