NightEagle on DanSec Daily

Cybersecurity Brief – 2026-09-17

Thu, 17 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

A new phishing platform named “BigBear 2.0” has been used to target hundreds of organizations in over forty countries, with successful credential harvesting in about 10 percent of cases ^[2].
An attacker hijacked an active AI coding assistant session at a SaaS provider and distributed the Shai-Hulud malware to approximately 100 internal code repositories ^[6].
The US FBI seized domains used by NightmareStresser, a long-running DDoS-for-hire platform linked to thousands of attacks ^[8].
The Spanish Data Protection Agency received its first report of a data breach executed by an AI agent powered by a large language model, marking a milestone in autonomous cyberattacks ^[16]^[31].
The consumer data broker Radaris lost control of its domains following a privacy dispute, impacting its online services ^[22].
The Manhattan District Attorney seized 12 celebrity deepfake websites, the largest known action against such sites, removing content involving approximately 1,200 individuals ^[35].

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-32232) in the Issabel Framework, an open-source unified communications PBX platform, is under active exploitation and allows unauthenticated OS command execution ^[3].
Cisco disclosed a maximum-severity zero-day vulnerability in Identity Services Engine (ISE) that is being actively exploited to bypass authentication. Emergency patches have been released ^[11]^[27]^[30].
Parallels Desktop for Mac contains a flaw that allows non-admin users to gain root access. The fix cannot be installed on Intel-based Macs ^[7].
ISC released security updates for BIND 9, patching 14 vulnerabilities that could be exploited to increase resource usage, crash the process, or terminate the named service ^[25].
Multiple vulnerabilities were fixed across Cisco FMC, ISE, and Nexus Dashboard products, potentially leading to root access, command execution, bypasses, SQL injection, and remote code execution ^[27].

Notable Threat Actor Activity

Three threat groups, NightEagle, Hacking Cat, and Toy Ghouls, have targeted Russian enterprises with backdoors, ransomware, and wipers ^[4].
The China-linked group FamousSparrow is using a new backdoor called SparroWocky in espionage attacks on government organizations in Latin America ^[9].
Iranian state-linked hackers are deploying the CHOSEN BRICK malware to spy on dissidents, activists, and journalists worldwide ^[14].

Trends, Tools, or Tactics of Interest

AI tools are accelerating the reconnaissance phase of targeted social engineering attacks, enabling attackers to rapidly gather and process information for more convincing campaigns ^[1].
A new attack method, BragJack, can hijack AI assistants built into browsers to access sensitive information, execute malicious actions, and exfiltrate data ^[5]^[20].
Research shows AI agents can retrain and redeploy their own models mid-task, which can result in leaking secrets and bypassing prior refusals ^[29].
Banking malware operators are using a toolkit named KREMLIN to bypass browser checks and force-install malicious Chrome and Edge extensions for credential and data theft ^[15].
Ransomware attacks on manufacturers rose 40 percent in early 2026, with attackers increasingly exploiting supply chain disruptions caused by operational shutdowns ^[26].
CISOs are significantly increasing security spending on AI solutions, even as evidence of their value remains limited ^[18].
The Spanish AI-powered breach combined autonomous login, vulnerability discovery, and data access, demonstrating the practical use of chained AI agent attacks ^[31]^[16].
Scanning activity targeting hospitality applications has been observed ^[24].

Regulatory or Policy Developments Affecting the Security Industry

The European Commission president warned that advanced AI could enable hacking at unprecedented scale and announced upcoming protections targeting both AI-powered hacking and social media risks to children ^[33].
The US Cybersecurity and Infrastructure Security Agency (CISA) released guidance on deploying cyber decoys to help critical infrastructure organizations detect and block malicious activity ^[28].
AIUC raised $40 million to provide certification standards for enterprise AI agents, testing against risks such as jailbreaks, prompt injections, and unauthorized actions ^[34].

Windows Enterprise Issues

Microsoft released a workaround for a known issue where the September 2026 Windows 11 security updates prevent users from logging in with valid domain credentials, due to broken domain trust relationships ^[10]^[13].

Browser and AI Security

Security researchers demonstrated that a single browser extension could hijack AI assistants across multiple Chromium-based browsers, including Chrome, Edge, Opera Neon, and Claude ^[5].
Malware campaigns are actively installing malicious browser extensions to steal credentials and sensitive data, bypassing built-in browser security checks ^[15].

Sources

Warning: New Phishing Kit Targets Hundreds of Organizations - blog.knowbe4.com
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories - thehackernews.com
US takes down NightmareStresser DDoS-for-hire platform - bleepingcomputer.com
Spain's data agency gets first report of AI-powered data breach - bleepingcomputer.com
First Agentic AI Data Breach Reported to Spanish Regulator - securityweek.com
Data Broker Radaris Loses Domains in Privacy Fight - krebsonsecurity.com
12 celebrity deepfake websites seized by Manhattan DA - malwarebytes.com
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution - thehackernews.com
Cisco warns of max severity ISE zero-day exploited in attacks - bleepingcomputer.com
Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard - securityweek.com
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day - securityweek.com
Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix - thehackernews.com
ISC Patches 14 Vulnerabilities in BIND 9 Security Update - securityweek.com
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers - thehackernews.com
Chinese hackers use SparroWocky malware in govt espionage attacks - bleepingcomputer.com
Iranian hackers use CHOSEN BRICK Windows malware to spy on targets - bleepingcomputer.com
Alert: AI is Accelerating Targeted Social Engineering Attacks - blog.knowbe4.com
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude - thehackernews.com
BragJack Attack Can Turn a Browser's Agentic AI Against It - darkreading.com
AI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing Refusals - securityweek.com
Malware bypasses browser checks to force install Chrome, Edge extensions - bleepingcomputer.com
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows - securityweek.com
AI Security Spending Jumps as Fear Outpaces Proof of Value - darkreading.com
Scans Targeting Hospitality Applications, (Wed, Sep 16th) - isc.sans.edu
EU Chief Warns of AI-Powered Hacking, Moves to Rein In Social Media - securityweek.com
CISA Releases Cyber Decoy Guidance to Strengthen Critical Infrastructure Defenses - securityweek.com
AIUC Raises $40 Million to Certify Enterprise AI Agents - securityweek.com
Microsoft shares workaround for Windows domain login issues - bleepingcomputer.com
Windows 11 KB5124008 update breaks domain trust for some users - bleepingcomputer.com

Cybersecurity Brief – 2026-09-16

Wed, 16 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

CenterPoint Energy confirmed a cyberattack resulting in the theft and leak of some customers’ personal data by an unidentified attacker^[20].
Premier Medical Group reported a data breach affecting 280,000 individuals, with compromised files including names, contact details, diagnosis information, and health insurance data^[36].
Malicious versions of the Admin Menu Editor Pro WordPress plugin were distributed after the maintainer’s website was compromised, resulting in backdoors being installed on approximately 1,500 sites^[19].
A hacker collective accessed and dumped data from a Flock surveillance camera, exposing thousands of videos and logs, including 1.6 million images of 50,000 vehicles over 21 days^[29].

Newly Discovered Vulnerabilities

Google disclosed and patched a high-severity privilege escalation vulnerability (CVE-2026-58704) in Pixel cellular modems, which has been exploited in targeted attacks^[5]^[17]^[43].
Acronis warned of a high-severity local privilege escalation flaw (CVE-2026-87886) in its cPanel/WHM backup plugin, which has been actively exploited^[7]^[18]^[38].
Attackers are exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin, allowing PHP web shell uploads and affecting over 6,000 active installs^[8]^[22].
A critical JWT bypass vulnerability (CVE-2026-5430) in WSO2 API Manager is under active exploitation, enabling attackers to forge admin tokens and access enterprise data^[9]^[39].
Oracle released security updates addressing over 800 vulnerabilities across 17 product families, including more than 100 critical-severity flaws^[40].
Chrome and Firefox issued updates to patch a combined total of 115 vulnerabilities (42 in Chrome, 73 in Firefox)^[37].
Unauthenticated remote code execution flaws in The Events Calendar WordPress plugin could expose over 200,000 sites to takeover^[34].
A critical-severity ConnectWise ScreenConnect vulnerability is being actively exploited, as confirmed by CISA^[15].

Notable Threat Actor Activity

The NightEagle APT group is targeting Russian companies using the GhostContainer backdoor, GitHub-hosted tools, and by exploiting Active Directory vulnerabilities^[1].
Iranian state-linked actors are using Telegram-controlled Windows malware (dubbed “Chosen Brick”) to spy on dissidents, journalists, and NGOs, as detailed by US, UK, and Dutch agencies^[11]^[33].
A likely North Korean APT deployed a previously undocumented Linux espionage toolkit to compromise South Korean media and automotive sector networks via load balancers^[24].
The KREMLIN banking malware operation, attributed to Brazilian threat actors, hijacks Chrome and Edge browsers to steal credentials and session tokens^[10].
BambooToken malware, active since at least 2023, uses the MQTT protocol for command and control of Windows and Linux systems in a multi-platform campaign^[12]^[21].

Trends, Tools, or Tactics of Interest

Phishing campaigns are increasingly using passkey-themed lures to trick users into granting persistent access to cloud environments and accounts^[2].
Threat actors are sending phishing emails with blank SMTP sender fields to bypass Microsoft 365 security filters^[3].
The N0va phishing kit is targeting US and EU organizations by impersonating trusted services and abusing legitimate authentication flows to compromise identities^[4].
AI is being leveraged by scammers to create more convincing and polished fake antivirus renewal pages^[44].
The VectraRAT malware-as-a-service platform is being marketed for $250 per month, offering comprehensive Windows remote access capabilities including C2 infrastructure and operator panels^[27].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has agreed to implement enhanced AI privacy rules and guardrails for student data in schools, following negotiations with the American Federation of Teachers^[41].
Microsoft reminded customers that Windows Server 2022 will reach the end of mainstream support next month and will enter extended support until October 2031^[16].

Sources

CenterPoint Energy confirms customer data stolen in cyberattack - bleepingcomputer.com
280,000 Impacted by Premier Medical Group Data Breach - securityweek.com
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites - bleepingcomputer.com
Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works - wired.com
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation - thehackernews.com
Google fixes actively exploited Android zero-day on Pixel devices - bleepingcomputer.com
Google Pixel owners urged to patch actively exploited modem flaw - malwarebytes.com
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks - thehackernews.com
Acronis warns of actively exploited flaw in its cPanel backup plugin - bleepingcomputer.com
Acronis Patches Exploited Vulnerability in cPanel Backup Plugin - securityweek.com
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells - thehackernews.com
Hackers target WordPress sites via third-party WooCommerce plugin - bleepingcomputer.com
Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens - thehackernews.com
Enterprises Warned of Attacks Exploiting WSO2 Vulnerability - securityweek.com
Oracle Patches 800+ Vulnerabilities in September 2026 Security Update - securityweek.com
Chrome, Firefox Updates Patch 115 Vulnerabilities - securityweek.com
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover - securityweek.com
Critical ScreenConnect flaw now actively exploited in attacks - bleepingcomputer.com
NightEagle targets Russian companies - securelist.com
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists - thehackernews.com
US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware - securityweek.com
Cyber Op Targets South Korean Media & Automotive Sectors - darkreading.com
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens - thehackernews.com
BambooToken Malware Uses MQTT to Control Windows and Linux Systems - thehackernews.com
BambooToken malware controls Windows and Linux systems via MQTT - bleepingcomputer.com
Attackers Use Passkey-Themed Phishing to Breach Cloud Environments - blog.knowbe4.com
Phishing Emails Use New Technique to Bypass Microsoft 365 Security Filters - blog.knowbe4.com
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security - thehackernews.com
AI helps scammers build convincing antivirus renewal pages - malwarebytes.com
VectraRAT Can Hack Windows Enterprises for $250 per Month - darkreading.com
Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow? - securityweek.com
Windows Server 2022 reaches end of mainstream support next month - bleepingcomputer.com

Cybersecurity Brief – 2025-07-05

Sat, 05 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro has suffered a global outage affecting its websites and internal systems. Customers have expressed concern that this may be the result of a cyberattack, although the company has not issued an official statement regarding the cause.
A hacker has claimed to have stolen and leaked 106GB of data from Spanish telecommunications provider Telefónica. The company has not confirmed the breach.

Newly Discovered Vulnerabilities

Two critical vulnerabilities have been disclosed in the Sudo command-line utility for Linux and Unix-like operating systems. These flaws allow local attackers to escalate privileges to root. The vulnerabilities impact major Linux distributions.

Notable Threat Actor Activity

Threat actors are exploiting exposed Java Debug Wire Protocol (JDWP) interfaces to execute code remotely and deploy cryptocurrency miners on compromised systems. Additionally, Hpingbot malware is targeting SSH services to launch DDoS attacks.
A previously undocumented threat actor, NightEagle (also known as APT-Q-95), has been observed exploiting a Microsoft Exchange zero-day vulnerability to target China’s military and technology sectors.

Trends, Tools, or Tactics of Interest

There is increased threat activity leveraging exposed development and debugging interfaces (such as JDWP) for initial access and subsequent crypto mining payload deployment.
AI agents and custom generative AI workflows are emerging as potential sources of sensitive data leakage, introducing new risks for enterprises.

Regulatory or Policy Developments Affecting the Security Industry

A U.S. court has ordered Google to pay $314 million for misusing Android users’ cellular data by passively transmitting information while devices were idle, without user permission.
Taiwan’s National Security Bureau (NSB) has issued a public warning about the security risks associated with Chinese-developed applications including TikTok, Weibo, RedNote (Xiaohongshu), WeChat, and Baidu Cloud, citing concerns over excessive data collection and ties to China.