Zero Day Wire - Zero Day Wire (Page 8)

Breaches

PayPal Confirms Six-Month Data Exposure After Loan System Code Error Leaked Social Security Numbers

PayPal has confirmed a data exposure incident affecting its Working Capital (PPWC) business loan service, where a software code change left sensitive customer information accessible for nearly six months before being detected. The exposure ran from 1 July 2025 to 12 December 2025, when the error was finally discovered and

Threats

AWS Reports 600+ FortiGate Firewalls Compromised in AI-Augmented Campaign by Russian-Speaking Cybercrime Group

A financially motivated Russian-speaking cybercrime group compromised more than 600 internet-exposed FortiGate firewalls across 55 countries in just over a month, using off-the-shelf generative AI tools to scale an operation that would traditionally require a well-resourced team, according to a new incident report from AWS.

Threats

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security

Threats

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

Threats

Massiv Android Banking Trojan Disguised as IPTV Apps Enables Full Device Takeover for Financial Fraud

ThreatFabric has disclosed a new Android banking trojan called Massiv that masquerades as IPTV streaming apps to gain access to victims' devices, enabling full remote control and financial fraud through device takeover attacks. Although currently observed in a limited number of targeted campaigns, the malware already poses significant risk

Threats

CRESCENTHARVEST Campaign Deploys RAT Malware Against Iran Protest Supporters Using DLL Sideloading via Signed Google Binary

Acronis Threat Research Unit (TRU) has disclosed a new espionage campaign dubbed CRESCENTHARVEST that targets supporters of Iran's ongoing protests with a custom remote access trojan designed for long-term surveillance and data theft. The campaign, observed since January 9, 2026, is believed to be the work of

Threats

Underground Telegram Channels Weaponize SmarterMail Exploits Within Days of Disclosure, Enabling Ransomware Campaigns

Researchers at Flare have documented the rapid weaponization of critical SmarterMail vulnerabilities across underground Telegram channels, showing how threat actors moved from disclosure to exploit sharing to ransomware deployment in a matter of days. The activity centers on two critical vulnerabilities — CVE-2026-24423 (CVSS 9.3), an unauthenticated remote

Threats

APT UNC6201 Exploited Dell Zero-Day Since Mid-2024, Deploying Novel Grimbolt Backdoor and ESXi Ghost NICs

Mandiant and the Google Threat Intelligence Group (GTIG) have disclosed that a suspected Chinese state-backed threat group tracked as UNC6201 has been exploiting a maximum-severity Dell zero-day vulnerability since mid-2024 — remaining undetected in victim networks for over 18 months. The vulnerability, CVE-2026-22769, is a

Threats

SmartLoader Campaign Trojanizes Oura MCP Server With Fake GitHub Network to Deploy StealC Infostealer

A new SmartLoader campaign is targeting developers through trojanized AI tooling — cloning a legitimate Model Context Protocol (MCP) server for Oura Health's smart ring and distributing it through the MCP Market registry to deliver the StealC infostealer. The campaign, documented by Straiker's AI Research (STAR) Labs,

Threats

Kaspersky Uncovers Keenadu Backdoor Pre-Installed in Android Firmware Across Multiple Device Brands

Kaspersky researchers have identified a new Android malware family called Keenadu that is being distributed through compromised device firmware, system apps, and even Google Play — giving attackers complete control over infected devices and the ability to compromise every application installed on them. As of February 2026, Kaspersky has confirmed 13,

Threats

Check Point Demonstrates AI Chatbots as Covert C2 Channels — Grok and Copilot Exploited Without Authentication

Check Point Research (CPR) has published findings showing that AI assistants with web-browsing capabilities can be weaponized as covert command-and-control infrastructure — allowing malware to communicate with attacker servers through trusted AI domains that blend seamlessly into normal enterprise traffic. The technique was demonstrated against Grok and Microsoft

Threats

Microsoft Exposes "AI Recommendation Poisoning" — Businesses Secretly Manipulating Chatbot Memory via Summarize Buttons

Microsoft's Defender Security Research Team has uncovered a widespread campaign in which legitimate businesses are embedding hidden prompt injection commands inside "Summarize with AI" buttons on their websites — hijacking AI assistant memory to bias future recommendations in their favor. The technique, which Microsoft has dubbed AI