Recent findings reveal that attackers can exploit Grafana's AI components to leak sensitive enterprise data. By directing Grafana to external resources and using indirect prompts, they can bypass existing security measures. This vulnerability poses a significant risk to organizations that rely on Grafana for data visualization and monitoring, as it may expose confidential information. Companies using Grafana should take immediate action to assess their configurations and consider implementing additional safeguards to protect against such exploitation. The implications of this issue are serious, as it could lead to unauthorized access to critical business data.
Researchers have identified a new attack method called GPUBreach that exploits vulnerabilities in GPU memory, specifically through a technique known as RowHammer. This attack can lead to privilege escalation and even give attackers full control over affected systems. The method takes advantage of bit-flips in GDDR6 memory, which can go beyond just corrupting data. This poses a significant risk to users and organizations relying on these graphics processors, as it could compromise sensitive information and system integrity. As technology increasingly relies on GPUs for various applications, understanding and addressing this vulnerability is crucial for maintaining security.
The Medusa ransomware group has been swift in exploiting vulnerabilities, utilizing zero-day exploits to gain access to systems. Once inside, they quickly exfiltrate and encrypt data, often within days of their initial breach. This rapid response poses a significant threat to organizations, as it reduces the time available for victims to respond and mitigate the damage. Companies across various sectors need to be vigilant and ensure their systems are updated to prevent falling victim to these attacks. The effectiveness of Medusa's tactics highlights the importance of maintaining robust cybersecurity defenses and monitoring for unusual activity.
Recent research has identified serious vulnerabilities in Nvidia GPU-based devices, which are common in cloud computing environments. Three new Rowhammer attacks have been discovered that could allow attackers to completely take control of these systems. This is particularly concerning for organizations that rely on high-performance GPUs for various applications, as it raises the risk of unauthorized access and potential data breaches. The ability to exploit these vulnerabilities could have significant implications for cloud security, making it essential for companies to assess their defenses against such attacks. As these GPUs are widely used, the impact of this discovery could be extensive across many sectors relying on cloud services.
Researchers at Google DeepMind have identified six types of web-based attacks that can target autonomous AI agents. These attacks exploit malicious web content to manipulate AI behavior, potentially leading to harmful consequences. The study emphasizes how AI agents, which increasingly navigate the internet autonomously, can be misled by deceptive information, resulting in unexpected actions. This research highlights the need for stronger security measures to protect AI systems from manipulation. As AI continues to be integrated into various applications, understanding these vulnerabilities is crucial for developers and organizations relying on AI technology.
Recent research has identified several email-based threats that are evolving with the rise of AI and sophisticated attack methods. Key threats include OAuth consent attacks, where attackers exploit legitimate app permissions to gain unauthorized access to accounts. Lateral phishing is also on the rise, where compromised accounts are used to target other users within the same organization. Additionally, AI is being misused in payroll fraud schemes, tricking companies into making mistaken payments. These threats impact a wide range of organizations, as they rely heavily on email for communication and transactions. As these tactics become more common, businesses must remain vigilant and enhance their email security measures to protect against these evolving risks.
In March 2026, a threat actor known as TeamPCP executed a supply chain attack that targeted developer workstations, turning them into credential vaults for attackers. These machines are crucial for developers, as they handle the creation and management of various credentials across services and tools. By infiltrating these systems, attackers gained access to sensitive information that could be reused across multiple platforms, increasing the risk of data breaches. This incident raises significant concerns for companies that rely on developer machines, highlighting the need for improved security measures to protect sensitive credentials. As attackers continue to exploit these valuable resources, organizations must reassess their security protocols to safeguard against similar threats in the future.
North Korean hackers, previously linked to the Axios supply chain attack, are now targeting prominent maintainers of Node.js in a social engineering campaign. These attackers are using deceptive tactics to compromise the accounts of these developers, potentially putting the security of the Node.js ecosystem at risk. This is concerning because Node.js is widely used in web development, and any breach could lead to widespread vulnerabilities in applications that rely on its libraries. Developers and organizations that utilize Node.js should be on high alert and take precautions to protect their accounts and code repositories. The ongoing targeting of developers reflects a broader trend of cybercriminals seeking to exploit trusted software maintainers to gain access to critical systems.
Hackers are actively exploiting a vulnerability known as React2Shell (CVE-2025-55182) to automate the theft of user credentials from Next.js applications. This attack targets systems that have not been updated or patched against this specific vulnerability, making them susceptible to unauthorized access. Researchers have observed that this campaign is widespread, indicating that many developers using vulnerable versions of Next.js may be at risk. The implications are significant, as stolen credentials can lead to account takeovers and further breaches within organizations. Companies using Next.js should prioritize updating their applications to mitigate this threat and protect user data.
Recent findings show that the Akira ransomware group has become more efficient in executing attacks, significantly shortening the time it takes to compromise systems. This development poses a serious risk to organizations, as attackers are now able to exploit vulnerabilities and deploy ransomware more quickly than before. The report from CyberScoop indicates that businesses need to be increasingly vigilant, as traditional defenses may no longer be sufficient against this evolving threat. Companies are urged to review their cybersecurity measures and ensure they are up to date with the latest defenses to mitigate potential attacks. The growing speed of these intrusions could lead to increased financial and operational damage for those caught off guard.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
Mercor, an AI firm, has confirmed a significant data breach linked to a supply chain attack involving LiteLLM. Hackers claim to have stolen 4TB of sensitive data, which may include internal systems and proprietary information. This breach raises serious concerns about the security of supply chain processes, as attackers often exploit vulnerabilities in third-party software to gain access to larger networks. Companies that rely on LiteLLM and similar technologies should be particularly vigilant and assess their security measures. The implications of such a large data theft could be severe, affecting not only Mercor but also its clients and partners who may be at risk of data exposure or further attacks.
Drift, a company involved in cryptocurrency, has suffered a significant loss of $285 million due to a sophisticated hacking operation likely orchestrated by North Korean cybercriminals. The attackers employed advanced techniques, including the use of nonce-based tricks to pre-sign transactions and delay approvals, allowing them to bypass security measures. This incident raises alarms about the vulnerabilities in cryptocurrency platforms and the potential for state-sponsored actors to exploit these weaknesses for financial gain. The scale of the theft not only impacts Drift but also poses broader implications for the cryptocurrency market, as it highlights the ongoing risks of cyberattacks in this rapidly evolving sector. As companies like Drift face these threats, it becomes crucial for the industry to bolster security measures to protect against such sophisticated attacks.
A significant credential harvesting campaign has been detected, utilizing the React2Shell vulnerability (CVE-2025-55182) to gain access to sensitive data from 766 Next.js hosts. Attackers are stealing various credentials, including database logins, SSH private keys, AWS secrets, Stripe API keys, and GitHub tokens. This operation has been linked to a threat group that Cisco Talos is monitoring. The widespread nature of this breach is concerning, as it affects a range of developers and companies using Next.js, potentially compromising their applications and user data. Companies need to be vigilant and take immediate steps to secure their systems against this threat.
A Brazilian cybercrime group known as Augmented Marauder and Water Saci has launched a phishing campaign that spreads two banking trojans: Casbaneiro and Horabot. The attackers use a mix of WhatsApp, ClickFix techniques, and email phishing to deliver these malicious programs. The campaign primarily targets individuals and organizations, aiming to steal sensitive banking information. This is particularly concerning as it showcases the evolving tactics employed by cybercriminals to exploit users through familiar communication channels. Users should be cautious about unsolicited messages and verify the authenticity of links before clicking.
Recent reports indicate that ransomware attackers are increasingly using legitimate IT tools, such as Process Hacker and IOBit Unlocker, to bypass traditional antivirus software. These tools have deep access to operating system functions, allowing attackers to execute malicious activities without raising alarms. This trend poses significant risks to organizations, as it makes it harder for security systems to detect and prevent these kinds of attacks. Companies must reassess their security measures to account for the misuse of legitimate software, which could compromise sensitive data and disrupt operations. As attackers continue to evolve their tactics, it’s crucial for users and companies to stay vigilant and update their defenses accordingly.