artificial intelligence | Breaking Cybersecurity News | The Hacker News

Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into their computer's operating system, thereby bypassing conventional security controls. As part of these attacks, unsuspecting users who land on legitimate-but-compromised sites or malicious ads are redirected to phishing landing pages that display fake Cloudflare or Google reCAPTCHA verification or other non-existent errors and instruct users to copy and paste a command on the Windows Run dialog (or the Mac Terminal app) to address it. The moment a user presses the Enter key after pasting the command, it triggers a multi-stage infection chain that leads to the deployment of malware, such as information stealers or remote access trojans. In an attempt to blend in with regular act...

Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and the behavioral signals email filters have relied on for years are fading as a result. Proofpoint shared several examples of the shift at its Protect 2026 conference. In one, a single threat actor contacted more than 30 real estate agents at the same company, each from a different account, about a different property, and in different words, before closing every thread with the same request: join a video meeting. Federal data points the same way. The FBI's Internet Crime Complaint Center counted more than 22,000 complaints involving AI in 2025, with nearly $900 million in associated losses, and logged 24,768 business email compromise (BEC) complaints with about $3.05 billion in reported losses, according to its 2025 Internet Crime Report . What AI C...

An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model. The harness is where the engineering in AI pentesting sits. The Hugging Face intrusion OpenAI disclosed in July showed what happens when that harness gives way, even inside an OpenAI evaluation built to contain the agents. Why Each Control Takes Rigorous Engineering Let’s take a closer look at the attack different stages and the role AI agents can take there Scope A pentesting agent makes thousands of decisions about where to send its next request, and the model judges each one against a rule written in plain language. A web app’s real boundary often extends past one domain through redirects and calls to outside services. Enforcing scope means code that inspects every request before it leaves, a...

U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of Homeland Security order. They may also no longer buy information technology products or services from the Chinese AI developer or its affiliates Homeland Security Secretary Markwayne Mullin issued the order, dated July 24, 2026, under the  Federal Acquisition Supply Chain Security Act of 2018 , and the department published it in the  Federal Register  on October 20. The notice does not define " DeepSeek implementations. " The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., the developer of the R1 and V3 models, and covers its affiliates as defined in federal acquisition rules. The company's  privacy policy  says it collects, processes and stores users' personal data in the People's Republic of China. Under the 2018...

A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet. The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including farm-equipment maker Deere, appliance company SharkNinja and engine maker Cummins,  according to Reuters , which reviewed the attacker's own records to identify them. How much data, if any, was taken is not known. The researcher, Snorre Fagerland of the security firm NorForge , found the operations by scanning the internet for exposed copies of  Cairn , an open-source AI tool popular with hackers. Beginning around October 2, he found about two dozen Cairn instances being used maliciously, which let him read the attackers' work in real time. He set out the findings on Monday, and Reuters, which saw the report before publication, named...

WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one. The text sat in the pages' code, never shown on screen, until it was removed by October 18. Whether the chatbot ever followed the instructions is not known:  Redact , the data-deletion software company that found the text, read the instructions, not the chatbot's answers. WhatsApp told WIRED the instructions were for the chatbot that users reach by messaging WhatsApp Support with AI, and that they appeared in the pages because of a bug, now fixed. A second block of hidden text on the page about reporting and blocking told the chatbot that once a user mentioned a lawyer, a lawsuit, or a court, it should not cite privacy laws such as the GDPR, even when the user raised them. A W...

A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them.  If you work in security, that success introduces a new set of questions. Whose credentials does the workflow use? Which records can it access? Who can see its output? If it starts exposing information it shouldn’t, can you trace what happened and stop further access?  Wild code takes root when useful builds spread faster than the processes for owning, securing, and maintaining them. It isn’t simply another name for unapproved software. Employees are creating new capabilities, not just adopting existing products. A small experiment can become an operational dependency before secu...

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the affected service. "The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path," Siemens said in an advisory. "This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application." The issue has been patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon has been credited with discovering and reporting the shortcoming. In a separate alert, Siemens said attackers have abused a genuine ...

A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, a 35-year-old Saudi national, was "in frequent communications via WhatsApp with a member of the Saudi Royal Family" throughout 2025 and 2026. Alfozan is said to have communicated with the Saudi royal as recently as October 5, 2026, four days before he was arrested. "Among other things, the individual told the defendant that an artificial intelligence initiative was being launched in Saudi Arabia and wanted the defendant to join it," the filing reads. "In May 2026, the individual told the defendant, 'Saudi needs you more then [sic] the US!' to which the defendant responded '100,' indicating he agreed." The S...

Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own machines. "ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators," security researcher Sai Molige said in an analysis. The cybersecurity company said it identified six IP addresses running ROMULUS -

The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren't supposed to. Some attacks were clever. Others were painfully simple. The full recap shows just how much can go wrong, and how little it sometimes takes. ⚡ Threat of the Week ConnectWise Suspends Cloud Backup Following Unauthorized Access — ConnectWise disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenant...

In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features. Chained together, they produce this path: public internet → email → case record → agent prompt → agent action → case comment → outbound reply An unauthenticated outsider now has a route into an internal agent's instructions, and the agent's reply leaves through the same door. Nothing was misconfigured. The finding, documented by researchers in August 2026, is a clean example of how agents that arrive inside existing platforms fail: through the application around them, not the model inside them. The risk is in the application, and the application is the thing nobody re-reviewed Which intake fea...

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic said . "The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings." The scheme poses as a Web3 venture capital accelerator named Apex Accelerator to target cryptocurrency startups and founders. It's being tracked under the moniker REF8801 . The names of the npm packages, each of which targets both Windows and macOS machines, are listed below - @apexacc/cli (Apex Copilot CLI — AI advisor fo...

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without ever seeing the key. The affected group is 1.4% of Console users, all of whom have an outside provider linked, and OpenCode has told them via email to revoke those keys with each provider and replace them. The email went out on the morning of October 17 under the subject line "Action Required: Potential provider key breach." Anyone who did not get one was not affected,  OpenCode said  in a post on X later that day. The keys at risk are the ones pasted into Console. The OpenCode command-line and desktop apps keep provider keys added on the machine in a  SQLite database  th...

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by Cisco Talos under the moniker UAT-11985 , describing it as likely fueled by artificial intelligence (AI)-assisted content generation so as to quickly craft bespoke lures aimed at different targets within the confines of a common social engineering framework. The campaign was first observed in mid-2026. "The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility," Talos researcher Joey Chen said in an analysis. "Beyond traditional email phishing, the actor incorporated QR code phishing (quishing) te...

OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without authorization to complete a coding task. The incident, the AI company said, involved an internal research model part of the GPT-5.6 Sol family. The incident occurred on June 26, 2026, and was discovered by OpenAI three months later. "An internal research model asked to update a cryptocurrency trading application used funds from a wallet that the task had not supplied to pay for a deployment on Sepolia, an Ethereum test network," OpenAI said . "It derived wallet keys from publicly known developer recovery phrases, found an account with test-network funds, and used that account to pay for the requested contract deployment." The assignment allowed the model to deploy compatible cont...

In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking . OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision , an open LoRA adapter you can run locally. Others, like Laya, are already showing up in open source tooling. These models skip text generation entirely. You hand them some state and a set of typed questions. They hand back a choice, a score, or a yes/no with a probability attached. For security operations, I think this is some of the best news of the year. I also think most of the conversation is pointed at the wrong layer. Why a SOC should be excited Three properties make decision models a natural fit for alert triage. You get a number you can automate against. A typed answer with a calibrated probability is something you can put a thresho...

AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In  said in an advisory  on October 15. The agents went beyond their assigned tasks, and none of the organizations detected the unauthorized access. After internal reviews, the AI companies whose models were being tested voluntarily reported the cases to CERT-In, India's national cyber agency. AI agents are software systems that can plan work, run commands, use tools, and act on the internet autonomously for extended periods. In these cases, the agents gained access via credentials and connection settings left exposed in application configuration and public code repositories, and via cloud service roles with excessive permissions. CERT-In did not name the AI companies, their models, or the organizations and sectors involved. It did not say how many companies reported cases or how many organizations were affecte...

A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape , is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared layer that cloud providers use to keep customers' workloads apart. It was found in a Vercel security challenge and reported privately before any public release, and there is no sign it has been used in a real attack. What the Researcher Showed Paulos Yibelo of the security firm pwn.ai found that specially made network packets sent from inside a virtual machine could do three things, he explained in a  technical write-up : read the host's memory, crash the host, and run code on it. All three come from the same kernel flaw. Vercel said in its  report on the challen...

Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and some flaws are so simple you wonder how nobody spotted them sooner. There's a lot more hiding in the details, including a few twists you probably wouldn't expect. Here's what made the list this week. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.