PPHM HACKER NEWS

Trusted Admin Software Becomes a Stealth Gateway Into Windows Networks

Threat actors are abusing legitimate remote-management software in a multi-stage phishing campaign that gives them persistent control over Windows systems while allowing malicious activity to resemble ordinary IT administration.

🔗 Read More

🔴 Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader

Europol says a 16-year-old is believed to be the administrator and main operator of KillSec, a ransomware group linked to roughly 1,000 suspected attacks worldwide.

The teen was identified in Operation KillSwitch, an international investigation led by police and prosecutors in Germany. Authorities made three provisional arrests and searched eight homes in Greece, Romania, Spain, and the UK.

Investigators also identified a suspected developer who turned 18 in August, as well as one suspected negotiator and one suspected affiliate. The hunt for other possible members continues.

🔴 Warlock Ransomware Hits Large Spanish, Portuguese Orgs

A Chinese ransomware outfit is exploiting Microsoft technologies to extort large and critical organizations in the Spanish- and Portuguese-speaking world.

The Warlock ransomware group — tracked by Symantec as "Longlegs" and by Microsoft as "Storm-2603" — has never fit neatly into any box. It surfaced in the summer of 2025, in a campaign that mirrored state-level espionage activity in its tactics, techniques, and procedures (TTPs). Yet it acted like a cybercrime gang, deploying ransomware against organizations without any apparent discrimination.

🔴 Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure

Hackers started exploiting a high-severity OS command injection vulnerability in Zimbra Collaboration Suite (ZCS) shortly after patches were rolled out, before public disclosure, Microsoft reports.

Tracked as CVE-2026-73570 (CVSS score of 8.9), the flaw exists because, in ZCS before 10.1.20, untrusted input during SNMP notification processing is improperly sanitized.

Thus, if the zimbra-snmp package has been installed and SNMP notifications have been enabled, an attacker could trigger the security defect via specially crafted SMTP requests.

🔴 Google Cloud and Firebase Service Account Credentials Offered for Sale

A collection of 2,690 Google Cloud and Firebase service account credentials is being offered for sale on a forum.

The seller claims the credentials are valid and provided as JSON service account files, with the entire collection being sold as a single package.

A sample shown in the listing contains fields associated with a Google Cloud service account, including a project ID, private key ID, private key, client email, client ID, and Google authentication endpoints.

The seller is asking $7,500 for the collection and states that full escrow is accepted.

🔴 Kevin Mandia’s Armadin Raises $255 Million at $2.5 Billion Valuation

Armadin, the AI-native cybersecurity startup founded by Mandiant founder Kevin Mandia, has raised $255.5 million in Series B funding at a valuation topping $2.5 billion.

The company has now raised a total of $445 million only seven months after its public launch.

Mandia founded Mandiant in 2004 and sold the incident response and threat intelligence firm to FireEye in a $1 billion deal in 2014 before its later $5.4 billion acquisition by Google

Andreessen Horowitz and existing investor Accel co-led the round, with participation from new investors Bain Capital Ventures and Redpoint.

🔴 Treasury Blacklists Most-Wanted ATM Malware Developer and His Network

The US Treasury Department has sanctioned the alleged developer of malware used in ATM jackpotting attacks linked to Tren de Aragua (TdA), along with members of his network and two Mexico-based companies.

Anibal Alexander Canelon Aguirre, known as ‘Prometheus,’ was added in March to the FBI’s Ten Most Wanted Fugitives list, becoming the first person on the list wanted for cybercrimes. Treasury describes him as “the alleged engineer of the malware used in ATM jackpotting attacks.” TdA typically uses the malware named Ploutus.

Canelon Aguirre’s network is based in Mexico and Venezuela but targets ATMs in the United States. The stolen cash is laundered, including through cryptocurrency, and moved to TdA members in various countries.

🔴 Homes.com Real Estate Agent Dataset With 1.16 Million Profiles Offered for Sale

A large dataset containing information on U.S. real estate agents sourced from Homes.com has been offered for sale.

The seller claims the collection contains more than 1.16 million unique agent profiles and is provided as a relational SQLite dataset, with CSV files available on request. The full dataset is listed at approximately 15.2 GB, or 5.74 GB compressed.

The records include names, direct email addresses, phone numbers, real estate license numbers, brokerage and company information, physical addresses, sales history, deal metrics, geographic coordinates, and social media links.

The collection also includes property listing history, MLS identifiers, buyer and seller transaction data, agent reviews, and neighborhood coverage information.

🔴 Zammad Zero-Days Exploited in AI-Powered DIVD Hack

The Dutch Institute for Vulnerability Disclosure (DIVD) was hacked in an automated AI attack that exploited two zero-day vulnerabilities in the web-based, open source user support/ticketing solution Zammad.

The attack occurred on September 21, triggering full incident response, including blocked access to the DIVD infrastructure. The organization immediately started investigating the incident and notified the relevant Dutch authorities.

“This is an attack we have not seen before. Not because it’s our first, but because the modus operandi indicates that this is an agentic AI-powered attack,” it said in a September 24 post on LinkedIn.

Poisoned Dependencies Turn Developer Workstations Into Cloud Entry Points

Software supply-chain attacks are expanding beyond source-code manipulation as threat actors increasingly use trusted dependencies to steal credentials from developer workstations and CI/CD environments.

🔗 Read More

🔴 500,000 Active Credentials Left Exposed on GitHub

Truffle Security has discovered over half a million active unique credentials exposed in public GitHub repositories.

A total of 1,103,438 exposed credentials were discovered through the scanning of 224 million public GitHub repositories in August 2025.

At the end of July 2026, the security firm tested the credentials against their services and found that 543,699 of them were still active.

The oldest is an AWS key that was committed in 2009 and has remained untouched since. The median exposure window across the set is 784 days.

🔴 Losing gamblers pushed to bet more by DraftKings’ AI, report says

Two separate investigations have raised concerns about betting site DraftKings’ marketing to target problem gamblers, including its use of AI. On September 19, the New York Times reported that the company’s machine learning model targeted people who were more likely to respond to betting promotions by gambling and losing more money.

The model crunched data on each customer, including how often they bet, how much they lost, and what their daily account balances were. According to the report, it used this information to send targeted advertising to lure those people back to the site with promotions. DraftKings uses promotions to entice users into betting more. These offers include profit boosts on winnings.

🔴 108 security bugs affect Google Chrome 154

Google has released Chrome 154, one of the most extensive security patches in recent memory. Developers have fixed 108 vulnerabilities, 11 of which are classified as critical. The update is already rolling out to Windows, macOS, and Linux users.

Critical vulnerabilities have been discovered affecting several key browser components. Three vulnerabilities have been discovered in ANGLE, and two others allow data to be written outside the allowed GPU memory area. Issues have also been discovered in WebGL, ServiceWorker, full-screen mode, WindowDialog, and AdFilter. The ANGLE graphics layer has previously been a source of critical vulnerabilities in previous versions of Chrome.

🔴 French Transparence Santé Dataset With 9.1 Million Records Shared

A dataset containing approximately 9.1 million records from France's Transparence Santé platform has been shared on a forum.

The actor says the information was scraped from publicly accessible French health transparency data rather than obtained through a breach.

According to the post, the dataset includes names, professional information, beneficiary identifiers, organizations, addresses, SIREN numbers, geographic information, dates, financial amounts, agreements, and other records documenting relationships involving healthcare professionals and organizations.

The actor also provided a 1,000-record sample and referenced an API for accessing the information.

🔴 Hackers Hide Microsoft Defender Exclusions From Admins to Evade Antivirus Scans

Threat actors are increasingly abusing Microsoft Defender Antivirus exclusions to keep malicious files outside the reach of endpoint scans, and a little-known policy setting can conceal those exclusions from administrators using normal management tools.

Huntress researchers found that attackers can combine broad Defender exclusions with the HideExclusionsFromLocalAdmins setting, creating a stealthy defense-evasion path that leaves malicious activity unscanned while obscuring evidence of the change.

Microsoft Defender Antivirus (MDAV) exclusions are legitimate administrative controls intended to prevent performance or compatibility problems for trusted software.

🔴 Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests

OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions.

Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub but remain unassigned for several issues.

The recently published advisory impacts ModSecurity’s version 3 engine, libmodsecurity3, and also affects some issues in the version 2 branch. Administrators should update to ModSecurity version 3.0.17 or version 2.9.15, depending on their deployment.

🔴 HPE Instant On AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands

HPE has released security updates for its Networking Instant On access points after identifying 18 vulnerabilities, including several critical flaws that could allow unauthenticated attackers to execute arbitrary code or commands with privileged operating-system access.

These vulnerabilities are detailed in advisory HPESBNW05150 rev. 1 and affect Instant On AP software versions 3.4.1.0 and earlier. HPE recommends that users upgrade to version 3.4.2.0 or later. Fixes will be automatically applied to eligible devices through the Instant On cloud management portal.

🔴 Google Launches Gemini 4 Argon With Guardrail-Free Access for Vetted Defenders

Google announced Gemini 4 Argon, its new frontier AI model, which it is initially rolling out to a select group of trusted cyber defenders through its Fairwind Program.

Google’s internal teams are also using the model. The company says it will expand access gradually as it gathers feedback from early testers.

The tech giant says Argon is designed for complex workflows in software engineering, enterprise knowledge work such as legal and finance, and cybersecurity defense. On the security side, the company says it trained the model to be highly capable at cyber defense, and that it can autonomously find, validate, and patch critical software vulnerabilities.

🔴 AI is making decisions for us. But the real danger is when we stop thinking

A SOC analyst approves an alert without actually verifying it. A team decides to eliminate a human check because it slows down their work: "The system has been working fine for months anyway." These aren't futuristic scenarios. They're situations that can happen today, whenever a security decision is no longer made by a person, but by an automatic result that no one has the time—or the inclination—to question. We can't do without artificial intelligence anymore. And perhaps it wouldn't even make sense to try to reject it.