msaRAT Hides C2 Traffic Inside Chrome and Edge
Cisco Talos found a Rust backdoor that starts a hidden Chrome or Edge process and routes encrypted C2 traffic through WebRTC. Check the MSI, browser flags, relays, and response steps.
News desk
Security News
Security incidents, exploited vulnerabilities, breach reports, malware campaigns, and urgent patch notes arranged for fast daily scanning.
October 4, 2026
Latest reports
AWS Kiro Flaw Turned Hidden Web Text Into Code Execution
AWS patched a Kiro IDE flaw that let hidden web text rewrite mcp.json and run commands without approval. Update Kiro and check MCP configurations…
HOLLOWGRAPH Malware Hides in Microsoft 365 Calendar Events
HOLLOWGRAPH uses Microsoft 365 calendar events dated 2050 for command-and-control and file theft. Check Graph activity, logAzure.txt, and DNS telemetry.
NGINX CVE-2026-42533: Check Regex Maps and Update Now
CVE-2026-42533 affects NGINX map directives with regex captures. Check the exposure pattern and update to 1.30.4 or 1.31.3.
UAC-0145 Uses Fake CAPTCHA and Security Apps Against Ukraine
CERT-UA says UAC-0145 is using ClickFix pages, fake security tools, Signal lures, and Android malware against Ukrainian targets. Check the exact files, paths, and…
WordPress wp2shell CVE-2026-63030: Update to 7.0.2 Now
CVE-2026-63030 (wp2shell) gives anonymous attackers a route to code execution in WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Verify and update now.
OTTERCOOKIE Malware Hides in SVG Files in Fake Coding Tests
Fake coding-test repositories hide OTTERCOOKIE fragments in SVG flags. Here is what executes, what it steals, and what to check after running one.
Grok Build Repository Upload: What to Do After Version 0.2.93
Grok Build 0.2.93 was observed uploading tracked repositories and Git history. Here is how to scope exposure, rotate secrets, review logs, and harden future…
ACR Stealer ClickFix Attacks: What to Check After Running the Command
Microsoft tracked ACR Stealer ClickFix chains using WebDAV, MSHTA and PowerShell. Check scheduled tasks, browser sessions, exposed passwords and cleanup steps.