Zero Day Wire - Zero Day Wire (Page 6)

Threats

CRESCENTHARVEST Campaign Deploys RAT Malware Against Iran Protest Supporters Using DLL Sideloading via Signed Google Binary

Acronis Threat Research Unit (TRU) has disclosed a new espionage campaign dubbed CRESCENTHARVEST that targets supporters of Iran's ongoing protests with a custom remote access trojan designed for long-term surveillance and data theft. The campaign, observed since January 9, 2026, is believed to be the work of an

Threats

Underground Telegram Channels Weaponize SmarterMail Exploits Within Days of Disclosure, Enabling Ransomware Campaigns

Researchers at Flare have documented the rapid weaponization of critical SmarterMail vulnerabilities across underground Telegram channels, showing how threat actors moved from disclosure to exploit sharing to ransomware deployment in a matter of days. The activity centers on two critical vulnerabilities — CVE-2026-24423 (CVSS 9.3), an unauthenticated remote code execution

Threats

APT UNC6201 Exploited Dell Zero-Day Since Mid-2024, Deploying Novel Grimbolt Backdoor and ESXi Ghost NICs

Mandiant and the Google Threat Intelligence Group (GTIG) have disclosed that a suspected Chinese state-backed threat group tracked as UNC6201 has been exploiting a maximum-severity Dell zero-day vulnerability since mid-2024 — remaining undetected in victim networks for over 18 months. The vulnerability, CVE-2026-22769, is a hardcoded-credential flaw in Dell RecoverPoint for

Threats

SmartLoader Campaign Trojanizes Oura MCP Server With Fake GitHub Network to Deploy StealC Infostealer

A new SmartLoader campaign is targeting developers through trojanized AI tooling — cloning a legitimate Model Context Protocol (MCP) server for Oura Health's smart ring and distributing it through the MCP Market registry to deliver the StealC infostealer. The campaign, documented by Straiker's AI Research (STAR) Labs,

Threats

Kaspersky Uncovers Keenadu Backdoor Pre-Installed in Android Firmware Across Multiple Device Brands

Kaspersky researchers have identified a new Android malware family called Keenadu that is being distributed through compromised device firmware, system apps, and even Google Play — giving attackers complete control over infected devices and the ability to compromise every application installed on them. As of February 2026, Kaspersky has confirmed 13,

Threats

Check Point Demonstrates AI Chatbots as Covert C2 Channels — Grok and Copilot Exploited Without Authentication

Check Point Research (CPR) has published findings showing that AI assistants with web-browsing capabilities can be weaponized as covert command-and-control infrastructure — allowing malware to communicate with attacker servers through trusted AI domains that blend seamlessly into normal enterprise traffic. The technique was demonstrated against Grok and Microsoft Copilot, both of

Threats

Microsoft Exposes "AI Recommendation Poisoning" — Businesses Secretly Manipulating Chatbot Memory via Summarize Buttons

Microsoft's Defender Security Research Team has uncovered a widespread campaign in which legitimate businesses are embedding hidden prompt injection commands inside "Summarize with AI" buttons on their websites — hijacking AI assistant memory to bias future recommendations in their favor. The technique, which Microsoft has dubbed AI

Threats

GS7 Threat Group Targets Fortune 500 Financial Institutions With Near-Perfect Brand Impersonation in Operation DoppelBrand

A financially motivated threat group tracked as GS7 has been running a large-scale phishing operation against Fortune 500 financial institutions, constructing near-perfect replicas of corporate login portals to harvest credentials and deploy remote access tools, according to research published by SOCRadar. The campaign, dubbed Operation DoppelBrand, was first observed between

Threats

Infostealers Begin Targeting OpenClaw AI Agent Configuration Files, Stealing Gateway Tokens and Cryptographic Keys

Information-stealing malware has been caught exfiltrating configuration files from OpenClaw, the rapidly growing open-source AI agent platform, in what researchers describe as the first observed case of infostealers targeting AI agent infrastructure. "This finding marks a significant milestone in the evolution of infostealer behavior: the transition from stealing browser

Threats

Former L3Harris Cyber Executive Sold Eight Zero-Day Exploit Kits to Russian Broker, DoJ Reveals

A former senior executive at L3Harris's cyber subsidiary Trenchant sold eight zero-day exploit kits to a broker who regularly provided exploits to the Russian government, according to a sentencing memorandum published by the US Department of Justice. Peter Williams, the former General Manager of Trenchant, pleaded guilty to

Threats

Hijacked Google Ads and Fake Claude AI Guides Used to Deliver MacSync Infostealer Through ClickFix Campaign

Attackers are hijacking verified Google Ads accounts and abusing a public Claude AI artifact page to deliver the MacSync infostealer to macOS users through ClickFix social engineering, according to researchers at Moonlock Lab. The campaign combines three distinct social engineering layers — hijacked advertising infrastructure, trusted AI platform content, and Terminal

Breaches

ShinyHunters Claims 600,000 Customer Records From Canada Goose as Third-Party Payment Processor Breach

Data extortion group ShinyHunters has published over 600,000 customer records from Canadian luxury outerwear brand Canada Goose, including personal information, partial payment card data, and detailed e-commerce order histories. Canada Goose, a Toronto-based brand founded in 1957 with a global retail footprint and nearly 4,000 employees, confirmed awareness