INJ3CTOR3 has expanded its FreePBX toll-fraud campaign with automated credential theft, letting attackers keep billing unauthorized calls to victims even after infected servers are cleaned. September 2026 artifacts described in the supplied research show the installer targeting 17 configuration files containing telephony, database, management, and mail-relay secrets. The change separates the attacker’s revenue stream from […]

The post INJ3CTOR3 Malware Steals FreePBX Credentials to Enable Fraudulent Calls Even After Server Cleanup appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Attackers are using compromised websites to present fake Cloudflare verification pages that steer Windows and macOS users toward executing malicious commands. The findings establish a delivery attempt, not a confirmed infection or identified malware family. The activity exploits the familiarity of browser security checks. Instead of completing a legitimate verification, visitors receive instructions intended to […]

The post Hackers Turn Compromised Websites Into Fake Cloudflare Verification Traps for Windows and Mac Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

CyberDakait, a financially motivated Android malware operation targeting Indian banking customers since July 2025. Researchers identified at least 17,960 compromised devices and 7,611,443 intercepted SMS messages, exposing a campaign that combines banking credential theft, remote device control, and cryptocurrency mining. Although their technical implementations differ, Group-IB clusters them together because of overlapping distribution methods, phishing […]

The post CyberDakait Hackers Target Indian Banking Users, Compromise 17,960 Android Devices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Three malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget to steal cryptocurrency wallet recovery phrases and private keys. The campaign combines deceptive branding, bundled credential stealers, and remotely delivered JavaScript, with stolen information routed through infrastructure under bonto[.]io. All three listings were removed before Socket published its findings on October 27, 2026. Phantom’s impersonator advertised […]

The post Hackers Use Fake Phantom, Jupiter, and Bitget Firefox Extensions to Target Cryptocurrency Wallets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A judicial-themed phishing campaign targeting Colombian organizations that delivers XWorm through obfuscated scripts, encrypted PowerShell, and a reusable .NET loader. The recovered loader is binary-identical to one documented in a September 10, 2026, UK-linked case, connecting otherwise differently packaged delivery chains. The overlap establishes loader reuse, not common attribution. Different payload hashes, execution targets, and […]

The post Hackers Reuse XWorm Malware Loader Across Phishing Campaigns Targeting Colombia and the UK appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Japan’s GMO Internet Group urged Onamae.com Desktop Cloud customers to back up their data, disconnect computers from networks, shut them down, and unplug connected cables after suspected attackers threatened to publish customer information and launch ransomware at noon on October 27. The emergency instructions followed unauthorized access to the company’s cloud desktop service and an […]

The post Japan’s GMO Internet Warns Customers to Unplug PCs as Hackers Threaten Ransomware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Attackers are compromising camera management software to gain remote access, run malicious DLLs through a legitimate Windows component, and maintain persistent footholds in enterprise environments. The incidents show how overlooked surveillance applications can become entry points into broader corporate networks. Huntress observed several intrusions during September and October involving CMS.exe, a camera management application installed […]

The post Hackers Hijack Camera Management Software to Deploy Reverse Shells and Hidden Windows Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Threat actors targeting Japanese organizations are using artificial intelligence to automate intrusion workflows, speed up attack planning, and develop credential-theft tools, according to an investigation of three exposed attack infrastructures. The findings show distinct levels of AI involvement, from autonomous agents conducting attacks to experienced operators using generated scripts. The research follows Japan’s National Cybersecurity […]

The post AI-Powered Hackers Target Japanese Companies With Automated Attacks and Credential Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers have abused Indian government and educational domains to promote illegal gambling websites through Google Search, using unauthorized DNS changes to establish malicious subdomains while leaving legitimate websites operational. Another delegated government subzones to third-party nameservers, enabling broader control over subordinate DNS records. The technique, called domain shadowing, allows attackers to misuse an organization’s domain […]

The post Hackers Abuse Indian Government Domains to Push Illegal Gambling Websites Through Google Search appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Research has identified 42 weaponized GitHub repositories belonging to 11 legitimate owners in the testmetest npm campaign, exposing an operation that combines credential theft, development-tool execution hooks, and malicious package publishing. The findings establish that the campaign extended beyond attacker-controlled test packages into established developers’ repositories. Researchers Guy Korolevski and Yair Benamou uncovered oversized payload […]

The post Malicious npm Campaign Hijacks 42 GitHub Repositories to Steal Credentials and Spread Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cisco Talos identified roughly 1,400 scam emails delivered through legitimate Staples and Dell order notification systems, exposing how attackers can insert fraudulent support instructions into authenticated transactional messages. The findings fit a wider pattern: Talos observed abuse across more than 25 legitimate platforms over the past year, including collaboration, productivity, payments, file sharing, surveys, and […]

The post Cisco Talos Uncovers 1,400 Scam Emails Sent Through Staples and Dell Order Notification Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A previously undocumented Sirius backdoor variant during a priority customer investigation, revealing a multistage campaign that hides malicious code inside legitimate Windows processes. The supplied analysis details stealthy remote access and persistence, although it does not establish specific password extraction capabilities. The financial urgency and regional tailoring reflect established phishing techniques that exploit trust in […]

The post New Sirius Backdoor Hides Inside Windows Processes to Steal Passwords and Evade Detection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Attackers have compromised at least 17 internet-exposed Cairn AI penetration-testing panels, turning autonomous security agents against their own infrastructure to steal credentials, establish unauthorized access, and deploy malware. Victims included panels associated with suspected criminal operations, alongside instances apparently used for legitimate red teaming, bug bounty research, and capture-the-flag challenges. The attacks exploit unauthenticated administrative […]

The post Hackers Compromise 17 Exposed AI Pentesting Panels to Deploy Malware and Steal Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers are buying Google Ads to promote fake Claude download pages hosted on Anthropic’s legitimate claude.ai domain, exploiting content-sharing features to distribute malware. The operation does not require compromising Anthropic’s infrastructure. Attackers publish malicious instructions through Shared Chats and public Artifacts, borrowing the platform’s domain and branding while persuading visitors to execute commands themselves. The […]

The post Hackers Use Google Ads to Push Fake Claude Downloads Hosted on Real Claude.ai Domain appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers are injecting JavaScript into Magento CMS blocks to maintain access to compromised storefronts while selectively hiding malicious responses from security scanners. Registered on October 6, 2026, the domain appeared on infected stores the following evening. Sixty of the 83 victims previously loaded infrastructure belonging to the same operator, including 34 infected since October 2025. […]

The post Hackers Abuse Magento CMS Blocks to Infect Online Stores and Evade Malware Detection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

More than 400 incidents in which attackers abused Microsoft Teams external chats to impersonate IT support, obtain remote access, and deliver malware. Researchers identified recurring tenant names, deceptive display names, remote administration tools, and payload infrastructure across incidents. Teams federation, enabled by default, allows communication between organizations when both tenants permit external access. Attackers exploit […]

The post Fake Microsoft Teams IT Support Messages Lead to Remote Access and Malware Infections appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers accessed Microsoft 365 environments at 79 organizations by replaying stolen sign-in sessions, letting them enter business accounts without victims’ passwords. Huntress recorded 497 successful sign-ins and more than 200,000 failed attempts during the ten-week campaign, which ran from July 14 through September 22, 2026. Use of the provider’s network does not establish its involvement […]

The post Microsoft 365 Token Replay Attacks Let Hackers Access Business Emails Without Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cybercriminal groups are using malicious Instagram advertisements, abandoned analytics tags, and compromised websites to deliver Coruna and DarkSword exploit kits to vulnerable iPhones. The investigation exposes a scalable spyware distribution model in which attackers exploit advertising infrastructure to reach victims during ordinary browsing. Researchers describe these as “half-click” attacks: users must encounter an infected webpage […]

The post Hackers Use Instagram Ads to Deploy Coruna and DarkSword Spyware on iPhones appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers abused compromised ConnectWise Cloud Backup application credentials to access Microsoft 365 environments, escalate privileges, and plant persistent credentials. Microsoft attributed the campaign to Storm-0940, a China-state-aligned threat actor using ARTEX, an open-source agentic AI framework, to accelerate downstream attacks against more than 2,250 tenants. Successful authentication, however, does not establish data theft. Huntress initially […]

The post Hackers Abuse ConnectWise Cloud Backup Credentials to Launch AI-Driven Microsoft 365 Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly observed infostealer called Aokigahara is targeting AI coding assistants, developer workstations, and cloud credentials, expanding credential theft beyond browsers and cryptocurrency wallets. The targets include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant. Rather than exploiting an identified vulnerability in these products, the malware […]

The post New Malware Targets AI Coding Tools to Steal Login Tokens, SSH Keys, and Cloud Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.