VulnHub

Anthropic recently released a report detailing various ways AI technology, specifically their Claude AI, is being misused for malicious purposes. The report outlines 117 different findings, revealing that attackers are utilizing AI for tasks such as reconnaissance, data theft, and propaganda production, while humans oversee the targeting and goal-setting aspects. Notably, AI has been employed to automate credential theft and phishing attacks, as well as to compromise cloud services and extract sensitive data from organizations. This development raises serious concerns about the implications of AI in cybercrime, as it allows for more efficient and widespread attacks. Companies and individuals need to be aware of these evolving tactics to better protect themselves from AI-facilitated threats.

Bitget, a cryptocurrency exchange, reported that suspected North Korean hackers stole $351.6 million from its hot and warm wallets. The unauthorized transfers were detected on September 24, 2026, at 18:31 UTC, when Bitget's security systems flagged the activity. While the hot wallets were compromised, the exchange reassured users that its cold wallets and most of its assets remain secure. This incident raises concerns about the security of cryptocurrency exchanges, especially given the involvement of state-sponsored actors. The theft further emphasizes the need for enhanced security measures in the crypto space as attacks from sophisticated groups continue to pose significant risks.

Three vulnerabilities in Salesforce's Agentforce platform have been discovered, allowing attackers to exploit trusted agents for data theft and phishing attacks. Dubbed 'SalesBleed,' these flaws enable zero-click data exfiltration, meaning hackers can access sensitive information without any user interaction. This poses a significant risk for organizations using Salesforce, as it can lead to unauthorized access to customer data and other confidential information. Companies relying on Agentforce must address these vulnerabilities promptly to prevent potential breaches and protect their users. The situation underscores the need for continuous security assessments in widely-used platforms.

A new variant of MacSync malware is targeting Mac users by stealing sensitive information such as login credentials and crypto wallet data. Discovered by Kaspersky, this malware spreads through a crypto wallet application named Toria, which has been promoted on platforms like X and Telegram. The MacSync malware family, which first appeared in 2025, has evolved to include a persistent backdoor that allows attackers continued access to infected systems. This poses significant risks to users, particularly those involved in cryptocurrency, as their financial and personal data could be compromised. Users should be cautious about downloading apps from unverified sources and consider enhancing their security measures to protect against such malware.

Bitget, a cryptocurrency exchange, has reported a significant security breach in which hackers, suspected to be linked to North Korea, stole $351.6 million from its hot and warm wallets. This incident raises concerns for users of the exchange, as funds stored in these wallets are typically accessible and vulnerable to attacks. The stolen amount highlights the ongoing risks associated with cryptocurrency exchanges, which have been frequent targets for cybercriminals. As the investigation unfolds, affected users may need to take precautions to secure their assets and remain vigilant against potential phishing attempts or further attacks. The incident serves as a reminder of the importance of cybersecurity in the rapidly evolving digital currency landscape.

Researchers at Allure Security have discovered a malicious scheme where attackers are distributing fake desktop applications claiming to be for three major US payroll and HR platforms. These platforms do not actually offer desktop versions, as all their services are web-based. When users install these fraudulent apps, they inadvertently install ScreenConnect, a legitimate remote access tool that is configured for unauthorized access by the attacker. This means the attacker can control the user's computer without their knowledge, potentially leading to theft of sensitive payroll information. Companies and employees need to be cautious about downloading software that purports to be from trusted vendors and stick to official sources for applications.

European nations providing support to Ukraine are experiencing a surge in hybrid warfare tactics from Russia. This includes a mix of cyber sabotage, disinformation campaigns, and drone attacks. The ongoing conflict has escalated, with these aggressive tactics targeting critical infrastructure and public perception in countries that stand against Russian aggression. The situation poses a significant risk not only to national security but also to the stability of the region, as misinformation can undermine public trust and response efforts. As tensions rise, the need for robust cybersecurity measures becomes increasingly urgent for these nations.

A newly discovered vulnerability in Roundcube Webmail, tracked as CVE-2026-48842, has caught the attention of attackers. This SQL injection flaw can be exploited without any authentication, meaning that unauthorized users could potentially access sensitive data. The vulnerability poses a significant risk to organizations using Roundcube for email management, as it allows attackers to manipulate the database and extract information. Users of the platform should be vigilant and take immediate action to protect their systems. It's crucial for administrators to monitor their installations and apply any necessary updates as they become available to mitigate the risk of exploitation.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two significant vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence that they are being actively exploited. One of the vulnerabilities, identified as CVE-2026-5430, is a path traversal flaw in WSO2 API Control Plane, which has a severity score of 9.8, indicating it's highly critical. The other vulnerability affects Adobe Commerce and Magento, although specific details about it were not provided in the article. Organizations using these platforms should be aware of the risks, as attackers may exploit these vulnerabilities to gain unauthorized access or control over systems. Immediate action is advised to mitigate potential threats from these vulnerabilities.

A bipartisan group of lawmakers in the U.S. Congress is pushing for legislation that would direct the Cybersecurity and Infrastructure Security Agency (CISA) to enhance cyber defenses specifically for the biotechnology sector. Biotechnology plays a crucial role in healthcare and agriculture, but it currently lacks a specific designation as critical infrastructure, which means it may not receive the same level of cybersecurity protection as other sectors. The proposed legislation aims to ensure that biotech facilities and systems are safeguarded against potential cyberattacks. Given the increasing reliance on technology in biotech, the lawmakers believe that proactive measures are necessary to prevent vulnerabilities that could impact public health and safety.

A new vulnerability known as 'Salesbleed' has been identified, which allows attackers to exploit Salesforce agents to facilitate phishing attacks via Slack. This vulnerability enables malicious actors to send harmful instructions through trusted internal communication channels, effectively bypassing security measures. The implications are significant, as it puts both companies using Salesforce and their employees at risk of falling victim to phishing scams. Users need to be aware of this risk, as it can lead to unauthorized access to sensitive information. Companies should take immediate action to secure their communications and educate staff about the potential dangers of such attacks.