|
📱 Spyware infects phones via online ads
LINK
|
- Citizen Lab today revealed AdFection, the first technical proof of zero-click mercenary spyware delivered through targeted online ads, meaning a device can be infected the moment an ad loads, without the victim ever clicking anything.
- Israeli firm Discover-Tech poses as an ad company but runs a platform that lets surveillance partners, including the known vendor Candiru, fingerprint and infect devices as the ad renders; between March and June its ads appeared across over 120,000 websites and 70,000 apps.
- At least 45 devices at Al Jazeera were hit in attacks tied to Candiru, which can remotely take over a phone, steal data and access its microphone and camera; Google has removed Discover-Tech from its vendor registries and cut its ad-platform access, as has IAB Europe.
|
🎣 Microsoft takes down huge phishing network
LINK
|
- Microsoft, working with Japanese authorities, Health-ISAC and several security firms, dismantled an ecosystem of Chinese-language phishing kits and services, tracked as Storm-2990, that sent more than 1 billion phishing emails and texts to over 75,000 organizations this year.
- The kits, sold under names like YAM Store, CoGUI and Iron Man, impersonated banks, retailers and government agencies to steal logins and financial data, and abused the device code sign-in process to grab authentication tokens and access victims' accounts, mainly in US and Japanese healthcare, finance, logistics and IT.
- Under a federal court order Microsoft seized and redirected the infrastructure domains, disabled more than 20,000 YAM Store accounts and blocked over 100,000 impersonation domains; Resecurity found thousands of phishing templates across many countries, with over three-quarters of all messages aimed at Microsoft customers.
|
🔥 Palo Alto firewall zero-day under attack
LINK
|
- Attackers are actively exploiting a zero-day in Palo Alto Networks PAN-OS that lets them run code with root privileges on affected firewalls, with the company confirming "very limited exploitation" and urging customers to apply fixes immediately.
- The flaw (CVE-2026-0322, high severity at CVSS 8.6) is a code injection bug in the management interface: an attacker already holding a high-privilege login and network access to that interface can run commands as root, no user interaction needed.
- It is not an unauthenticated path, and no workaround exists, so Palo Alto says the supported fixed releases, PA-Series, VM-Series, and Panorama deployments, with Cloud NGFW and Prisma Access unaffected, are the recommended protection; three attacker-linked addresses were published for reviewing management traffic.
|
📧 Cisco email gateway zero-day gives root
LINK
|
- Cisco has patched an actively exploited zero-day in its Secure Email Gateway that lets remote attackers with no login run commands as root on the underlying operating system.
- The flaw, CVE-2026-76519, is a relative path traversal bug in the gateway's Advanced Malware Protection feature that mishandles email attachments, so an attacker just sends an email with a crafted attachment to an unpatched device to write files and run code; it affects instances where File Reputation is enabled with older Content Scanner Tools versions.
- Cisco says attackers may erase traces after gaining root, so it urges checking firewall and network logs and, for customers it contacted, renewing credentials and cryptographic materials and restricting access to the appliance.
|
🔑 Claude Code bug could leak SSH keys
LINK
|
- A bug in Anthropic's Claude Code Desktop app, called SneakPeek, let attackers steal a developer's SSH private keys, AWS credentials and GitHub secrets simply by asking the tool to review a malicious HTML file.
- Rated high severity (CVSS 8.7), the flaw abused the app's automated preview pane: HTML files over 256KB were written to disk and loaded as "file://" URLs, bypassing the script-blocking protections applied to smaller files and giving the renderer local filesystem access.
- Anthropic fully resolved the issue after an initial patch was bypassed, and is preparing a GitHub Security Advisory and a CVE; Noma advises keeping AI coding tools updated and using scoped, short-lived tokens instead of long-lived credentials on developer machines.
|
|
