AI Model Evaluator METR Hit by Credential Theft, Probing
In one attack, threat actors stole an API key that ultimately led to the consumption of $600,000 in public AI model credits for the security nonprofit.
threat-intel
Berlin’s 7-Day Isolation Gap Let Rhysida Steal Data [2026]
Berlin’s state government waited seven days before disconnecting compromised departments from its central network after first detecting suspicious data movement, a delay that gave the Rhysida ransomware gang enough time to pull an estimated 5.79 terabytes of files out of critical infrastructure systems, according to reporting from Tech Times and The Hacker News. The gap,…
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024. Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as “specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers.” The adversary
Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-82329 (CVSS score: 9.8), a case of authentication bypass that could lead to administrative access in Artifactory. “JFrog Artifactory contains an authentication weakness that, under default
Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones
The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix,…
Steam Guard Setup: Block Account Hacks in 12 Steps [2026]
A Discord account with a decade of servers, roles, and Nitro history can be gone in about four minutes. That’s roughly how long security researchers say it takes an infostealer to grab an active token, log in from a fresh device, and lock the real owner out. Steam accounts fare worse in the headlines: in…
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis
Cybersecurity researchers have disclosed a new technique dubbed GuardBreaker that’s been put to use by a Russia-aligned threat actor known as UAC-0099 against a target in Ukraine with an aim to interfere with artificial intelligence (AI)-assisted analysis. The idea, ESET said in a series of posts on X, is to deliberately trip a large language…
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below – CVE-2026-0768 (CVSS score: 9.8) – A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of…
McKesson Confirms Breach: 284M Records, $55M Demand [2026]
McKesson Corporation, the Irving, Texas pharmaceutical distributor that moves roughly a third of the prescription drugs sold in the United States, has confirmed what the extortion group ShinyHunters spent the past week threatening to prove: its cloud systems were breached, and patient data went out the door. The confirmation, posted Friday, August 28, 2026, and…
McKesson copes with fallout from data theft extortion attack
The major healthcare sector vendor did not identify the attackers, but ShinyHunters, a prolific group increasingly targeting the sector, claimed responsibility. The post McKesson copes with fallout from data theft extortion attack appeared first on CyberScoop.