Cybercriminals are exploiting ChatGPT's Custom GPTs feature to trick users into visiting harmful websites. These sites use ClickFix lures to deliver Remote Access Trojans (RATs), which can take control of victims' devices. This tactic was observed by Huntress in late September 2026 and represents a concerning trend where trusted AI platforms are manipulated to spread malware. Users who interact with these malicious GPTs may unknowingly expose their systems to significant risks. This incident serves as a reminder for individuals and organizations to be cautious when engaging with AI-driven tools and to verify the legitimacy of any offerings before clicking links.
Two former members of the U.S. Air Force have been sentenced to a total of 189 months in federal prison for their involvement in a series of business email compromise (BEC) scams and phishing campaigns that spanned several years. These scams tricked businesses into transferring large sums of money by impersonating company executives or trusted partners through compromised email accounts. The actions of these individuals not only caused financial harm to various businesses but also highlighted the vulnerabilities in email communication systems. This case serves as a warning to organizations about the importance of email security and the need for robust verification processes to prevent similar attacks in the future.
The Lantronix G520 Series Cellular Gateway has been found to have serious vulnerabilities that could allow attackers to execute arbitrary code with root privileges. Specifically, versions 2.6.0.4R6_stable are affected by two major issues: one involving improper handling of update metadata that could enable cross-site scripting (CVE-2026-84409), and another related to the acceptance of unauthorized software packages, undermining package authenticity (CVE-2026-91191). These vulnerabilities pose risks to critical infrastructure sectors, including transportation, energy, and water systems, and could be exploited by malicious actors to gain control over devices. Lantronix has released a patch, version 2.6.0.7R6, to address these issues, and users are strongly advised to update their devices promptly to mitigate risks.
Toptech Systems has identified a series of serious vulnerabilities affecting its TMS7 and TopHAT software, both at version 7.6.3. These vulnerabilities could let attackers access sensitive data or run arbitrary code on the servers. Notable issues include the ability for unauthenticated users to export database tables, upload malicious files, and execute SQL injection attacks that could compromise database integrity. Toptech issued a security advisory on July 20, 2026, and has addressed these vulnerabilities in the software's latest version, 7.8. Users are encouraged to update their systems to mitigate the risks associated with these vulnerabilities.
The Viidure Dashcam Android Application is facing serious security vulnerabilities that could allow attackers to access sensitive user data and critical system files. Two main issues have been identified: one involves a misconfigured cloud storage backend that permits unrestricted public access to sensitive records and live footage, while the other reveals hard-coded credentials embedded in the application, granting full access to critical storage. Affected users are running versions of the app prior to 3.3.1.260403. Despite the severity of these vulnerabilities, Viidure has not provided any fixes and did not respond to CISA's attempts to coordinate on these issues. Users are advised to contact Viidure support for more information and to take defensive measures to secure their systems.
Anjvision's YSSD-RTMP-H5 firmware version 3.3.2.4 has several serious vulnerabilities that could allow attackers to gain unauthorized access, execute commands, or take control of the devices. These flaws stem from issues like improper authentication, hardcoded credentials, and insufficient cryptographic protections. Notably, the firmware lacks a planned fix, and Anjvision has not engaged with CISA to address these vulnerabilities. Users of affected devices are encouraged to reach out to Anjvision for support, but without a patch, the risk remains high. The potential for exploitation is significant, affecting devices deployed globally across commercial facilities.
A vulnerability has been identified in the Baicells Nova 430H eNodeB (model pBS3101SH) that could allow attackers to disrupt service by sending malformed messages to the device. This issue affects all versions up to BaiBLQ_3.0.12 and could lead to a denial-of-service condition, temporarily shutting down network connectivity. The vulnerability, designated as CVE-2026-96274, is particularly concerning as it can be exploited by any unauthenticated device within radio range. Baicells Technologies has not planned a fix for this vulnerability and has not collaborated with CISA on mitigation efforts. Users are advised to contact Baicells customer support for more information on how to protect their systems from potential exploitation.
This week saw a notable rise in cyber threats, including a $387 million cryptocurrency hack that has raised alarms in the crypto community. Attackers registered a previously harmless domain that appeared in about 1,700 repositories and began using it to distribute malicious content. This incident illustrates how old assumptions about security can be exploited by cybercriminals. Additionally, weak service accounts, outdated vulnerabilities, and exposed systems continue to provide attackers with easy access points. Companies and users alike need to remain vigilant and update their security measures to protect against these ongoing threats.
Last week, a significant data breach involving Gyazo was reported, exposing the personal information of 23.6 million users. The breach has raised concerns about the security of user data on the popular screenshot-sharing platform. Attackers managed to access sensitive information, including email addresses and user-generated content, which could lead to identity theft or phishing attacks. This incident underscores the importance of robust security measures for online services that handle sensitive user data. Users of Gyazo are advised to change their passwords and monitor their accounts for any suspicious activity.
The article discusses the growing issue of IT worker scams, which target companies by exploiting weaknesses in their hiring processes. It emphasizes the importance of training human-resource managers to recognize the latest tactics used by scammers, such as phishing and social engineering. Additionally, the piece advocates for the use of automated analysis tools to enhance the detection of potential fraud. By improving HR processes and integrating technology, organizations can better protect themselves from these scams, which can lead to significant financial losses and reputational damage. This is particularly crucial as the number of incidents continues to rise, making it imperative for companies to stay ahead of these threats.
Anthropic recently released a report detailing various ways AI technology, specifically their Claude AI, is being misused for malicious purposes. The report outlines 117 different findings, revealing that attackers are utilizing AI for tasks such as reconnaissance, data theft, and propaganda production, while humans oversee the targeting and goal-setting aspects. Notably, AI has been employed to automate credential theft and phishing attacks, as well as to compromise cloud services and extract sensitive data from organizations. This development raises serious concerns about the implications of AI in cybercrime, as it allows for more efficient and widespread attacks. Companies and individuals need to be aware of these evolving tactics to better protect themselves from AI-facilitated threats.
Three vulnerabilities in Salesforce's Agentforce platform have been discovered, allowing attackers to exploit trusted agents for data theft and phishing attacks. Dubbed 'SalesBleed,' these flaws enable zero-click data exfiltration, meaning hackers can access sensitive information without any user interaction. This poses a significant risk for organizations using Salesforce, as it can lead to unauthorized access to customer data and other confidential information. Companies relying on Agentforce must address these vulnerabilities promptly to prevent potential breaches and protect their users. The situation underscores the need for continuous security assessments in widely-used platforms.
Bitget, a cryptocurrency exchange, has reported a significant security breach in which hackers, suspected to be linked to North Korea, stole $351.6 million from its hot and warm wallets. This incident raises concerns for users of the exchange, as funds stored in these wallets are typically accessible and vulnerable to attacks. The stolen amount highlights the ongoing risks associated with cryptocurrency exchanges, which have been frequent targets for cybercriminals. As the investigation unfolds, affected users may need to take precautions to secure their assets and remain vigilant against potential phishing attempts or further attacks. The incident serves as a reminder of the importance of cybersecurity in the rapidly evolving digital currency landscape.
A new vulnerability known as 'Salesbleed' has been identified, which allows attackers to exploit Salesforce agents to facilitate phishing attacks via Slack. This vulnerability enables malicious actors to send harmful instructions through trusted internal communication channels, effectively bypassing security measures. The implications are significant, as it puts both companies using Salesforce and their employees at risk of falling victim to phishing scams. Users need to be aware of this risk, as it can lead to unauthorized access to sensitive information. Companies should take immediate action to secure their communications and educate staff about the potential dangers of such attacks.
Botslab G980H dashcams have several serious vulnerabilities that could allow attackers to bypass authentication and gain unauthorized access to sensitive data and device functions. The affected models include the G980H dash cam series 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+. Vulnerabilities identified include issues with session management, predictable session identifiers, and weak authentication mechanisms, which could be exploited by attackers within range of the device. Botslab has not yet responded to requests for mitigation strategies, leaving users vulnerable. It's crucial for owners of these dashcams to reach out to Botslab for guidance on securing their devices against these threats.